{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/origin/pulls/comments/30830023","id":30830023,"diff_hunk":"@@ -141,10 +151,25 @@ func BuildMasterConfig(options configapi.MasterConfig) (*MasterConfig, error) {\n \tadmissionControlPluginNames := []string{\"OriginNamespaceLifecycle\"}\n \tadmissionController := admission.NewFromPlugins(privilegedLoopbackKubeClient, admissionControlPluginNames, \"\")\n \n+\tvar tokenGetter serviceaccount.ServiceAccountTokenGetter\n+\tif options.KubernetesMasterConfig == nil {","path":"pkg/cmd/server/origin/master_config.go","position":40,"original_position":40,"commit_id":"c37150204d615648249a352a8342de75d5b8d62e","original_commit_id":"c37150204d615648249a352a8342de75d5b8d62e","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"body":"I wasn't sure if the loopback client would ever be authenticated using a service account token, so was trying to prevent ever calling our own auth layer to validate a service account token with external kubernetes","created_at":"2015-05-21T18:10:04Z","updated_at":"2015-05-21T18:10:04Z","html_url":"https://github.com/openshift/origin/pull/2345#discussion_r30830023","pull_request_url":"https://api.github.com/repos/openshift/origin/pulls/2345","_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments/30830023"},"html":{"href":"https://github.com/openshift/origin/pull/2345#discussion_r30830023"},"pull_request":{"href":"https://api.github.com/repos/openshift/origin/pulls/2345"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/2345","id":35698572,"html_url":"https://github.com/openshift/origin/pull/2345","diff_url":"https://github.com/openshift/origin/pull/2345.diff","patch_url":"https://github.com/openshift/origin/pull/2345.patch","issue_url":"https://api.github.com/repos/openshift/origin/issues/2345","number":2345,"state":"open","locked":false,"title":"Enable service accounts","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"body":"- [x] Start service account controller\r\n- [x] Start service account token controller\r\n- [x] Add service account admission plugin\r\n- [x] Add serviceaccount token authenticator\r\n- [x] Generate public/private keypair for service accounts\r\n- [x] Add groups to service accounts\r\n- [x] Add config for managed service account names, signing key, authenticating key\r\n- [x] Add bootstrap policy for image-puller and image-builder roles\r\n- [x] Add role bindings to default project template\r\n  - Bind all service accounts in a namespace to the `image-puller` role\r\n  - Bind the `builder` service account in a namespace to the `image-builder` role\r\n- [x] Add a `osadm create-bootstrap-project-template` command to dump the default project template to a file\r\n- [ ] Integration test\r\n- [ ] test-cmd tests for `create-key-pair`, `create-bootstrap-project-template`\r\n\r\nAdded a stanza to master-config.yaml\r\n```\r\nserviceAccountConfig:\r\n  managedNames:\r\n  - default\r\n  - builder\r\n  privateKeyFile: ...\r\n  publicKeyFiles:\r\n  - ...\r\n  - ...\r\n```\r\n\r\n`managedNames` is a list of service account names that will be auto-created in every namespace. If no names are specified, the ServiceAccountsController will not be started.\r\n\r\n`privateKeyFile` is a file containing a PEM-encoded private RSA key, used to sign service account tokens. If no private key is specified, no API tokens will be generated for service accounts.\r\n\r\n`publicKeyFiles` is a list of files, each containing a PEM-encoded public RSA key (If any file contains a private key, the public portion of the key is used). The list of public keys is used to verify service account tokens presented to the API as bearer tokens. Each key is tried in order until the list is exhausted or verification succeeds. If no keys are specified, no service account API authentication will be available.\r\n\r\n`osadm create-master-certs` and `openshift start --write-config=...` generate a public/private keypair:\r\n```\r\n$CONFIG_DIR/serviceaccounts.private.key\r\n$CONFIG_DIR/serviceaccounts.public.key\r\n```\r\n\r\nWhen running Kubernetes in-process, the default config generated by `--write-config` is:\r\n```\r\nserviceAccountConfig:\r\n  managedNames:\r\n  - default\r\n  - builder\r\n  privateKeyFile: serviceaccounts.private.key\r\n  publicKeyFiles:\r\n  - serviceaccounts.public.key\r\n```\r\n\r\nWhen running against an external Kubernetes (indicated by specifying `--kubeconfig`), the default config generated by `--write-config` is:\r\n```\r\nserviceAccountConfig:\r\n  managedNames:\r\n  - builder\r\n  privateKeyFile: \"\"\r\n  publicKeyFiles: []\r\n```\r\nIn this case, we expect Kubernetes to manage the `default` service account, and to have it's own private key it uses to create the service account tokens. The user would need to obtain the public key file from their kubernetes cluster (used to validate service account tokens) and add it to the config in order to enable service account usage within