From 60262cbaa3ad4ba3759f31f1dc3e7939e3052741 Mon Sep 17 00:00:00 2001 From: youtangai Date: Wed, 16 Jan 2019 05:22:50 +0000 Subject: [PATCH 1/3] setup demo environment --- .../controllers/ContainerController.go | 8 ++++++ docker-compose.yml | 3 ++- .../repositories/containerRepository.go | 1 + kubeconfig | 26 ++++++++++++------- 4 files changed, 27 insertions(+), 11 deletions(-) diff --git a/application/controllers/ContainerController.go b/application/controllers/ContainerController.go index 8a82f97..167904e 100644 --- a/application/controllers/ContainerController.go +++ b/application/controllers/ContainerController.go @@ -27,6 +27,7 @@ func NewContainerController() interfaces.IContainerController { func (ctrl ContainerController) Get(c *gin.Context) { uniqueUserID, err := getUniqueUserIDFromJWTInHeader(c) if err != nil { + fmt.Println("unauthorization err:", err) c.JSON(http.StatusUnauthorized, gin.H{"err": err.Error()}) return } @@ -34,6 +35,7 @@ func (ctrl ContainerController) Get(c *gin.Context) { containers, err := ctrl.Srv.GetContainersByUniqueUserID(uniqueUserID) if err != nil { + fmt.Println("bad request err:", err) c.JSON(http.StatusBadRequest, gin.H{"err": err.Error()}) return } @@ -43,6 +45,7 @@ func (ctrl ContainerController) Get(c *gin.Context) { func (ctrl ContainerController) Post(c *gin.Context) { uniqueUserID, err := getUniqueUserIDFromJWTInHeader(c) if err != nil { + fmt.Println("unahtorized err:", err) c.JSON(http.StatusUnauthorized, gin.H{"err": err.Error()}) return } @@ -50,12 +53,14 @@ func (ctrl ContainerController) Post(c *gin.Context) { var containerImage viewmodels.ContainerImage err = c.BindJSON(&containerImage) if err != nil { + fmt.Println("bad request err:cant bind json:", err) c.JSON(http.StatusBadRequest, gin.H{"err": err.Error()}) return } err = ctrl.Srv.CreateContainer(uniqueUserID, containerImage.ImageName) if err != nil { + fmt.Println("internal server err: cant create container:", err) c.JSON(http.StatusInternalServerError, gin.H{"err": err.Error()}) return } @@ -66,18 +71,21 @@ func (ctrl ContainerController) Post(c *gin.Context) { func (ctrl ContainerController) Delete(c *gin.Context) { uniqueUserID, err := getUniqueUserIDFromJWTInHeader(c) if err != nil { + fmt.Println("unauthorized err", err) c.JSON(http.StatusUnauthorized, gin.H{"err": err.Error()}) return } containerID := c.Param("id") if containerID == "" { + fmt.Println("bad request err: container id is not specified:", err) c.JSON(http.StatusBadRequest, gin.H{"err": "コンテナのIDが指定されていません"}) return } err = ctrl.Srv.DeleteContainer(uniqueUserID, containerID) if err != nil { + fmt.Println("internal server err: cant delete container:", err) c.JSON(http.StatusBadRequest, gin.H{"err": err.Error()}) return } diff --git a/docker-compose.yml b/docker-compose.yml index bc475d8..83404a4 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -7,7 +7,8 @@ services: - SQL_PASS=7CpV#RdTgttC - SQL_HOST=db - SQL_DB=cloud_api - - PROXY_ADDR=35.211.84.216:8081 + - K8S_IP=34.80.53.82:6443 + - PROXY_ADDR=34.85.115.170:8081 ports: - "8080:8080" depends_on: diff --git a/infrastructure/repositories/containerRepository.go b/infrastructure/repositories/containerRepository.go index a2a657d..048a909 100644 --- a/infrastructure/repositories/containerRepository.go +++ b/infrastructure/repositories/containerRepository.go @@ -13,6 +13,7 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/client-go/kubernetes" "k8s.io/client-go/tools/clientcmd" + _ "k8s.io/client-go/plugin/pkg/client/auth/oidc" ) const ( diff --git a/kubeconfig b/kubeconfig index 078f86b..1bd5f0d 100644 --- a/kubeconfig +++ b/kubeconfig @@ -1,19 +1,25 @@ apiVersion: v1 clusters: - cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURDekNDQWZPZ0F3SUJBZ0lRUHoreDhqVURwanM2UlhBWCtJd09zakFOQmdrcWhraUc5dzBCQVFzRkFEQXYKTVMwd0t3WURWUVFERXlRd1l6SmhOVFJpTXkweU16YzFMVFE1WmprdE9URTRNeTAxWldNek16azFZMkk1TXpJdwpIaGNOTVRneE1qRXdNRFkwTWpFeFdoY05Nak14TWpBNU1EYzBNakV4V2pBdk1TMHdLd1lEVlFRREV5UXdZekpoCk5UUmlNeTB5TXpjMUxUUTVaamt0T1RFNE15MDFaV016TXprMVkySTVNekl3Z2dFaU1BMEdDU3FHU0liM0RRRUIKQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUN3NHRWR2Q2V3hUOFQ4VnlQaEZySE1meWEvTGhSUHRLTUNkdWZLcDN5Ygo5dVBibEtYczNDTS85bFhxNDJyOGNFdllma0RZM2theVpuL1JITGpDOXE1V3BXSEJSSmZoSStlUmdJRlBJMW5ZCk5ySnErZFgrUXYwNnZmQkNaRGZITDdRLzdIZVJxQXlmWmVsaGJsMUVnS1k4MGsvcytBT1NuNjU2TFNWQTZHY2gKWlJmbkRzd0E1d2pnWDU1R2dvU0VtdGkvTkxJM1RRMW8renhGdCtjZkVuT1lWdlg1K1R1QVdnZGNtYjlnSEdKdgpHSlNkdTZlbGwzQVlteG93N0FQYWxweWxpUHVRVDF0ZkZiSGV1ZXJpWXR5Rk4vdDlHM0FsK0ZvTTlySzY3RGFsCktSTWlXUkhWM1NocVNQbnI3VHdZa1RlaFFRaTlBQ3lLd0k4L011dHZ4amVyQWdNQkFBR2pJekFoTUE0R0ExVWQKRHdFQi93UUVBd0lDQkRBUEJnTlZIUk1CQWY4RUJUQURBUUgvTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBaQpsOFdEeHppRVVONW5Za3BrV3RJcXh3a0oza0tIeWRYK09FcGQwbGpqUjJRVzBDSUhYbkw5UWxuUnNjNzkxZG56CmY3bXZBWnZEL1J6REpVNk4xcWxMT283MFhveU9IWnBNd2dwditCdk9kc2ZLR3h4UWZQZFdNbXdZRDY4QlVlZW4KTXZpV2hXbmJNMUNQSk5qblhxSlFWSzRUL3hmV3ZTUEV1M2pRNjNhb1NKalZJWjArS1dSVU1pQkNBYXZjaHYzbAoyYXJVY0hYeXpNUjlWMFk2VDk0NGd6SFIvVUNTakhGbHJxc2luQitXc1p2RU84c04xSjd4U2RIejYwR3ZoN1ZtCk1iTFAvV1J6dUFsSEZ1K0I0azNlRWN5OGI5ZnhaaTVzQWhSVmpEVGFuRGNmSVByWUVPaGo5SVZMWEhnU0VDZW4KZUhUUURKQnBMWHFhWmtnY1RBMW4KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - server: https://35.232.60.106 - name: gke_proud-shoreline-225107_us-central1-a_standard-cluster-1 + certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURkRENDQWx5Z0F3SUJBZ0lDSFZZd0RRWUpLb1pJaHZjTkFRRUxCUUF3YVRFTE1Ba0dBMVVFQmhNQ1NsQXgKRVRBUEJnTlZCQWdNQ0VodmEydGhhV1J2TVJFd0R3WURWUVFIREFoSVlXdHZaR0YwWlRFVE1CRUdBMVVFQ2d3SwpTM1ZpWlhKdVpYUmxjekVMTUFrR0ExVUVDd3dDUTBFeEVqQVFCZ05WQkFNTUNXbGpkQzFqYkc5MVpEQWVGdzB4Ck9UQXhNRGt4T1RBME5UZGFGdzB5T1RBeE1EWXhPVEEwTlRkYU1Ha3hDekFKQmdOVkJBWVRBa3BRTVJFd0R3WUQKVlFRSURBaEliMnRyWVdsa2J6RVJNQThHQTFVRUJ3d0lTR0ZyYjJSaGRHVXhFekFSQmdOVkJBb01Da3QxWW1WeQpibVYwWlhNeEN6QUpCZ05WQkFzTUFrTkJNUkl3RUFZRFZRUUREQWxwWTNRdFkyeHZkV1F3Z2dFaU1BMEdDU3FHClNJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUN6RmFLV1RYZ3FLSGZGZnAxRHBtU2t6KzdJRUlkd1lJMG0KRVo3VTI1WnZjT0c0YzlVMkJFN3dkcVlRWm9BYlJRY0ZiY2l2OURFZGR0UmdmeW4wdGh6eWVuWGRYQjM0dTNSNApHaG5nNFVyRVB0TU5LQlNMeG01V1lqTGhpYU82RGpJWjI2cGU5ZStrL3FRazloeS9qa0hOYmRCM0MzQ2ZRSmoxCkdEcnMxWk44dU80QzdsRkN0aDJjbkhnR3VVcXRWZml6NGk0NjIrcnFQZWt4NEtYZEU3K2ZsWExVdk1WYnZSazgKOWtkK1B2WXZjSjk3amplZS9hNHFmSW9MUVZhY0x6dXI2VlNCQUF6cE44Mmh6Y1RUSUIvbXIyMW5Ka0U2VUNicAppS2xkUnJtekRoSjU4MU9xQmcwei9uVkZFNG11dU4vV2FPTFpIN2tCWGZzUmFBY0xKalNKQWdNQkFBR2pKakFrCk1CUUdBMVVkRVFRTk1BdUNDV2xqZEMxamJHOTFaREFNQmdOVkhSTUVCVEFEQVFIL01BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUJFemZtS3UvZGd6cHJMSXRSd0xMbHFjVFkzOXNuNVU3aExvblNwTHBVampuOTAwL3FUeUNoOQpOYityNHpnYUtxam5lK0Z3T1JQZWcwYU5Sc3VwTEtqY0dCaG1KT3ZTMlkvQkk2T1ROMUpaS0FTTEwySk1JclExCmMweVhNbmRCQU90b1RWa2g2NUNDcXgrbGQ5cTRkcGltVjhsZXhpZmZ2VUkxbGJqdVNGWStPZEJwK2U0SWVyemIKa1BXV1lhWnppM2xWWS9qRVVDTFVoNmt2MHhGcmJKS1dLQTFlZHV2T3U2cERKYkhiNGZpUGg1b2hoemZCR0NuVwpNNURNcTh5ay9RRmJoZEFGZk5rL3FxODVSdk53VkpxWUhCT3FHVStSenhtYnh0OWhnN1huM1BoTW43YXczMkNGCmI0ZzNLTEcvRzdwSzZKdjB2SjU0Uk5CdDNqNzUwUlg1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + server: https://34.80.53.82:6443 + name: ict-cloud contexts: - context: - cluster: gke_proud-shoreline-225107_us-central1-a_standard-cluster-1 - user: gke_proud-shoreline-225107_us-central1-a_standard-cluster-1 - name: gke_proud-shoreline-225107_us-central1-a_standard-cluster-1 -current-context: gke_proud-shoreline-225107_us-central1-a_standard-cluster-1 + cluster: ict-cloud + user: youtanagai@gmail.com + name: ict-cloud-youtanagai@gmail.com +current-context: ict-cloud-youtanagai@gmail.com kind: Config preferences: {} users: -- name: gke_proud-shoreline-225107_us-central1-a_standard-cluster-1 +- name: youtanagai@gmail.com user: - username: admin - password: 0mYGkHlgsgXCqoZ3 \ No newline at end of file + auth-provider: + config: + client-id: 43129496828-9c3o6lr8i1o48sjlsi5gkjatbinnvfus.apps.googleusercontent.com + client-secret: cU02QKzFc7M_taIgIebKZTYF + id-token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjA4ZDMyNDVjNjJmODZiNjM2MmFmY2JiZmZlMWQwNjk4MjZkZDFkYzEiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiI0MzEyOTQ5NjgyOC05YzNvNmxyOGkxbzQ4c2psc2k1Z2tqYXRiaW5udmZ1cy5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbSIsImF1ZCI6IjQzMTI5NDk2ODI4LTljM282bHI4aTFvNDhzamxzaTVna2phdGJpbm52ZnVzLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwic3ViIjoiMTA4ODk4OTEzMjA2ODI4OTgxNDEwIiwiZW1haWwiOiJ5b3V0YW5hZ2FpQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJhdF9oYXNoIjoiVTNrZUtZYzAxV1JFLUFDV3ptMzVEdyIsImlhdCI6MTU0NzU0MTM5MiwiZXhwIjoxNTQ3NTQ0OTkyfQ.jWvjenlCNGVCp2nriUvzeTiXzco1TZ6vvb5TNC2MX0px0L3_CTwwwjoDSln4W3CUZDE6XQpXqmqwnr1da038TnYHTnU9A2jD72jT_6gkL2wWAsy93QvLqFnChWHaPviX8Gy0C44A5-qIcuAZPLnYsS3NGo5uU-LBAgQpgPeWhCSYaFTLVxqQ5ejyogcPbJRXxZDs_Orz-lZu0aNlsSHrE0EpyjXDhiu7mKeTn6PuEpKFZqyUYthmGBZEy2SSWdMKjJwnw4V-do9M56fneS1pHw4K5x7FgCI9WUawagOE5Py2ZFj-82DwdQz_JrnsA08iRbRSqQUdeyHKy0gvptc7JQ + idp-issuer-url: https://accounts.google.com + refresh-token: 1/blwlVUlLsTOr1uo2qeblihQe-sG2Z34IskuWyATfL7c + name: oidc From 2001c034c6c8a8f6cdaf8ba62a29a3a3e0d8b03f Mon Sep 17 00:00:00 2001 From: youtangai Date: Wed, 16 Jan 2019 14:30:34 +0900 Subject: [PATCH 2/3] =?UTF-8?q?oidc=E3=83=91=E3=83=83=E3=82=B1=E3=83=BC?= =?UTF-8?q?=E3=82=B8=E3=81=AE=E8=BF=BD=E5=8A=A0=E3=81=A8dep=20ensure?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Gopkg.lock | 4 +- .../plugin/pkg/client/auth/oidc/OWNERS | 5 + .../plugin/pkg/client/auth/oidc/oidc.go | 379 ++++++++++++++++++ 3 files changed, 387 insertions(+), 1 deletion(-) create mode 100644 vendor/k8s.io/client-go/plugin/pkg/client/auth/oidc/OWNERS create mode 100644 vendor/k8s.io/client-go/plugin/pkg/client/auth/oidc/oidc.go diff --git a/Gopkg.lock b/Gopkg.lock index 1528212..170f474 100644 --- a/Gopkg.lock +++ b/Gopkg.lock @@ -499,7 +499,7 @@ revision = "fa6ddc151d63306b3540a37d910a07b181e4a474" [[projects]] - digest = "1:20f641257f6c0c69ddf455a15b63b20bac524b08d90745da796d633724758bac" + digest = "1:d250d0523975c61fb2f2c2de4979e268c74965bf7259a6b8f107f3a99a9b1a42" name = "k8s.io/client-go" packages = [ "discovery", @@ -542,6 +542,7 @@ "pkg/apis/clientauthentication/v1beta1", "pkg/version", "plugin/pkg/client/auth/exec", + "plugin/pkg/client/auth/oidc", "rest", "rest/watch", "tools/auth", @@ -593,6 +594,7 @@ "k8s.io/api/core/v1", "k8s.io/apimachinery/pkg/apis/meta/v1", "k8s.io/client-go/kubernetes", + "k8s.io/client-go/plugin/pkg/client/auth/oidc", "k8s.io/client-go/tools/clientcmd", ] solver-name = "gps-cdcl" diff --git a/vendor/k8s.io/client-go/plugin/pkg/client/auth/oidc/OWNERS b/vendor/k8s.io/client-go/plugin/pkg/client/auth/oidc/OWNERS new file mode 100644 index 0000000..e0f3c6c --- /dev/null +++ b/vendor/k8s.io/client-go/plugin/pkg/client/auth/oidc/OWNERS @@ -0,0 +1,5 @@ +approvers: +- ericchiang +reviewers: +- ericchiang +- rithujohn191 diff --git a/vendor/k8s.io/client-go/plugin/pkg/client/auth/oidc/oidc.go b/vendor/k8s.io/client-go/plugin/pkg/client/auth/oidc/oidc.go new file mode 100644 index 0000000..1383a97 --- /dev/null +++ b/vendor/k8s.io/client-go/plugin/pkg/client/auth/oidc/oidc.go @@ -0,0 +1,379 @@ +/* +Copyright 2016 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package oidc + +import ( + "context" + "encoding/base64" + "encoding/json" + "errors" + "fmt" + "io/ioutil" + "net/http" + "strings" + "sync" + "time" + + "golang.org/x/oauth2" + "k8s.io/apimachinery/pkg/util/net" + restclient "k8s.io/client-go/rest" + "k8s.io/klog" +) + +const ( + cfgIssuerUrl = "idp-issuer-url" + cfgClientID = "client-id" + cfgClientSecret = "client-secret" + cfgCertificateAuthority = "idp-certificate-authority" + cfgCertificateAuthorityData = "idp-certificate-authority-data" + cfgIDToken = "id-token" + cfgRefreshToken = "refresh-token" + + // Unused. Scopes aren't sent during refreshing. + cfgExtraScopes = "extra-scopes" +) + +func init() { + if err := restclient.RegisterAuthProviderPlugin("oidc", newOIDCAuthProvider); err != nil { + klog.Fatalf("Failed to register oidc auth plugin: %v", err) + } +} + +// expiryDelta determines how earlier a token should be considered +// expired than its actual expiration time. It is used to avoid late +// expirations due to client-server time mismatches. +// +// NOTE(ericchiang): this is take from golang.org/x/oauth2 +const expiryDelta = 10 * time.Second + +var cache = newClientCache() + +// Like TLS transports, keep a cache of OIDC clients indexed by issuer URL. This ensures +// current requests from different clients don't concurrently attempt to refresh the same +// set of credentials. +type clientCache struct { + mu sync.RWMutex + + cache map[cacheKey]*oidcAuthProvider +} + +func newClientCache() *clientCache { + return &clientCache{cache: make(map[cacheKey]*oidcAuthProvider)} +} + +type cacheKey struct { + // Canonical issuer URL string of the provider. + issuerURL string + clientID string +} + +func (c *clientCache) getClient(issuer, clientID string) (*oidcAuthProvider, bool) { + c.mu.RLock() + defer c.mu.RUnlock() + client, ok := c.cache[cacheKey{issuer, clientID}] + return client, ok +} + +// setClient attempts to put the client in the cache but may return any clients +// with the same keys set