{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kops/issues/5317","repository_url":"https://api.github.com/repos/kubernetes/kops","labels_url":"https://api.github.com/repos/kubernetes/kops/issues/5317/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kops/issues/5317/comments","events_url":"https://api.github.com/repos/kubernetes/kops/issues/5317/events","html_url":"https://github.com/kubernetes/kops/pull/5317","id":331676947,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk0MzQ5NDQ2","number":5317,"title":"Node Authorization Service [WIP] ","user":{"login":"gambol99","id":4280679,"node_id":"MDQ6VXNlcjQyODA2Nzk=","avatar_url":"https://avatars3.githubusercontent.com/u/4280679?v=4","gravatar_id":"","url":"https://api.github.com/users/gambol99","html_url":"https://github.com/gambol99","followers_url":"https://api.github.com/users/gambol99/followers","following_url":"https://api.github.com/users/gambol99/following{/other_user}","gists_url":"https://api.github.com/users/gambol99/gists{/gist_id}","starred_url":"https://api.github.com/users/gambol99/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gambol99/subscriptions","organizations_url":"https://api.github.com/users/gambol99/orgs","repos_url":"https://api.github.com/users/gambol99/repos","events_url":"https://api.github.com/users/gambol99/events{/privacy}","received_events_url":"https://api.github.com/users/gambol99/received_events","type":"User","site_admin":false},"labels":[{"id":655705079,"node_id":"MDU6TGFiZWw2NTU3MDUwNzk=","url":"https://api.github.com/repos/kubernetes/kops/labels/approved","name":"approved","color":"0ffa16","default":false},{"id":485059302,"node_id":"MDU6TGFiZWw0ODUwNTkzMDI=","url":"https://api.github.com/repos/kubernetes/kops/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":651618338,"node_id":"MDU6TGFiZWw2NTE2MTgzMzg=","url":"https://api.github.com/repos/kubernetes/kops/labels/needs-rebase","name":"needs-rebase","color":"BDBDBD","default":false},{"id":676563299,"node_id":"MDU6TGFiZWw2NzY1NjMyOTk=","url":"https://api.github.com/repos/kubernetes/kops/labels/size/XXL","name":"size/XXL","color":"ee0000","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-06-12T17:11:18Z","updated_at":"2018-06-12T19:51:54Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/kubernetes/kops/pulls/5317","html_url":"https://github.com/kubernetes/kops/pull/5317","diff_url":"https://github.com/kubernetes/kops/pull/5317.diff","patch_url":"https://github.com/kubernetes/kops/pull/5317.patch"},"body":"A previous [PR](https://github.com/kubernetes/kops/pull/5253) added the ability to enable the bootstrap tokens. Note the feature is isolated and regardless of this PR can still be enabled and used (albeit they will have to implement their own means of token distribution). This PR adds on top of https://github.com/kubernetes/kops/pull/5253 and provides an authorization service which runs on the masters. The service is responsible for receiving request from nodes (who's identity is verified via a chosen means) and issues a bootstrap token to the node registration. The bootstrap is part of the `system:node-bootstrapper` group and can request a CSR via that. Note, but turning on NodeAuthorization we also default to using the NodeAdmission controller providing extra security by apply a filter on the requests from a node (_i.e. you can't request something that isn't scheduled on the node)_\r\n\r\nFor aws, the nodes are verified in the following manner\r\n- the pkcs7 signed identity document available only from the node metadata service is passed in the request.\r\n- the instance is checked as running, inside the region, part of the cluster via a tag and then check that the node is not already registered.\r\n- assuming everyone is cool a bootstrap token is given (this at present is auto-approval, though think about it I meant add it as an optional thing)\r\n\r\nI've tried to break up the commits in logical order make reviewing easier.