Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

no auto-generation of secret-based service account token #108309

Merged
merged 1 commit into from
Mar 2, 2022
Merged

no auto-generation of secret-based service account token #108309

merged 1 commit into from
Mar 2, 2022

Conversation

zshihang
Copy link
Contributor

@zshihang zshihang commented Feb 23, 2022 •
edited by liggitt

What type of PR is this?

/kind feature

What this PR does / why we need it:

stops auto-generation of legacy tokens because they are less secure

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Action required: The `LegacyServiceAccountTokenNoAutoGeneration` feature gate is beta, and enabled by default. When enabled, Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount. Use the [TokenRequest](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/) API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this [guide](https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets).

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

-[KEP]: kubernetes/enhancements#2800

@k8s-ci-robot k8s-ci-robot added do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. release-note-action-required Denotes a PR that introduces potentially breaking changes that require user action. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. kind/feature Categorizes issue or PR as related to a new feature. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. area/test sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/testing Categorizes an issue or PR as relevant to SIG Testing. and removed do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Feb 23, 2022
@zshihang
Copy link
Contributor Author

/cc @liggitt
/triage accepted
/priority important-soon

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Feb 23, 2022
@k8s-ci-robot k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Feb 23, 2022
@liggitt liggitt mentioned this pull request Feb 23, 2022
Closed
@everettraven everettraven mentioned this pull request Jun 10, 2022
Merged
JoaoBraveCoding added a commit to JoaoBraveCoding/must-gather that referenced this pull request Jun 15, 2022
@JoaoBraveCoding
Updates how gether_monitoring obtains SA token
b3de331 
problem: Since k8s 1.24 tokens for SA are not automatically generated [1]
hence, it's not possible to get a SA token with the command
"oc sa get-token default", this breaks the gather_monitoring script as
we need the token to make http requests to prometheus

solution: use instead the new command "oc create token default"

[1] kubernetes/kubernetes#108309
@JoaoBraveCoding JoaoBraveCoding mentioned this pull request Jun 15, 2022
Merged
@aktech aktech mentioned this pull request Jun 19, 2022
Closed
@sharangb sharangb mentioned this pull request Jun 27, 2022
Closed
krgostev pushed a commit to krgostev/gardener that referenced this pull request Jul 5, 2022
@acumino
Support for Kubernetes v1.24 (gardener#6023)
80491c1 
* Extend docs to support kubernetes v1.24 and allow client creation

* Adapt kubernetes feature gates

./hack/compare-k8s-feature-gates.sh 1.23 1.24                                                                                                    ✔
Feature gates added in 1.24 compared to 1.23:
CSIMigrationRBD
CronJobTimeZone
LegacyServiceAccountTokenNoAutoGeneration
MaxUnavailableStatefulSet
MinDomainsInPodTopologySpread
NetworkPolicyStatus
NodeOutOfServiceVolumeDetach
ServiceIPStaticSubrange

Feature gates removed in 1.24 compared to 1.23:
HugePageStorageMediumSize
ImmutableEphemeralVolumes
MigrationRBD
NamespaceDefaultLabelName
RuntimeClass
SetHostnameAsFQDN
StreamingProxyRedirects
ValidateProxyRedirects
WarningHeaders

Feature gates locked to default in 1.24 compared to 1.23:
CSIMigrationOpenStack
CSIStorageCapacity
CSRDuration
ControllerManagerLeaderMigration
DefaultPodTopologySpread
EfficientWatchResumption
IndexedJob
NonPreemptingPriority
PodAffinityNamespaceSelector
PodOverhead
PreferNominatedNode
RemoveSelfLink
ServiceLBNodePortControl
ServiceLoadBalancerClass
SuspendJob

* Use 1.24 for local shoot

* Drop removed flag --insecure-port for v1.24

ref kubernetes/kubernetes#106859

* Drop removed flag --port for v1.24

ref kubernetes/kubernetes#106860

* Remove deprecated usages of metadata.Selflink

* Use 1.24 e2e test

* Bump kindest/node image to v1.24

* Adapt changes for with k/k v1.24 Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount

ref kubernetes/kubernetes#108309

* Add unit test
@sparkoo sparkoo mentioned this pull request Jul 7, 2022
Merged
@hawksight hawksight mentioned this pull request Jul 12, 2022
Closed
@aojea aojea mentioned this pull request Jul 13, 2022
Closed
@blomsoft blomsoft mentioned this pull request Aug 16, 2022
Closed
@prasad-shirodkar prasad-shirodkar mentioned this pull request Aug 18, 2022
Merged
@illume illume mentioned this pull request Aug 30, 2022
Merged
@alexellis alexellis mentioned this pull request Sep 20, 2022
Open
@pacoxu pacoxu mentioned this pull request Jan 4, 2023
Closed
@ebensom ebensom mentioned this pull request Jan 12, 2023
Merged
@yetone yetone mentioned this pull request Jan 27, 2023
Merged
@zisom-hc zisom-hc mentioned this pull request Mar 7, 2023
Merged
@nicolaihald nicolaihald mentioned this pull request Mar 21, 2023
Closed
@ytinirt ytinirt mentioned this pull request May 26, 2023
Closed
@kahirokunn kahirokunn mentioned this pull request Jun 15, 2023
Merged
kahirokunn added a commit to kahirokunn/aws-ebs-csi-driver that referenced this pull request Jun 15, 2023
@kahirokunn
chore: Allow to set automountServiceAccountToken in ServiceAccount
aea7ec2 
https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#urgent-upgrade-notes

> The LegacyServiceAccountTokenNoAutoGeneration feature gate is beta, and enabled by default. When enabled, Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount. Use the [TokenRequest](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/) API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this [guide](https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets). (kubernetes/kubernetes#108309, [@zshihang](https://github.com/zshihang))

Since k8s 1.24, TOKEN is not mounted automatically.
If you want to access with IRSA, you need to use a token.

