chore: Deprecate the Shoot field `.kubeAPIServer.enableAnonymousAuthentication` #11984

marc1404 · 2025-04-30T14:35:09Z

How to categorize this PR?

/area control-plane
/area robustness
/kind task
/kind api-change

What this PR does / why we need it:

This PR deprecates the Shoot field spec.kubernetes.kubeAPIServer.enableAnonymousAuthentication.
It adds validation that prevents users from configuring the legacy setting in the Shoot spec at the same time as the preferred anonymous authentication configuration.

Once the Kubernetes feature gate AnonymousAuthConfigurableEndpoints graduates, we should forbid setting .kubeAPIServer.enableAnonymousAuthentication in the Shoot spec (it remains in Beta state with Kubernetes v1.33).
Finally, further out in the future, when Gardener only supports Kubernetes versions with the stable AnonymousAuthConfigurableEndpoints feature, we should drop the legacy field altogether.

Which issue(s) this PR fixes:

Fixes #11657

Special notes for your reviewer:

Reviewing the individual commits is easier.

/cc @LucaBernstein @dimityrmirchev

I used #10666 as a reference. Thanks for the well-structured PR @AleksandarSavchev!

Release note:

The `spec.kubernetes.kubeAPIServer.enableAnonymousAuthentication` field in the `Shoot` API is deprecated and will be removed in a future release. Before removal, it will be forbidden to set the field when using a future Kubernetes version that graduates the feature gate `AnonymousAuthConfigurableEndpoints`.

marc1404 · 2025-04-30T14:50:26Z

Test Integration Operator Garden Garden Suite: [It] Garden controller tests should successfully reconcile and delete a Garden

[FAILED] Timed out after 10.061s.
Expected
    <[]string | len:0, cap:0>: []
to consist of
    <[]string | len:2, cap:2>: [
        "virtual-garden-etcd-main",
        "virtual-garden-etcd-events",
    ]
the missing elements were
    <[]string | len:2, cap:2>: [
        "virtual-garden-etcd-main",
        "virtual-garden-etcd-events",
    ]
In [It] at: /home/prow/go/src/github.com/gardener/gardener/test/integration/operator/garden/garden/garden_test.go:551 @ 04/30/25 14:40:59.34

/test pull-gardener-integration

LucaBernstein

Nice, thank you for this PR!
/lgtm

rfranzke

Can you also send a warning when a Shoot specifies this field? https://github.com/gardener/gardener/blob/master/pkg/api/core/shoot/warnings.go

…Authentication`

…ation

marc1404 · 2025-05-02T07:57:47Z

Can you also send a warning when a Shoot specifies this field? master/pkg/api/core/shoot/warnings.go

Good idea! Fixed via: 9e8c9b7 (#11984)

rfranzke

/lgtm
/approve

gardener-prow · 2025-05-02T12:07:33Z

LGTM label has been added.

Git tree hash: 66fb23aea2881cbb2430b8e17837fec9bf3e4f8d

gardener-prow · 2025-05-02T12:07:37Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rfranzke

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [rfranzke]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

marc1404 · 2025-05-02T13:26:04Z

Test E2E Gardener Suite: [It] Shoot Tests Create Shoot, Rotate Credentials and Delete Shoot Shoot with workers with workers rollout, in-place update strategy Wait for Shoot to be reconciled [Shoot, default, credentials-rotation, basic, with-workers-rollout, in-place]

A spec timeout occurred timedout [TIMEDOUT] A spec timeout occurred
In [It] at: /home/prow/go/src/github.com/gardener/gardener/test/e2e/gardener/shoot/create_rotate_delete.go:103 @ 05/02/25 13:20:48.532

This is the Progress Report generated when the spec timeout occurred:
  Shoot Tests Create Shoot, Rotate Credentials and Delete Shoot Shoot with workers with workers rollout, in-place update strategy Wait for Shoot to be reconciled (Spec Runtime: 30m0s)
    /home/prow/go/src/github.com/gardener/gardener/test/e2e/gardener/shoot/create_rotate_delete.go:103
    In [It] (Node Runtime: 30m0s)
      /home/prow/go/src/github.com/gardener/gardener/test/e2e/gardener/shoot/create_rotate_delete.go:103

