Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add structured authentication configuration #11841

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

add structured authentication configuration #11841

wants to merge 2 commits into from
+151 −6

Conversation

Payback159
Copy link
Contributor

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespaces from that line:

/kind api-change
/kind bug
/kind cleanup
/kind design
/kind documentation
/kind failing-test

/kind feature

/kind flake

What this PR does / why we need it:

#11834

Which issue(s) this PR fixes:

Fixes #11834

Special notes for your reviewer:

I have tried to take #11822 into account.
I have one more question:

From my point of view, setting the default value for kube_oidc_username_prefix and kube_oidc_groups_prefix to oidc: would be the safer and more future-proof way. As this prevents any collision per default with other users.

This would mean a breaking change today, as Kubespray users who have not set the prefix would now receive a prefix and thus break the (cluster)role bindings if the user did not subsequently prefix all users and groups with oidc:.

The alternative is to set the prefix to an empty string, in which case there would be no breaking change and the user is responsible for the configuration.

Both are supported by “Structured Authentication Configuration” only not setting the prefix is unsupported. (Which to my knowledge was supported by kubeadm with the currently used --oidc flags.)

Does this PR introduce a user-facing change?:

Add the possibility to use "Structured Authentication Configuration" for Kubernetes API OIDC

@k8s-ci-robot k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. release-note Denotes a PR that will be considered when it comes time to generate release notes. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Dec 30, 2024
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Payback159
Once this PR has been reviewed and has the lgtm label, please assign vannten for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Dec 30, 2024
@k8s-ci-robot
Copy link
Contributor

Hi @Payback159. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added do-not-merge/contains-merge-commits and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Dec 30, 2024
@VannTen
Copy link
Contributor

VannTen commented Dec 30, 2024 via email

@yankay
Copy link
Member

yankay commented Dec 31, 2024

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 31, 2024
@Payback159
Move configuration from kube_oidc to own top-level configuration. Exp…
8296a06 
…and the entire Struct-Auth configuration and only create the configurations if the feature gate is activated.
@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 2, 2025
@Payback159
Copy link
Contributor Author

Payback159 commented Jan 2, 2025 •
edited
Loading

Thanks. I have pushed another implementation based on your feedback.

The following has changed:

  • removed configuration under kube_oidc
  • the currently known version of the StructAuth configuration is templatized.
  • The configuration is now rolled out based on the FeatureGate or not (and not based on the kube_version)

What is still missing in some areas of the jwt configuration would be to check whether the claim is configured directly because, as I understand it, the fields claimMappings.[username|groups].claim and claimMappings.[username|groups].expression are mutually exclusive.

What do you think?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cyclinder cyclinder Awaiting requested review from cyclinder

@VannTen VannTen Awaiting requested review from VannTen

Assignees
No one assigned
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Structured Authentication Configuration
4 participants
@Payback159 @k8s-ci-robot @VannTen @yankay