Skip to content

KSA token for Kubelet image credential providers alpha#128372

Merged
k8s-ci-robot merged 6 commits intokubernetes:masterfrom
aramase:aramase/f/kep_4412_alpha_impl
Mar 12, 2025
Merged

KSA token for Kubelet image credential providers alpha#128372
k8s-ci-robot merged 6 commits intokubernetes:masterfrom
aramase:aramase/f/kep_4412_alpha_impl

Conversation

@aramase
Copy link
Copy Markdown
Member

@aramase aramase commented Oct 28, 2024 •
edited
Loading

Expand the on-disk kubelet credential provider configuration to allow an optional tokenAttribute field to be configured. When this field is not set, no KSA token will be sent to the plugin. When it is set, the Kubelet will provision a token with the given audience bound to the current pod and its service account. This KSA token along with required annotations on the KSA defined in configuration will be sent to the credential provider plugin via its standard input (along with the image information that is already sent today). The KSA annotations to be sent are configurable in the kubelet credential provider configuration.

/kind feature
/sig auth
/triage accepted
/milestone v1.32
/priority important-soon

Expanded the on-disk kubelet credential provider configuration to allow an optional `tokenAttribute` field to be configured. When it is set, the Kubelet will provision a token with the given audience bound to the current pod and its service account. This KSA token along with required annotations on the KSA defined in configuration will be sent to the credential provider plugin via its standard input (along with the image information that is already sent today). The KSA annotations to be sent are configurable in the kubelet credential provider configuration.

[KEP]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/4412-projected-service-account-tokens-for-kubelet-image-credential-providers/README.md

@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Oct 28, 2024

@aramase: You must be a member of the kubernetes/milestone-maintainers GitHub team to set the milestone. If you believe you should be able to issue the /milestone command, please contact your Milestone Maintainers Team and have them propose you as an additional delegate for this responsibility.

Details

In response to this:

TODO

/kind feature
/sig auth
/triage accepted
/milestone v1.32
/priority important-soon

TODO

[KEP]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/4412-projected-service-account-tokens-for-kubelet-image-credential-providers/README.md

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. sig/auth Categorizes an issue or PR as relevant to SIG Auth. triage/accepted Indicates an issue or PR is ready to be actively worked on. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. area/code-generation area/kubelet kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API labels Oct 28, 2024
@aramase aramase changed the title PSAT for Kubelet image credential providers alpha [WIP] PSAT for Kubelet image credential providers alpha Oct 28, 2024
@k8s-ci-robot k8s-ci-robot added sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/node Categorizes an issue or PR as relevant to SIG Node. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Oct 28, 2024
@k8s-ci-robot k8s-ci-robot requested review from enj and ffromani October 28, 2024 06:11
@aramase aramase mentioned this pull request Oct 28, 2024
Open
28 tasks
@k8s-ci-robot k8s-ci-robot added this to the v1.32 milestone Oct 28, 2024
@Vyom-Yadav
Copy link
Copy Markdown
Member

Vyom-Yadav commented Oct 30, 2024

Hey @aramase
I see this PR is being actively worked on and is tagged for the v1.32 release.

Just a reminder that the code freeze is starting 02:00 UTC Friday November 8th 2024 (about 1 week from now). Please make sure the PR has both lgtm and approved labels before the code freeze. Thanks!

@aramase aramase force-pushed the aramase/f/kep_4412_alpha_impl branch from 8236d95 to f6c268d Compare October 31, 2024 17:03
@k8s-ci-robot k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 31, 2024
@aramase aramase force-pushed the aramase/f/kep_4412_alpha_impl branch 5 times, most recently from 8ab96f0 to 8b87dd2 Compare November 1, 2024 06:41
@k8s-ci-robot k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Nov 1, 2024
@stlaz stlaz mentioned this pull request Feb 19, 2025
Closed
@stlaz
Copy link
Copy Markdown
Member

stlaz commented Feb 19, 2025

#128372 (comment) is still true (but github is hiding it), please consider this when investing further in testing private image pulling ... we really need an answer that doesn't depend on a fixed SaaS with permanently valid credentials. My suggestion is an in-cluster registry stood up by e2e with some tiny test image (pause?)

