token-server: Make machine token minter config apply to subdomains.

tokenserver/api/admin/v1/config.proto

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 syntax = "proto3";
 
 package tokenserver.admin;
 
 
 // TokenServerConfig is read from tokenserver.cfg in luci-config.
 message TokenServerConfig {
   // List of CAs we trust.
   repeated CertificateAuthorityConfig certificate_authority = 1;
 }
 
 
 // CertificateAuthorityConfig defines a single CA we trust.
 //
 // Such CA issues certificates for nodes that use The Token Service. Each node
 // has a private key and certificate with Common Name set to the FQDN of this
 // node, e.g. "CN=slave43-c1.c.chromecompute.google.com.internal".
 //
 // The Token Server uses this CN to derive an identity string for a machine. It
 // splits FQDN into a hostname ("slave43-c1") and a domain name
 // ("c.chromecompute.google.com.internal"), searches for a domain name in
 // "known_domains" set, and, if it is present, uses parameters described there
-// for generating a token with machine_id <hostname>@<token-server-url>.

[Vadim Sh., 2017/06/21 00:09:02]

<hostname>@<token-server-url> format was actually never used. And thus '@' is
not a magical symbol

+// for generating a token that contains machine's FQDN and certificate serial
+// number (among other things, see MachineTokenBody in machine_token.proto).
 message CertificateAuthorityConfig {
   int64  unique_id = 6; // ID of this CA, will be embedded into tokens.
   string cn = 1;        // CA Common Name, must match Subject CN in the cert
   string cert_path = 2; // path to the root certificate file in luci-config
   string crl_url = 3;   // where to fetch CRL from
   bool   use_oauth = 4; // true to send Authorization header when fetching CRL
 
   // KnownDomains describes parameters to use for each particular domain.
   repeated DomainConfig known_domains = 5;
 }
 
 
 // DomainConfig is used inside CertificateAuthorityConfig.
 message DomainConfig {
   reserved 2, 3, 4, 6; // deleted fields, do not reuse.
 
   // Domain is domain names of hosts this config applies to.
+  //
+  // Machines that reside in a subdomain of given domain are also considered
+  // part of it, e.g. both FQDNs "host.example.com" and "host.abc.example.com"
+  // match domain "example.com".
   repeated string domain = 1;
 
   // MachineTokenLifetime is how long generated machine tokens live, in seconds.
   //
   // If 0, machine tokens are not allowed.
   int64 machine_token_lifetime = 5;
 }
 
 
 // DelegationPermissions is read from delegation.cfg in luci-config.
@@ skipping 91 matching lines @@
   //  * A service identity string ("service:<id>").
   //  * A special token "*" that mean "any LUCI service should accept the
   //    token".
   repeated string target_service = 6;
 
   // Maximum allowed validity duration (sec) of minted delegation tokens.
   //
   // Default is 12 hours.
   int64 max_validity_duration = 7;
 }