Define ComponentPlugin API type

Just writing down how I think plugins should get registered with the system. Was thinking it'd be nice to do the event thing as a plugin.
W.r.t. authorization, the component that launches the component plugin (self-hosted or integrated into a binary) is responsible for passing into the component the necessary credentials, secret, or configuration necessary to authenticate itself to lower level components.  At least some plugins will wish to reuse the standard authn/z mechanisms, and the operator is likely to be the one choosing whether the plugin delegates trust, or is integrated into the lower level trust mechanisms.  At scale (as per the other issues about self hosting), each component plugin will run at the lowest trust level that can be afforded, which means plugins should be able to act as slightly privileged clients.

An example:

1. The core kube apiserver runs with an authz filter in front of the api
2. A client component plugin is implemented which wants the lowest cost authz solution that is supported by the rest of the cluster
3. The plugin starts with a filter that delegates and caches authz decisions made by a remote call to 1.
4. The administrator adjusts the policies defined in 1 to allow users to perform actions on the plugin
5. When the plugin needs to act on behalf of a user to call an API in 1, the authn/z info is passed down to 1
6. When the plugin needs to act at a higher level, it must authn/z as itself
7. The credentials / service acct the plugin acts as must be identified in 1 and in the policies that control access to 1.
8. The mechanism the plugin uses to access 1 as "itself" should follow the normal conventions for long running, high security components, which could be Kerberos, client cert SSL, or SSL + secret + short term tokens.

(Substitute 1 above for "the authz/n component of the system" which may be part of the core server or separate)

The initial secret / credentials for the plugin can be provided at initialization - if the core security is trusted (pod templates are secure) then the secrets are no more at risk than in any other mechanism. Refresh of those credentials has to be handled by an administrative action today.


> On Oct 14, 2014, at 7:18 PM, bgrant0607 <notifications@github.com> wrote:
> 
> In docs/plugin-component.md:
> 
> > +A. We can support this with some changes to the way we setup resource endpoints in master. Specifically, it should be possible to run necessary plugins as either a "component plugin" for scalability, or as a compile-time plugin for ease of use. It's reasonable for us to require that third-party plugins run as external components.
> > +
> > +Q. Why run a component plugin from a replication controller?
> > +A. This allows scaling and ensures that your plugin will be restarted if it crashes or the minion it's on dies, etc..
> > +
> > +Q. Why require a service? Why not just an arbitrary endpoint?
> > +A. If you're running as a k8s component behind a replication controller, there's really no other way to identify your current location, at least not currently. We might reevaluate this when IP-per-service is implemented.
> > +
> > +Q. What if a plugin wants to handle multiple api endpoints?
> > +A. Put multiple ComponentPlugin objects into the system.
> > +
> > +Q. How do you bring up a component plugin?
> > +A. Your config (not yet existing) will have entries for a replicationController.json (which will keep your binaries running), a service.json (so we can route traffic to your binaries), and a componentPlugin.json, which actually will cause you to own the endpoint.
> > +
> > +Q. Bootstrap order?
> > +A. Component plugins are built on top of the core features of the cluster and can't be used by startup code.
> That's not unreasonable, though I'd eventually like to self-host all our components. It would be easy to start controller-manager pods directly and then put them under control of a replication controller, for example.
> 
> —
> Reply to this email directly or view it on GitHub.