Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

KEP-2799: update for LegacyServiceAccountTokenTracking beta #3696

Merged
merged 1 commit into from
Jan 5, 2023
Merged

KEP-2799: update for LegacyServiceAccountTokenTracking beta #3696

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 7 additions & 10 deletions keps/sig-auth/2799-reduction-of-secret-based-service-account-token/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,9 +142,8 @@ indicates if tracking is enabled in the cluster. It is similar to the existing

- the controller creates/updates a configmap in `kube-system` namespace that
stores the current date as `tracked-since`.
- when a legacy token is used, issue a warning, annotate/update the
`last-used` on the secret at date granularity, and record in a metric.
optionally, add a label `in-use` for fast query.
- when a legacy token is used, issue a warning, update the label `last-used`
on the secret at date granularity, and record in a metric.

- When LegacyServiceAccountTokenTracking is disabled in any apiserver,
- the controller ensures the configmap in `kube-system` namespace is deleted
Expand Down Expand Up @@ -235,10 +234,9 @@ legacy tokens for security practices.

#### Alpha -> Beta Graduation

- [ ] In use by multiple distributions
- [ ] Approved by PRR and scalability
- [ ] Any known bugs fixed
- [ ] Tests passing
- [x] Approved by PRR and scalability
- [x] Any known bugs fixed
- [x] Tests passing

#### LegacyServiceAccountTokenCleanUp

Expand All @@ -255,7 +253,6 @@ legacy tokens for security practices.

#### Alpha -> Beta Graduation

- [ ] In use by multiple distributions
- [ ] Approved by PRR and scalability
- [ ] Any known bugs fixed
- [ ] Tests passing
Expand Down Expand Up @@ -286,7 +283,7 @@ The only touches control plane, so version skew strategy is not applicable.
###### Does enabling the feature change any default behavior?

- LegacyServiceAccountTokenNoAutoGeneration: no legacy tokens are auto-generated.
- LegacyServiceAccountTokenTracking: legacy tokens would have new annotation and a configmap would be created in kube-system.
- LegacyServiceAccountTokenTracking: legacy tokens would have new label and a configmap would be created in kube-system.
- LegacyServiceAccountTokenCleanUp: unused auto-generated legacy tokens will be removed.

###### Can the feature be disabled once it has been enabled (i.e. can we roll back the enablement)?
Expand All @@ -299,7 +296,7 @@ yes for all feature gates.
before the reenablement, Token Controller would create tokens for
serviceaccounts while the feature was off.
- LegacyServiceAccountTokenTracking: during this sequence of operations,
only the annotation `last-used` is persisted, but there is no impact on the
only the label `last-used` is persisted, but there is no impact on the
functionality of this feature.
- LegacyServiceAccountTokenCleanUp: the same as enable the feature.

Expand Down
6 changes: 3 additions & 3 deletions keps/sig-auth/2799-reduction-of-secret-based-service-account-token/kep.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,10 @@ reviewers:
approvers:
- "@liggitt"
stage: beta
latest-milestone: "v1.26"
latest-milestone: "v1.27"
milestone:
alpha: "v1.24"
beta: "v1.25"
beta: "v1.24"
stable: "v1.26"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might be too late to raise but I am confused by the milestone labels here. Is this targeting beta in 1.27? If so, it seems not matching here. :)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rollout of this KEP has three pieces, the first of which graduated to stable in 1.26 (LegacyServiceAccountTokenNoAutoGeneration)

LegacyServiceAccountTokenTracking graduates to beta in 1.27

the KEP template doesn't have a way to track progressive rollout of successive pieces

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the clarification. In this case I guess the PRR section could be considered as approved earlier. Thanks

feature-gates:
- name: LegacyServiceAccountTokenNoAutoGeneration
components:
Expand Down