Added the note for --service-account-issuer flag. #31237

Shubham82 · 2022-01-07T09:51:34Z

This PR adds more information for --service-account-issuer flag under Service Account Token Volume Projection in Configure Service Accounts for Pods task.

Fixes: #31235

linux-foundation-easycla · 2022-01-07T09:51:38Z

❌ - Shubham The commit (36f29df ,cf5f912b1fd9090800e7efe3d931425b4e598609 ,088976cf7b00977820fe3ff3610ed3905ff41a2e ,ff133eee324223a27d594292dac7b1188f7a6c61) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please submit a support request ticket.

Shubham82 · 2022-01-07T09:56:17Z

Hi @liggitt @thockin @sftim
PTAL!

netlify · 2022-01-07T10:05:19Z

✔️ Deploy Preview for kubernetes-io-main-staging ready!

🔨 Explore the source changes: ff133ee

🔍 Inspect the deploy log: https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/61f8d2145fe9b2000717d818

😎 Browse the preview: https://deploy-preview-31237--kubernetes-io-main-staging.netlify.app

annajung · 2022-01-07T19:50:24Z

Hi @Shubham82, please sign the CLA for the PR to be reviewed

Shubham82 · 2022-01-08T13:15:14Z

Hi @annajung
I already signed the CLA. This EasyCLA is a different thing that is optional and ignored by Kubernetes as of now.

Please refer to this comment for more information.

sftim · 2022-01-08T15:05:08Z

content/en/docs/tasks/configure-pod-container/configure-service-account.md

+To enable non-disruptive change of issuer we can specify `--service-account-issuer` flag multiple times to `kube-apiserver` for k8s v1.22 and later versions.
+
 {{< /note >}}


Suggested change

To enable non-disruptive change of issuer we can specify `--service-account-issuer` flag multiple times to `kube-apiserver` for k8s v1.22 and later versions.

{{< /note >}}

{{< /note >}}

You can specify the `--service-account-issuer` argument multiple times. This can be useful to

enable a non-disruptive change of the key for an issuer.

You must be running running Kubernetes v1.22 or later to be able to specify

`--service-account-issuer` multiple times`.

Is that true? How does that work if there are two different keys / signing keys?

Hi, @sftim thanks for looking at this. I will modify this according to your suggestion soon.

Is that true? How does that work if there are two different keys / signing keys?

Yes, it is true. It was merged in k8s v1.22. See this PR for more information.

Hi @sftim
I have Addressed the comment, please take a look.

Thanks

sftim · 2022-01-10T09:22:16Z

content/en/docs/tasks/configure-pod-container/configure-service-account.md

+You can specify the `--service-account-issuer` argument multiple times. This can be useful to
+enable a non-disruptive change of the key for an issuer.
+You must be running running Kubernetes v1.22 or later to be able to specify
+`--service-account-issuer` multiple times.


This isn't wrong but it's also not at all clear (to a reader) what the deal is about specifying the other arguments such as --service-account-key-file multiple times.

Readers have to go and look at https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ to work it out.
It would be nice to save them some of that effort.

Hi @sftim, can we write like this so that Readers have some info regarding these flags? Please take a look and let me know your thoughts on this. if it seems good then I will add this.

`--service-account-issuer` can use for the Identifier of the service account token issuer. The issuer will assert this identifier in the "iss" claim of issued tokens. This value must be a string or URI. You can specify specified `--service-account-key-file` flag multiple times with different files, It must be specified when `--service-account-signing-key` is provided. This File contains PEM-encoded x509 RSA or ECDSA private or public keys which are used to verify ServiceAccount tokens. No need for k8s version v1.22 or greater, it also works in the lower version of k8s v1.22. You can use `--service-account-signing-key-file` flag for the path to the file that contains the current private key of the service account token issuer. The issuer will sign issued ID tokens with this private key. You can use `--api-audiences ` flag for Identifiers of the API. We can specify multiple audiences for whom the token is used. You can omit it also if not specified then it defaults to a single element list containing the issuer URL. For more information please see various flags used in [kube-apiserver](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/).

