Bound service account token improvements

[enj]

Enhancement Description

• One-line enhancement description (can be used as a release note): Bound service account token improvements

• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/4193-bound-service-account-token-improvements/

• Discussion Link: Discussion Link: 2023-08-16 2023-08-02

• Primary contact (assignee): @enj

• Responsible SIGs: Auth

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): v1.29
  • Beta release target (x.y): v1.30, v1.31
  • Stable release target (x.y): v1.32 (ServiceAccountTokenJTI, ServiceAccountTokenNodeBindingValidation, ServiceAccountTokenPodNodeInfo)
  • Stable release target (x.y): v1.33 (ServiceAccountTokenNodeBinding)

• Alpha

  • KEP (k/enhancements) update PR(s): KEP-4193: bound service account token improvements #4141
  • Code (k/k) update PR(s): Including JTI & node reference in issued service account tokens (kep 4193) kubernetes#120780
  • Docs (k/website) update PR(s): KEP-4193: bound service account token improvements website#43958

• Beta

  • KEP (k/enhancements) update PR(s):
    • KEP-4193: Update milestone for v1.30 & clarify latest state #4470
    • KEP-4193: Update kep to beta #4498
    • KEP-4193: Mark as updated in 1.31 #4724
    • KEP-4193: note ServiceAccountTokenNodeBinding being promoted to beta #4675
  • Code (k/k) update PR(s):
    • KEP-4193: promote ServiceAccountTokenJTI, ServiceAccountTokenPodNodeInfo and ServiceAccountTokenNodeBindingValidation to beta kubernetes#123135
    • use authentication.kubernetes.io/issued-credential-id audit annotation in serviceaccount token registry endpoint kubernetes#123098
    • KEP-4193: promote ServiceAccountTokenNodeBinding feature to beta kubernetes#125238
  • Docs (k/website) update(s):
    • Make KEP-4193 documentation updates website#45292
    • KEP-4193: beta promotion of ServiceAccountTokenNodeBinding feature gate website#47283

• Stable

  • KEP (k/enhancements) update PR(s): KEP-4193: stable updates for 1.32 #4892
  • Code (k/k) update PR(s): KEP-4193: Promote ServiceAccountTokenJTI, ServiceAccountTokenPodNodeInfo, ServiceAccountTokenNodeBindingValidation to stable kubernetes#128169
  • Docs (k/website) update(s): KEP-4193: Update ServiceAccount admin docs with additional info on bound tokens website#48495

• Stable ServiceAccountTokenNodeBinding

  • KEP update: KEP-4193: 1.33 updates for ServiceAccountTokenNodeBinding GA #5036
  • Code update: KEP-4193: Promote ServiceAccountTokenNodeBinding to GA kubernetes#129591
  • Doc update: KEP-4193: 1.33 updates for ServiceAccountTokenNodeBinding GA website#49413

[sreeram-venkitesh]

Hello @enj 👋, v1.29 Enhancements team here.

Just checking in as we approach enhancements freeze on 01:00 UTC, Friday, 6th October, 2023.

This enhancement is targeting for stage alpha for v1.29 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.29. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

For this KEP, everything seems to be done in #4141. Please make sure that the PR is merged in time.

The status of this enhancement is marked as at risk for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[sreeram-venkitesh]

Hi @enj, checking in once more as we approach the 1.29 enhancement freeze deadline on 01:00 UTC Friday, 6th October 2023. The status of this enhancement is marked as at risk. It looks like #4141 will address all of the requirements. Please make sure that the changes are merged in time. Let me know if I missed anything. Thanks!

[liggitt]

@sreeram-venkitesh #4141 is now merged. Can you confirm requirements for 1.29 enhancements freeze are met? Thanks!