OpenShift.","created_at":"2015-05-19T06:06:08Z","updated_at":"2015-05-21T18:10:04Z","closed_at":null,"merged_at":null,"merge_commit_sha":"27cdb3e23a8b878f170cf28d8b5aaa0492c23d95","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openshift/origin/pulls/2345/commits","review_comments_url":"https://api.github.com/repos/openshift/origin/pulls/2345/comments","review_comment_url":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/origin/issues/2345/comments","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/c37150204d615648249a352a8342de75d5b8d62e","head":{"label":"liggitt:service_accounts","ref":"service_accounts","sha":"c37150204d615648249a352a8342de75d5b8d62e","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"repo":{"id":23198153,"name":"origin","full_name":"liggitt/origin","owner":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/liggitt/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":true,"url":"https://api.github.com/repos/liggitt/origin","forks_url":"https://api.github.com/repos/liggitt/origin/forks","keys_url":"https://api.github.com/repos/liggitt/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/liggitt/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/liggitt/origin/teams","hooks_url":"https://api.github.com/repos/liggitt/origin/hooks","issue_events_url":"https://api.github.com/repos/liggitt/origin/issues/events{/number}","events_url":"https://api.github.com/repos/liggitt/origin/events","assignees_url":"https://api.github.com/repos/liggitt/origin/assignees{/user}","branches_url":"https://api.github.com/repos/liggitt/origin/branches{/branch}","tags_url":"https://api.github.com/repos/liggitt/origin/tags","blobs_url":"https://api.github.com/repos/liggitt/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/liggitt/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/liggitt/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/liggitt/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/liggitt/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/liggitt/origin/languages","stargazers_url":"https://api.github.com/repos/liggitt/origin/stargazers","contributors_url":"https://api.github.com/repos/liggitt/origin/contributors","subscribers_url":"https://api.github.com/repos/liggitt/origin/subscribers","subscription_url":"https://api.github.com/repos/liggitt/origin/subscription","commits_url":"https://api.github.com/repos/liggitt/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/liggitt/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/liggitt/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/liggitt/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/liggitt/origin/contents/{+path}","compare_url":"https://api.github.com/repos/liggitt/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/liggitt/origin/merges","archive_url":"https://api.github.com/repos/liggitt/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/liggitt/origin/downloads","issues_url":"https://api.github.com/repos/liggitt/origin/issues{/number}","pulls_url":"https://api.github.com/repos/liggitt/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/liggitt/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/liggitt/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/liggitt/origin/labels{/name}","releases_url":"https://api.github.com/repos/liggitt/origin/releases{/id}","created_at":"2014-08-21T18:23:05Z","updated_at":"2015-05-08T13:01:51Z","pushed_at":"2015-05-21T17:53:52Z","git_url":"git://github.com/liggitt/origin.git","ssh_url":"git@github.com:liggitt/origin.git","clone_url":"https://github.com/liggitt/origin.git","svn_url":"https://github.com/liggitt/origin","homepage":"https://openshift.github.io","size":115002,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"54cc564d4825bf9635862cbc404f8c49e7caa2c7","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":22442668,"name":"origin","full_name":"openshift/origin","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":false,"url":"https://api.github.com/repos/openshift/origin","forks_url":"https://api.github.com/repos/openshift/origin/forks","keys_url":"https://api.github.com/repos/openshift/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/origin/teams","hooks_url":"https://api.github.com/repos/openshift/origin/hooks","issue_events_url":"https://api.github.com/repos/openshift/origin/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/origin/events","assignees_url":"https://api.github.com/repos/openshift/origin/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/origin/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/origin/tags","blobs_url":"https://api.github.com/repos/openshift/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/origin/languages","stargazers_url":"https://api.github.com/repos/openshift/origin/stargazers","contributors_url":"https://api.github.com/repos/openshift/origin/contributors","subscribers_url":"https://api.github.com/repos/openshift/origin/subscribers","subscription_url":"https://api.github.com/repos/openshift/origin/subscription","commits_url":"https://api.github.com/repos/openshift/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/origin/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/origin/merges","archive_url":"https://api.github.com/repos/openshift/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/origin/downloads","issues_url":"https://api.github.com/repos/openshift/origin/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/origin/labels{/name}","releases_url":"https://api.github.com/repos/openshift/origin/releases{/id}","created_at":"2014-07-30T20:04:05Z","updated_at":"2015-05-21T05:41:01Z","pushed_at":"2015-05-21T18:07:56Z","git_url":"git://github.com/openshift/origin.git","ssh_url":"git@github.com:openshift/origin.git","clone_url":"https://github.com/openshift/origin.git","svn_url":"https://github.com/openshift/origin","homepage":"http://www.openshift.org","size":186071,"stargazers_count":428,"watchers_count":428,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":211,"mirror_url":null,"open_issues_count":219,"forks":211,"open_issues":219,"watchers":428,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/2345"},"html":{"href":"https://github.com/openshift/origin/pull/2345"},"issue":{"href":"https://api.github.com/repos/openshift/origin/issues/2345"},"comments":{"href":"https://api.github.com/repos/openshift/origin/issues/2345/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/origin/pulls/2345/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/origin/pulls/2345/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/origin/statuses/c37150204d615648249a352a8342de75d5b8d62e"}}}}