starred/cli
1
0
Fork 0
mirror of https://github.com/docker/cli.git synced 2026-09-24 23:41:10 -05:00
Code Issues Packages Projects Releases Wiki Activity

Replace secrets with join tokens

Browse Source 
Implement the proposal from
https://github.com/docker/docker/issues/24430#issuecomment-233100121

Removes acceptance policy and secret in favor of an automatically
generated join token that combines the secret, CA hash, and
manager/worker role into a single opaque string.

Adds a docker swarm join-token subcommand to inspect and rotate the
tokens.

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
Upstream-commit: 2cc5bd33eef038bf5721582e2410ba459bb656e9
Component: engine
This commit is contained in:
Aaron Lehmann
2016-07-21 15:23:03 -07:00
parent 281fb0ce0f
commit b141a44de0
46 changed files with 451 additions and 893 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/engine/docs/reference/api/docker_remote_api_v1.24.md
+20 -37
View File
@@ -3351,7 +3351,6 @@ List nodes
"UpdatedAt": "2016-06-07T20:31:11.999868824Z",
"Spec": {
"Role": "MANAGER",
"Membership": "ACCEPTED",
"Availability": "ACTIVE"
},
"Description": {
@@ -3481,7 +3480,6 @@ Return low-level information on the node `id`
"UpdatedAt": "2016-06-07T20:31:11.999868824Z",
"Spec": {
"Role": "MANAGER",
"Membership": "ACCEPTED",
"Availability": "ACTIVE"
},
"Description": {
@@ -3595,18 +3593,6 @@ Initialize a new Swarm
"ListenAddr": "0.0.0.0:4500",
"ForceNewCluster": false,
"Spec": {
"AcceptancePolicy": {
"Policies": [
{
"Role": "MANAGER",
"Autoaccept": false
},
{
"Role": "WORKER",
"Autoaccept": true
}
]
},
"Orchestration": {},
"Raft": {},
"Dispatcher": {},
@@ -3676,9 +3662,7 @@ Join an existing new Swarm
{
"ListenAddr": "0.0.0.0:4500",
"RemoteAddrs": ["node1:4500"],
"Secret": "",
"CACertHash": "",
"Manager": false
"JoinToken": "SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-7p73s1dx5in4tatdymyhg9hu2"
}
**Example response**:
@@ -3698,9 +3682,7 @@ JSON Parameters:
- **ListenAddr** – Listen address used for inter-manager communication if the node gets promoted to
manager, as well as determining the networking interface used for the VXLAN Tunnel Endpoint (VTEP).
- **RemoteAddr** – Address of any manager node already participating in the Swarm to join.
- **Secret** – Secret token for joining this Swarm.
- **CACertHash** – Optional hash of the root CA to avoid relying on trust on first use.
- **Manager** – Directly join as a manager (only for a Swarm configured to autoaccept managers).
- **JoinToken** – Secret token for joining this Swarm.
### Leave a Swarm
@@ -3741,18 +3723,6 @@ Update a Swarm
{
"Name": "default",
"AcceptancePolicy": {
"Policies": [
{
"Role": "WORKER",
"Autoaccept": false
},
{
"Role": "MANAGER",
"Autoaccept": false
}
]
},
"Orchestration": {
"TaskHistoryRetentionLimit": 10
},
@@ -3767,6 +3737,10 @@ Update a Swarm
},
"CAConfig": {
"NodeCertExpiry": 7776000000000000
},
"JoinTokens": {
"Worker": "SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-1awxwuwd3z9j1z3puu7rcgdbx",
"Manager": "SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-7p73s1dx5in4tatdymyhg9hu2"
}
}
@@ -3777,6 +3751,13 @@ Update a Swarm
Content-Length: 0
Content-Type: text/plain; charset=utf-8
**Query parameters**:
- **version** – The version number of the swarm object being updated. This is
required to avoid conflicting writes.
- **rotate_worker_token** - Set to `true` to rotate the worker join token.
- **rotate_manager_token** - Set to `true` to rotate the manager join token.
**Status codes**:
- **200** – no error
@@ -3785,11 +3766,6 @@ Update a Swarm
JSON Parameters:
- **Policies** – An array of acceptance policies.
- **Role** – The role that policy applies to (`MANAGER` or `WORKER`)
- **Autoaccept** – A boolean indicating whether nodes joining for that role should be
automatically accepted in the Swarm.
- **Secret** – An optional secret to provide for nodes to join the Swarm.
- **Orchestration** – Configuration settings for the orchestration aspects of the Swarm.
- **TaskHistoryRetentionLimit** – Maximum number of tasks history stored.
- **Raft** – Raft related configuration.
@@ -3811,6 +3787,9 @@ JSON Parameters:
- **URL** - URL where certificate signing requests should be sent.
- **Options** - An object with key/value pairs that are interpreted
as protocol-specific options for the external CA driver.