The behavior when the flags are specified times should be described. If service-account-key-file or api-audiences is specified multiple times, tokens signed by any of the specified keys or for any of the specified audiences are considered valid by the Kubernetes API server.

Hi @liggitt Thanks for looking at this.

The behavior when the flags are specified times should be described. If service-account-key-file or api-audiences is specified multiple times, tokens signed by any of the specified keys or for any of the specified audiences are considered valid by the Kubernetes API server.

Sure, I will add this thing to it.

Hi, @liggitt @sftim I modified it acc. to the suggestion. we can append these lines to the commit. Please take a look at this one, and let me know any kind of changes or modifications you want.

`--service-account-issuer` can use for the Identifier of the service account token issuer. The issuer will assert this identifier in the "iss" claim of issued tokens. This value must be a string or URI. If `service-account-issuer` is specified multiple times, tokens issued by any of the specified issuers are considered valid by the Kubernetes API server. You can specify specified `--service-account-key-file` flag multiple times with different files, It must be specified when `--service-account-signing-key` is provided. This File contains PEM-encoded x509 RSA or ECDSA private or public keys which are used to verify ServiceAccount tokens. No need for k8s version v1.22 or greater, it also works in the lower version of k8s v1.22. If `service-account-key-file` is specified multiple times, tokens signed by any of the specified keys are considered valid by the Kubernetes API server. You can use `--service-account-signing-key-file` flag for the path to the file that contains the current private key of the service account token issuer. The issuer will sign issued ID tokens with this private key. You can use `--api-audiences ` flag for Identifiers of the API. We can specify multiple audiences for whom the token is used. You can omit it also if not specified then it defaults to a single element list containing the issuer URL. If `api-audiences` is specified multiple times, tokens for any of the specified audiences are considered valid by the Kubernetes API server. For more information please see various flags used in [kube-apiserver](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/).

Thanks.

Hi @sftim @liggitt
Could you please take a look? and let me know your thoughts on this.

Hi, @liggitt @sftim I modified it acc. to the suggestion. we can append these lines to the commit. Please take a look at this one, and let me know any kind of changes or modifications you want.

`--service-account-issuer` can use for the Identifier of the service account token issuer. The issuer will assert this identifier in the "iss" claim of issued tokens. This value must be a string or URI. If `service-account-issuer` is specified multiple times, tokens issued by any of the specified issuers are considered valid by the Kubernetes API server. You can specify specified `--service-account-key-file` flag multiple times with different files, It must be specified when `--service-account-signing-key` is provided. This File contains PEM-encoded x509 RSA or ECDSA private or public keys which are used to verify ServiceAccount tokens. No need for k8s version v1.22 or greater, it also works in the lower version of k8s v1.22. If `service-account-key-file` is specified multiple times, tokens signed by any of the specified keys are considered valid by the Kubernetes API server. You can use `--service-account-signing-key-file` flag for the path to the file that contains the current private key of the service account token issuer. The issuer will sign issued ID tokens with this private key. You can use `--api-audiences ` flag for Identifiers of the API. We can specify multiple audiences for whom the token is used. You can omit it also if not specified then it defaults to a single element list containing the issuer URL. If `api-audiences` is specified multiple times, tokens for any of the specified audiences are considered valid by the Kubernetes API server. For more information please see various flags used in [kube-apiserver](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/).

Thanks.

sftim · 2022-01-10T09:23:47Z

/sig auth

liggitt · 2022-01-18T14:21:59Z

content/en/docs/tasks/configure-pod-container/configure-service-account.md

+You can specify the `--service-account-issuer` argument multiple times. This can be useful to
+enable a non-disruptive change of the key for an issuer.
+You must be running running Kubernetes v1.22 or later to be able to specify
+`--service-account-issuer` multiple times.


