WIP: 🐛 authentication: add custom SA lookup with ttl cache for non-local clusters #3274

sttts · 2025-01-26T22:07:27Z

Summary

With service accounts valid (even as system:anonymous+system:authenticated) on other clusters, we have to validate them on other shards. As there are many service accounts, we cannot distribute them via the cache server. But luckily there are not many those service accounts. We can use some ttl cache for that and use a real external client.

TODO

wire external client

Related issue(s)

Fixes # #3289

Release Notes

NONE

kcp-ci-bot · 2025-01-26T22:07:32Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from sttts. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…sters Signed-off-by: Dr. Stefan Schimanski <[email protected]>

kcp-ci-bot · 2025-03-15T23:31:12Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

TODO: this commit may be dropped once kcp-dev/kcp#3274 and related issues are done Signed-off-by: Karol Szwaj <[email protected]> On-behalf-of: @SAP [email protected]

kcp-ci-bot · 2025-06-14T08:39:38Z

Issues go stale after 90d of inactivity.
After a furter 30 days, they will turn rotten.
Mark the issue as fresh with /remove-lifecycle stale.

If this issue is safe to close now please do so with /close.

/lifecycle stale

TODO: this commit may be dropped once kcp-dev/kcp#3274 and related issues are done Signed-off-by: Karol Szwaj <[email protected]> On-behalf-of: @SAP [email protected] Signed-off-by: Nelo-T. Wallus <[email protected]>

kcp-ci-bot · 2025-07-14T08:40:04Z

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

/lifecycle rotten

TODO: this commit may be dropped once kcp-dev/kcp#3274 and related issues are done Signed-off-by: Karol Szwaj <[email protected]> On-behalf-of: @SAP [email protected] Signed-off-by: Nelo-T. Wallus <[email protected]>

kcp-ci-bot · 2025-08-13T08:40:31Z

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

/close

kcp-ci-bot · 2025-08-13T08:40:35Z

@kcp-ci-bot: Closed this PR.

Details

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

TODO: this commit may be dropped once kcp-dev/kcp#3274 and related issues are done Signed-off-by: Karol Szwaj <[email protected]> On-behalf-of: @SAP [email protected] Signed-off-by: Nelo-T. Wallus <[email protected]> Signed-off-by: Nelo-T. Wallus <[email protected]>

TODO: this commit may be dropped once kcp-dev/kcp#3274 and related issues are done Signed-off-by: Karol Szwaj <[email protected]> On-behalf-of: @SAP [email protected] Signed-off-by: Nelo-T. Wallus <[email protected]>

mjudeikis · 2025-12-08T08:25:56Z

We need to revist this

kcp-ci-bot · 2025-12-08T08:26:16Z

@sttts: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-kcp-test-e2e	`82d13e5`	link	true	`/test pull-kcp-test-e2e`
pull-kcp-test-e2e-sharded	`82d13e5`	link	true	`/test pull-kcp-test-e2e-sharded`
pull-kcp-test-e2e-shared	`82d13e5`	link	true	`/test pull-kcp-test-e2e-shared`
pull-kcp-test-e2e-multiple-runs	`82d13e5`	link	true	`/test pull-kcp-test-e2e-multiple-runs`
pull-kcp-test-unit	`82d13e5`	link	true	`/test pull-kcp-test-unit`
pull-kcp-lint	`82d13e5`	link	true	`/test pull-kcp-lint`
pull-kcp-validate-prow-yaml	`82d13e5`	link	true	`/test pull-kcp-validate-prow-yaml`

Full PR test history

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

TODO: this commit may be dropped once kcp-dev/kcp#3274 and related issues are done Signed-off-by: Karol Szwaj <[email protected]> On-behalf-of: @SAP [email protected] Signed-off-by: Nelo-T. Wallus <[email protected]>

kcp-ci-bot · 2026-01-07T08:42:47Z

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

/close

kcp-ci-bot · 2026-01-07T08:42:51Z

@kcp-ci-bot: Closed this PR.

Details

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

mjudeikis · 2026-01-07T08:43:35Z

/reopen
/remove-lifecycle rotten

kcp-ci-bot · 2026-01-07T08:43:39Z

@mjudeikis: Reopened this PR.

Details

In response to this:

/reopen
/remove-lifecycle rotten

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

kcp-ci-bot added release-note-none Denotes a PR that doesn't merit a release note. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. dco-signoff: yes Indicates the PR's author has signed the DCO. labels Jan 26, 2025

kcp-ci-bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jan 26, 2025

sttts mentioned this pull request Jan 26, 2025

🌱 stop the bleeding: e2e/sharded: temporarily disable service account lookup #3275

Merged

embik added this to the v0.27.0 milestone Feb 4, 2025

embik mentioned this pull request Feb 10, 2025

🌱 Fix flaky SA test #3290

Merged

embik removed this from the v0.27.0 milestone Feb 24, 2025

kcp-ci-bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 24, 2025

authentication: add custom SA lookup with ttl cache for non-local clu…

82d13e5

…sters Signed-off-by: Dr. Stefan Schimanski <[email protected]>

sttts force-pushed the sttts-sa-lookup-cache branch from c6c34c8 to 82d13e5 Compare February 24, 2025 21:10

kcp-ci-bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 24, 2025

This was referenced Mar 12, 2025

Add kube feature gate for global service account kcp-dev/kubernetes#164

Closed

DROP: Add kube feature gate for global service account kcp-dev/kubernetes#165

Merged

🌱 Add kube feature gate for global service account #3328

Merged

kcp-ci-bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 15, 2025

kcp-ci-bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 14, 2025

kcp-ci-bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Jul 14, 2025

mjudeikis mentioned this pull request Aug 4, 2025

feature: Enable cross-shard service account authentication #3510

Open

1 task

kcp-ci-bot closed this Aug 13, 2025

mjudeikis reopened this Dec 8, 2025

kcp-ci-bot added the do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. label Dec 8, 2025

kcp-ci-bot closed this Jan 7, 2026

kcp-ci-bot reopened this Jan 7, 2026

kcp-ci-bot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Jan 7, 2026

WIP: 🐛 authentication: add custom SA lookup with ttl cache for non-local clusters #3274

Are you sure you want to change the base?

WIP: 🐛 authentication: add custom SA lookup with ttl cache for non-local clusters #3274

Uh oh!

Conversation

sttts commented Jan 26, 2025 • edited by mjudeikis Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

TODO

Related issue(s)

Release Notes

Uh oh!

kcp-ci-bot commented Jan 26, 2025

Uh oh!

kcp-ci-bot commented Mar 15, 2025

Uh oh!

kcp-ci-bot commented Jun 14, 2025

Uh oh!

kcp-ci-bot commented Jul 14, 2025

Uh oh!

kcp-ci-bot commented Aug 13, 2025

Uh oh!

kcp-ci-bot commented Aug 13, 2025

Uh oh!

mjudeikis commented Dec 8, 2025

Uh oh!

kcp-ci-bot commented Dec 8, 2025

Uh oh!

kcp-ci-bot commented Jan 7, 2026

Uh oh!

kcp-ci-bot commented Jan 7, 2026

Uh oh!

mjudeikis commented Jan 7, 2026

Uh oh!

kcp-ci-bot commented Jan 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sttts commented Jan 26, 2025 •

edited by mjudeikis

Loading