github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-21 17:15:35 +00:00
Code Issues Projects Releases Wiki Activity
134,908 Commits 42 Branches 9,765 Tags
d800e7e052d4e5d71fb0046fe591e4dcb0c9ebcd
Commit Graph

152 Commits

Author SHA1 Message Date
Alvaro Aleman
3d6a5d471f Service account controller: Wire through context 
This change enables structured logging and cancellation in the service
account controller by replacing the usage of context.TODO with an actual
context.
 2025-12-04 19:30:55 -05:00
Sascha Grunert
841886df76 Convert externaljwt from gogo to protoc 
Use standard protoc for the `externaljwt` package instead of gogo.

Part of https://github.com/kubernetes/kubernetes/issues/96564

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
 2025-07-08 08:08:30 +02:00
Harshal Neelkamal
0baeccd32f KEP-740: promote ExternalJWTSigner feature to beta 2025-06-10 16:16:13 +00:00
Mark Rossetti
5e6611af55 fixing various unit tests on Windows that create abstract sockets 
by now having them create file-based sockets on windows/darwin

Signed-off-by: Mark Rossetti <marosset@microsoft.com>
 2025-02-13 15:41:33 -08:00
Davanum Srinivas
c9e81cd84c Switch to gopkg.in/go-jose/go-jose.v2 @ v2.6.3 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2025-01-21 09:21:27 -05:00
Jordan Liggitt
59850b5823 Promote ServiceAccountTokenNodeBinding to GA 2025-01-14 09:48:35 -05:00
Kubernetes Prow Robot
4c2acddaa0 Merge pull request #129059 from liggitt/externaljwt-flake 
Isolate mock signer for externaljwt tests
 2024-12-12 16:44:28 +01:00
Jordan Liggitt
1fd76884b9 Isolate mock signer for externaljwt tests 2024-12-02 18:44:40 -05:00
Jordan Liggitt
eb6bb5f84d Record dataTimestamp as float 2024-11-25 12:01:28 -05:00
Jordan Liggitt
c68a11a09f Deflake supported key ack 2024-11-07 14:14:39 -05:00
Jordan Liggitt
dc41c91a07 Move broadcast of key updates into sync 2024-11-07 14:07:33 -05:00
Harshal Neelkamal
6fdacf0411 Add plugin and key-cache for ExternalJWTSigner integration 2024-11-07 03:16:23 +00:00
Jordan Liggitt
0771f601e1 KEP-4193: Promote ServiceAccountTokenJTI, ServiceAccountTokenPodNodeInfo, ServiceAccountTokenNodeBindingValidation to stable 2024-10-17 21:25:09 -04:00
Anish Ramasekar
c22a41e879 Set credential-id in userinfo.extra for jwt authenticators if jti claim present 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
 2024-08-30 11:02:44 -07:00
Jordan Liggitt
3e037070bb Move public key getter to interface 2024-06-25 18:10:08 -04:00
Monis Khan
3da48466d6 serviceaccount: use generics to remove runtime type checks during validation 
Signed-off-by: Monis Khan <mok@microsoft.com>
 2024-06-20 11:16:15 -04:00
Marek Siarkowicz
3ee8178768 Cleanup defer from SetFeatureGateDuringTest function call 2024-04-24 20:25:29 +02:00
Monis Khan
e89dddd4af jwt: strictly support compact serialization only 
Signed-off-by: Monis Khan <mok@microsoft.com>
 2024-02-27 17:16:08 -05:00
Patrick Ohly
4a380609a9 serviceaccount: fix incorrect usage of %w in Errorf 
Found by govet in combination with new klog where printf-style checking is
enabled.
 2023-11-01 09:32:23 +01:00
James Munnelly
76463e21d4 KEP-4193: bound service account token improvements 2023-10-30 21:15:10 +00:00
tinatingyu
5925dc0775 LegacyServiceAccountTokenCleanUp beta 2023-10-27 03:52:06 +00:00
Kubernetes Prow Robot
88aa34c124 Merge pull request #119643 from carlory/fix-119638 
Fix Non Constant-Time Comparison of Service Account Token Secrets
 2023-08-15 19:43:32 -07:00
carlory
14251738d2 NCC-E003660-PCK: Non Constant-Time Comparison of Service Account Token Secrets 2023-07-28 14:06:23 +08:00
Yuan Chen
c4739313b7 Track manually created secret-based tokens 
Add audit annotation and metrics to track secret-based tokens

Update pkg/serviceaccount/metrics.go

Co-authored-by: Jordan Liggitt <jordan@liggitt.net>

Update pkg/serviceaccount/legacy.go

Co-authored-by: Jordan Liggitt <jordan@liggitt.net>

Update pkg/serviceaccount/legacy.go

Co-authored-by: Jordan Liggitt <jordan@liggitt.net>

Update pkg/serviceaccount/metrics.go

Co-authored-by: Jordan Liggitt <jordan@liggitt.net>

Update pkg/serviceaccount/metrics.go

Co-authored-by: Jordan Liggitt <jordan@liggitt.net>

Update pkg/serviceaccount/metrics.go

Co-authored-by: Jordan Liggitt <jordan@liggitt.net>

Fix a bug
 2023-07-25 10:07:39 -07:00
Shihang Zhang
182cd425d3 graduate LegacyServiceAccountTokenTracking to GA 2023-05-19 10:33:34 -07:00
Max Goltzsche
fa5e6587f1 handle new error where sa jwt issued in the future 
Signed-off-by: Max Goltzsche <max.goltzsche@gmail.com>
 2023-03-02 03:15:13 +01:00
Max Goltzsche
031075d149 check jwt timestamp for zero value 
Co-authored-by: Jordan Liggitt <jordan@liggitt.net>
 2023-03-02 03:09:49 +01:00
Max Goltzsche
df8fa2eab5 bump go-jose to v2.6.0 
Update go-jose from v2.2.2 to v2.6.0.
This is to make the kubernetes code compatible with newer go-jose versions that have a small breaking change (`jwt.NewNumericDate()` returns a pointer).