I'd suggest something like this:

You can specify the `--service-account-issuer` argument multiple times. This can be useful to enable a non-disruptive change of the issuer. The first issuer specified is used when signing new tokens, and all of the specified issuers are accepted when validating tokens presented to the API server. You must be running running Kubernetes v1.22 or later to be able to specify `--service-account-issuer` multiple times.

Thanks, @liggitt for looking at this.
this sounds good +1

I'd suggest something like this:

You can specify the `--service-account-issuer` argument multiple times. This can be useful to enable a non-disruptive change of the issuer. The first issuer specified is used when signing new tokens, and all of the specified issuers are accepted when validating tokens presented to the API server. You must be running running Kubernetes v1.22 or later to be able to specify `--service-account-issuer` multiple times.

But this is only for --service-account-issuer flag, should I mention about others flag or go with only --service-account-issuer flag.

We can copy in the CLI flag doc if that's helpful:

--service-account-key-file:

File containing PEM-encoded x509 RSA or ECDSA private or public keys, used to verify ServiceAccount tokens. The specified file can contain multiple keys, and the flag can be specified multiple times with different files.

--service-account-issuer:

When this flag is specified multiple times, the first is used to generate tokens and all are used to determine which issuers are accepted. You must be running running Kubernetes v1.22 or later to be able to specify --service-account-issuer multiple times.

--api-audiences:

The service account token authenticator will validate that tokens used against the API are bound to at least one of these audiences.

yes, @liggitt this is helpful for the readers, and I think the same thing that @sftim mentioned.
so I will update it soon.
Thanks.

Shubham82 · 2022-01-19T07:38:06Z

Hi @liggitt @sftim
I have addressed the comment, please take a look!

Thanks

liggitt · 2022-01-19T15:03:22Z

content lgtm, will defer to docs reviewer on formatting

Shubham82 · 2022-01-25T10:32:27Z

Hi @sftim
Could you please take a look at formatting as @liggitt suggested?

jimangel · 2022-02-01T02:02:48Z

content/en/docs/tasks/configure-pod-container/configure-service-account.md

 * `--service-account-signing-key-file`
+
+     Path to the file that contains the current private key of the service account token issuer. The issuer will sign issued ID tokens with this private key.


Suggested change

Path to the file that contains the current private key of the service account token issuer. The issuer will sign issued ID tokens with this private key.

Path to the file that contains the current private key of the service account token issuer. The issuer signs issued ID tokens with this private key.

jimangel · 2022-02-01T02:03:01Z

content/en/docs/tasks/configure-pod-container/configure-service-account.md

 * `--api-audiences` (can be omitted)

+     The service account token authenticator will validate that tokens used against the API are bound to at least one of these audiences. If `api-audiences` is specified multiple times, tokens for any of the specified audiences are considered valid by the Kubernetes API server. If the `--service-account-issuer` flag is configured and this flag is not, this field defaults to a single element list containing the issuer URL.


Suggested change

The service account token authenticator will validate that tokens used against the API are bound to at least one of these audiences. If `api-audiences` is specified multiple times, tokens for any of the specified audiences are considered valid by the Kubernetes API server. If the `--service-account-issuer` flag is configured and this flag is not, this field defaults to a single element list containing the issuer URL.

The service account token authenticator validates that tokens used against the API are bound to at least one of these audiences. If `api-audiences` is specified multiple times, tokens for any of the specified audiences are considered valid by the Kubernetes API server. If the `--service-account-issuer` flag is configured and this flag is not, this field defaults to a single element list containing the issuer URL.

Thanks, @jimangel for taking a look at this.
I will modify it soon.

Hi, @jimangel
I have Addressed the comment. Please take a look!

sftim · 2022-02-01T15:21:22Z

/label tide/merge-method-squash
/lgtm
/approve

LGTM also from #31237 (comment)

k8s-ci-robot · 2022-02-01T15:21:45Z

LGTM label has been added.

Git tree hash: 25d6792263ea361b1eb69cb04b3590bba109c5e6

k8s-ci-robot · 2022-02-01T15:21:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sftim

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [sftim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Added the note for --service-account-issuer flag.