before. This is so there's only ever one client for a provider. +func (c *clientCache) setClient(issuer, clientID string, client *oidcAuthProvider) *oidcAuthProvider { + c.mu.Lock() + defer c.mu.Unlock() + key := cacheKey{issuer, clientID} + + // If another client has already initialized a client for the given provider we want + // to use that client instead of the one we're trying to set. This is so all transports + // share a client and can coordinate around the same mutex when refreshing and writing + // to the kubeconfig. + if oldClient, ok := c.cache[key]; ok { + return oldClient + } + + c.cache[key] = client + return client +} + +func newOIDCAuthProvider(_ string, cfg map[string]string, persister restclient.AuthProviderConfigPersister) (restclient.AuthProvider, error) { + issuer := cfg[cfgIssuerUrl] + if issuer == "" { + return nil, fmt.Errorf("Must provide %s", cfgIssuerUrl) + } + + clientID := cfg[cfgClientID] + if clientID == "" { + return nil, fmt.Errorf("Must provide %s", cfgClientID) + } + + // Check cache for existing provider. + if provider, ok := cache.getClient(issuer, clientID); ok { + return provider, nil + } + + if len(cfg[cfgExtraScopes]) > 0 { + klog.V(2).Infof("%s auth provider field depricated, refresh request don't send scopes", + cfgExtraScopes) + } + + var certAuthData []byte + var err error + if cfg[cfgCertificateAuthorityData] != "" { + certAuthData, err = base64.StdEncoding.DecodeString(cfg[cfgCertificateAuthorityData]) + if err != nil { + return nil, err + } + } + + clientConfig := restclient.Config{ + TLSClientConfig: restclient.TLSClientConfig{ + CAFile: cfg[cfgCertificateAuthority], + CAData: certAuthData, + }, + } + + trans, err := restclient.TransportFor(&clientConfig) + if err != nil { + return nil, err + } + hc := &http.Client{Transport: trans} + + provider := &oidcAuthProvider{ + client: hc, + now: time.Now, + cfg: cfg, + persister: persister, + } + + return cache.setClient(issuer, clientID, provider), nil +} + +type oidcAuthProvider struct { + client *http.Client + + // Method for determining the current time. + now func() time.Time + + // Mutex guards persisting to the kubeconfig file and allows synchronized + // updates to the in-memory config. It also ensures concurrent calls to + // the RoundTripper only trigger a single refresh request. + mu sync.Mutex + cfg map[string]string + persister restclient.AuthProviderConfigPersister +} + +func (p *oidcAuthProvider) WrapTransport(rt http.RoundTripper) http.RoundTripper { + return &roundTripper{ + wrapped: rt, + provider: p, + } +} + +func (p *oidcAuthProvider) Login() error { + return errors.New("not yet implemented") +} + +type roundTripper struct { + provider *oidcAuthProvider + wrapped http.RoundTripper +} + +var _ net.RoundTripperWrapper = &roundTripper{} + +func (r *roundTripper) RoundTrip(req *http.Request) (*http.Response, error) { + if len(req.Header.Get("Authorization")) != 0 { + return r.wrapped.RoundTrip(req) + } + token, err := r.provider.idToken() + if err != nil { + return nil, err + } + + // shallow copy of the struct + r2 := new(http.Request) + *r2 = *req + // deep copy of the Header so we don't modify the original + // request's Header (as per RoundTripper contract). + r2.Header = make(http.Header) + for k, s := range req.Header { + r2.Header[k] = s + } + r2.