Description of problem: We are now using the WebhookTokenAuthenticator auth stack for OpenShift authentication which means the kube-apiserver is reaching to the oauth-apiserver's TokenReview endpoint. To avoid additional request from the oauth-apiserver to the kube-apiserver to validate the SA token, use client cert authenticaion. Version-Release number of selected component (if applicable): 4.8 How reproducible: 100%
needs one more slight improvement from lib-go
Tested in cluster 4.8.0-0.nightly-2021-06-10-071057 1. check secret/webhook-authentication-integrated-oauth content is presented with cert/key form $ oc extract secret/webhook-authentication-integrated-oauth -n openshift-config 2. save cert and key echo 'client-certificate-data value' | base64 -d > cert echo 'client-key-data value' | base64 -d > key 3. In terminal A: cat > tokenreview_invalid.json << EOF {"kind":"TokenReview","apiVersion":"authentication.k8s.io/v1","spec":{"token":"aaaaaaaaaaaa"}} EOF oc login -u testuser-41 -p <password> TOKEN=`oc whoami -t` cat > tokenreview_valid.json << EOF {"kind":"TokenReview","apiVersion":"authentication.k8s.io/v1","spec":{"token":"$TOKEN"}} EOF 4.In terminal B: VALIDATION_POD=`oc get pod -n openshift-oauth-apiserver --no-headers | awk '{print $1}' | head -n 1` oc port-forward -n openshift-oauth-apiserver $VALIDATION_POD 8443:8443 5.In terminal A again, using the cert and key file saved in step2 curl -ksS -XPOST --cert ./cert --key ./key -H "Content-Type: application/json" https://localhost:8443/apis/oauth.openshift.io/v1/tokenreviews/ -d @tokenreview_valid.json ... "status": { "authenticated": true, check and find above .status.authenticated is true, which is the expected value.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:2438