    Spec Goroutine
    goroutine 1197 [select]
      github.com/onsi/gomega/internal.(*AsyncAssertion).match(0xc00027dd50, {0x2d1e648, 0xc0008d8920}, 0x1, {0x0, 0x0, 0x0})
        /home/prow/go/pkg/mod/github.com/onsi/gomega@v1.37.0/internal/async_assertion.go:558
      github.com/onsi/gomega/internal.(*AsyncAssertion).Should(0xc00027dd50, {0x2d1e648, 0xc0008d8920}, {0x0, 0x0, 0x0})
        /home/prow/go/pkg/mod/github.com/onsi/gomega@v1.37.0/internal/async_assertion.go:145
    > github.com/gardener/gardener/test/e2e/gardener/shoot.ItShouldWaitForShootToBeReconciledAndHealthy.func1({0x2d375d0, 0xc003f365d0})
        /home/prow/go/src/github.com/gardener/gardener/test/e2e/gardener/shoot/shoot.go:165
          | 	}
          | 	return completed
          > }).WithPolling(30 * time.Second).Should(BeTrue())
          | 
          | s.Log.Info("Shoot has been reconciled and is healthy")
      github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3()
        /home/prow/go/pkg/mod/github.com/onsi/ginkgo/v2@v2.23.3/internal/suite.go:894
      github.com/onsi/ginkgo/v2/internal.(*Suite).runNode in goroutine 92
        /home/prow/go/pkg/mod/github.com/onsi/ginkgo/v2@v2.23.3/internal/suite.go:881

    Begin Additional Progress Reports >>
      Expected
          <bool>: false
      to be true
    << End Additional Progress Reports

[FAILED] A spec timeout occurred and then the following failure was recorded in the timedout node before it exited:
Context was cancelled (cause: spec timeout occurred) after 1800.001s.
Expected
    <bool>: false
to be true
In [It] at: /home/prow/go/src/github.com/gardener/gardener/test/e2e/gardener/shoot/shoot.go:165 @ 05/02/25 13:20:48.533

/test pull-gardener-e2e-kind-ipv6

The requested change has been addressed

marc1404 · 2025-05-02T18:19:38Z

Test E2E Gardener Suite: [It] Shoot Tests Create Shoot, Rotate Credentials and Delete Shoot Shoot with workers with workers rollout, in-place update strategy Wait for Shoot to be reconciled [Shoot, default, credentials-rotation, basic, with-workers-rollout, in-place]

A spec timeout occurred timedout [TIMEDOUT] A spec timeout occurred
In [It] at: /home/prow/go/src/github.com/gardener/gardener/test/e2e/gardener/shoot/create_rotate_delete.go:103 @ 05/02/25 14:22:38.577

This is the Progress Report generated when the spec timeout occurred:
  Shoot Tests Create Shoot, Rotate Credentials and Delete Shoot Shoot with workers with workers rollout, in-place update strategy Wait for Shoot to be reconciled (Spec Runtime: 30m0.001s)
    /home/prow/go/src/github.com/gardener/gardener/test/e2e/gardener/shoot/create_rotate_delete.go:103
    In [It] (Node Runtime: 30m0s)
      /home/prow/go/src/github.com/gardener/gardener/test/e2e/gardener/shoot/create_rotate_delete.go:103

    Spec Goroutine
    goroutine 831 [select]
      github.com/onsi/gomega/internal.(*AsyncAssertion).match(0xc000268690, {0x2d1e648, 0xc0004101f0}, 0x1, {0x0, 0x0, 0x0})
        /home/prow/go/pkg/mod/github.com/onsi/gomega@v1.37.0/internal/async_assertion.go:558
      github.com/onsi/gomega/internal.(*AsyncAssertion).Should(0xc000268690, {0x2d1e648, 0xc0004101f0}, {0x0, 0x0, 0x0})
        /home/prow/go/pkg/mod/github.com/onsi/gomega@v1.37.0/internal/async_assertion.go:145
    > github.com/gardener/gardener/test/e2e/gardener/shoot.ItShouldWaitForShootToBeReconciledAndHealthy.func1({0x2d375d0, 0xc0031fc210})
        /home/prow/go/src/github.com/gardener/gardener/test/e2e/gardener/shoot/shoot.go:165
          | 	}
          | 	return completed
          > }).WithPolling(30 * time.Second).Should(BeTrue())
          | 
          | s.Log.Info("Shoot has been reconciled and is healthy")
      github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3()
        /home/prow/go/pkg/mod/github.com/onsi/ginkgo/v2@v2.23.3/internal/suite.go:894
      github.com/onsi/ginkgo/v2/internal.(*Suite).runNode in goroutine 84
        /home/prow/go/pkg/mod/github.com/onsi/ginkgo/v2@v2.23.3/internal/suite.go:881

    Begin Additional Progress Reports >>
      Expected
          <bool>: false
      to be true
    << End Additional Progress Reports