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token)) + + return r.wrapped.RoundTrip(r2) +} + +func (t *roundTripper) WrappedRoundTripper() http.RoundTripper { return t.wrapped } + +func (p *oidcAuthProvider) idToken() (string, error) { + p.mu.Lock() + defer p.mu.Unlock() + + if idToken, ok := p.cfg[cfgIDToken]; ok && len(idToken) > 0 { + valid, err := idTokenExpired(p.now, idToken) + if err != nil { + return "", err + } + if valid { + // If the cached id token is still valid use it. + return idToken, nil + } + } + + // Try to request a new token using the refresh token. + rt, ok := p.cfg[cfgRefreshToken] + if !ok || len(rt) == 0 { + return "", errors.New("No valid id-token, and cannot refresh without refresh-token") + } + + // Determine provider's OAuth2 token endpoint. + tokenURL, err := tokenEndpoint(p.client, p.cfg[cfgIssuerUrl]) + if err != nil { + return "", err + } + + config := oauth2.Config{ + ClientID: p.cfg[cfgClientID], + ClientSecret: p.cfg[cfgClientSecret], + Endpoint: oauth2.Endpoint{TokenURL: tokenURL}, + } + + ctx := context.WithValue(context.Background(), oauth2.HTTPClient, p.client) + token, err := config.TokenSource(ctx, &oauth2.Token{RefreshToken: rt}).Token() + if err != nil { + return "", fmt.Errorf("failed to refresh token: %v", err) + } + + idToken, ok := token.Extra("id_token").(string) + if !ok { + // id_token isn't a required part of a refresh token response, so some + // providers (Okta) don't return this value. + // + // See https://github.com/kubernetes/kubernetes/issues/36847 + return "", fmt.Errorf("token response did not contain an id_token, either the scope \"openid\" wasn't requested upon login, or the provider doesn't support id_tokens as part of the refresh response.") + } + + // Create a new config to persist. + newCfg := make(map[string]string) + for key, val := range p.cfg { + newCfg[key] = val + } + + // Update the refresh token if the server returned another one. + if token.RefreshToken != "" && token.RefreshToken != rt { + newCfg[cfgRefreshToken] = token.RefreshToken + } + newCfg[cfgIDToken] = idToken + + // Persist new config and if successful, update the in memory config. + if err = p.persister.Persist(newCfg); err != nil { + return "", fmt.Errorf("could not persist new tokens: %v", err) + } + p.cfg = newCfg + + return idToken, nil +} + +// tokenEndpoint uses OpenID Connect discovery to determine the OAuth2 token +// endpoint for the provider, the endpoint the client will use the refresh +// token against. +func tokenEndpoint(client *http.Client, issuer string) (string, error) { + // Well known URL for getting OpenID Connect metadata. + // + // https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig + wellKnown := strings.TrimSuffix(issuer, "/") + "/.well-known/openid-configuration" + resp, err := client.Get(wellKnown) + if err != nil { + return "", err + } + defer resp.Body.Close() + + body, err := ioutil.ReadAll(resp.Body) + if err != nil { + return "", err + } + if resp.StatusCode != http.StatusOK { + // Don't produce an error that's too huge (e.g. if we get HTML back for some reason). + const n = 80 + if len(body) > n { + body = append(body[:n], []byte("...")