Merge pull request #9133 from justinsb/service_account_jwks_uri_flag

Map kube-apiserver service-account-jwks-uri flag

k8s/crds/kops.k8s.io_clusters.yaml

@@ -1268,6 +1268,11 @@ spec:
                       issuer will assert this identifier in "iss" claim of issued
                       tokens. This value is a string or URI.
                     type: string
+                  serviceAccountJWKSURI:
+                    description: ServiceAccountJWKSURI overrides the path for the
+                      jwks document; this is useful when we are republishing the service
+                      account discovery information elsewhere.
+                    type: string
                   serviceAccountKeyFile:
                     description: File containing PEM-encoded x509 RSA or ECDSA private
                       or public keys, used to verify ServiceAccount tokens. The specified

pkg/apis/kops/componentconfig.go

@@ -455,6 +455,9 @@ type KubeAPIServerConfig struct {
 	// in "iss" claim of issued tokens. This value is a string or URI.
 	ServiceAccountIssuer *string `json:"serviceAccountIssuer,omitempty" flag:"service-account-issuer"`
 
+	// ServiceAccountJWKSURI overrides the path for the jwks document; this is useful when we are republishing the service account discovery information elsewhere.
+	ServiceAccountJWKSURI *string `json:"serviceAccountJWKSURI,omitempty" flag:"service-account-jwks-uri"`
+
 	// Identifiers of the API. The service account token authenticator will validate that
 	// tokens used against the API are bound to at least one of these audiences. If the
 	// --service-account-issuer flag is configured and this flag is not, this field

pkg/apis/kops/v1alpha2/componentconfig.go

@@ -455,6 +455,9 @@ type KubeAPIServerConfig struct {
 	// in "iss" claim of issued tokens. This value is a string or URI.
 	ServiceAccountIssuer *string `json:"serviceAccountIssuer,omitempty" flag:"service-account-issuer"`
 
+	// ServiceAccountJWKSURI overrides the path for the jwks document; this is useful when we are republishing the service account discovery information elsewhere.
+	ServiceAccountJWKSURI *string `json:"serviceAccountJWKSURI,omitempty" flag:"service-account-jwks-uri"`
+
 	// Identifiers of the API. The service account token authenticator will validate that
 	// tokens used against the API are bound to at least one of these audiences. If the
 	// --service-account-issuer flag is configured and this flag is not, this field

pkg/apis/kops/v1alpha2/zz_generated.conversion.go

@@ -3785,6 +3785,7 @@ func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku
 	out.ServiceAccountKeyFile = in.ServiceAccountKeyFile
 	out.ServiceAccountSigningKeyFile = in.ServiceAccountSigningKeyFile
 	out.ServiceAccountIssuer = in.ServiceAccountIssuer
+	out.ServiceAccountJWKSURI = in.ServiceAccountJWKSURI
 	out.APIAudiences = in.APIAudiences
 	out.CPURequest = in.CPURequest
 	out.EventTTL = in.EventTTL
@@ -3887,6 +3888,7 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *ko
 	out.ServiceAccountKeyFile = in.ServiceAccountKeyFile
 	out.ServiceAccountSigningKeyFile = in.ServiceAccountSigningKeyFile
 	out.ServiceAccountIssuer = in.ServiceAccountIssuer
+	out.ServiceAccountJWKSURI = in.ServiceAccountJWKSURI
 	out.APIAudiences = in.APIAudiences
 	out.CPURequest = in.CPURequest
 	out.EventTTL = in.EventTTL

pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go

@@ -2253,6 +2253,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
 		*out = new(string)
 		**out = **in
 	}
+	if in.ServiceAccountJWKSURI != nil {
+		in, out := &in.ServiceAccountJWKSURI, &out.ServiceAccountJWKSURI
+		*out = new(string)
+		**out = **in
+	}
 	if in.APIAudiences != nil {
 		in, out := &in.APIAudiences, &out.APIAudiences
 		*out = make([]string, len(*in))

pkg/apis/kops/zz_generated.deepcopy.go

@@ -2435,6 +2435,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) {
 		*out = new(string)
 		**out = **in
 	}
+	if in.ServiceAccountJWKSURI != nil {
+		in, out := &in.ServiceAccountJWKSURI, &out.ServiceAccountJWKSURI
+		*out = new(string)
+		**out = **in
+	}
 	if in.APIAudiences != nil {
 		in, out := &in.APIAudiences, &out.APIAudiences
 		*out = make([]string, len(*in))