\r\n\r\n- adding the node authorization api specification https://github.com/kubernetes/kops/commit/f0ef3ae6f33375383ba1a9ae94c3bf0ab50d0901\r\n- consuming the node authorization api spec in nodeup binary https://github.com/kubernetes/kops/commit/1fe90ec6d229d67d70411120b7991189f463eccc\r\n- adding the options builder to fill in the model\r\n- adding the spec into the bootstrap config\r\n- adding the node authorization service into kops https://github.com/kubernetes/kops/commit/d73d4ad76bf4e1efaee2b145da53980152053ddb\r\n- adding the dependencies for the node authorization service https://github.com/kubernetes/kops/commit/8efbaea70828a106ff26d420d0d65784fdb7b60d\r\n- adding the node authorization addon deployment manifest https://github.com/kubernetes/kops/commit/ff31be1d1f380aabbfec700ab5b1584629d7df21"},"comment":{"url":"https://api.github.com/repos/kubernetes/kops/issues/comments/396712091","html_url":"https://github.com/kubernetes/kops/pull/5317#issuecomment-396712091","issue_url":"https://api.github.com/repos/kubernetes/kops/issues/5317","id":396712091,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NjcxMjA5MQ==","user":{"login":"k8s-ci-robot","id":20407524,"node_id":"MDQ6VXNlcjIwNDA3NTI0","avatar_url":"https://avatars0.githubusercontent.com/u/20407524?v=4","gravatar_id":"","url":"https://api.github.com/users/k8s-ci-robot","html_url":"https://github.com/k8s-ci-robot","followers_url":"https://api.github.com/users/k8s-ci-robot/followers","following_url":"https://api.github.com/users/k8s-ci-robot/following{/other_user}","gists_url":"https://api.github.com/users/k8s-ci-robot/gists{/gist_id}","starred_url":"https://api.github.com/users/k8s-ci-robot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/k8s-ci-robot/subscriptions","organizations_url":"https://api.github.com/users/k8s-ci-robot/orgs","repos_url":"https://api.github.com/users/k8s-ci-robot/repos","events_url":"https://api.github.com/users/k8s-ci-robot/events{/privacy}","received_events_url":"https://api.github.com/users/k8s-ci-robot/received_events","type":"User","site_admin":false},"created_at":"2018-06-12T19:51:53Z","updated_at":"2018-06-12T19:51:53Z","author_association":"CONTRIBUTOR","body":"@gambol99: The following tests **failed**, say `/retest` to rerun them all:\n\nTest name | Commit | Details | Rerun command\n--- | --- | --- | ---\npull-kops-bazel-build | 18c3798cc595374f57b90e5a9030ba43a93f62b5 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/kops/5317/pull-kops-bazel-build/1258/) | `/test pull-kops-bazel-build`\npull-kops-verify-boilerplate | 18c3798cc595374f57b90e5a9030ba43a93f62b5 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/kops/5317/pull-kops-verify-boilerplate/1253/) | `/test pull-kops-verify-boilerplate`\npull-kops-bazel-test | 18c3798cc595374f57b90e5a9030ba43a93f62b5 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/kops/5317/pull-kops-bazel-test/1268/) | `/test pull-kops-bazel-test`\npull-kops-e2e-kubernetes-aws | 18c3798cc595374f57b90e5a9030ba43a93f62b5 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/kops/5317/pull-kops-e2e-kubernetes-aws/6737/) | `/test pull-kops-e2e-kubernetes-aws`\npull-kops-verify-gofmt | 18c3798cc595374f57b90e5a9030ba43a93f62b5 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/kops/5317/pull-kops-verify-gofmt/1256/) | `/test pull-kops-verify-gofmt`\npull-kops-verify-govet | 18c3798cc595374f57b90e5a9030ba43a93f62b5 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/kops/5317/pull-kops-verify-govet/1255/) | `/test pull-kops-verify-govet`\npull-kops-verify-packages | 18c3798cc595374f57b90e5a9030ba43a93f62b5 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/kops/5317/pull-kops-verify-packages/1254/) | `/test pull-kops-verify-packages`\npull-kops-verify-bazel | 18c3798cc595374f57b90e5a9030ba43a93f62b5 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/kops/5317/pull-kops-verify-bazel/1257/) | `/test pull-kops-verify-bazel`\n\n[Full PR test history](https://k8s-gubernator.appspot.com/pr/kops/5317). [Your PR dashboard](https://k8s-gubernator.appspot.com/pr/gambol99). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes/kops/issues?q=is:issue+is:open) when you hit one in your PR.\n\n<details>\n\nInstructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).\n</details>\n<!-- test report -->"}}
{"actor":{"display_login":"k8s-ci-robot"}}