Structured Authentication Config

[nabokihms]

Enhancement Description

• One-line enhancement description (can be used as a release note): Structured Authentication Config
• Kubernetes Enhancement Proposal: KEP
• Discussion Link:
  • Slack post - https://kubernetes.slack.com/archives/C0EN96KUY/p1638208007167400
  • Google doc - https://docs.google.com/document/d/1sY8fRyRtk4eG9R439z5ao5i9bFuuxilS03XaNlqoni0/edit?disco=AAAARL1K8OE
• Primary contact (assignee): @nabokihms
• Responsible SIGs: sig-auth
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): v1.29
  • Beta release target (x.y): v1.30
  • Stable release target (x.y): v1.34
• Alpha
  • KEP (k/enhancements) update PR(s): KEP-3331: Structured Authentication Config #3332
  • Code (k/k) update PR(s):
    • [StructuredAuthenticationConfig] Create struct for authn config and re-wire OIDC flags to use it kubernetes#118984
    • [StructuredAuthenticationConfig] Add feature flag and wire up --authentication-config flag kubernetes#119142
    • [StructuredAuthnConfig] use local variables in oidc pkg kubernetes#120183
    • Implement CEL for StructuredAuthenticationConfig kubernetes#121078
    • [StructuredAuthn] Ensure empty fields of user object are accessible by CEL kubernetes#121709
  • Docs (k/website) update PR(s): add docs for StructuredAuthenticationConfig v1alpha1 website#43397
• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP-3331: update for beta in v1.30 #4461
    • KEP-3331: update configuration reload metric #4491
    • KEP-3331: update kep latest milestone to v1.32 #4844
  • Code (k/k) update PR(s):
    • add StructuredAuthenticationConfiguration feature to kube feature gates file kubernetes#121622
    • [StructuredAuthnConfig] add comment for extra keys unique requirement kubernetes#122560
    • cleanup structured authn/authz error logic kubernetes#122975
    • Add AudienceMatchPolicy and support multiple audiences in AuthenticationConfiguration kubernetes#123165
    • Add apiserver_authentication_jwt_authenticator_latency_seconds metric kubernetes#123225
    • Support all key algs with structured authn config kubernetes#123282
    • Add integration test for multiple audience in structured authn kubernetes#123305
    • Support multiple JWT authenticators with structured authn config kubernetes#123431
    • add min valid jwt payload to API docs for structured authn config kubernetes#123458
    • Add dynamic reload support for authentication configuration kubernetes#123525
    • Add DiscoveryURL to Authentication Configuration kubernetes#123527
    • Prevent conflicts between service account and jwt issuers kubernetes#123561
    • jwt: fail on empty username via CEL expression kubernetes#123568
    • Duplicate v1alpha1 AuthenticationConfiguration to v1beta1 kubernetes#123696
    • Mark StructuredAuthenticationConfiguration feature gate as beta kubernetes#123719
    • Fix AuthenticationConfiguration docs around nested claims via CEL kubernetes#123721
    • Require email_verified to be used when email is set as username via CEL kubernetes#123737
    • Add metrics for authentication config reload kubernetes#123793
    • fix test flake in TestStructuredAuthenticationConfigReload kubernetes#123856
    • Set credential-id in userinfo.extra for jwt authenticators if jti claim present kubernetes#127010
    • Disallow k8s.io and kubernetes.io namespaced extra key in structured authn config kubernetes#126553
    • Add JWKS fetch metrics for jwt authenticator kubernetes#123642
  • Docs (k/website) update(s):
    • Add blog post for Structured Authn beta website#45106
    • Add docs for Structured Authn beta website#45108
    • Add note about k8s.io, kubernetes disallowed prefix for structured authn website#47821

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[nabokihms]

/sig auth

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[marosset]

Hello @nabokihms 👋, 1.26 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PDT on Thursday 6th October 2022.

This enhancement is targeting for stage alpha for 1.26 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.26
• KEP readme has a updated detailed test plan section filled out
• KEP readme has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

It looks #3332 will address most of these issues.

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[enj]

/milestone v1.27

[tjons]

Hi, enhancements lead here - I inadvertently added this to the 1.32 tracking board 😀. Please readd it if you wish to progress this enhancement in 1.32.

/remove-label lead-opted-in

[tjons]

Hello @aramase @enj 👋, Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 11th October 2024 / 19:00 PDT Thursday 10th October 2024.

This enhancement is targeting for stage beta for v1.32 (correct me, if otherwise).

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: v1.32.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here). If your production readiness review is not completed yet, please make sure to fill the production readiness questionnaire in your KEP by the PRR Freeze deadline on Thursday, October 3rd, 2024 so that the PRR team has enough time to review your KEP.