[FAILED] A spec timeout occurred and then the following failure was recorded in the timedout node before it exited:
Context was cancelled (cause: spec timeout occurred) after 1800.002s.
Expected
    <bool>: false
to be true
In [It] at: /home/prow/go/src/github.com/gardener/gardener/test/e2e/gardener/shoot/shoot.go:165 @ 05/02/25 14:22:38.579

/test pull-gardener-e2e-kind-ipv6

gardener-prow bot requested review from dimityrmirchev and LucaBernstein April 30, 2025 14:35

LucaBernstein reviewed Apr 30, 2025

View reviewed changes

gardener-prow bot assigned LucaBernstein Apr 30, 2025

gardener-prow bot added the lgtm Indicates that a PR is ready to be merged. label Apr 30, 2025

rfranzke previously requested changes May 2, 2025

View reviewed changes

gardener-prow bot assigned rfranzke May 2, 2025

gardener-prow bot removed the lgtm Indicates that a PR is ready to be merged. label May 2, 2025

gardener-prow bot requested a review from LucaBernstein May 2, 2025 06:50

marc1404 added 4 commits May 2, 2025 09:22

chore: Deprecate `Shoot.Spec.Kubernetes.KubeAPIServer.EnableAnonymous…

bbb66b6

…Authentication`

chore: Run make generate

e1359e6

chore: Add helper func IsLegacyAnonymousAuthenticationEnabled

f6aea3c

chore: Validate against conflicting anonymous authentication configur…

c158613

…ation

marc1404 force-pushed the chore/11657-deprecate-kapi-enable-anonymous-auth branch from d75fb5d to 79eba6d Compare May 2, 2025 07:56

chore: Add shoot spec warning when setting EnableAnonymousAuthentication

9e8c9b7

marc1404 force-pushed the chore/11657-deprecate-kapi-enable-anonymous-auth branch from 79eba6d to 9e8c9b7 Compare May 2, 2025 07:57

marc1404 requested a review from rfranzke May 2, 2025 07:57

rfranzke reviewed May 2, 2025

View reviewed changes

gardener-prow bot added the lgtm Indicates that a PR is ready to be merged. label May 2, 2025

gardener-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 2, 2025

gardener-prow bot merged commit 5e3c211 into gardener:master May 2, 2025
19 checks passed

marc1404 deleted the chore/11657-deprecate-kapi-enable-anonymous-auth branch May 5, 2025 06:51

dimityrmirchev mentioned this pull request May 28, 2025

Clarify k8s version when setting anonymous authentication via StructuredAuthentication #12199

Merged

AleksandarSavchev mentioned this pull request Jun 4, 2025

Refactor Rules 242390 and 2000 to check for a Structured Authentication Configuration gardener/diki#510

Merged

ialidzhikov mentioned this pull request Jun 4, 2025

Improve the doc string of the EnableAnonymousAuthentication field #12255

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: Deprecate the Shoot field `.kubeAPIServer.enableAnonymousAuthentication` #11984

chore: Deprecate the Shoot field `.kubeAPIServer.enableAnonymousAuthentication` #11984

Uh oh!

marc1404 commented Apr 30, 2025 •

edited

Loading

Uh oh!

marc1404 commented Apr 30, 2025

Uh oh!

LucaBernstein left a comment

Uh oh!

rfranzke left a comment

Uh oh!

marc1404 commented May 2, 2025

Uh oh!

rfranzke left a comment

Uh oh!

gardener-prow bot commented May 2, 2025

Uh oh!

gardener-prow bot commented May 2, 2025

Uh oh!

marc1404 commented May 2, 2025

Uh oh!

marc1404 commented May 2, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

chore: Deprecate the Shoot field .kubeAPIServer.enableAnonymousAuthentication #11984

chore: Deprecate the Shoot field .kubeAPIServer.enableAnonymousAuthentication #11984

Uh oh!

Conversation

marc1404 commented Apr 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marc1404 commented Apr 30, 2025

Uh oh!

LucaBernstein left a comment

Choose a reason for hiding this comment

Uh oh!

rfranzke left a comment

Choose a reason for hiding this comment

Uh oh!

marc1404 commented May 2, 2025

Uh oh!

rfranzke left a comment

Choose a reason for hiding this comment

Uh oh!

gardener-prow bot commented May 2, 2025

Uh oh!

gardener-prow bot commented May 2, 2025

Uh oh!

marc1404 commented May 2, 2025

Uh oh!

marc1404 commented May 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chore: Deprecate the Shoot field `.kubeAPIServer.enableAnonymousAuthentication` #11984

chore: Deprecate the Shoot field `.kubeAPIServer.enableAnonymousAuthentication` #11984

marc1404 commented Apr 30, 2025 •

edited

Loading

marc1404 commented May 2, 2025 •

edited

Loading