WIP: Make the console display an informative page when no auth source is configured #13802
Conversation
…o separate package
…ays contains the header This wasn't the case previously where the static user handling improperly didn't add the Authorization header.
This removes a possible use-cases of `--k8s-mode=in-cluster --k8s-auth=service-account`. In order to be able to use that, you should paste the SA account into the `--k8s-auth-bearer-token` flag. It might make sense to add a `--k8s-auth-bearer-token-file` option but we're sticking to the original implementation for now.
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: stlaz The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@stlaz: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
/close |
|
@stlaz: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
This is a different take on #13713.
The PR splits CSRF identification from authentication as these are generally two separate concepts.
There are generalization fixes that leverage the ability of static user authentication to be used as yet another authenticator.
The
k8s-authflag is deprecated and setting it no longer does anything. This removes a single use-case of a development pod running inside of the cluster withk8s-authbeing set to "service-account". This behavior can be emulated by using the SA token directly. As an alternative, we could add a "k8s-auth-bearer-token-file" option. This would've likely been a better idea than having the token be pasted in options as we do nowadays./assign @jhadvig