76d01bb325
By now, qinling connects to the Kubernetes API server insecurely. kubectl proxy is used for testing purpose. However, in real production deployments, it is not a good idea to let qinling connect to the Kubernetes API server without any authentication and authorization. This commit adds the support in qinling for it to connect to the Kubernetes API server with X509 Client Certs for authentication [1]. An example file is also added for users to grant specific access to the Kubernetes API for qinling using the RBAC authorization of Kubernetes [2]. With these users can control qinling's access to the Kubernetes API [3] and ensure qinling uses a secure connection to talk with the Kubernetes API. Devstack plugin also setups qinling to connect to Kubernetes API server using TLS certificates by default. This makes the deployment with devstack closer to a production-ready environment. For testing purpose, user can set the QINLING_K8S_APISERVER_TLS variable to False in devstack's local.conf. Note: a HOTWO document will be added in a follow-up commit. [1] https://kubernetes.io/docs/admin/authentication/#x509-client-certs [2] https://kubernetes.io/docs/admin/authorization/rbac/ [3] https://kubernetes.io/docs/admin/accessing-the-api/ Change-Id: I532f131abbfc8ed90de398cc135e9b8248d2757a
44 lines
1.5 KiB
Python
44 lines
1.5 KiB
Python
# Copyright 2015
|
|
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
from oslo_config import cfg
|
|
|
|
service_option = cfg.BoolOpt(
|
|
'qinling',
|
|
default=True,
|
|
help="Whether or not Qinling is expected to be"
|
|
"available"
|
|
)
|
|
|
|
|
|
qinling_group = cfg.OptGroup(name="qinling", title="Qinling Service Options")
|
|
|
|
QinlingGroup = [
|
|
cfg.StrOpt("region",
|
|
default="",
|
|
help="The region name to use. If empty, the value "
|
|
"of identity.region is used instead. If no such region "
|
|
"is found in the service catalog, the first found one is "
|
|
"used."),
|
|
cfg.StrOpt("catalog_type",
|
|
default="function-engine",
|
|
help="Catalog type of the Qinling service."),
|
|
cfg.StrOpt('endpoint_type',
|
|
default='publicURL',
|
|
choices=['public', 'admin', 'internal',
|
|
'publicURL', 'adminURL', 'internalURL'],
|
|
help="The endpoint type to use for the qinling service."),
|
|
]
|