kubernetes
/
apiserver
mirror of https://github.com/kubernetes/apiserver.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add TokenRequestServiceAccountUIDValidation feature gate with UID validation 

This change introduces the TokenRequestServiceAccountUIDValidation feature
gate and implements feature-gated service account UID validation for the
TokenRequest API. When enabled, the API validates that the service account
UID in token requests matches the actual service account UID, preventing
token requests for recreated service accounts with the same name but
different UIDs.

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 45dfb46448a130482e9050664f9d7f7288c0b4b3
This commit is contained in:
Anish Ramasekar 2025-07-07 16:51:41 -07:00 committed by Kubernetes Publisher
parent 6dc2a56d3a
commit c42cceba12
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/features/kube_features.go
View File

@ -216,6 +216,16 @@ const (
// Enables Structured Authorization Configuration
StructuredAuthorizationConfiguration featuregate.Feature = "StructuredAuthorizationConfiguration"
// owner: @aramase
//
// Enables validation of service account UID in TokenRequest API.
//
// This feature gate is used to ensure that the UID provided in the TokenRequest
// matches the UID of the service account for which the token is being requested.
// It helps prevent misuse of the TokenRequest API by ensuring that tokens are only
// issued for the correct service account.
TokenRequestServiceAccountUIDValidation featuregate.Feature = "TokenRequestServiceAccountUIDValidation"
// owner: @enj
//
// Enables http2 DOS mitigations for unauthenticated clients.
@ -411,6 +421,10 @@ var defaultVersionedKubernetesFeatureGates = map[featuregate.Feature]featuregate
{Version: version.MustParse("1.32"), Default: true, PreRelease: featuregate.GA, LockToDefault: true},
},
TokenRequestServiceAccountUIDValidation: {
{Version: version.MustParse("1.34"), Default: true, PreRelease: featuregate.Beta},
},
UnauthenticatedHTTP2DOSMitigation: {
{Version: version.MustParse("1.25"), Default: false, PreRelease: featuregate.Beta},
{Version: version.MustParse("1.29"), Default: true, PreRelease: featuregate.Beta},