Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://github.com/brancz/kube-rbac-proxy/issues/238 below:

Sig-Auth Pre-Acceptance 2nd Review · Issue #238 · brancz/kube-rbac-proxy · GitHub

Issues collected during the second round of review with @enj.

kube-rbac-proxy should become a project owned by Kubernetes.

cmd/kube-rbac-proxy/app/kube-rbac-proxy.go:

• (1) Log deprecation warnings link. #317
• (2) Rename to ApplyTo to conform naming convention link.
• (3) Replace func with cobra.Args link.
• (4) Run should run with a final config version. Complete should finish the necessary changes and those shouldn't happen anymore in Run. link.
• (5) Use context from Signals. link.
• (6) Wrapper to highlight tokens being audience agnostic link. #318
• (7) Don't use deprecated Director func link. #316
• (8) Verify that custom Connection headers can't drop headers link. #319
• (9) H2C is fine as plaintext if listening to 127.0.0.1 / ::1 or UDS link.
• (10) Describe what an empty request info factory means link.
• (11) Use safe wait group from k/k instead of run.Group link
• (12) Avoid nested code blocks link
• (13) Comment why we have two listeners on different ports link
• (14) Validate if a simple response by the health endpoint is enough to proof healthiness link #320
• (15) Add serverconfig.SetupSignalContext lin.
• (16) Log error of serverCtxCancel link.
• (17) Authorizers should only be added, when used link.
• (18) Verify that Rewrite Attributes is definitely turned off if not configured link.
• (19) Discuss in comment, why regular path k/k authorizer can't be used link.
• (20) What should happen if an Authorizer errs? link.
  • Maybe fail? link.

cmd/kube-rbac-proxy/app/options/legacyoptions.go:

• (21) Add whitespace link.
• (22) Remove validation or add validation link.
• (23) Rename to ApplyTo due to naming conventions link.
• (24) Same: why do we have empty functions? link.

cmd/kube-rbac-proxy/app/options/proxyoptions.go:

• (25) Rename config file name to authz config filename as it is specific to authz link. #331
• (26) Add whitespace link. #332
• (28) Force a manual opt-in for legacy SA token? #336
• (29) Doesn't make sense with OIDC #371

pkg/authn/config.go:

• (30) What does this do? link.

pkg/authn/identityheaders/identityheaders.go:

• (31) Allow authHeaders only with mTLS or 127.0.0.1/::1 link.
• (32) If !ok err-out link.
• (33) Several header entries for groups, such that group separator can be used in group name link. #330

pkg/authorization/path/path.go:

• (34) Better NewDenyPathAuthorizerUnlessAllowed name? link
• (35) Just use authorizationpath.NewAuthorizer link

pkg/authorization/rewrite/rewrite.go:

• (36) Use dedicated type link.
• (37) Better link.
• (38) Emphasize AND logic link.
• (39) Better link.
• (40) Groups aren't being used. Fix it #333
• (41) Is a massive mutation of the authorizer.Attributes intended? Why? #356
• (42) Describe that this turns dynamic path authz checks into static resource checks link.
• (43) Verify and parse templates on process startup link.
• (44) Use sync.Pool instead? link #334
• (45) Noop on nil link.
• Improve the reasoning for rewriting un-trusted requests #368
• (47) Collapse logic into a custom request info parser, if possible link.
• (48) If only one header is supported, ensure to fail on more than one #355
• (49) Quit early on no params link.

pkg/authorization/static/static.go:

• (50) Seems to be unused.
• (51) Return interface instead of unexported struct #335

pkg/server/config.go:

• (52) Check conditional statement on ForceAttemptHTTP2 link.

• (53) Should we have rewrites in general link OR
• (54) several SAR requests in particular per incoming request OR
• (55) support only header based config link OR
• (56) handle "scary config" #345
• (57) highlight as a very scary config link.

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4