Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Workload Identity reconciler integration using SPIFFE #809

Draft
wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

Workload Identity reconciler integration using SPIFFE #809

wants to merge 5 commits into from

Conversation

PrimalPimmy
Copy link

@PrimalPimmy PrimalPimmy commented Sep 17, 2024 •
edited
Loading

This PR initiates the work to implement workload Identity in the nephio ecosystem. More documentation can be found here:
Design Document: https://docs.google.com/document/d/1k8Hcd7tJKPIsyiYZX6hpRECuJ4IIxVnaESghU5bLNVQ/edit?usp=sharing
User Story: https://docs.google.com/document/d/1nkh7tTItwii1bY877PfzjFCBtmRos4IDh5EOJxWXRdg/edit?usp=sharing
Updating-Kubeconfigs

@nephio-prow Nephio PROW
Copy link
Contributor

nephio-prow bot commented Sep 17, 2024

Hi @PrimalPimmy. Thanks for your PR.

I'm waiting for a nephio-project member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@liamfallon
Copy link
Member

/ok-to-test

PrimalPimmy and others added 4 commits September 20, 2024 07:42
@PrimalPimmy
Bootstrapping bundle init
643bc99 
Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

minor fix

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Cluster reconciler

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Cluster reconciler

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

sending bundle to remote cluster

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Test

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Spire auth inside reconciler

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Vault authentication and fetching kubeconfig

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Some testing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Mid testing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Mid testing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Mid testing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Mid testing-2

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Mid testing-2

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Mid testing-2

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Mid testing-3

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Mid testing-3

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Mid testing-3

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Refactoring

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Kubeconfig test

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Removed found

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

log testing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

log testing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

log testing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Getting svid

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Getting svid-2

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Getting svid-2

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Getting svid-3

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Getting svid-4

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Getting svid-5

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Getting svid-6

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Vault addr and patch configmap

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Vault addr and patch configmap

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Restricted Kubeconfig

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

configmap perms

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

server addr

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Struct to yaml

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Struct to yaml

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Reverting changes

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Reverting changes

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Reverting changes

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Reverting changes

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Reverting changes

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Reverting changes

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Reverting changes

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Reverting changes

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

yaml indent fixing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

yaml indent fixing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

yaml indent fixing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Some cleanup

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Some cleanup

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Debugging

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Debugging

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Debugging

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Debugging

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

vault storage change

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Added kubeconfig change

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Spire-agent conf, vault testing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Spire-agent conf, vault testing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Spire-agent conf, vault testing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Spire-agent conf, vault testing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

module testing

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

revert module change

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Vault JWT role detect

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Vault JWT role detect

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>

Vault JWT role detect-2

Signed-off-by: PrimalPimmy <Prashant20.pm@gmail.com>
@PrimalPimmy
Removing vault, need to refactor cluster client
93d004d 
Signed-off-by: PrimalPimmy <prashant20.pm@gmail.com>
@PrimalPimmy
Removing more vault elements
8b0e927 
Signed-off-by: PrimalPimmy <prashant20.pm@gmail.com>
@PrimalPimmy
Go mod changes
60bb4c8 
Signed-off-by: PrimalPimmy <prashant20.pm@gmail.com>
@liamfallon
Copy link
Member

/assign @tliron @efiacor @kispaljr

@liamfallon
Copy link
Member

@PrimalPimmy I think maybe we should take another look at this in SIG-Auto. Would you be able to schedule it on the agenda for one of the upcoming meetings?

@PrimalPimmy
Copy link
Author

Sure @liamfallon . Where do I post about this to schedule it?

cc: @nyrahul

@liamfallon
Copy link
Member

Please enter an item on the agenda for a forthcoming meeting, the agenda document is here:
https://docs.google.com/document/d/1SW4acc0950QdDNEvmeHArfNsgKPeY_EIwHBqGBky2CY/edit#heading=h.k7dq727kte8c

@PrimalPimmy
[Testing commit] Changes to addr port handling
b867add 
Signed-off-by: PrimalPimmy <prashant20.pm@gmail.com>
@nephio-prow Nephio PROW
Copy link
Contributor

nephio-prow bot commented Sep 23, 2024

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from efiacor by writing /assign @efiacor in a comment. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@PrimalPimmy PrimalPimmy mentioned this pull request Nov 19, 2024
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@henderiw henderiw Awaiting requested review from henderiw

@liamfallon liamfallon Awaiting requested review from liamfallon

Assignees

@kispaljr kispaljr

@tliron tliron

@efiacor efiacor

Labels
do-not-merge/work-in-progress ok-to-test
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@PrimalPimmy @liamfallon @kispaljr @tliron @efiacor