This repository has been archived by the owner on Oct 20, 2023. It is now read-only.
New Resource: IdentityBinding #248
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
keithmattix
requested review from
grampelberg,
lachie83,
leecalcote,
nicholasjackson,
slack,
stefanprodan,
bridgetkromhout,
ilevine,
mhausenblas and
Pothulapati
as code owners
keithmattix
force-pushed
the
feature/identitybinding
branch
2 times, most recently
from
78d3639 to
0f2fd35
Compare
Signed-off-by: Keith Mattix II <[email protected]>
keithmattix
force-pushed
the
feature/identitybinding
branch
from
0f2fd35 to
c70e90d
Compare
Signed-off-by: Keith Mattix II <[email protected]>
mikemorris
reviewed
Mar 17, 2022
Comment on lines
+349
to
+352
| - Other types of policy - having policy around retries, timeouts and rate limits | ||
| would be great. This specific object only manages access control. As policy | ||
| for these examples would be HTTP specific, there needs to be a HTTP specific | ||
| policy object created. |
There was a problem hiding this comment.
A resource like https://gateway-api.sigs.k8s.io/v1alpha2/references/policy-attachment/ might be a reasonable way of handling this in the future?
Comment on lines
+344
to
+347
| - Ingress policy - assuming clients present the correct identity, this *should* | ||
| work for some kind of ingress. Unfortunately, it does not cover many of the | ||
| common use cases (filtering by hostname) and will need to be expanded to cover | ||
| this use case. |
There was a problem hiding this comment.
This might be a relevant case to consider proposing TrafficTarget at some point in the future (maybe with a different name to better reflect its authorization purpose?) as an extension to the Kubernetes Gateway API, which I believe intends to support some forms of authentication, but AFAIK doesn't yet have any way of representing those (JWT identity is probably something that would be desirable to add at that point).
keithmattix
commented
Mar 23, 2022
Also add some clarification around security model Signed-off-by: Keith Mattix II <[email protected]>
keithmattix
force-pushed
the
feature/identitybinding
branch
from
33d7527 to
2340800
Compare
keithmattix
requested review from
stefanprodan
and removed request for
stefanprodan
nicholasjackson
previously approved these changes
Mar 26, 2022
stefanprodan
previously approved these changes
Mar 28, 2022
keithmattix
dismissed stale reviews from stefanprodan and nicholasjackson
via
6ef1d7e
Multiple podLabelSelectors doesn't seem necessary and the semantics around such configuration are confusing. If the need arises for multiple selectors, we can reconsider, but let's keep it simple for now Signed-off-by: Keith Mattix II <[email protected]>
keithmattix
force-pushed
the
feature/identitybinding
branch
from
6ef1d7e to
4314b5f
Compare
nicholasjackson
approved these changes
Mar 30, 2022
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a new TrafficAccess resource: IdentityBinding. Note that a new release with this change would advance TrafficAccess to v1alpha4 and modify
TrafficTargetto accept a(n) (optional) group along with a kind for source and destination resouces.