KEP-4193: Update ServiceAccount admin docs with additional info on bound tokens #48495
Conversation
k8s-ci-robot
added
language/en
munnerz
changed the title
k8s-ci-robot
added
the
size/M
👷 Deploy Preview for kubernetes-io-vnext-staging processing.
|
✅ Pull request preview available for checkingBuilt without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify site configuration. |
|
/sig auth |
k8s-ci-robot
added
the
sig/auth
| ```json | ||
| { | ||
| "aud": [ | ||
| "https://kubernetes.default.svc.cluster.local" |
There was a problem hiding this comment.
make it clear with a comment that this is an example and can vary from cluster to cluster, and from token to token (you can switch the formatting type to yaml and add # comments that will get formatted nicely) (or better yet, make this clearly a dummy value like https://my-audience.example.com)
| ], | ||
| "exp": 1729605240, | ||
| "iat": 1729601640, | ||
| "iss": "https://kubernetes.default.svc.cluster.local", |
There was a problem hiding this comment.
same comment that this is an example and can vary from cluster to cluster (or better yet, make this clearly a dummy value like https://my-cluster.example.com)
|
Hi @munnerz 👋 could we take a look at the unaddressed comments above ahead of tomorrow's docs freeze? The deadline for docs is tomorrow at 18:00 PDT. Thanks! |
content/en/docs/reference/access-authn-authz/service-accounts-admin.md
Outdated
Show resolved
Hide resolved
content/en/docs/reference/access-authn-authz/service-accounts-admin.md
Outdated
Show resolved
Hide resolved
content/en/docs/reference/access-authn-authz/service-accounts-admin.md
Outdated
Show resolved
Hide resolved
content/en/docs/reference/access-authn-authz/service-accounts-admin.md
Outdated
Show resolved
Hide resolved
content/en/docs/reference/access-authn-authz/service-accounts-admin.md
Outdated
Show resolved
Hide resolved
|
Comments addressed, PTAL :) |
content/en/docs/reference/access-authn-authz/service-accounts-admin.md
Outdated
Show resolved
Hide resolved
content/en/docs/reference/access-authn-authz/service-accounts-admin.md
Outdated
Show resolved
Hide resolved
content/en/docs/reference/access-authn-authz/service-accounts-admin.md
Outdated
Show resolved
Hide resolved
content/en/docs/reference/access-authn-authz/service-accounts-admin.md
Outdated
Show resolved
Hide resolved
|
@kubernetes/sig-auth-leads i know Jordan has re-reviewed this a couple of hours ago, so as an FYI we'll need a tech LGTM as an outcome here. @munnerz PTAL at Jordan's further comments and we'll have SIG Docs eyes on this soon |
…admin.md Co-authored-by: Jordan Liggitt <[email protected]>
Co-authored-by: Jordan Liggitt <[email protected]>
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
LGTM label has been added. Git tree hash: f96dccb80d77593357de9e43d8f88a3010a4d222
|
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: natalisucks The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
7 participants
Description
Adds additional information on handling bound service account tokens, including details on external validation, as per KEP 4193.
Issue
kubernetes/enhancements#4193
/cc @liggitt