github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-01 07:47:56 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #125473 from liggitt/serviceaccount-cleanup

Browse Source 
Clean up service account options completion and fallback
This commit is contained in:
Kubernetes Prow Robot 2024-06-21 17:50:55 -07:00 committed by GitHub
commit 7c780186d7
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 23 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
pkg/controlplane/apiserver/options/options.go
View File

@ -37,7 +37,6 @@ import (
netutil "k8s.io/utils/net" netutil "k8s.io/utils/net"
_ "k8s.io/kubernetes/pkg/features" _ "k8s.io/kubernetes/pkg/features"
kubeauthenticator "k8s.io/kubernetes/pkg/kubeapiserver/authenticator"
kubeoptions "k8s.io/kubernetes/pkg/kubeapiserver/options" kubeoptions "k8s.io/kubernetes/pkg/kubeapiserver/options"
"k8s.io/kubernetes/pkg/serviceaccount" "k8s.io/kubernetes/pkg/serviceaccount"
) )
@ -230,49 +229,36 @@ func (o *Options) Complete(alternateDNS []string, alternateIPs []net.IP) (Comple
// adjust authentication for completed authorization // adjust authentication for completed authorization
completed.Authentication.ApplyAuthorization(completed.Authorization) completed.Authentication.ApplyAuthorization(completed.Authorization)
// Use (ServiceAccountSigningKeyFile != "") as a proxy to the user enabling // verify and adjust ServiceAccountTokenMaxExpiration
// TokenRequest functionality. This defaulting was convenient, but messed up if completed.Authentication.ServiceAccounts.MaxExpiration != 0 {
// a lot of people when they rotated their serving cert with no idea it was lowBound := time.Hour
// connected to their service account keys. We are taking this opportunity to upBound := time.Duration(1<<32) * time.Second
// remove this problematic defaulting. if completed.Authentication.ServiceAccounts.MaxExpiration < lowBound ||
if completed.ServiceAccountSigningKeyFile == "" { completed.Authentication.ServiceAccounts.MaxExpiration > upBound {
// Default to the private server key for service account token signing return CompletedOptions{}, fmt.Errorf("the service-account-max-token-expiration must be between 1 hour and 2^32 seconds")
if len(completed.Authentication.ServiceAccounts.KeyFiles) == 0 && completed.SecureServing.ServerCert.CertKey.KeyFile != "" { }
if kubeauthenticator.IsValidServiceAccountKeyFile(completed.SecureServing.ServerCert.CertKey.KeyFile) { if completed.Authentication.ServiceAccounts.ExtendExpiration {
completed.Authentication.ServiceAccounts.KeyFiles = []string{completed.SecureServing.ServerCert.CertKey.KeyFile} if completed.Authentication.ServiceAccounts.MaxExpiration < serviceaccount.WarnOnlyBoundTokenExpirationSeconds*time.Second {
} else { klog.Warningf("service-account-extend-token-expiration is true, in order to correctly trigger safe transition logic, service-account-max-token-expiration must be set longer than %d seconds (currently %s)", serviceaccount.WarnOnlyBoundTokenExpirationSeconds, completed.Authentication.ServiceAccounts.MaxExpiration)
klog.Warning("No TLS key provided, service account token authentication disabled") }
if completed.Authentication.ServiceAccounts.MaxExpiration < serviceaccount.ExpirationExtensionSeconds*time.Second {
klog.Warningf("service-account-extend-token-expiration is true, enabling tokens valid up to %d seconds, which is longer than service-account-max-token-expiration set to %s seconds", serviceaccount.ExpirationExtensionSeconds, completed.Authentication.ServiceAccounts.MaxExpiration)
} }
} }
} }
completed.ServiceAccountTokenMaxExpiration = completed.Authentication.ServiceAccounts.MaxExpiration
if completed.ServiceAccountSigningKeyFile != "" && len(completed.Authentication.ServiceAccounts.Issuers) != 0 && completed.Authentication.ServiceAccounts.Issuers[0] != "" { if len(completed.Authentication.ServiceAccounts.Issuers) != 0 && completed.Authentication.ServiceAccounts.Issuers[0] != "" {
sk, err := keyutil.PrivateKeyFromFile(completed.ServiceAccountSigningKeyFile) if completed.ServiceAccountSigningKeyFile != "" {
if err != nil { sk, err := keyutil.PrivateKeyFromFile(completed.ServiceAccountSigningKeyFile)
return CompletedOptions{}, fmt.Errorf("failed to parse service-account-issuer-key-file: %v", err) if err != nil {
} return CompletedOptions{}, fmt.Errorf("failed to parse service-account-issuer-key-file: %w", err)
if completed.Authentication.ServiceAccounts.MaxExpiration != 0 {
lowBound := time.Hour
upBound := time.Duration(1<<32) * time.Second
if completed.Authentication.ServiceAccounts.MaxExpiration < lowBound ||
completed.Authentication.ServiceAccounts.MaxExpiration > upBound {
return CompletedOptions{}, fmt.Errorf("the service-account-max-token-expiration must be between 1 hour and 2^32 seconds")
} }
if completed.Authentication.ServiceAccounts.ExtendExpiration { completed.ServiceAccountIssuer, err = serviceaccount.JWTTokenGenerator(completed.Authentication.ServiceAccounts.Issuers[0], sk)
if completed.Authentication.ServiceAccounts.MaxExpiration < serviceaccount.WarnOnlyBoundTokenExpirationSeconds*time.Second { if err != nil {
klog.Warningf("service-account-extend-token-expiration is true, in order to correctly trigger safe transition logic, service-account-max-token-expiration must be set longer than %d seconds (currently %s)", serviceaccount.WarnOnlyBoundTokenExpirationSeconds, completed.Authentication.ServiceAccounts.MaxExpiration) return CompletedOptions{}, fmt.Errorf("failed to build token generator: %w", err)
}
if completed.Authentication.ServiceAccounts.MaxExpiration < serviceaccount.ExpirationExtensionSeconds*time.Second {
klog.Warningf("service-account-extend-token-expiration is true, enabling tokens valid up to %d seconds, which is longer than service-account-max-token-expiration set to %s seconds", serviceaccount.ExpirationExtensionSeconds, completed.Authentication.ServiceAccounts.MaxExpiration)
}
} }
} }
completed.ServiceAccountIssuer, err = serviceaccount.JWTTokenGenerator(completed.Authentication.ServiceAccounts.Issuers[0], sk)
if err != nil {
return CompletedOptions{}, fmt.Errorf("failed to build token generator: %v", err)
}
completed.ServiceAccountTokenMaxExpiration = completed.Authentication.ServiceAccounts.MaxExpiration
} }
for key, value := range completed.APIEnablement.RuntimeConfig { for key, value := range completed.APIEnablement.RuntimeConfig {