Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[StructuredAuthenticationConfig] Add feature flag and wire up --authentication-config flag #119142

Merged
merged 3 commits into from Sep 5, 2023
Merged

[StructuredAuthenticationConfig] Add feature flag and wire up --authentication-config flag #119142

merged 3 commits into from Sep 5, 2023
+676 −90

Conversation

aramase
Copy link
Member

@aramase aramase commented Jul 6, 2023 •
edited

Implements the first phase of Structured Authentication Configuration

  • Adds StructuredAuthenticationConfiguration feature gate
  • kube-apiserver flag (--authentication-config) for authentication configuration file

fixes #118833

/kind feature
/sig auth
/triage accepted
/milestone v1.28
/priority important-soon

kube-apiserver: adds --authentication-config flag for reading AuthenticationConfiguration files. --authentication-config flag is mutually exclusive with the existing --oidc-* flags.

[KEP]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/3331-structured-authentication-configuration

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. kind/feature Categorizes issue or PR as related to a new feature. labels Jul 6, 2023
@k8s-ci-robot k8s-ci-robot added this to the v1.28 milestone Jul 6, 2023
@k8s-ci-robot k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. sig/auth Categorizes an issue or PR as relevant to SIG Auth. triage/accepted Indicates an issue or PR is ready to be actively worked on. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. area/apiserver sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. labels Jul 6, 2023
@k8s-ci-robot k8s-ci-robot requested review from enj and liggitt July 6, 2023 22:06
@aramase aramase force-pushed the aramase/f/kep_3331_add_feature_flag branch from 9fa7c09 to 5aad8ab Compare July 6, 2023 22:15
@furkatgofurov7
Copy link
Member

@aramase hey, Bug Triage Lead here 👋🏼

This still labelled as WIP though, JFYI, please be aware the code freeze is starting 01:00 UTC Wednesday 19th July 2023 / 18:00 PDT Tuesday 18th July 2023 (about less than 2 weeks from now).

@aramase aramase force-pushed the aramase/f/kep_3331_add_feature_flag branch 2 times, most recently from 9e375ee to 28ef53d Compare July 12, 2023 00:24
@furkatgofurov7
Copy link
Member

@aramase 👋🏼 again :)

This is a reminder, as I informed about it already 2 weeks ago, we are in week 9 currently and the code freeze is starting next week (week 10) at 01:00 UTC Wednesday 19th July 2023 / 18:00 PDT Tuesday 18th July 2023.

Please make sure that PR is on track and have sufficient labels in order to make it to release 1.28 before code freeze is in. Also, let me know if you need any help/assistance.

@k8s-ci-robot k8s-ci-robot added area/test sig/testing Categorizes an issue or PR as relevant to SIG Testing. labels Jul 12, 2023
@aramase aramase force-pushed the aramase/f/kep_3331_add_feature_flag branch from 11b079f to 507a3b2 Compare July 12, 2023 20:34
@aramase aramase changed the title [WIP][StructuredAuthenticationConfig] Add feature flag and wire up --authentication-config flag [StructuredAuthenticationConfig] Add feature flag and wire up --authentication-config flag Jul 12, 2023
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 12, 2023
@aramase
Copy link
Member Author

aramase commented Jul 12, 2023 •
edited

This PR builds on top of #118984 to add feature gate and wire kube-apiserver flag for reading authentication config.

@Atharva-Shinde Atharva-Shinde mentioned this pull request Jul 19, 2023
Open
36 tasks
@enj
Copy link
Member

enj commented Jul 19, 2023

/milestone next-candidate

@k8s-ci-robot k8s-ci-robot modified the milestones: v1.28, next-candidate Jul 19, 2023
@enj
Copy link
Member

enj commented Aug 8, 2023

/milestone v1.29

@k8s-ci-robot k8s-ci-robot removed this from the next-candidate milestone Aug 8, 2023
@aramase aramase force-pushed the aramase/f/kep_3331_add_feature_flag branch 2 times, most recently from bc52ffc to 85d5036 Compare August 16, 2023 19:20
@enj
Copy link
Member

enj commented Aug 18, 2023

xref: reviewed this PR at aramase#1

@aramase aramase mentioned this pull request Aug 25, 2023
Merged
@aramase
add StructuredAuthenticationConfiguration feature flag
1bf90f9 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
@aramase aramase force-pushed the aramase/f/kep_3331_add_feature_flag branch from 85d5036 to 2d8b7b9 Compare August 25, 2023 18:59
@k8s-ci-robot k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Aug 25, 2023
@aramase
Copy link
Member Author

aramase commented Aug 25, 2023

/assign enj deads2k

@k8s-ci-robot k8s-ci-robot added the kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API label Aug 25, 2023
@aramase aramase force-pushed the aramase/f/kep_3331_add_feature_flag branch from 2d8b7b9 to 9d389b2 Compare August 25, 2023 19:23
deads2k
deads2k reviewed Aug 30, 2023
View reviewed changes
Copy link
Contributor

@deads2k deads2k left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

largely good, minor comments.

pkg/kubeapiserver/options/authentication.go Outdated Show resolved Hide resolved
pkg/kubeapiserver/options/authentication.go Outdated Show resolved Hide resolved
pkg/kubeapiserver/options/authentication.go Outdated Show resolved Hide resolved
pkg/kubeapiserver/options/authentication.go Outdated Show resolved Hide resolved
@aramase aramase force-pushed the aramase/f/kep_3331_add_feature_flag branch from 9d389b2 to f6db694 Compare August 30, 2023 22:19
@aramase aramase requested a review from deads2k August 30, 2023 22:19
@aramase
Copy link
Member Author

aramase commented Aug 30, 2023

largely good, minor comments.

thanks @deads2k! I've updated the PR to resolve the comments. PTAL!

@aramase
add loading config and wire feature flag
9e1ff1e 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
@aramase
add integration tests
15c02f2 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
@aramase aramase force-pushed the aramase/f/kep_3331_add_feature_flag branch from f6db694 to 15c02f2 Compare August 30, 2023 23:15
@deads2k
Copy link
Contributor

deads2k commented Sep 5, 2023

/lgtm

@deads2k
Copy link
Contributor

deads2k commented Sep 5, 2023

/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 5, 2023
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: 932ca5f3b975cfd356e6b75b0abf97e9c4c8f8c1

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aramase, deads2k

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 5, 2023
@k8s-ci-robot k8s-ci-robot merged commit f68c66f into kubernetes:master Sep 5, 2023
15 of 16 checks passed
@aramase aramase deleted the aramase/f/kep_3331_add_feature_flag branch September 5, 2023 20:11
@acumino acumino mentioned this pull request Dec 21, 2023
Open
16 tasks
@openshift-ci-robot openshift-ci-robot mentioned this pull request Feb 13, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@enj enj Awaiting requested review from enj

@liggitt liggitt Awaiting requested review from liggitt

@deads2k deads2k Awaiting requested review from deads2k

Assignees

@enj enj

@deads2k deads2k

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver area/test cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
SIG Auth
Archived in project
[sig-release] Bug Triage
Archived in project
Milestone
v1.29
Development

Successfully merging this pull request may close these issues.

Wire feature flag and to authn config struct
5 participants
@aramase @furkatgofurov7 @enj @deads2k @k8s-ci-robot