{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/19891","repository_url":"https://api.github.com/repos/openshift/origin","labels_url":"https://api.github.com/repos/openshift/origin/issues/19891/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/19891/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/19891/events","html_url":"https://github.com/openshift/origin/pull/19891","id":327976309,"node_id":"MDExOlB1bGxSZXF1ZXN0MTkxNjMxODcx","number":19891,"title":"Router support for mutual tls authentication","user":{"login":"ramr","id":928868,"node_id":"MDQ6VXNlcjkyODg2OA==","avatar_url":"https://avatars1.githubusercontent.com/u/928868?v=4","gravatar_id":"","url":"https://api.github.com/users/ramr","html_url":"https://github.com/ramr","followers_url":"https://api.github.com/users/ramr/followers","following_url":"https://api.github.com/users/ramr/following{/other_user}","gists_url":"https://api.github.com/users/ramr/gists{/gist_id}","starred_url":"https://api.github.com/users/ramr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ramr/subscriptions","organizations_url":"https://api.github.com/users/ramr/orgs","repos_url":"https://api.github.com/users/ramr/repos","events_url":"https://api.github.com/users/ramr/events{/privacy}","received_events_url":"https://api.github.com/users/ramr/received_events","type":"User","site_admin":false},"labels":[{"id":223051294,"node_id":"MDU6TGFiZWwyMjMwNTEyOTQ=","url":"https://api.github.com/repos/openshift/origin/labels/approved","name":"approved","color":"0ffa16","default":false},{"id":223479084,"node_id":"MDU6TGFiZWwyMjM0NzkwODQ=","url":"https://api.github.com/repos/openshift/origin/labels/lgtm","name":"lgtm","color":"15dd18","default":false},{"id":657292628,"node_id":"MDU6TGFiZWw2NTcyOTI2Mjg=","url":"https://api.github.com/repos/openshift/origin/labels/sig/security","name":"sig/security","color":"f9d0c4","default":false},{"id":640548394,"node_id":"MDU6TGFiZWw2NDA1NDgzOTQ=","url":"https://api.github.com/repos/openshift/origin/labels/size/L","name":"size/L","color":"ee9900","default":false}],"state":"open","locked":false,"assignee":{"login":"pravisankar","id":1258630,"node_id":"MDQ6VXNlcjEyNTg2MzA=","avatar_url":"https://avatars0.githubusercontent.com/u/1258630?v=4","gravatar_id":"","url":"https://api.github.com/users/pravisankar","html_url":"https://github.com/pravisankar","followers_url":"https://api.github.com/users/pravisankar/followers","following_url":"https://api.github.com/users/pravisankar/following{/other_user}","gists_url":"https://api.github.com/users/pravisankar/gists{/gist_id}","starred_url":"https://api.github.com/users/pravisankar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pravisankar/subscriptions","organizations_url":"https://api.github.com/users/pravisankar/orgs","repos_url":"https://api.github.com/users/pravisankar/repos","events_url":"https://api.github.com/users/pravisankar/events{/privacy}","received_events_url":"https://api.github.com/users/pravisankar/received_events","type":"User","site_admin":false},"assignees":[{"login":"pravisankar","id":1258630,"node_id":"MDQ6VXNlcjEyNTg2MzA=","avatar_url":"https://avatars0.githubusercontent.com/u/1258630?v=4","gravatar_id":"","url":"https://api.github.com/users/pravisankar","html_url":"https://github.com/pravisankar","followers_url":"https://api.github.com/users/pravisankar/followers","following_url":"https://api.github.com/users/pravisankar/following{/other_user}","gists_url":"https://api.github.com/users/pravisankar/gists{/gist_id}","starred_url":"https://api.github.com/users/pravisankar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pravisankar/subscriptions","organizations_url":"https://api.github.com/users/pravisankar/orgs","repos_url":"https://api.github.com/users/pravisankar/repos","events_url":"https://api.github.com/users/pravisankar/events{/privacy}","received_events_url":"https://api.github.com/users/pravisankar/received_events","type":"User","site_admin":false},{"login":"simo5","id":8332609,"node_id":"MDQ6VXNlcjgzMzI2MDk=","avatar_url":"https://avatars2.githubusercontent.com/u/8332609?v=4","gravatar_id":"","url":"https://api.github.com/users/simo5","html_url":"https://github.com/simo5","followers_url":"https://api.github.com/users/simo5/followers","following_url":"https://api.github.com/users/simo5/following{/other_user}","gists_url":"https://api.github.com/users/simo5/gists{/gist_id}","starred_url":"https://api.github.com/users/simo5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simo5/subscriptions","organizations_url":"https://api.github.com/users/simo5/orgs","repos_url":"https://api.github.com/users/simo5/repos","events_url":"https://api.github.com/users/simo5/events{/privacy}","received_events_url":"https://api.github.com/users/simo5/received_events","type":"User","site_admin":false},{"login":"knobunc","id":10033853,"node_id":"MDQ6VXNlcjEwMDMzODUz","avatar_url":"https://avatars1.githubusercontent.com/u/10033853?v=4","gravatar_id":"","url":"https://api.github.com/users/knobunc","html_url":