Reduction of Secret-based Service Account Tokens

[zshihang]

Enhancement Description

• One-line enhancement description: reduce secret-based service account tokens

• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/2799-reduction-of-secret-based-service-account-token

• Discussion Link: sig-auth

• Primary contact (assignee): @zshihang, @yt2985

• Responsible SIGs: sig-auth

• Enhancement target (which target equals to which milestone):

  • LegacyServiceAccountTokenNoAutoGeneration feature gate
    • Beta release target (x.y): 1.24
    • Stable release target (x.y): 1.26
  • LegacyServiceAccountTokenTracking feature gate
    • Alpha release target (x.y): 1.26
    • Beta release target (x.y): 1.27
    • Stable release target (x.y): 1.28
  • LegacyServiceAccountTokenCleanUp feature gate
    • Alpha release target (x.y): 1.28
    • Beta release target (x.y): 1.29
    • Stable release target (x.y): 1.30

• 1.24

  • KEP (k/enhancements) update PR(s):
    • KEP-2799: Reduction of Secret-based Service Account Tokens #2800
  • Code (k/k) update PR(s):
    • LegacyServiceAccountTokenNoAutoGeneration
      • no auto-generation of secret-based service account token kubernetes#108309
  • Docs (k/website) update PR(s):
    • Stop recommending people scrape auto-generated service account tokens website#31845
    • Fixup service account token doc website#31894
    • New feature 'LegacyServiceAccountTokenNoAutoGeneration' website#32339

• 1.25

  • KEP (k/enhancements) update PR(s):
    • KEP-2799: Update for 1.25 #3393

• 1.26

  • KEP (k/enhancements) update PR(s):
    • KEP-2799: LegacyServiceAccountTokenNoAutoGeneration ga and LegacyServiceAccountTokenTracking alpha #3536
  • Code (k/k) update PR(s):
    • LegacyServiceAccountTokenNoAutoGeneration
      • graduate LegacyServiceAccountTokenNoAutoGeneration to ga kubernetes#112838
    • LegacyServiceAccountTokenTracking
      • track legacy service account tokens kubernetes#108858
  • Docs (k/website) update(s):
    • update doc of KEP-2799 website#37483

• 1.27

  • KEP (k/enhancements) update PR(s):
    • KEP-2799: update for LegacyServiceAccountTokenTracking beta #3696
  • Code (k/k) update PR(s):
    • LegacyServiceAccountTokenNoAutoGeneration
      • lock LegacyServiceAccountTokenNoAutoGeneration kubernetes#114522
    • LegacyServiceAccountTokenTracking
      • graduate LegacyServiceAccountTokenTracking to beta kubernetes#114523
  • Docs (k/website) update(s):
    • LegacyServiceAccountTokenNoAutoGeneration / LegacyServiceAccountTokenTracking gate PR - update LegacyServiceAccountTokenTracking to beta website#40066

• 1.28

  • KEP (k/enhancements) update PR(s):
    • update kep-2799 #3964
    • KEP-2799: update latest-milestone to 1.28 #4135
  • Code (k/k) update PR(s):
    • LegacyServiceAccountTokenTracking
      • graduate LegacyServiceAccountTokenTracking to GA kubernetes#117591
    • LegacyServiceAccountTokenCleanUp
      • LegacyServiceAccountTokenCleanUp alpha kubernetes#115554
  • Docs (k/website) update(s):
    • Add LegacyServiceAccountTokenCleanUp feature in alpha; move LegacyServiceAccountTokenTracking to GA website#41341

• 1.29

  • KEP (k/enhancements) update PR(s):
    • Revise KEP 2799-reduction-of-secret-based-service-account-token for LegacyServiceaccountTokenCleanup feature. #4157
  • Code (k/k) update PR(s):
    • LegacyServiceAccountTokenCleanUp
      • LegacyServiceAccountTokenCleanUp beta kubernetes#120682
  • Docs (k/website) update(s):
    • Add LegacyServiceAccountTokenCleanUp feature in beta website#43563

[zshihang]

/sig auth

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[enj]

/remove-lifecycle stale
/lifecycle frozen