36f29df

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jan 7, 2022

k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Jan 7, 2022

k8s-ci-robot requested review from liggitt and thockin January 7, 2022 09:52

k8s-ci-robot added language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. labels Jan 7, 2022

This was referenced Jan 7, 2022

Document that specifying --service-account-issuer multiple times requires k8s v1.22 or later #31235

Closed

Specifying --service-account-issuer multiple times only works as expected in 1.22+ #31236

Closed

sftim reviewed Jan 8, 2022

View reviewed changes

Modify the Note.

cf5f912

sftim reviewed Jan 10, 2022

View reviewed changes

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Jan 10, 2022

liggitt reviewed Jan 18, 2022

View reviewed changes

Added Content for each Flag.

088976c

jimangel reviewed Feb 1, 2022

View reviewed changes

Improvement: Modify the content.

ff133ee

k8s-ci-robot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Feb 1, 2022

k8s-ci-robot assigned sftim Feb 1, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 1, 2022

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 1, 2022

k8s-ci-robot merged commit 9af1c83 into kubernetes:main Feb 1, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added the note for --service-account-issuer flag. #31237

Added the note for --service-account-issuer flag. #31237

Shubham82 commented Jan 7, 2022

linux-foundation-easycla bot commented Jan 7, 2022 •

edited

Loading

Shubham82 commented Jan 7, 2022

netlify bot commented Jan 7, 2022 •

edited

Loading

annajung commented Jan 7, 2022

Shubham82 commented Jan 8, 2022

sftim Jan 8, 2022

Shubham82 Jan 10, 2022

Shubham82 Jan 10, 2022

sftim Jan 10, 2022

Shubham82 Jan 10, 2022

liggitt Jan 10, 2022

Shubham82 Jan 11, 2022

Shubham82 Jan 11, 2022

Shubham82 Jan 17, 2022

sftim commented Jan 10, 2022

liggitt Jan 18, 2022

Shubham82 Jan 18, 2022

liggitt Jan 18, 2022

Shubham82 Jan 18, 2022

Shubham82 commented Jan 19, 2022

liggitt commented Jan 19, 2022

Shubham82 commented Jan 25, 2022

jimangel Feb 1, 2022

jimangel Feb 1, 2022

Shubham82 Feb 1, 2022

Shubham82 Feb 1, 2022

sftim commented Feb 1, 2022

k8s-ci-robot commented Feb 1, 2022

k8s-ci-robot commented Feb 1, 2022

		To enable non-disruptive change of issuer we can specify `--service-account-issuer` flag multiple times to `kube-apiserver` for k8s v1.22 and later versions.

		{{< /note >}}

		* `--service-account-signing-key-file`

		Path to the file that contains the current private key of the service account token issuer. The issuer will sign issued ID tokens with this private key.

		* `--api-audiences` (can be omitted)

		The service account token authenticator will validate that tokens used against the API are bound to at least one of these audiences. If `api-audiences` is specified multiple times, tokens for any of the specified audiences are considered valid by the Kubernetes API server. If the `--service-account-issuer` flag is configured and this flag is not, this field defaults to a single element list containing the issuer URL.

Added the note for --service-account-issuer flag. #31237

Added the note for --service-account-issuer flag. #31237

Conversation

Shubham82 commented Jan 7, 2022

linux-foundation-easycla bot commented Jan 7, 2022 • edited Loading

Shubham82 commented Jan 7, 2022

netlify bot commented Jan 7, 2022 • edited Loading

annajung commented Jan 7, 2022

Shubham82 commented Jan 8, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sftim commented Jan 10, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Shubham82 commented Jan 19, 2022

liggitt commented Jan 19, 2022

Shubham82 commented Jan 25, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sftim commented Feb 1, 2022

k8s-ci-robot commented Feb 1, 2022

k8s-ci-robot commented Feb 1, 2022

linux-foundation-easycla bot commented Jan 7, 2022 •

edited

Loading

netlify bot commented Jan 7, 2022 •

edited

Loading