Skip to content

KEP-740: promote ExternalJWTSigner feature to beta #131300

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jun 10, 2025
Merged

KEP-740: promote ExternalJWTSigner feature to beta #131300

merged 1 commit into from
Jun 10, 2025

Conversation

HarshalNeelkamal
Copy link
Contributor

@HarshalNeelkamal HarshalNeelkamal commented Apr 14, 2025 •
edited by liggitt
Loading

What type of PR is this?

/kind feature

What this PR does / why we need it:

  1. Promotes API for external signing of Service Account tokens enhancements#740 to Beta
  2. Introduces v1 version of externaljwt api proto. There are no changes from v1alpha1 to v1.

Special notes for your reviewer:

from kubernetes/enhancements#740, the Graduation criteria to Beta is:

  • 1. E2E tests are completed. (Were completed in Alpha version itself)

  • 2. We have at least one ExternalSigner implementation working with this change. (Condition satisfied)

       -  GKE has integrated with and rigorously tested externaljwt signer.
   -  It is able to handle usual cluster operations with no impact on performance.
   -  There were no changes/fixes required.
   -  scalability, of-course, depends on external system that is being integrated.

  • 3. Decide whether to externalize legacy token controller code in a staging repo. Check Support for Legacy Tokens for details.

Note: There is already suggested alternatives for externalize legacy token. Would appreciate if ask for staging support is only after trying the alternatives first.

Does this PR introduce a user-facing change?


kube-apiserver: Promoted `ExternalServiceAccountTokenSigner` feature to beta, which enables external signing of service account tokens and fetching of public verifying keys, by enabling the beta `ExternalServiceAccountTokenSigner` feature gate and specifying `--service-account-signing-endpoint`. The flag value can either be the location of a Unix domain socket on a filesystem, or be prefixed with an @ symbol and name a Unix domain socket in the abstract socket namespace.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:


- [KEP]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/740-service-account-external-signing

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. kind/feature Categorizes issue or PR as related to a new feature. labels Apr 14, 2025
@k8s-ci-robot
Copy link
Contributor

Please note that we're already in Test Freeze for the release-1.33 branch. This means every merged PR will be automatically fast-forwarded via the periodic ci-fast-forward job to the release branch of the upcoming v1.33.0 release.

Fast forwards are scheduled to happen every 6 hours, whereas the most recent run was: Mon Apr 14 19:31:33 UTC 2025.

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 14, 2025
@k8s-ci-robot
Copy link
Contributor

Hi @HarshalNeelkamal. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added the needs-priority Indicates a PR lacks a `priority/foo` label and requires one. label Apr 14, 2025
@HarshalNeelkamal
Copy link
Contributor Author

/cc @liggitt

@k8s-ci-robot k8s-ci-robot requested a review from liggitt April 15, 2025 00:00
@k8s-ci-robot k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. area/test sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/testing Categorizes an issue or PR as relevant to SIG Testing. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Apr 15, 2025
@github-project-automation github-project-automation bot moved this to Needs Triage in SIG Auth Apr 15, 2025
liggitt
liggitt reviewed Apr 17, 2025
View reviewed changes
liggitt
liggitt reviewed Apr 17, 2025
View reviewed changes
@liggitt
Copy link
Member

liggitt commented Apr 17, 2025

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 17, 2025
@liggitt liggitt added this to the v1.34 milestone Apr 17, 2025
@HarshalNeelkamal
Copy link
Contributor Author

/retest

@HarshalNeelkamal HarshalNeelkamal requested a review from liggitt May 15, 2025 21:27
@liggitt
Copy link
Member

liggitt commented May 20, 2025

lgtm, beta promotion PR for the KEP open at kubernetes/enhancements#5323

@Rajalakshmi-Girish Rajalakshmi-Girish moved this to Pending inclusion in [sig-release] Bug Triage May 23, 2025
This was referenced May 27, 2025
Closed
Closed
dims
dims reviewed May 28, 2025
View reviewed changes
haoranleo
haoranleo reviewed May 28, 2025
View reviewed changes
@HarshalNeelkamal HarshalNeelkamal requested a review from liggitt June 3, 2025 23:38
@liggitt
Copy link
Member

liggitt commented Jun 10, 2025

lgtm, can squash down commits, will tag for merge after kubernetes/enhancements#5323 merges

@yue9944882
Copy link
Member

/cc @haoranleo

@k8s-ci-robot k8s-ci-robot requested a review from haoranleo June 10, 2025 19:21
@liggitt
Copy link
Member

liggitt commented Jun 10, 2025

/retest

@liggitt
Copy link
Member

liggitt commented Jun 10, 2025

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 10, 2025
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: be5381a08f350cd0356114d78ba74d8c63cfdbe3

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: HarshalNeelkamal, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 10, 2025
@HarshalNeelkamal
Copy link
Contributor Author

/retest

@k8s-ci-robot k8s-ci-robot merged commit b0b28b5 into kubernetes:master Jun 10, 2025
14 of 16 checks passed
@github-project-automation github-project-automation bot moved this from In Review to Closed / Done in SIG Auth Jun 10, 2025
@github-project-automation github-project-automation bot moved this from Pending inclusion to Done in [sig-release] Bug Triage Jun 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dims dims dims left review comments

@liggitt liggitt liggitt left review comments

@dashpole dashpole Awaiting requested review from dashpole

@thockin thockin Awaiting requested review from thockin

@dchen1107 dchen1107 Awaiting requested review from dchen1107

@deads2k deads2k Awaiting requested review from deads2k

@haoranleo haoranleo Awaiting requested review from haoranleo

Assignees

@liggitt liggitt

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/test cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
SIG Auth
Status: Closed / Done
[sig-release] Bug Triage
Status: Done
Milestone
v1.34
Development

Successfully merging this pull request may close these issues.
9 participants
@HarshalNeelkamal @k8s-ci-robot @liggitt @yongruilin @aaron-prindle @aramase @yue9944882 @dims @haoranleo