update KEP 740 #4852
update KEP 740 #4852
Conversation
k8s-ci-robot
added
cncf-cla: yes
|
Welcome @HarshalNeelkamal! |
k8s-ci-robot
added
the
needs-ok-to-test
|
Hi @HarshalNeelkamal. Thanks for your PR. I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
the
size/L
|
/ok-to-test |
k8s-ci-robot
added
ok-to-test
k8s-ci-robot
added
size/XL
|
|
||
| No. | ||
|
|
||
| ### Monitoring Requirements |
There was a problem hiding this comment.
Need to fill out this section. Maybe we would want some part of this in the kube audit logs?
There was a problem hiding this comment.
Waiting until beta to release to fill it out. Let me know if you think we need it sooner?
There was a problem hiding this comment.
have filled the parts that I could. Would add the remaining after starting implementation. Might need benchmarking on SLIs.
|
#740 (comment) |
HarshalNeelkamal
requested review from
soltysh,
micahhausler,
aramase and
liggitt
| - Create a cluster with ExternalJWTSigner configured. | ||
| - Request a token for a service account principal. | ||
| - Use a token as bearer for making requests to kube-apiserver and ensure it succeeds. |
There was a problem hiding this comment.
no change needed, just FYI, but integration tests will be way easier to test... to configure this for an e2e, we'd have to set up a completely new job with the cluster configured this way
See the KMS e2e tests:
- Their own job config: https://github.com/kubernetes/test-infra/blob/master/config/jobs/kubernetes/sig-auth/sig-auth-encryption-at-rest.yaml
- Their own e2e setup: https://github.com/kubernetes/kubernetes/blob/master/test/e2e/testing-manifests/auth/encrypt/run-e2e.sh
- Their own buildable binary mock provider: https://github.com/kubernetes/kubernetes/tree/master/staging/src/k8s.io/kms/internal/plugins/_mock
There was a problem hiding this comment.
I would still expect an e2e like the encrypt-all-kind one to exercise all the wiring, but I would expect ~95% of the testing to be done via unit/integration tests.
|
once you do the final sweep, also run |
|
|
||
| The Feature would not be used by workload directly but will be used by kube-apiserver. | ||
|
|
||
| The usage should be visible to the operator using Audit logs. |
HarshalNeelkamal
force-pushed
the
external-sa-signing
branch
from
f3eeecd
to
8284baa
Compare
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: enj, HarshalNeelkamal, soltysh The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
One-line PR description: Update KEP for External ServiceAccount JWT signing
Issue link: API for external signing of Service Account tokens #740
Other comments:
provisionalin KEP-740: fix incorrect status #3653 due to being stale for over 3 years.