diff --git a/cmd/kube-apiserver/app/server.go b/cmd/kube-apiserver/app/server.go index c880c1a5d39..8eec41ba560 100644 --- a/cmd/kube-apiserver/app/server.go +++ b/cmd/kube-apiserver/app/server.go @@ -333,14 +333,14 @@ func CreateKubeAPIServerConfig( if s.ServiceAccountSigningKeyFile != "" || s.Authentication.ServiceAccounts.Issuer != "" || - len(s.Authentication.ServiceAccounts.APIAudiences) > 0 { + len(s.Authentication.APIAudiences) > 0 { if !utilfeature.DefaultFeatureGate.Enabled(features.TokenRequest) { lastErr = fmt.Errorf("the TokenRequest feature is not enabled but --service-account-signing-key-file, --service-account-issuer and/or --service-account-api-audiences flags were passed") return } if s.ServiceAccountSigningKeyFile == "" || s.Authentication.ServiceAccounts.Issuer == "" || - len(s.Authentication.ServiceAccounts.APIAudiences) == 0 || + len(s.Authentication.APIAudiences) == 0 || len(s.Authentication.ServiceAccounts.KeyFiles) == 0 { lastErr = fmt.Errorf("service-account-signing-key-file, service-account-issuer, service-account-api-audiences and service-account-key-file should be specified together") return @@ -365,7 +365,7 @@ func CreateKubeAPIServerConfig( lastErr = fmt.Errorf("failed to build token generator: %v", err) return } - apiAudiences = s.Authentication.ServiceAccounts.APIAudiences + apiAudiences = s.Authentication.APIAudiences maxExpiration = s.Authentication.ServiceAccounts.MaxExpiration } @@ -401,7 +401,7 @@ func CreateKubeAPIServerConfig( MasterCount: s.MasterCount, ServiceAccountIssuer: issuer, - ServiceAccountAPIAudiences: apiAudiences, + APIAudiences: apiAudiences, ServiceAccountMaxExpiration: maxExpiration, InternalInformers: sharedInformers, diff --git a/pkg/kubeapiserver/authenticator/config.go b/pkg/kubeapiserver/authenticator/config.go index e86228b7a43..a91136599c6 100644 --- a/pkg/kubeapiserver/authenticator/config.go +++ b/pkg/kubeapiserver/authenticator/config.go @@ -63,7 +63,7 @@ type AuthenticatorConfig struct { ServiceAccountKeyFiles []string ServiceAccountLookup bool ServiceAccountIssuer string - ServiceAccountAPIAudiences []string + APIAudiences []string WebhookTokenAuthnConfigFile string WebhookTokenAuthnCacheTTL time.Duration @@ -141,7 +141,7 @@ func (config AuthenticatorConfig) New() (authenticator.Request, *spec.SecurityDe tokenAuthenticators = append(tokenAuthenticators, serviceAccountAuth) } if utilfeature.DefaultFeatureGate.Enabled(features.TokenRequest) && config.ServiceAccountIssuer != "" { - serviceAccountAuth, err := newServiceAccountAuthenticator(config.ServiceAccountIssuer, config.ServiceAccountAPIAudiences, config.ServiceAccountKeyFiles, config.ServiceAccountTokenGetter) + serviceAccountAuth, err := newServiceAccountAuthenticator(config.ServiceAccountIssuer, config.APIAudiences, config.ServiceAccountKeyFiles, config.ServiceAccountTokenGetter) if err != nil { return nil, nil, err } diff --git a/pkg/kubeapiserver/options/authentication.go b/pkg/kubeapiserver/options/authentication.go index 846883940d7..c73764626ad 100644 --- a/pkg/kubeapiserver/options/authentication.go +++ b/pkg/kubeapiserver/options/authentication.go @@ -34,6 +34,7 @@ import ( ) type BuiltInAuthenticationOptions struct { + APIAudiences []string Anonymous *AnonymousAuthenticationOptions BootstrapToken *BootstrapTokenAuthenticationOptions ClientCert *genericoptions.ClientCertAuthenticationOptions @@ -76,7 +77,6 @@ type ServiceAccountAuthenticationOptions struct { KeyFiles []string Lookup bool Issuer string - APIAudiences []string MaxExpiration time.Duration } @@ -174,6 +174,10 @@ func (s *BuiltInAuthenticationOptions) Validate() []error { } func (s *BuiltInAuthenticationOptions) AddFlags(fs *pflag.FlagSet) { + fs.StringSliceVar(&s.APIAudiences, "api-audiences", s.APIAudiences, ""+ + "Identifiers of the API. The service account token authenticator will validate that "+ + "tokens used against the API are bound to at least one of these audiences.") + if s.Anonymous != nil { fs.BoolVar(&s.Anonymous.Allow, "anonymous-auth", s.Anonymous.Allow, ""+ "Enables anonymous requests to the secure port of the API server. "+ @@ -258,9 +262,11 @@ func (s *BuiltInAuthenticationOptions) AddFlags(fs *pflag.FlagSet) { "Identifier of the service account token issuer. The issuer will assert this identifier "+ "in \"iss\" claim of issued tokens. This value is a string or URI.") - fs.StringSliceVar(&s.ServiceAccounts.APIAudiences, "service-account-api-audiences", s.ServiceAccounts.APIAudiences, ""+ + // Deprecated in 1.13 + fs.StringSliceVar(&s.APIAudiences, "service-account-api-audiences", s.APIAudiences, ""+ "Identifiers of the API. The service account token authenticator will validate that "+ "tokens used against the API are bound to at least one of these audiences.") + fs.MarkDeprecated("service-account-api-audiences", "Use --api-audiences") fs.DurationVar(&s.ServiceAccounts.MaxExpiration, "service-account-max-token-expiration", s.ServiceAccounts.MaxExpiration, ""+ "The maximum validity duration of a token created by the service account token issuer. If an otherwise valid "+ @@ -325,7 +331,7 @@ func (s *BuiltInAuthenticationOptions) ToAuthenticationConfig() kubeauthenticato ret.ServiceAccountKeyFiles = s.ServiceAccounts.KeyFiles ret.ServiceAccountLookup = s.ServiceAccounts.Lookup ret.ServiceAccountIssuer = s.ServiceAccounts.Issuer - ret.ServiceAccountAPIAudiences = s.ServiceAccounts.APIAudiences + ret.APIAudiences = s.APIAudiences } if s.TokenFile != nil { @@ -367,7 +373,7 @@ func (o *BuiltInAuthenticationOptions) ApplyTo(c *genericapiserver.Config) error } c.Authentication.SupportsBasicAuth = o.PasswordFile != nil && len(o.PasswordFile.BasicAuthFile) > 0 - c.Authentication.APIAudiences = o.ServiceAccounts.APIAudiences + c.Authentication.APIAudiences = o.APIAudiences return nil } diff --git a/pkg/master/master.go b/pkg/master/master.go index bda9c0bcb51..5547b161ffe 100644 --- a/pkg/master/master.go +++ b/pkg/master/master.go @@ -169,9 +169,10 @@ type ExtraConfig struct { EndpointReconcilerType reconcilers.Type ServiceAccountIssuer serviceaccount.TokenGenerator - ServiceAccountAPIAudiences []string ServiceAccountMaxExpiration time.Duration + APIAudiences []string + VersionedInformers informers.SharedInformerFactory InternalInformers internalinformers.SharedInformerFactory } @@ -334,8 +335,8 @@ func (c completedConfig) New(delegationTarget genericapiserver.DelegationTarget) ServiceNodePortRange: c.ExtraConfig.ServiceNodePortRange, LoopbackClientConfig: c.GenericConfig.LoopbackClientConfig, ServiceAccountIssuer: c.ExtraConfig.ServiceAccountIssuer, - ServiceAccountAPIAudiences: c.ExtraConfig.ServiceAccountAPIAudiences, ServiceAccountMaxExpiration: c.ExtraConfig.ServiceAccountMaxExpiration, + APIAudiences: c.ExtraConfig.APIAudiences, } m.InstallLegacyAPI(&c, c.GenericConfig.RESTOptionsGetter, legacyRESTStorageProvider) } diff --git a/pkg/registry/core/rest/storage_core.go b/pkg/registry/core/rest/storage_core.go index 4208f940a89..d7a6ec8bdbe 100644 --- a/pkg/registry/core/rest/storage_core.go +++ b/pkg/registry/core/rest/storage_core.go @@ -80,9 +80,10 @@ type LegacyRESTStorageProvider struct { ServiceNodePortRange utilnet.PortRange ServiceAccountIssuer serviceaccount.TokenGenerator - ServiceAccountAPIAudiences []string ServiceAccountMaxExpiration time.Duration + APIAudiences []string + LoopbackClientConfig *restclient.Config } @@ -142,7 +143,7 @@ func (c LegacyRESTStorageProvider) NewLegacyRESTStorage(restOptionsGetter generi var serviceAccountStorage *serviceaccountstore.REST if c.ServiceAccountIssuer != nil && utilfeature.DefaultFeatureGate.Enabled(features.TokenRequest) { - serviceAccountStorage = serviceaccountstore.NewREST(restOptionsGetter, c.ServiceAccountIssuer, c.ServiceAccountAPIAudiences, c.ServiceAccountMaxExpiration, podStorage.Pod.Store, secretStorage.Store) + serviceAccountStorage = serviceaccountstore.NewREST(restOptionsGetter, c.ServiceAccountIssuer, c.APIAudiences, c.ServiceAccountMaxExpiration, podStorage.Pod.Store, secretStorage.Store) } else { serviceAccountStorage = serviceaccountstore.NewREST(restOptionsGetter, nil, nil, 0, nil, nil) } diff --git a/test/integration/auth/svcaccttoken_test.go b/test/integration/auth/svcaccttoken_test.go index 4fa84be6979..6409c475bed 100644 --- a/test/integration/auth/svcaccttoken_test.go +++ b/test/integration/auth/svcaccttoken_test.go @@ -27,6 +27,7 @@ import ( "time" "gopkg.in/square/go-jose.v2/jwt" + authenticationv1 "k8s.io/api/authentication/v1" v1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -87,8 +88,8 @@ func TestServiceAccountTokenCreate(t *testing.T) { t.Fatalf("err: %v", err) } masterConfig.ExtraConfig.ServiceAccountIssuer = tokenGenerator - masterConfig.ExtraConfig.ServiceAccountAPIAudiences = aud masterConfig.ExtraConfig.ServiceAccountMaxExpiration = maxExpirationDuration + masterConfig.ExtraConfig.APIAudiences = aud master, _, closeFn := framework.RunAMaster(masterConfig) defer closeFn()