apiserver: switch authorization to use protobuf client #74956
Conversation
|
/assign @sttts |
|
/sig api-machinery |
There was a problem hiding this comment.
this seems like a weird place to have to override this. Does this mean the webhook this points at must speak proto?
There was a problem hiding this comment.
This mechanism is explicitly about speaking to the "core" API server, i.e. kube-apiserver. Why should we not assume it speaks proto?
There was a problem hiding this comment.
@liggitt additional question... why we use protoConfig.AcceptContentTypes and negotiate to fallback to JSON, when we then force the proto anyway (general question, not just this case, but in other places in code).
There was a problem hiding this comment.
You're right, I'm sorry... I thought this was the generic webhook setup. Does the same thing need to apply to the delegating token authenticator?
There was a problem hiding this comment.
would scoping this to the rest.InClusterConfig() block be safer? there we're much more confident we're talking to the kube apiserver and not some arbitrary endpoint that speaks subjectaccessreviews
There was a problem hiding this comment.
last two questions are still relevant
|
/hold |
|
Issues go stale after 90d of inactivity. If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
|
Stale issues rot after 30d of inactivity. If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
|
Rotten issues close after 30d of inactivity. Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
|
@fejta-bot: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/reopen |
|
@mfojtik: Reopened this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/remove-lifecycle rotten |
What type of PR is this?
/kind bug
What this PR does / why we need it:
Set the DelegatingAuthorizationOptions client to prefer
application/vnd.kubernetes.protobufwhen talking to API server.