For this KEP, we would just need to update the following:

• KEP status is marked as implementable for latest-milestone: v1.32. This should be resolved once https://github.com/kubernetes/enhancements/pull/4844/files merges.

The status of this enhancement is marked as at risk for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you!

[jpbetz]

PRR reviewer here. Is this still targeting v1.32? The PRR deadline is Thursday. Is there anything I can review?

[aramase]

PRR reviewer here. Is this still targeting v1.32? The PRR deadline is Thursday. Is there anything I can review?

@jpbetz This is going to stay beta in v1.32. We're opting it in, so we can make code changes for defaulting, validation and metrics in v1.32. There is no change in the KEP. I have #4844 open to update the latest milestone to v1.32.

[jpbetz]

This is going to stay beta in v1.32. We're opting it in, so we can make code changes for defaulting, validation and metrics in v1.32. There is no change in the KEP. I have #4844 open to update the latest milestone to v1.32.

Sounds good. No need for PRR on this one for 1.32 then. Thanks!

[liggitt]

@tjons can you mark this as tracked for code freeze, all KEP / milestone changes for 1.32 are merged

[tjons]

With all requirements met this enhancement is now tracked for enhancements freeze!

[kfox1111]

Question... It looks like the discovery url can only be HTPS. For better integration with SPIFFE, it would be very nice if it could refer to a unix socket that speaks HTTP to gather the JWKS info. Would this be ok? Should that be discussed/added here, or should I open up another issue?

[spurin]

Hi @aramase, @enj 👋, I'm James Spurin, a 1.32 Docs Shadow. Great to meet you.

Does this enhancement work planned for 1.32 require any new docs or modifications to the existing docs?

If so, please follows the steps here to open a PR against dev-1.32 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday October 24th 2024 18:00 PDT.

Also, take a look at Documenting for a release to familiarise with the docs requirement for the release.

Thank you!

[mbianchidev]

Hello hello @nabokihms @aramase @enj 👋 from the v1.32 Communications Team!

We'd love for you to consider writing a feature blog about your enhancement.
Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and it is graduating.

To opt-in, let us know by opening a Feature Blog placeholder PR against the website repository by 30th Oct 2024. For more information about writing a blog see the blog contribution guidelines.

Note: In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we finalize the blog schedule.

[spurin]

Hi @aramase, @enj 👋,

Just a reminder to open a placeholder PR against dev-1.32 branch in the k/website repo for this (steps available here) for this KEP if it requires new or modifications to existing docs.

The deadline for this is Thursday Oct 24 at 18:00 PDT.

Thanks

James Spurin

[aramase]

The docs changes have already merged: kubernetes/website#47821. I don't have permissions to update the issue.

[tjons]

Hello @aramase @enj 👋, Enhancements team here.

With all the implementation(code related) PRs merged as per the issue description:

• add StructuredAuthenticationConfiguration feature to kube feature gates file kubernetes#121622
• [StructuredAuthnConfig] add comment for extra keys unique requirement kubernetes#122560
• cleanup structured authn/authz error logic kubernetes#122975
• Add AudienceMatchPolicy and support multiple audiences in AuthenticationConfiguration kubernetes#123165
• Add apiserver_authentication_jwt_authenticator_latency_seconds metric kubernetes#123225
• Support all key algs with structured authn config kubernetes#123282
• Add integration test for multiple audience in structured authn kubernetes#123305
• Support multiple JWT authenticators with structured authn config kubernetes#123431
• add min valid jwt payload to API docs for structured authn config kubernetes#123458
• Add dynamic reload support for authentication configuration kubernetes#123525
• Add DiscoveryURL to Authentication Configuration kubernetes#123527
• Prevent conflicts between service account and jwt issuers kubernetes#123561
• jwt: fail on empty username via CEL expression kubernetes#123568
• Duplicate v1alpha1 AuthenticationConfiguration to v1beta1 kubernetes#123696
• Mark StructuredAuthenticationConfiguration feature gate as beta kubernetes#123719
• Fix AuthenticationConfiguration docs around nested claims via CEL kubernetes#123721
• Require email_verified to be used when email is set as username via CEL kubernetes#123737
• Add metrics for authentication config reload kubernetes#123793
• fix test flake in TestStructuredAuthenticationConfigReload kubernetes#123856

This enhancement is now marked as tracked for code freeze for the 1.32 Code Freeze!

Please note that KEPs targeting stable need to have the status field marked as implemented in the kep.yaml file after code PRs are merged and the feature gates are removed.

[liggitt]

This will be worked on in 1.33 but stay in beta
/milestone v1.33
/label lead-opted-in