I created an issue for sig-node - #130271 to track this. As far as I can tell, at least one of the NodeConformance tests would be affected, hopefully this will be prioritized in a triage.

@stlaz
Copy link
Copy Markdown
Member

stlaz commented Feb 19, 2025 •
edited
Loading

/test pull-kubernetes-node-kubelet-credential-provider
/test pull-kubernetes-e2e-gce-kubelet-credential-provider
these test failures appear to refer to a featuregate that was removed from the suites in master?

@liggitt
Copy link
Copy Markdown
Member

liggitt commented Feb 19, 2025

/test pull-kubernetes-node-kubelet-credential-provider /test pull-kubernetes-e2e-gce-kubelet-credential-provider these test failures appear to refer to a featuregate that was removed from the suites in master?

just removed in #130162 and broke these test suites

@stlaz
Copy link
Copy Markdown
Member

stlaz commented Feb 20, 2025

Thanks for the info 👍 I see there were some fixes, I'll try to rerun again and perhaps see if more fixing is needed.

/test pull-kubernetes-node-kubelet-credential-provider
/test pull-kubernetes-e2e-gce-kubelet-credential-provider

@stlaz
Copy link
Copy Markdown
Member

stlaz commented Feb 20, 2025

I haven't dealt with k8s test infra before but kubernetes/test-infra#34374 should hopefully fix the permafails in these and couple other jobs.

@aramase
Copy link
Copy Markdown
Member Author

aramase commented Feb 24, 2025

/retest

@stlaz
Copy link
Copy Markdown
Member

stlaz commented Feb 24, 2025

kubernetes/kops#17270 merged, let's see if it got picked by the CI

/test pull-kubernetes-node-kubelet-credential-provider
/test pull-kubernetes-e2e-gce-kubelet-credential-provider

@Rajalakshmi-Girish
Copy link
Copy Markdown
Contributor

Rajalakshmi-Girish commented Feb 24, 2025 •
edited
Loading

Hello @aramase @stlaz
Thanks for actively working on this PR.

Friendly reminder that code freeze is starting at 02:00 UTC Friday 21st March 2025 (about 4 weeks from now), and while there is still time, we want to ensure that each PR has a chance to be merged on time.

Please make sure the PR has both lgtm and approved labels before the code freeze. Thanks!

@aramase
Copy link
Copy Markdown
Member Author

aramase commented Feb 24, 2025

/assign @mrunalp

@mrunalp could you review the PR?

cross posting my comment from slack (xref: https://kubernetes.slack.com/archives/C04UMAUC4UA/p1738772703138039?thread_ts=1738000047.329689&cid=C04UMAUC4UA)

@mrunalp
fyi, we have a LGTM from SIG Auth. Looking for review and approval for the node changes and after that we'll get the API bits reviewed with Jordan. LMK if you have any questions as you review the PR.

@aramase
Copy link
Copy Markdown
Member Author

aramase commented Feb 24, 2025

kubernetes/kops#17270 merged, let's see if it got picked by the CI

/test pull-kubernetes-node-kubelet-credential-provider /test pull-kubernetes-e2e-gce-kubelet-credential-provider

thanks @stlaz for opening kubernetes/test-infra#34374. CI failures in this PR (*-kubelet-credential-provider) should be resolved after that's merged.

@haircommander
Copy link
Copy Markdown
Contributor

haircommander commented Mar 3, 2025

this LGTM thanks @aramase

liggitt
liggitt reviewed Mar 7, 2025
View reviewed changes
Comment thread pkg/credentialprovider/plugin/config.go Outdated
liggitt
liggitt reviewed Mar 7, 2025
View reviewed changes
Comment thread pkg/credentialprovider/plugin/plugin.go Outdated
Comment thread pkg/credentialprovider/plugin/plugin.go
Comment thread pkg/kubelet/kuberuntime/kuberuntime_image.go Outdated
Comment thread pkg/credentialprovider/plugin/plugin.go Outdated
Comment thread pkg/credentialprovider/plugin/plugin.go Outdated
Comment thread pkg/credentialprovider/plugin/plugin.go Outdated
Comment thread pkg/credentialprovider/plugin/plugin.go Outdated
Comment thread pkg/credentialprovider/plugin/plugin.go Outdated
@aramase aramase mentioned this pull request Mar 11, 2025
Closed
3 tasks
liggitt
liggitt reviewed Mar 11, 2025
View reviewed changes
Comment thread plugin/pkg/auth/authorizer/node/node_authorizer.go Outdated
Comment thread pkg/credentialprovider/plugin/config.go
Comment thread pkg/kubelet/apis/config/types.go
Comment thread pkg/kubelet/apis/config/types.go Outdated
Comment thread pkg/credentialprovider/plugin/plugin.go Outdated
Comment thread pkg/credentialprovider/plugin/plugin.go Outdated
aramase added 4 commits March 11, 2025 19:24
@aramase
Add TokenAttributes field to v1 CredentialProvider
ba2eecc 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
@aramase
Add service account token and annotation to v1 CredentialProviderRequest
dd7b9f6 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
@aramase
Add KubeletServiceAccountTokenForCredentialProviders feature gate
d398de2 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
@aramase
node authorizer changes to allow read on svcaccounts
6defd8c 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
liggitt
liggitt reviewed Mar 12, 2025
View reviewed changes
Comment thread pkg/kubelet/kubelet.go Outdated
aramase added 2 commits March 11, 2025 20:36
@aramase
Update credential provider plugin to support using service account token
ad8666c 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
@aramase
add e2e test with the gcp-credential-provider test plugin
2090a01 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
@liggitt
Copy link
Copy Markdown
Member

liggitt commented Mar 12, 2025

/lgtm
/approve

@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Mar 12, 2025

LGTM label has been added.

DetailsGit tree hash: b74ac7e23d53f50e5e9760a3f46c85f912b366bc

@aramase aramase mentioned this pull request Mar 12, 2025
Merged
@stlaz stlaz mentioned this pull request Mar 14, 2025
Closed
@dereknola dereknola mentioned this pull request Apr 29, 2025
Merged
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Oct 5, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aramase, enj, hashim21223445, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BenTheElder BenTheElder BenTheElder left review comments

@ffromani ffromani Awaiting requested review from ffromani

@haircommander haircommander Awaiting requested review from haircommander

@SergeyKanzhelev SergeyKanzhelev Awaiting requested review from SergeyKanzhelev

@enj enj Awaiting requested review from enj

@mrunalp mrunalp Awaiting requested review from mrunalp

@liggitt liggitt Awaiting requested review from liggitt

+3 more reviewers

@stlaz stlaz stlaz left review comments

@mikebrow mikebrow mikebrow left review comments

@hashim21223445 hashim21223445 hashim21223445 approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@mrunalp mrunalp

@liggitt liggitt

@enj enj

@haircommander haircommander

@SergeyKanzhelev SergeyKanzhelev

Labels

api-review Categorizes an issue or PR as actively needing an API review. approved Indicates a PR has been approved by an approver from all required OWNERS files. area/code-generation area/kubelet area/test cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/node Categorizes an issue or PR as relevant to SIG Node. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.

Projects

API Reviews
Status: API review completed, 1.33
SIG Auth
Archived in project
SIG Node CI/Test Board
Archived in project
SIG Node: code and documentation PRs
Archived in project
[sig-release] Bug Triage
Archived in project

Milestone

v1.33

Development

Successfully merging this pull request may close these issues.