/sig auth

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

Hello @nabokihms 👋, 1.26 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PDT on Thursday 6th October 2022.

This enhancement is targeting for stage alpha for 1.26 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.26
• KEP readme has a updated detailed test plan section filled out
• KEP readme has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

It looks #3332 will address most of these issues.

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

/milestone v1.27

Question... It looks like the discovery url can only be HTPS. For better integration with SPIFFE, it would be very nice if it could refer to a unix socket that speaks HTTP to gather the JWKS info. Would this be ok? Should that be discussed/added here, or should I open up another issue?

Hi @aramase, @enj 👋, I'm James Spurin, a 1.32 Docs Shadow. Great to meet you.

Does this enhancement work planned for 1.32 require any new docs or modifications to the existing docs?

If so, please follows the steps here to open a PR against dev-1.32 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday October 24th 2024 18:00 PDT.

Also, take a look at Documenting for a release to familiarise with the docs requirement for the release.

Thank you!

Hello hello @nabokihms @aramase @enj 👋 from the v1.32 Communications Team!

We'd love for you to consider writing a feature blog about your enhancement.
Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and it is graduating.

To opt-in, let us know by opening a Feature Blog placeholder PR against the website repository by 30th Oct 2024. For more information about writing a blog see the blog contribution guidelines.

Note: In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we finalize the blog schedule.

Hi @aramase, @enj 👋,

Just a reminder to open a placeholder PR against dev-1.32 branch in the k/website repo for this (steps available here) for this KEP if it requires new or modifications to existing docs.

The deadline for this is Thursday Oct 24 at 18:00 PDT.

Thanks

James Spurin

The docs changes have already merged: kubernetes/website#47821. I don't have permissions to update the issue.

Hello @aramase @enj 👋, Enhancements team here.

With all the implementation(code related) PRs merged as per the issue description:

• add StructuredAuthenticationConfiguration feature to kube feature gates file kubernetes#121622
• [StructuredAuthnConfig] add comment for extra keys unique requirement kubernetes#122560
• cleanup structured authn/authz error logic kubernetes#122975
• Add AudienceMatchPolicy and support multiple audiences in AuthenticationConfiguration kubernetes#123165
• Add apiserver_authentication_jwt_authenticator_latency_seconds metric kubernetes#123225
• Support all key algs with structured authn config kubernetes#123282
• Add integration test for multiple audience in structured authn kubernetes#123305
• Support multiple JWT authenticators with structured authn config kubernetes#123431
• add min valid jwt payload to API docs for structured authn config kubernetes#123458
• Add dynamic reload support for authentication configuration kubernetes#123525
• Add DiscoveryURL to Authentication Configuration kubernetes#123527
• Prevent conflicts between service account and jwt issuers kubernetes#123561
• jwt: fail on empty username via CEL expression kubernetes#123568
• Duplicate v1alpha1 AuthenticationConfiguration to v1beta1 kubernetes#123696
• Mark StructuredAuthenticationConfiguration feature gate as beta kubernetes#123719
• Fix AuthenticationConfiguration docs around nested claims via CEL kubernetes#123721
• Require email_verified to be used when email is set as username via CEL kubernetes#123737
• Add metrics for authentication config reload kubernetes#123793
• fix test flake in TestStructuredAuthenticationConfigReload kubernetes#123856

This enhancement is now marked as tracked for code freeze for the 1.32 Code Freeze!

Please note that KEPs targeting stable need to have the status field marked as implemented in the kep.yaml file after code PRs are merged and the feature gates are removed.

This will be worked on in 1.33 but stay in beta
/milestone v1.33
/label lead-opted-in

Hello @nabokihms 👋, v1.33 Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 14th February 2025 / 19:00 PDT Thursday 13th February 2025.

This enhancement is targeting stage beta for v1.33 (correct me, if otherwise)
/stage beta

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: v1.33. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here). If your production readiness review is not completed yet, please make sure to fill the production readiness questionnaire in your KEP by the PRR Freeze deadline on Thursday 6th February 2025 so that the PRR team has enough time to review your KEP.

For this KEP, we would just need to update the following:

• Description needs to reflect the correct Beta release target (x.y): v1.33

With all the KEP requirements in place and merged into k/enhancements, this enhancement is all good for the upcoming enhancements freeze. 🚀

The status of this enhancement is marked as Tracked for enhancements freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

/label tracked/yes

Description needs to reflect the correct Beta release target (x.y): v1.33

The existing beta target of 1.30 is correct, as the feature has been beta since then, and will continue to be beta in 1.33.

Hello, @aramase @enj @nabokihms 👋, v1.33 Docs Shadow here.

Does this enhancement work planned for v1.33 require any new docs or modifications to existing docs?

If so, please follow the steps here to open a PR against dev-1.33 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday 27th February 2025 18:00 PDT.

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!

Hi @nabokihms @aramase @enj 👋 -- this is Ryota (@rytswd) from the 1.33 Communications Team!

For the 1.33 release, we are currently in the process of collecting and curating a list of potential feature blogs, and we'd love for you to consider writing one for your enhancement!

As you may be aware, feature blogs are a great way to communicate to users about features which fall into (but not limited to) the following categories:

• This introduces some breaking change(s)
• This has significant impacts and/or implications to users
• ...Or this is a long-awaited feature, which would go a long way to cover the journey more in detail 🎉

To opt in to write a feature blog, could you please let us know and open a "Feature Blog placeholder PR" (which can be only a skeleton at first) against the website repository by Wednesday, 5th March, 2025? For more information about writing a blog, please find the blog contribution guidelines 📚

Hi @nabokihms, @aramase and @enj 👋, 1.33 Communications Team here again!

This is a gentle reminder for the feature blog deadline mentioned above, which is 02:00 UTC Wednesday, 5th March, 2025. To opt in, please let us know and open a Feature Blog placeholder PR against k/website by the deadline. If you have any questions, please feel free to reach out to us!

Hey again @nabokihms 👋, v1.33 Enhancements team here,

Just checking in as we approach code freeze at 02:00 UTC Friday 21st March 2025 / 19:00 PDT Thursday 20th March 2025.

Here's where this enhancement currently stands:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PRs are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

For this enhancement, it looks like the following PRs need to be merged before code freeze (and we need to update the Issue description to include all the related PRs of this KEP):

• Add JWKS fetch metrics for jwt authenticator kubernetes#123642

If you anticipate missing code freeze, you can file an exception request in advance.

Also, please let me know if there are other PRs in k/k we should be tracking for this KEP.

The status of this enhancement is marked as at risk for code freeze.

Hi @nabokihms @enj @aramase 👋, v1.33 Enhancements team here,

Just a quick friendly reminder as we approach the code freeze later this week, at 02:00 UTC Friday 21st March 2025 / 19:00 PDT Thursday 20th March 2025.

The current status of this enhancement is marked as At risk for code freeze. There are a few requirements mentioned in the comment #3331 (comment) that still need to be completed.

If you anticipate missing code freeze, you can file an exception request in advance. Thank you!

Hello @nabokihms @enj @aramase 👋, v1.33 Enhancements team here,

Unfortunately, the implementation (code-related) PRs associated with this enhancement are not in the merge-ready state by code-freeze and hence this enhancement is now removed from the v1.33 milestone.

If you still wish to progress this enhancement in v1.33, please file an exception request as soon as possible, within three days. If you have any questions, you can reach out in the #release-enhancements channel on Slack and we'll be happy to help. Thanks!

/milestone clear