Fix authentication in sharded setup.

[mjudeikis]

Summary

What Type of PR Is This?

Kubernetes only checks on the provided keys to SA validity. Not chain.
FrontProxy without flags denies SA's as "not enabled"
This boils down to "every shard & frontproxy must use same SA certs"

In addition SubjectAccessReview calls in delegated authentication mode are passed down to the shards. So if OIDC is used, shards need to be able to verify the tokens.

FrontProxy with enabled SA authentication:

  containers:
  - args:
    - --secure-port=6443
    - --root-kubeconfig=/etc/kcp-front-proxy/kubeconfig/kubeconfig
    - --shards-kubeconfig=/etc/kcp-front-proxy/kubeconfig/kubeconfig
    - --tls-private-key-file=/etc/kcp-front-proxy/tls/tls.key
    - --tls-cert-file=/etc/kcp-front-proxy/tls/tls.crt
    - --client-ca-file=/etc/kcp-front-proxy/client-ca/tls.crt
    - --mapping-file=/etc/kcp-front-proxy/config/path-mapping.yaml
    - --service-account-lookup=false
    - --service-account-key-file=/etc/kcp/tls/shard-sample/service-account/tls.key
    - --service-account-key-file=/etc/kcp/tls/secondary-shard/service-account/tls.key
    - --service-account-key-file=/etc/kcp/tls/shard2-sample/service-account/tls.key

/kind bug

Related Issue(s)

Fixes #

Release Notes

Fix ServiceAccount resolution & authentication in sharded model

[Copilot]

Pull Request Overview

This PR fixes authentication issues in sharded KCP setups by implementing proper ServiceAccount authentication configuration. The changes enable FrontProxy and shards to share ServiceAccount certificates and configure OIDC token verification across all components.

Key changes:

• Adds ServiceAccount authentication configuration to AuthSpec for FrontProxy, RootShard, and Shard resources
• Implements automatic mounting of all shard ServiceAccount certificates to FrontProxy when enabled
• Updates RootShard controller to track child shards in status for certificate distribution

Reviewed Changes

Copilot reviewed 30 out of 30 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
sdk/apis/operator/v1alpha1/frontproxy_types.go	Adds ServiceAccountAuthentication struct and field to AuthSpec
sdk/apis/operator/v1alpha1/shard_types.go	Adds Auth field to CommonShardSpec for shard authentication
sdk/apis/operator/v1alpha1/rootshard_types.go	Adds ShardReference tracking to RootShardStatus
internal/resources/utils/authentication.go	Implements ServiceAccount certificate mounting logic
internal/resources/frontproxy/deployment.go	Updates to use new FrontProxy-specific auth configuration
internal/controller/rootshard_controller.go	Adds shard tracking and watching logic
config/samples/	Sample configurations demonstrating new authentication features

[mjudeikis]

/retest

[embik]

Minor language/typo nit. Don't forget to re-run codegen afterwards.

[mjudeikis]

/retest

[embik]

/approve

[kcp-ci-bot]

LGTM label has been added.

Details

Git tree hash: 2b1ee69a5f5d3ec0ed376168deb0f5e54de7272d

[kcp-ci-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: embik

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [embik]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment