{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/54163","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/54163/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/54163/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/54163/events","html_url":"https://github.com/kubernetes/kubernetes/pull/54163","id":266594081,"number":54163,"title":"Adds support for in-server service name resolution.","user":{"login":"filmil","id":246576,"avatar_url":"https://avatars2.githubusercontent.com/u/246576?v=4","gravatar_id":"","url":"https://api.github.com/users/filmil","html_url":"https://github.com/filmil","followers_url":"https://api.github.com/users/filmil/followers","following_url":"https://api.github.com/users/filmil/following{/other_user}","gists_url":"https://api.github.com/users/filmil/gists{/gist_id}","starred_url":"https://api.github.com/users/filmil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/filmil/subscriptions","organizations_url":"https://api.github.com/users/filmil/orgs","repos_url":"https://api.github.com/users/filmil/repos","events_url":"https://api.github.com/users/filmil/events{/privacy}","received_events_url":"https://api.github.com/users/filmil/received_events","type":"User","site_admin":false},"labels":[{"id":477397086,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":114509261,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/design","name":"kind/design","color":"c7def8","default":false},{"id":200149833,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note","name":"release-note","color":"c2e0c6","default":false},{"id":173493835,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/api-machinery","name":"sig/api-machinery","color":"d2b48c","default":false},{"id":357119284,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/auth","name":"sig/auth","color":"d2b48c","default":false},{"id":116712108,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/network","name":"sig/network","color":"d2b48c","default":false},{"id":253451057,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/XL","name":"size/XL","color":"ee5500","default":false}],"state":"open","locked":false,"assignee":{"login":"sttts","id":730123,"avatar_url":"https://avatars0.githubusercontent.com/u/730123?v=4","gravatar_id":"","url":"https://api.github.com/users/sttts","html_url":"https://github.com/sttts","followers_url":"https://api.github.com/users/sttts/followers","following_url":"https://api.github.com/users/sttts/following{/other_user}","gists_url":"https://api.github.com/users/sttts/gists{/gist_id}","starred_url":"https://api.github.com/users/sttts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sttts/subscriptions","organizations_url":"https://api.github.com/users/sttts/orgs","repos_url":"https://api.github.com/users/sttts/repos","events_url":"https://api.github.com/users/sttts/events{/privacy}","received_events_url":"https://api.github.com/users/sttts/received_events","type":"User","site_admin":false},"assignees":[{"login":"sttts","id":730123,"avatar_url":"https://avatars0.githubusercontent.com/u/730123?v=4","gravatar_id":"","url":"https://api.github.com/users/sttts","html_url":"https://github.com/sttts","followers_url":"https://api.github.com/users/sttts/followers","following_url":"https://api.github.com/users/sttts/following{/other_user}","gists_url":"https://api.github.com/users/sttts/gists{/gist_id}","starred_url":"https://api.github.com/users/sttts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sttts/subscriptions","organizations_url":"https://api.github.com/users/sttts/orgs","repos_url":"https://api.github.com/users/sttts/repos","events_url":"https://api.github.com/users/sttts/events{/privacy}","received_events_url":"https://api.github.com/users/sttts/received_events","type":"User","site_admin":false},{"login":"liggitt","id":980082,"avatar_url":"https://avatars0.githubusercontent.com/u/980082?v=4","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false}],"milestone":null,"comments":23,"created_at":"2017-10-18T18:23:44Z","updated_at":"2017-10-24T22:07:40Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/54163","html_url":"https://github.com/kubernetes/kubernetes/pull/54163","diff_url":"https://github.com/kubernetes/kubernetes/pull/54163.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/54163.patch"},"body":"Note: the full design proposal is available at: https://goo.gl/APfsCE\r\n\r\nThis change allows webhook authorizer that call out to an endpoint of\r\nthe form:\r\n\r\n    https://servicename.namespace.svc/someurl\r\n\r\nto resolve \"servicename.namespace.svc\" to the service's current\r\nendpoint, without contacting kube-dns.\r\n\r\nThis allows deployments without kube-dns access (e.g. GKE, or the\r\ndefault k8s-on-GCP) to host the webhook authorizer as a pod.  It is\r\nsomewhat similar to the resolution already used for say admission\r\ncontrol plugins, but has a few important differences:\r\n\r\n- The configuration files for admission control and webhook authz are\r\ndifferent.\r\n\r\n- There is no dynamic registration support for authz webhooks.\r\n\r\nThe feature depends on a recent change that requires server certificate\r\nto have CN subject field in the certificate be set to the Kubernetes\r\nservice name (for example: \"/CN=servicename.namespace.svc\").\r\n\r\nAlso, since the authz webhook is already released and being used, we\r\nmust uphold a few constraints:\r\n\r\n- Deployments that don't need or use this feature should not have to pay\r\nthe cost of having it around.\r\n\r\n- Since kube-apiserver is the only server that would need this feature,\r\nthe changes are confined to kube-apiserver specific code, and not pushed\r\ndeeper into generic webhook.\r\n\r\nChanges inside:\r\n\r\n- Introduced a flag --authorization-webhook-use-service-resolution\r\n(default: false) that gates the service resolution.  This is because\r\nthere may be deployments that can do service resolution from the master\r\nnode through kube-dns, which do not need this additional functionality.\r\nThose users can simply keep the flag set to its default value and\r\npretend that this functionality does not exist.\r\n\r\n- Wired through a service resolver and the proxy transport dialer from\r\nthe apiserver setup code into authorizer.  This is a very similar\r\napproach to how this is done today with the admission control code.\r\n\r\n- In the authz webhook proper, added a whole optional section that\r\nperiodically recreates the webhook client based off of the freshest\r\navailable endpoint IP address for the service in question.  The optional\r\nsection only makes a difference when the resolution is used.  Otherwise,\r\nthe code paths are not extended.  I did introduce a lock for the client\r\nrefresh; but I expect that the contention would be significant in\r\nregular use, since write locks are rare, and regular requests use the\r\nread locks.\r\n\r\n- Some refactoring and reformatting of the existing code.  Namely the\r\nwebhook client construction was broken up into two smaller pieces:\r\nreading the kubeconfig file, and creating the client proper from the\r\nkubeconfig file.\r\n\r\n<!--  Thanks for sending a pull request!  Here are some tips for you:\r\n1. If this is your first time, read our contributor guidelines https://git.k8s.io/community/contributors/devel/pull-requests.md#the-pr-submit-process and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide\r\n2. If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/devel/pull-requests.md#best-practices-for-faster-reviews\r\n3. Follow the instructions for writing a release note: https://git.k8s.io/community/contributors/devel/pull-requests.md#write-release-notes-if-needed\r\n-->\r\n\r\n**What this PR does / why we need it**: This pull request handles item (2) from https://github.com/kubernetes/kubernetes/issues/52511  It mirrors the approach that is already in use\r\nfor webhook admission control for example, but is adjusted to fit neatly in the current kubeconfig-based\r\nwebhook authz configuration.\r\n\r\n**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #\r\n\r\n**Special notes for your reviewer**:\r\n\r\n**Release note**:\r\n<!--  Steps to write your release note:\r\n1. Use the release-note-* labels to set the release note state (if you have access)\r\n2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`.\r\n-->\r\n```release-note\r\nAdds support for in-server service name resolution.\r\n\r\nThis change allows webhook authorizer that call out to an endpoint of\r\nthe form:\r\n\r\n    https://servicename.namespace.svc/someurl\r\n\r\nto resolve \"servicename.namespace.svc\" to the service's current\r\nendpoint, without contacting kube-dns.\r\n\r\nDesign proposal is available at: https://goo.gl/APfsCE\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/339149348","html_url":"https://github.com/kubernetes/kubernetes/pull/54163#issuecomment-339149348","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/54163","id":339149348,"user":{"login":"filmil","id":246576,"avatar_url":"https://avatars2.githubusercontent.com/u/246576?v=4","gravatar_id":"","url":"https://api.github.com/users/filmil","html_url":"https://github.com/filmil","followers_url":"https://api.github.com/users/filmil/followers","following_url":"https://api.github.com/users/filmil/following{/other_user}","gists_url":"https://api.github.com/users/filmil/gists{/gist_id}","starred_url":"https://api.github.com/users/filmil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/filmil/subscriptions","organizations_url":"https://api.github.com/users/filmil/orgs","repos_url":"https://api.github.com/users/filmil/repos","events_url":"https://api.github.com/users/filmil/events{/privacy}","received_events_url":"https://api.github.com/users/filmil/received_events","type":"User","site_admin":false},"created_at":"2017-10-24T22:07:40Z","updated_at":"2017-10-24T22:07:40Z","author_association":"NONE","body":"PTAL.  I added some useful unit tests."}}
{"actor":{"display_login":"filmil"}}