API for external signing of Service Account tokens

[micahhausler]

Enhancement Description

• One-line enhancement description (can be used as a release note): External signer integration for service account tokens

• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/740-service-account-external-signing

• Primary contact (assignee): @HarshalNeelkamal

• Responsible SIGs: sig-auth

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): 1.32
  • Beta release target (x.y): 1.34
  • Stable release target (x.y): 1.36

• Alpha 1.32

  • KEP (k/enhancements) update PR(s):
    • update KEP 740 #4852
  • Code (k/k) update PR(s):
    • Add plugin and key-cache for ExternalJWTSigner integration kubernetes#128190
    • Wait for updated keys to be observed kubernetes#128966
    • Automated cherry pick of #129059: Isolate mock signer for externaljwt tests kubernetes#129178
    • Clean up service account options completion and fallback kubernetes#125473
    • Move public key serviceaccount getter to interface, filter by key id kubernetes#125177
  • Docs (k/website) update PR(s):
    • Docs for ExternalJWTSigner website#48518

• Alpha 1.33

  • KEP (k/enhancements) update PR(s):
    • KEP-740: update KEP latest milestone to v1.33 #5130
  • Code (k/k) update PR(s):
    • Improve SA max token expiry with external signer logic, and plumb extended expiry duration. kubernetes#129816
    • Isolate mock signer for externaljwt tests kubernetes#129059
    • Record dataTimestamp as float kubernetes#128967
  • Docs (k/website) update(s): n/a

• Beta 1.34

  • KEP (k/enhancements) update PR(s): KEP-740: promote external token signing to beta #5323
  • Code (k/k) update PR(s):
    • Relax external signer path validation to allow relative paths kubernetes#131509
    • Externaljwt OIDC discovery fix kubernetes#131493
    • KEP-740: promote ExternalJWTSigner feature to beta kubernetes#131300
  • Docs (k/website) update(s):
    • KEP-740: Update externaljwt docs for beta website#51725

• Stable

  • KEP (k/enhancements) update PR(s): KEP-740: Update for GA promotion #5786
  • Code (k/k) update PR(s): Make ExternalServiceAccountTokenSigner GA kubernetes#136118
  • Docs (k/website) update(s): move externalJWTSigner to Stable website#54633

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[claurence]

@micahhausler I see this issue has been added targeting Alpha for 1.14 - I'm the enhancements lead so if that is correct I'll add it to the milestone - as an FYI enhancements freeze is today 1/29 at PST EOD - we'll want to have a KEP for this issue merged and in an implementable state by then.

[justaugustus]

/assign @micahhausler

[mrbobbytables]

Hey there @micahhausler, I'm one of the 1.16 Enhancement Shadows. Is this feature going to be graduating alpha/beta/stable stages in 1.16? Please let me know so it can be added to the 1.16 Tracking Spreadsheet. If it's not graduating, I will remove it from the milestone and change the tracked label.

Once coding begins or if it already has, please list all relevant k/k PRs in this issue so they can be tracked properly.

As a reminder, every enhancement requires a KEP in an implementable state with Graduation Criteria explaining each alpha/beta/stable stages requirements.

Milestone dates are Enhancement Freeze 7/30 and Code Freeze 8/29.

Thank you.

[annajung]

Hello @micahhausler, 1.17 Enhancement Shadow here! 🙂

I wanted to reach out to see if this enhancement will be graduating to alpha/beta/stable in 1.17?


Please let me know so that this enhancement can be added to 1.17 tracking sheet.

Please note that the KEP is missing test plan.

Thank you!

🔔Friendly Reminder

• The current release schedule is

  • Monday, September 23 - Release Cycle Begins
  • Tuesday, October 15, EOD PST - Enhancements Freeze
  • Thursday, November 14, EOD PST - Code Freeze
  • Tuesday, November 19 - Docs must be completed and reviewed
  • Monday, December 9 - Kubernetes 1.17.0 Released

• A Kubernetes Enhancement Proposal (KEP) must meet the following criteria before Enhancement Freeze to be accepted into the release

  • PR is merged in
  • In an implementable state
  • Include test plan and graduation criteria

• All relevant k/k PRs should be listed in this issue

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[palnabarun]

/remove-lifecycle stale