Signed-off-by: Max Goltzsche <max.goltzsche@gmail.com>
 2023-03-02 02:53:17 +01:00
Shihang Zhang
e878bc17e6 Update pkg/serviceaccount/legacy.go 
Co-authored-by: Jordan Liggitt <jordan@liggitt.net>
 2022-12-16 12:54:52 -08:00
Shihang Zhang
0852a49020 graduate LegacyServiceAccountTokenTracking to beta 2022-12-16 10:34:17 -08:00
Kubernetes Prow Robot
d93ea2557f Merge pull request #111908 from dengyufeng2206/new-test0818 
spelling fix
 2022-11-08 13:51:20 -08:00
Shihang Zhang
569cd70a52 track legacy service account tokens 2022-10-24 09:37:53 -07:00
dengyufeng2206
402b09f532 spelling fix 
Signed-off-by: dengyufeng2206 <deng.yufeng@zte.com.cn>
 2022-08-18 18:28:21 +08:00
Davanum Srinivas
a9593d634c Generate and format files 
- Run hack/update-codegen.sh
- Run hack/update-generated-device-plugin.sh
- Run hack/update-generated-protobuf.sh
- Run hack/update-generated-runtime.sh
- Run hack/update-generated-swagger-docs.sh
- Run hack/update-openapi-spec.sh
- Run hack/update-gofmt.sh

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2022-07-26 13:14:05 -04:00
Davanum Srinivas
ab690750df Switch to v3 of github.com/emicklei/go-restful 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2022-06-09 14:11:41 -04:00
Davanum Srinivas
9405e9b55e Check in OWNERS modified by update-yamlfmt.sh 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2021-12-09 21:31:26 -05:00
Monis Khan
92c8596002 serviceaccount/claims: include validation failure error in the log 
Without this fix, the errors are logged as:

unexpected validation error: *errors.errorString

Signed-off-by: Monis Khan <mok@vmware.com>
 2021-10-27 16:50:25 -04:00
Shihang Zhang
925900317e allow multiple of --service-account-issuer 2021-04-19 09:54:11 -07:00
yoyinzyc
587cadf726 add context to serviceaccount authenticator metrics 2021-03-08 14:16:48 -08:00
Benjamin Elder
56e092e382 hack/update-bazel.sh 2021-02-28 15:17:29 -08:00
cici37
95acec5a3b Move client_builder to k8s.io/controller-manager 2020-10-19 14:48:22 -07:00
Jiajie Yang
ebbd455b24 Restrict service account token metrics to kube-apiserver only. 2020-05-21 15:34:57 -07:00
Davanum Srinivas
07d88617e5 Run hack/update-vendor.sh 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2020-05-16 07:54:33 -04:00
Davanum Srinivas
442a69c3bd switch over k/k to use klog v2 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2020-05-16 07:54:27 -04:00
Jiajie Yang
ae0e52d28c Monitoring safe rollout of time-bound service account token. 2020-04-22 11:59:16 -07:00
Jordan Liggitt
5125310023 Consider future deletionTimestamps when validating bound tokens 2020-03-27 14:37:33 -04:00
Charles Eckman
5a176ac772 Provide OIDC discovery endpoints 
- Add handlers for service account issuer metadata.
- Add option to manually override JWKS URI.
- Add unit and integration tests.
- Add a separate ServiceAccountIssuerDiscovery feature gate.

Additional notes:
- If not explicitly overridden, the JWKS URI will be based on
  the API server's external address and port.

- The metadata server is configured with the validating key set rather
than the signing key set. This allows for key rotation because tokens
can still be validated by the keys exposed in the JWKs URL, even if the
signing key has been rotated (note this may still be a short window if
tokens have short lifetimes).

- The trust model of OIDC discovery requires that the relying party
fetch the issuer metadata via HTTPS; the trust of the issuer metadata
comes from the server presenting a TLS certificate with a trust chain
back to the from the relying party's root(s) of trust. For tests, we use
a local issuer (https://kubernetes.default.svc) for the certificate
so that workloads within the cluster can authenticate it when fetching
OIDC metadata. An API server cannot validly claim https://kubernetes.io,
but within the cluster, it is the authority for kubernetes.default.svc,
according to the in-cluster config.

Co-authored-by: Michael Taufen <mtaufen@google.com>
 2020-02-11 16:23:31 -08:00
Mike Danese
3aa59f7f30 generated: run refactor 2020-02-07 18:16:47 -08:00
Tim Allclair
9d3670f358 Ensure testing credentials are labeled as such 2020-02-04 10:36:05 -08:00
chenyaqi01
66be69bb0e replace bytes.Compare() with bytes.Equal() 2019-09-27 10:08:49 +08:00