Request client certificates about kube-rbac-proxy HOT 6 CLOSED

Thanks for the report and sorry for the late reply! I did a quick test and I agree that we should be setting ClientAuth: tls.RequestClientCert here. The fix itself is very simple but adding a test case is more involved. If someone wants to have a look, they're welcome :)

cc @s-urbaniak for awareness.

from kube-rbac-proxy.

I feel like I can give it a try if you do not mind.

from kube-rbac-proxy.

@nabokihms generally the addition of RequestClientCert makes sense to me, but out of curiosity to understand why we need that option, do you also want to contribute a client-cert based authenticator in kube-rbac-proxy as well?

from kube-rbac-proxy.

The client-cert based authenticator is already in the code.

Actually, this authenticator is a combination of various authenticators.

Look here. The New method shows exactly how it combines authenticators and which authentication types you can use.

So, two thing you need to do to make client-cert based authenticator works:

• Add srv.TLSConfig.ClientAuth = tls.RequestClientCert
• Specify --client-ca-file=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt flag for kube-rbac-proxy instance.

from kube-rbac-proxy.

I forked this proxy and tested it (I think it was a year ago). In our Kubernetes clusters, we use both tokens and certs.

from kube-rbac-proxy.

Ahh, ok i was always under the impression that the delegating authenticator just does the token review. Yes, this makes perfect sense to me now 👍 Indeed, that would be a great contribution!

from kube-rbac-proxy.