- **JoinTokens** - Tokens that can be used by other nodes to join the Swarm.
- **Worker** - Token to use for joining as a worker.
- **Manager** - Token to use for joining as a manager.
## 3.8 Services
@@ -4292,6 +4271,10 @@ Update the service `id`.
of: `"Ports": { "<port>/<tcp|udp>: {}" }`
- **VirtualIPs**
**Query parameters**:
- **version** – The version number of the service object being updated. This is
required to avoid conflicting writes.
**Status codes**:
components/engine/docs/reference/api/docker_remote_api_v1.25.md
+20 -37
View File
@@ -3352,7 +3352,6 @@ List nodes
"UpdatedAt": "2016-06-07T20:31:11.999868824Z",
"Spec": {
"Role": "MANAGER",
"Membership": "ACCEPTED",
"Availability": "ACTIVE"
},
"Description": {
@@ -3482,7 +3481,6 @@ Return low-level information on the node `id`
"UpdatedAt": "2016-06-07T20:31:11.999868824Z",
"Spec": {
"Role": "MANAGER",
"Membership": "ACCEPTED",
"Availability": "ACTIVE"
},
"Description": {
@@ -3596,18 +3594,6 @@ Initialize a new Swarm
"ListenAddr": "0.0.0.0:4500",
"ForceNewCluster": false,
"Spec": {
"AcceptancePolicy": {
"Policies": [
{
"Role": "MANAGER",
"Autoaccept": false
},
{
"Role": "WORKER",
"Autoaccept": true
}
]
},
"Orchestration": {},
"Raft": {},
"Dispatcher": {},
@@ -3677,9 +3663,7 @@ Join an existing new Swarm
{
"ListenAddr": "0.0.0.0:4500",
"RemoteAddrs": ["node1:4500"],
"Secret": "",
"CACertHash": "",
"Manager": false
"JoinToken": "SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-7p73s1dx5in4tatdymyhg9hu2"
}
**Example response**:
@@ -3699,9 +3683,7 @@ JSON Parameters:
- **ListenAddr** – Listen address used for inter-manager communication if the node gets promoted to
manager, as well as determining the networking interface used for the VXLAN Tunnel Endpoint (VTEP).
- **RemoteAddr** – Address of any manager node already participating in the Swarm to join.
- **Secret** – Secret token for joining this Swarm.
- **CACertHash** – Optional hash of the root CA to avoid relying on trust on first use.
- **Manager** – Directly join as a manager (only for a Swarm configured to autoaccept managers).
- **JoinToken** – Secret token for joining this Swarm.
### Leave a Swarm
@@ -3742,18 +3724,6 @@ Update a Swarm
{
"Name": "default",
"AcceptancePolicy": {
"Policies": [
{
"Role": "WORKER",
"Autoaccept": false
},
{
"Role": "MANAGER",
"Autoaccept": false
}
]
},
"Orchestration": {
"TaskHistoryRetentionLimit": 10
},
@@ -3768,6 +3738,10 @@ Update a Swarm
},
"CAConfig": {
"NodeCertExpiry": 7776000000000000
},
"JoinTokens": {
"Worker": "SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-1awxwuwd3z9j1z3puu7rcgdbx",
"Manager": "SWMTKN-1-3pu6hszjas19xyp7ghgosyx9k8atbfcr8p2is99znpy26u2lkl-7p73s1dx5in4tatdymyhg9hu2"
}
}
@@ -3778,6 +3752,13 @@ Update a Swarm
Content-Length: 0
Content-Type: text/plain; charset=utf-8
**Query parameters**:
- **version** – The version number of the swarm object being updated. This is
required to avoid conflicting writes.
- **rotate_worker_token** - Set to `true` to rotate the worker join token.
- **rotate_manager_token** - Set to `true` to rotate the manager join token.
**Status codes**:
- **200** – no error
@@ -3786,11 +3767,6 @@ Update a Swarm
JSON Parameters:
- **Policies** – An array of acceptance policies.
- **Role** – The role that policy applies to (`MANAGER` or `WORKER`)
- **Autoaccept** – A boolean indicating whether nodes joining for that role should be
automatically accepted in the Swarm.
- **Secret** – An optional secret to provide for nodes to join the Swarm.
- **Orchestration** – Configuration settings for the orchestration aspects of the Swarm.
- **TaskHistoryRetentionLimit** – Maximum number of tasks history stored.
- **Raft** – Raft related configuration.
@@ -3812,6 +3788,9 @@ JSON Parameters:
- **URL** - URL where certificate signing requests should be sent.
- **Options** - An object with key/value pairs that are interpreted
as protocol-specific options for the external CA driver.
- **JoinTokens** - Tokens that can be used by other nodes to join the Swarm.
- **Worker** - Token to use for joining as a worker.
- **Manager** - Token to use for joining as a manager.
## 3.8 Services
@@ -4293,6 +4272,10 @@ Update the service `id`.
of: `"Ports": { "<port>/<tcp|udp>: {}" }`
- **VirtualIPs**
**Query parameters**:
- **version** – The version number of the service object being updated. This is
required to avoid conflicting writes.
**Status codes**: