Update CSR KEP with durationHint field details #2759
Conversation
Signed-off-by: Monis Khan <[email protected]>
k8s-ci-robot
added
the
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: enj The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
sig/auth
| // durationHint is a hint to the signer in regards to when the issued certificate should expire. | ||
| // The signer may or may not honor this field. The well-known kubernetes signers will honor this field | ||
| // as long as the requested duration is not later than the maximum duration they will honor. | ||
| DurationHint *metav1.Duration |
There was a problem hiding this comment.
per https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#units, include unit in the field name and make it an int32 (we don't use time.Duration / metav1.Duration in REST APIs since it requires go parsing to decode)
| @@ -323,6 +328,11 @@ type CertificateSigningRequestSpec struct { | |||
| // You can select on this field using `.spec.signerName`. | |||
| SignerName string | |||
|
|
|||
| // durationHint is a hint to the signer in regards to when the issued certificate should expire. | |||
| // The signer may or may not honor this field. The well-known kubernetes signers will honor this field | |||
| // as long as the requested duration is not later than the maximum duration they will honor. | |||
There was a problem hiding this comment.
I'd also expect a minimum duration, similar to the minimum token lifetime we grant. Describe the behavior of the build-in signers when the hint is less than the min or greater than the max (clip to the min/max, or revert to the default)?
There was a problem hiding this comment.
also, since this is an addition, we can't back-fill the hint honoring into the kubernetes signer definitions (since implementations before this field exists won't honor it), but we can say the in-tree implementations of the kubernetes signers will honor it from version X forward)
|
@enj as per a conversation in sig-release: https://kubernetes.slack.com/archives/C2C40FMNF/p1621950967079800 This PR is attempting to update an already GA/implemented KEP. For ref, the underlying issue is closed: #1513 This new change also would need to go through the stages of alpha, beta, GA therefore please open a new KEP and tracking issue. As a reminder the Enhancements Freeze deadline has already passed (May 13th), so you will need to submit an exception request for this new KEP if you want it to be included in 1.22. Thanks! /hold |
k8s-ci-robot
added
the
do-not-merge/hold
|
Closing in favor of #2788 |
Signed-off-by: Monis Khan [email protected]
xref kubernetes/kubernetes#99494
xref kubernetes/website#28070
/assign @mikedanese @liggitt