Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🛡 Enable ServiceAccount token projection and token requestor #467

Merged
merged 4 commits into from
Feb 11, 2022
Merged

🛡 Enable ServiceAccount token projection and token requestor #467

merged 4 commits into from
Feb 11, 2022

Conversation

rfranzke
Copy link
Member

@rfranzke rfranzke commented Dec 22, 2021 •
edited
Loading

How to categorize this PR?

/area security
/kind enhancement
/merge squash

What this PR does / why we need it:

  • When the extension is running on a seed with a gardenlet of at least v1.37 then
    • ServiceAccount token projection is enabled.
    • the components deployed into shoot namespaces
      • uses ServiceAccount token projection.
      • uses a token managed by GRM's token requestor instead of a client certificate.
    • the Prometheus configuration is adapted.

Which issue(s) this PR fixes:
Part of gardener/gardener#4659
Part of gardener/gardener#4878

Special notes for your reviewer:
✅ Depends on #463, hence, PR is in draft state.
✅ Depends on #478, hence, PR is in draft state.

Release note:

The extension controller uses a projected `ServiceAccount` token in case it runs on a seed with a gardenlet of at least `v1.37` or higher. Similarly, the components deployed into shoot namespaces will no longer use a client certificate but an auto-rotated `ServiceAccount` token which is only valid for `12h`.

@gardener-robot gardener-robot added area/security Security related kind/enhancement Enhancement, improvement, extension merge/squash Should be merged via 'Squash and merge' needs/review Needs review size/xl Size of pull request is huge (see gardener-robot robot/bots/size.py) needs/second-opinion Needs second review by someone else labels Dec 22, 2021
@gardener-robot-ci-3 gardener-robot-ci-3 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Dec 22, 2021
@rfranzke rfranzke added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Dec 22, 2021
@gardener-robot-ci-1 gardener-robot-ci-1 added needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Dec 23, 2021
@rfranzke rfranzke mentioned this pull request Jan 10, 2022
Closed
@rfranzke rfranzke changed the title 🛡 Revendor gardener/gardener@v1.39, enable ServiceAccount token projection and token requestor 🛡 Enable ServiceAccount token projection and token requestor Jan 20, 2022
@gardener-robot-ci-3 gardener-robot-ci-3 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Jan 20, 2022
This was referenced Jan 24, 2022
Closed
Closed
Closed
@gardener-robot-ci-2 gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jan 25, 2022
@rfranzke
Copy link
Member Author

/ready
/invite @BeckerMax @timebertt

@gardener-robot gardener-robot marked this pull request as ready for review January 25, 2022 08:19
@gardener-robot gardener-robot requested review from a team as code owners January 25, 2022 08:19
@gardener-robot-ci-3 gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jan 25, 2022
@rfranzke rfranzke marked this pull request as draft January 27, 2022 06:53
@gardener-robot-ci-2 gardener-robot-ci-2 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Jan 27, 2022
@gardener-robot-ci-2 gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Feb 9, 2022
@gardener-robot-ci-1 gardener-robot-ci-1 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Feb 9, 2022
@BeckerMax
Copy link
Contributor

/assign

dkistner
dkistner previously approved these changes Feb 11, 2022
View reviewed changes
Copy link
Member

@dkistner dkistner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

Sorry for the delay.

charts/internal/cloud-controller-manager/templates/cloud-controller-manager-svc.yaml
@@ -1,18 +0,0 @@
apiVersion: v1
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm good point this service was never be used right?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The service is maintained here: https://github.com/gardener/gardener-extension-provider-aws/blob/master/charts/internal/seed-controlplane/charts/cloud-controller-manager/templates/service.yaml

This file was probably "forgotten/overlooked" when the seed-controlplane chart was introduced and not used since then, yes.

@gardener-robot gardener-robot added reviewed/lgtm Has approval for merging and removed needs/review Needs review needs/second-opinion Needs second review by someone else labels Feb 11, 2022
@dkistner
Copy link
Member

/rebase

@gardener-robot gardener-robot added needs/rebase Needs git rebase and removed reviewed/lgtm Has approval for merging labels Feb 11, 2022
@gardener-robot gardener-robot added needs/review Needs review needs/second-opinion Needs second review by someone else labels Feb 11, 2022
@gardener-robot-ci-3 gardener-robot-ci-3 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Feb 11, 2022
@dkistner dkistner merged commit 49bca2f into gardener:master Feb 11, 2022
@rfranzke rfranzke deleted the enh/tr branch February 11, 2022 08:07
@ialidzhikov ialidzhikov mentioned this pull request Feb 17, 2022
Merged
@rfranzke rfranzke mentioned this pull request Feb 19, 2022
Merged
@rfranzke rfranzke mentioned this pull request Apr 29, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dkistner dkistner dkistner approved these changes

@BeckerMax BeckerMax Awaiting requested review from BeckerMax

@timebertt timebertt Awaiting requested review from timebertt

Assignees

@BeckerMax BeckerMax

Labels
area/security Security related kind/enhancement Enhancement, improvement, extension merge/squash Should be merged via 'Squash and merge' needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) needs/rebase Needs git rebase needs/review Needs review needs/second-opinion Needs second review by someone else size/xl Size of pull request is huge (see gardener-robot robot/bots/size.py)
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@rfranzke @BeckerMax @dkistner @gardener-robot-ci-1 @gardener-robot-ci-2 @gardener-robot-ci-3 @gardener-robot