CSR Duration KEP

[enj]

Signed-off-by: Monis Khan [email protected]

/sig auth
/assign @liggitt @smarterclayton @mikedanese

[enj]

/assign @deads2k

[deads2k]

The design and the PRR both lgtm. The exception request was approved.

/lgtm
/approve
/hold

placing a hold to allow additional reviewers this week.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, enj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• keps/prod-readiness/OWNERS [deads2k]
• keps/sig-auth/OWNERS [deads2k,enj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[liggitt]

lgtm as well

[liggitt]

non-blocking for merge of this doc, but can you confirm with them this addresses their use case ~now, not in a release?

[JoshVanL]

This looks good from the cert-manager side!

We currently use an annotation to allow clients to set requested duration. We can fallback to checking this annotation if this field is nil for users running older versions of kube.

Once pre 1.22 Kubernetes versions are no longer supported by cert-manager, we can remove the annotation completely.

/cc @munnerz

[mattmoyer]

This looks good for the Pinniped use case as well. Our planned usage is for a credential exchange API just like the second user story:

1. External user authenticates to a trusted service (using some custom application-specific credential).
2. Trusted service creates a CSR with a short spec.expirationSeconds (probably the 10 minute minimum).
3. Trusted service approves its own CSR and relies on a default signer to sign it.
4. Trusted service retrieves the signed certificate and returns it to the authenticated external user.

We would quickly add support for new flow but keep some fallback code that uses a custom signer until we no longer support current Kubernetes versions. We can probe for this feature dynamically and select the modern or fallback implementation appropriately.

[smarterclayton]

Sorry for the delay, I thought I dropped a "this looks good and Jordan and David hit all of my comments already", but it looks like I never pressed comment.

This looks good to me, no further comments above what was already landed.

[supriya-premkumar]

Hi @enj 👋🏽. Supriya here, 1.22 Enhancements Shadow.
For the enhancement to be included in the 1.22 milestone, it must meet the following criteria:

• Complete all the Beta release PRR questionnaire(upgrade/rollback test)
• The PR must be approved and merged by EOD June 25, 2021

Thank you!

[enj]

/hold cancel