Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Set credential-id in userinfo.extra for jwt authenticators if jti claim present #127010

Merged
merged 1 commit into from
Aug 30, 2024
Merged

Set credential-id in userinfo.extra for jwt authenticators if jti claim present #127010

merged 1 commit into from
Aug 30, 2024

Conversation

aramase
Copy link
Member

@aramase aramase commented Aug 30, 2024 •
edited
Loading

/kind feature

  • JWT authenticator sets authentication.kubernetes.io/credential-id in extra if jti claim is present

fixes #126496

JWT authenticators now set the `jti` claim (if present and is a string value) as credential id for use by audit logging.

[KEP]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/3331-structured-authentication-configuration

/sig auth
/triage accepted
/priority important-soon

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. kind/feature Categorizes issue or PR as related to a new feature. sig/auth Categorizes an issue or PR as relevant to SIG Auth. triage/accepted Indicates an issue or PR is ready to be actively worked on. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. area/apiserver area/test sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/testing Categorizes an issue or PR as relevant to SIG Testing. labels Aug 30, 2024
@k8s-ci-robot k8s-ci-robot requested review from enj and liggitt August 30, 2024 00:13
@aramase aramase force-pushed the aramase/f/kep_3331_jti branch from b9a7d08 to 7d7884b Compare August 30, 2024 00:17
@aramase
Copy link
Member Author

aramase commented Aug 30, 2024

/assign enj liggitt

@aramase aramase force-pushed the aramase/f/kep_3331_jti branch 2 times, most recently from 0ca9982 to 34ba2bd Compare August 30, 2024 17:13
@liggitt
Copy link
Member

liggitt commented Aug 30, 2024

a couple more test cases, then lgtm

@aramase
Set credential-id in userinfo.extra for jwt authenticators if jti cla…
c22a41e 
…im present

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
@aramase aramase force-pushed the aramase/f/kep_3331_jti branch from 34ba2bd to c22a41e Compare August 30, 2024 18:02
@liggitt
Copy link
Member

liggitt commented Aug 30, 2024

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 30, 2024
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: 20f2842044007119040694124f9b10ce68b9034c

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aramase, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 30, 2024
@k8s-ci-robot k8s-ci-robot merged commit c3cb89e into kubernetes:master Aug 30, 2024
15 checks passed
@k8s-ci-robot k8s-ci-robot added this to the v1.32 milestone Aug 30, 2024
@aramase aramase deleted the aramase/f/kep_3331_jti branch August 30, 2024 19:07
@enj enj mentioned this pull request Oct 31, 2024
Open
41 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@liggitt liggitt liggitt left review comments

@enj enj Awaiting requested review from enj

Assignees

@liggitt liggitt

@enj enj

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver area/test cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
SIG Auth
Archived in project
Milestone
v1.32
Development

Successfully merging this pull request may close these issues.

JWT authenticator should set authentication.kubernetes.io/credential-id in extra if jti claim is present
4 participants
@aramase @liggitt @k8s-ci-robot @enj