"https://github.com/knobunc","followers_url":"https://api.github.com/users/knobunc/followers","following_url":"https://api.github.com/users/knobunc/following{/other_user}","gists_url":"https://api.github.com/users/knobunc/gists{/gist_id}","starred_url":"https://api.github.com/users/knobunc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/knobunc/subscriptions","organizations_url":"https://api.github.com/users/knobunc/orgs","repos_url":"https://api.github.com/users/knobunc/repos","events_url":"https://api.github.com/users/knobunc/events{/privacy}","received_events_url":"https://api.github.com/users/knobunc/received_events","type":"User","site_admin":false}],"milestone":null,"comments":19,"created_at":"2018-05-31T03:01:54Z","updated_at":"2018-07-11T21:59:05Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/19891","html_url":"https://github.com/openshift/origin/pull/19891","diff_url":"https://github.com/openshift/origin/pull/19891.diff","patch_url":"https://github.com/openshift/origin/pull/19891.patch"},"body":"Changes as per RFE: https://bugzilla.redhat.com/show_bug.cgi?id=1477349\r\n\r\nAdds mutual tls authentication support. Verification is via client-side certificates and its\r\nuse can be mandated to be either required or optional. \r\nAdditionally, an env variable ROUTER_MUTUAL_TLS_AUTH_CN provides more fine-grain\r\ncontrol on access based on certificate common names.\r\n\r\nUsage:\r\nStart the router with the new command line options to specify the mutual tls options.\r\nExample: \r\n```\r\n$ oc adm router --latest-images=true  --mutual-tls-auth=required  \\\r\n       --mutual-tls-auth-ca=_ramr/nodejs-header-echo/config/CA/cacert.pem  \\\r\n       --mutual-tls-auth-filter='^/CN=header.test/ST=CA/C=US/O=Security/OU=OpenShift3$'\r\n```\r\nIn the above example, the regular expression for `mutual-tls-auth-filter` forces an exact match with a certificate's subject. \r\n\r\nTo Test: \r\n```\r\ncurl -insecure --cert-type pem --cert  _ramr/nodejs-header-echo/config/cert.pem  \\\r\n       --key _ramr/nodejs-header-echo/config/key.pem  -k -vvv  \\\r\n       --resolve reencrypt.header.test:443:127.0.0.1 https://reencrypt.header.test/\r\n```\r\n\r\nAnd test without the certificate/key to check that access is not allowed.\r\nOther test scenarios can use different combinations of the filter (and/or --mutual-tls-auth flag) to test access.\r\n\r\n@knobunc  PTAL Thx\r\n\r\n\r\n*Edited* Updated usage and tests"},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/404324017","html_url":"https://github.com/openshift/origin/pull/19891#issuecomment-404324017","issue_url":"https://api.github.com/repos/openshift/origin/issues/19891","id":404324017,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNDMyNDAxNw==","user":{"login":"openshift-ci-robot","id":30189103,"node_id":"MDQ6VXNlcjMwMTg5MTAz","avatar_url":"https://avatars1.githubusercontent.com/u/30189103?v=4","gravatar_id":"","url":"https://api.github.com/users/openshift-ci-robot","html_url":"https://github.com/openshift-ci-robot","followers_url":"https://api.github.com/users/openshift-ci-robot/followers","following_url":"https://api.github.com/users/openshift-ci-robot/following{/other_user}","gists_url":"https://api.github.com/users/openshift-ci-robot/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift-ci-robot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift-ci-robot/subscriptions","organizations_url":"https://api.github.com/users/openshift-ci-robot/orgs","repos_url":"https://api.github.com/users/openshift-ci-robot/repos","events_url":"https://api.github.com/users/openshift-ci-robot/events{/privacy}","received_events_url":"https://api.github.com/users/openshift-ci-robot/received_events","type":"User","site_admin":false},"created_at":"2018-07-11T21:59:05Z","updated_at":"2018-07-11T21:59:05Z","author_association":"NONE","body":"@ramr: The following tests **failed**, say `/retest` to rerun them all:\n\nTest name | Commit | Details | Rerun command\n--- | --- | --- | ---\nci/openshift-jenkins/unit | 770687ac6b45f858c02afc3619d8c455598de35a | [link](https://openshift-gce-devel.appspot.com/build/origin-ci-test/pr-logs/pull/19891/test_pull_request_origin_unit/13586/) | `/test unit`\nci/openshift-jenkins/cmd | eebf8f580e9717c03df166e9623605f9f73822ff | [link](https://openshift-gce-devel.appspot.com/build/origin-ci-test/pr-logs/pull/19891/test_pull_request_origin_cmd/15428/) | `/test cmd`\n\n[Full PR test history](https://openshift-gce-devel.appspot.com/pr/19891). [Your PR dashboard](https://openshift-gce-devel.appspot.com/pr/ramr). Please help us cut down on flakes by [linking to](https://github.com/kubernetes/community/blob/master/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/openshift/origin/issues?q=is:issue+is:open) when you hit one in your PR.\n\n<details>\n\nInstructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/devel/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).\n</details>\n<!-- test report -->"}}
{"actor":{"display_login":"openshift-ci-robot"}}