Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🛡 Enable ServiceAccount token projection and token requestor #369

Merged
merged 5 commits into from
Feb 11, 2022
Merged

🛡 Enable ServiceAccount token projection and token requestor #369

merged 5 commits into from
Feb 11, 2022

Conversation

rfranzke
Copy link
Member

@rfranzke rfranzke commented Dec 22, 2021 •
edited
Loading

How to categorize this PR?

/area security
/kind enhancement
/merge squash

What this PR does / why we need it:

  • When the extension is running on a seed with a gardenlet of at least v1.37 then
    • ServiceAccount token projection is enabled.
    • the components deployed into shoot namespaces
      • uses ServiceAccount token projection.
      • uses a token managed by GRM's token requestor instead of a client certificate.
    • the Prometheus configuration is adapted.

Which issue(s) this PR fixes:
Part of gardener/gardener#4659
Part of gardener/gardener#4878

Special notes for your reviewer:
✅ Depends on #364, hence, PR is in draft state.
✅ Depends on #383, hence, PR is in draft state.

Release note:

The extension controller uses a projected `ServiceAccount` token in case it runs on a seed with a gardenlet of at least `v1.37` or higher. Similarly, the components deployed into shoot namespaces will no longer use a client certificate but an auto-rotated `ServiceAccount` token which is only valid for `12h`.

@gardener-robot gardener-robot added area/security Security related kind/enhancement Enhancement, improvement, extension merge/squash Should be merged via 'Squash and merge' needs/review Needs review size/xl Size of pull request is huge (see gardener-robot robot/bots/size.py) needs/second-opinion Needs second review by someone else labels Dec 22, 2021
@gardener-robot-ci-2 gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Dec 22, 2021
@rfranzke rfranzke added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Dec 22, 2021
@gardener-robot-ci-2 gardener-robot-ci-2 added needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Dec 22, 2021
@rfranzke rfranzke changed the title 🛡 Revendor gardener/gardener@v1.39, enable ServiceAccount token projection and token requestor 🛡 Enable ServiceAccount token projection and token requestor Jan 21, 2022
This was referenced Jan 24, 2022
Closed
Closed
Closed
@gardener-robot-ci-3 gardener-robot-ci-3 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jan 24, 2022
@rfranzke
Copy link
Member Author

/ready

@gardener-robot gardener-robot marked this pull request as ready for review January 24, 2022 20:08
@gardener-robot gardener-robot requested review from a team as code owners January 24, 2022 20:08
@gardener-robot-ci-3 gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jan 24, 2022
@rfranzke
Copy link
Member Author

/invite @BeckerMax @timebertt

@rfranzke rfranzke marked this pull request as draft January 27, 2022 06:53
@rfranzke
Copy link
Member Author

/ready

@gardener-robot gardener-robot marked this pull request as ready for review January 27, 2022 16:13
@gardener-robot-ci-2 gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jan 27, 2022
@gardener-robot-ci-3 gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jan 27, 2022
@gardener-robot-ci-1 gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Feb 9, 2022
@gardener-robot-ci-3 gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Feb 9, 2022
@gardener-robot-ci-3 gardener-robot-ci-3 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Feb 9, 2022
dkistner
dkistner approved these changes Feb 11, 2022
View reviewed changes
Copy link
Member

@dkistner dkistner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@gardener-robot gardener-robot added reviewed/lgtm Has approval for merging and removed needs/review Needs review needs/second-opinion Needs second review by someone else labels Feb 11, 2022
@dkistner dkistner merged commit a313834 into gardener:master Feb 11, 2022
@rfranzke rfranzke deleted the enh/tr branch February 11, 2022 09:27
@rfranzke rfranzke mentioned this pull request Feb 19, 2022
Merged
@rfranzke rfranzke mentioned this pull request Apr 29, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dkistner dkistner dkistner approved these changes

@BeckerMax BeckerMax Awaiting requested review from BeckerMax

@timebertt timebertt Awaiting requested review from timebertt

Assignees
No one assigned
Labels
area/security Security related kind/enhancement Enhancement, improvement, extension merge/squash Should be merged via 'Squash and merge' needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) reviewed/lgtm Has approval for merging size/xl Size of pull request is huge (see gardener-robot robot/bots/size.py)
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@rfranzke @dkistner @gardener-robot-ci-1 @gardener-robot-ci-2 @gardener-robot-ci-3 @gardener-robot