...) + } + return "", fmt.Errorf("oidc: failed to query metadata endpoint %s: %q", resp.Status, body) + } + + // Metadata object. We only care about the token_endpoint, the thing endpoint + // we'll be refreshing against. + // + // https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata + var metadata struct { + TokenURL string `json:"token_endpoint"` + } + if err := json.Unmarshal(body, &metadata); err != nil { + return "", fmt.Errorf("oidc: failed to decode provider discovery object: %v", err) + } + if metadata.TokenURL == "" { + return "", fmt.Errorf("oidc: discovery object doesn't contain a token_endpoint") + } + return metadata.TokenURL, nil +} + +func idTokenExpired(now func() time.Time, idToken string) (bool, error) { + parts := strings.Split(idToken, ".") + if len(parts) != 3 { + return false, fmt.Errorf("ID Token is not a valid JWT") + } + + payload, err := base64.RawURLEncoding.DecodeString(parts[1]) + if err != nil { + return false, err + } + var claims struct { + Expiry jsonTime `json:"exp"` + } + if err := json.Unmarshal(payload, &claims); err != nil { + return false, fmt.Errorf("parsing claims: %v", err) + } + + return now().Add(expiryDelta).Before(time.Time(claims.Expiry)), nil +} + +// jsonTime is a json.Unmarshaler that parses a unix timestamp. +// Because JSON numbers don't differentiate between ints and floats, +// we want to ensure we can parse either. +type jsonTime time.Time + +func (j *jsonTime) UnmarshalJSON(b []byte) error { + var n json.Number + if err := json.Unmarshal(b, &n); err != nil { + return err + } + var unix int64 + + if t, err := n.Int64(); err == nil { + unix = t + } else { + f, err := n.Float64() + if err != nil { + return err + } + unix = int64(f) + } + *j = jsonTime(time.Unix(unix, 0)) + return nil +} + +func (j jsonTime) MarshalJSON() ([]byte, error) { + return json.Marshal(time.Time(j).Unix()) +} From b7c49f38e828a70dcc83538fa570bbd9b851528f Mon Sep 17 00:00:00 2001 From: Your Name Date: Wed, 10 Jul 2019 18:30:26 +0900 Subject: [PATCH 3/3] fix setting for cluster in fun --- docker-compose.yml | 4 ++-- kubeconfig | 7 ++++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 83404a4..3ebd9b7 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -7,8 +7,8 @@ services: - SQL_PASS=7CpV#RdTgttC - SQL_HOST=db - SQL_DB=cloud_api - - K8S_IP=34.80.53.82:6443 - - PROXY_ADDR=34.85.115.170:8081 + - K8S_IP=10.24.194.71:6443 + - PROXY_ADDR=10.6.16.228:8081 ports: - "8080:8080" depends_on: diff --git a/kubeconfig b/kubeconfig index 1bd5f0d..7587060 100644 --- a/kubeconfig +++ b/kubeconfig @@ -2,7 +2,7 @@ apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURkRENDQWx5Z0F3SUJBZ0lDSFZZd0RRWUpLb1pJaHZjTkFRRUxCUUF3YVRFTE1Ba0dBMVVFQmhNQ1NsQXgKRVRBUEJnTlZCQWdNQ0VodmEydGhhV1J2TVJFd0R3WURWUVFIREFoSVlXdHZaR0YwWlRFVE1CRUdBMVVFQ2d3SwpTM1ZpWlhKdVpYUmxjekVMTUFrR0ExVUVDd3dDUTBFeEVqQVFCZ05WQkFNTUNXbGpkQzFqYkc5MVpEQWVGdzB4Ck9UQXhNRGt4T1RBME5UZGFGdzB5T1RBeE1EWXhPVEEwTlRkYU1Ha3hDekFKQmdOVkJBWVRBa3BRTVJFd0R3WUQKVlFRSURBaEliMnRyWVdsa2J6RVJNQThHQTFVRUJ3d0lTR0ZyYjJSaGRHVXhFekFSQmdOVkJBb01Da3QxWW1WeQpibVYwWlhNeEN6QUpCZ05WQkFzTUFrTkJNUkl3RUFZRFZRUUREQWxwWTNRdFkyeHZkV1F3Z2dFaU1BMEdDU3FHClNJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUN6RmFLV1RYZ3FLSGZGZnAxRHBtU2t6KzdJRUlkd1lJMG0KRVo3VTI1WnZjT0c0YzlVMkJFN3dkcVlRWm9BYlJRY0ZiY2l2OURFZGR0UmdmeW4wdGh6eWVuWGRYQjM0dTNSNApHaG5nNFVyRVB0TU5LQlNMeG01V1lqTGhpYU82RGpJWjI2cGU5ZStrL3FRazloeS9qa0hOYmRCM0MzQ2ZRSmoxCkdEcnMxWk44dU80QzdsRkN0aDJjbkhnR3VVcXRWZml6NGk0NjIrcnFQZWt4NEtYZEU3K2ZsWExVdk1WYnZSazgKOWtkK1B2WXZjSjk3amplZS9hNHFmSW9MUVZhY0x6dXI2VlNCQUF6cE44Mmh6Y1RUSUIvbXIyMW5Ka0U2VUNicAppS2xkUnJtekRoSjU4MU9xQmcwei9uVkZFNG11dU4vV2FPTFpIN2tCWGZzUmFBY0xKalNKQWdNQkFBR2pKakFrCk1CUUdBMVVkRVFRTk1BdUNDV2xqZEMxamJHOTFaREFNQmdOVkhSTUVCVEFEQVFIL01BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUJFemZtS3UvZGd6cHJMSXRSd0xMbHFjVFkzOXNuNVU3aExvblNwTHBVampuOTAwL3FUeUNoOQpOYityNHpnYUtxam5lK0Z3T1JQZWcwYU5Sc3VwTEtqY0dCaG1KT3ZTMlkvQkk2T1ROMUpaS0FTTEwySk1JclExCmMweVhNbmRCQU90b1RWa2g2NUNDcXgrbGQ5cTRkcGltVjhsZXhpZmZ2VUkxbGJqdVNGWStPZEJwK2U0SWVyemIKa1BXV1lhWnppM2xWWS9qRVVDTFVoNmt2MHhGcmJKS1dLQTFlZHV2T3U2cERKYkhiNGZpUGg1b2hoemZCR0NuVwpNNURNcTh5ay9RRmJoZEFGZk5rL3FxODVSdk53VkpxWUhCT3FHVStSenhtYnh0OWhnN1huM1BoTW43YXczMkNGCmI0ZzNLTEcvRzdwSzZKdjB2SjU0Uk5CdDNqNzUwUlg1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - server: https://34.80.53.82:6443 + server: https://10.24.194.71:6443 name: ict-cloud contexts: - context: @@ -19,7 +19,8 @@ users: config: client-id: 43129496828-9c3o6lr8i1o48sjlsi5gkjatbinnvfus.apps.googleusercontent.com client-secret: cU02QKzFc7M_taIgIebKZTYF - id-token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjA4ZDMyNDVjNjJmODZiNjM2MmFmY2JiZmZlMWQwNjk4MjZkZDFkYzEiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiI0MzEyOTQ5NjgyOC05YzNvNmxyOGkxbzQ4c2psc2k1Z2tqYXRiaW5udmZ1cy5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbSIsImF1ZCI6IjQzMTI5NDk2ODI4LTljM282bHI4aTFvNDhzamxzaTVna2phdGJpbm52ZnVzLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwic3ViIjoiMTA4ODk4OTEzMjA2ODI4OTgxNDEwIiwiZW1haWwiOiJ5b3V0YW5hZ2FpQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJhdF9oYXNoIjoiVTNrZUtZYzAxV1JFLUFDV3ptMzVEdyIsImlhdCI6MTU0NzU0MTM5MiwiZXhwIjoxNTQ3NTQ0OTkyfQ.jWvjenlCNGVCp2nriUvzeTiXzco1TZ6vvb5TNC2MX0px0L3_CTwwwjoDSln4W3CUZDE6XQpXqmqwnr1da038TnYHTnU9A2jD72jT_6gkL2wWAsy93QvLqFnChWHaPviX8Gy0C44A5-qIcuAZPLnYsS3NGo5uU-LBAgQpgPeWhCSYaFTLVxqQ5ejyogcPbJRXxZDs_Orz-lZu0aNlsSHrE0EpyjXDhiu7mKeTn6PuEpKFZqyUYthmGBZEy2SSWdMKjJwnw4V-do9M56fneS1pHw4K5x7FgCI9WUawagOE5Py2ZFj-82DwdQz_JrnsA08iRbRSqQUdeyHKy0gvptc7JQ + id-token: eyJhbGciOiJSUzI1NiIsImtpZCI6ImE0MzEzZTdmZDFlOWUyYTRkZWQzYjI5MmQyYTdmNGU1MTk1NzQzMDgiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiI0MzEyOTQ5NjgyOC05YzNvNmxyOGkxbzQ4c2psc2k1Z2tqYXRiaW5udmZ1cy5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbSIsImF1ZCI6IjQzMTI5NDk2ODI4LTljM282bHI4aTFvNDhzamxzaTVna2phdGJpbm52ZnVzLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwic3ViIjoiMTA4ODk4OTEzMjA2ODI4OTgxNDEwIiwiZW1haWwiOiJ5b3V0YW5hZ2FpQGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJhdF9oYXNoIjoibjRIblZIbF9Na0czNEc0V0l5dmNoZyIsImlhdCI6MTU1NDE4NTQxMiwiZXhwIjoxNTU0MTg5MDEyfQ.j7_1aBlvceC4c5rN1k7QCrfUXkkWrEXNgNtnbgHkY4uly5sDB8L3x5QTdFvDU3rM5IdPkKqyPyTuE12BbTr6pbdbtmOpRPKCEGgNVqgh2xsyCRFgxHcW7ak6mc1XGOFG_n5_zkZrLi00jTYb3EIR0OSOELuGQTqjA46sGYY4FPM2CiFCLdP5JCrb9Z8vhwk6x-8ig16UH4YFGmgfb1AXl3xbDjhYwMFWLxKqpDVZPdAYgilo7CUASGe4enBOO2s01d3pQkYSVXYlaylcGKjQOf5a3RCFlrOe9KGZ7TPRBI4s3Y6eylqwPzdtmiwo4wuo3cc1lMgT7bSThU8TljoCig idp-issuer-url: https://accounts.google.com - refresh-token: 1/blwlVUlLsTOr1uo2qeblihQe-sG2Z34IskuWyATfL7c + refresh-token: 1/FkV2MDfpX-j-Cx7giury2ofw3-JE2jdMIjzvJdgoe8Q name: oidc +