Signed-off-by: kahirokunn <okinakahiro@gmail.com>
kahirokunn added a commit to kahirokunn/aws-ebs-csi-driver that referenced this pull request Jun 15, 2023
@kahirokunn
chore: Allow to set automountServiceAccountToken in ServiceAccount
5cbd0b4 
https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#urgent-upgrade-notes

> The LegacyServiceAccountTokenNoAutoGeneration feature gate is beta, and enabled by default. When enabled, Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount. Use the [TokenRequest](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/) API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this [guide](https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets). (kubernetes/kubernetes#108309, [@zshihang](https://github.com/zshihang))

Since k8s 1.24, TOKEN is not mounted automatically.
If you want to access with IRSA, you need to use a token.

Signed-off-by: kahirokunn <okinakahiro@gmail.com>
kahirokunn added a commit to kahirokunn/aws-ebs-csi-driver that referenced this pull request Jun 15, 2023
@kahirokunn
chore: Allow to set automountServiceAccountToken in ServiceAccount
9c54a66 
https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#urgent-upgrade-notes

> The LegacyServiceAccountTokenNoAutoGeneration feature gate is beta, and enabled by default. When enabled, Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount. Use the [TokenRequest](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/) API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this [guide](https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets). (kubernetes/kubernetes#108309, [@zshihang](https://github.com/zshihang))

Since k8s 1.24, TOKEN is not mounted automatically.
If you want to access with IRSA, you need to use a token.

Signed-off-by: kahirokunn <okinakahiro@gmail.com>
kahirokunn added a commit to kahirokunn/aws-ebs-csi-driver that referenced this pull request Jun 16, 2023
@kahirokunn
chore: Allow to set automountServiceAccountToken in ServiceAccount
4ff7a8c 
https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#urgent-upgrade-notes

> The LegacyServiceAccountTokenNoAutoGeneration feature gate is beta, and enabled by default. When enabled, Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount. Use the [TokenRequest](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/) API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this [guide](https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets). (kubernetes/kubernetes#108309, [@zshihang](https://github.com/zshihang))

Since k8s 1.24, TOKEN is not mounted automatically.
If you want to access with IRSA, you need to use a token.

Signed-off-by: kahirokunn <okinakahiro@gmail.com>
kahirokunn added a commit to kahirokunn/aws-ebs-csi-driver that referenced this pull request Jun 16, 2023
@kahirokunn
chore: Allow to set automountServiceAccountToken in ServiceAccount
9a30a54 
https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#urgent-upgrade-notes

> The LegacyServiceAccountTokenNoAutoGeneration feature gate is beta, and enabled by default. When enabled, Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount. Use the [TokenRequest](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/) API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this [guide](https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets). (kubernetes/kubernetes#108309, [@zshihang](https://github.com/zshihang))

Since k8s 1.24, TOKEN is not mounted automatically.
If you want to access with IRSA, you need to use a token.

Signed-off-by: kahirokunn <okinakahiro@gmail.com>
weizhouapache added a commit to weizhouapache/cloudstack that referenced this pull request Jul 24, 2023
@weizhouapache
UI: add step to create bearer token for kubernetes dashboard
a8c2970 
Since Kubernetes v1.24.0, there is no auto-generation of secret-based service account token due to security reason. see kubernetes/kubernetes#108309

To access kubernetes dashboard, users need to create a service account and an optional long-lived Bearer Token for the service account.
@weizhouapache weizhouapache mentioned this pull request Jul 24, 2023
Merged
12 tasks
weizhouapache added a commit to apache/cloudstack that referenced this pull request Jul 25, 2023
@weizhouapache
UI: add step to create bearer token for kubernetes dashboard (#7764)
6dd2ce8 
Since Kubernetes v1.24.0, there is no auto-generation of secret-based service account token due to security reason. see kubernetes/kubernetes#108309

To access kubernetes dashboard, users need to create a service account and an optional long-lived Bearer Token for the service account.
@brizaldi brizaldi mentioned this pull request May 10, 2024
Closed
@michael-plate michael-plate mentioned this pull request Jun 11, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@liggitt liggitt liggitt left review comments

@mikedanese mikedanese Awaiting requested review from mikedanese

Assignees

@liggitt liggitt

@deads2k deads2k

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/test cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note-action-required Denotes a PR that introduces potentially breaking changes that require user action. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Milestone
v1.24
Development

Successfully merging this pull request may close these issues.

None yet
10 participants
@zshihang @liggitt @fedebongio @sftim @k8s-ci-robot @leilajal @eddiezane @shuheiktgw @riaankleinhans @deads2k