Renew all garden access secrets on seed when triggered by annotation #8152
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
With this, we can renew the garden access secrets in all namespaces in the next commit without renewing shoot access secrets. In the future, the shoot/garden controller should also restrict the call to the `shoot` class. However, the controller in `gardener-resource-manager` is still not configured with the class, hence it is still responsible for all secrets. This is fine for now since resource-manager and the call to `RenewAccessSecrets` are restricted to the `garden` or shoot namespace, but in the future we should make sure that we restrict it to the `shoot` class to prevent potential future responsibility overlaps.
timebertt
commented
Jun 23, 2023
4 tasks
|
/assign |
|
@rfranzke @oliver-goetz thanks for your reviews, PTAL :) |
|
/lgtm |
|
LGTM label has been added. Git tree hash: 5c5b42f9bcc52f98383efe260642654d3b58482b
|
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: oliver-goetz The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@timebertt: The following test failed, say
Full PR test history. Your PR dashboard. Command help for this repository. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
andrerun
pushed a commit
to andrerun/gardener
that referenced
this pull request
Jul 6, 2023
…ardener#8152) * Nit: move the `tokenrequestor` controller docs out of the `shoot` controller section * Add documentation for the new feature * Validate operation annotation on `Seeds` * Bump `Seed` generation when the operation annotation is set * Allow selecting class in `RenewAccessSecrets` With this, we can renew the garden access secrets in all namespaces in the next commit without renewing shoot access secrets. In the future, the shoot/garden controller should also restrict the call to the `shoot` class. However, the controller in `gardener-resource-manager` is still not configured with the class, hence it is still responsible for all secrets. This is fine for now since resource-manager and the call to `RenewAccessSecrets` are restricted to the `garden` or shoot namespace, but in the future we should make sure that we restrict it to the `shoot` class to prevent potential future responsibility overlaps. * Renew all garden access secrets on seed when triggered by annotation * Verify garden access token renewal in e2e tests * Address review suggestions
1 task
nickytd
pushed a commit
to nickytd/gardener
that referenced
this pull request
Sep 11, 2023
…ardener#8152) * Nit: move the `tokenrequestor` controller docs out of the `shoot` controller section * Add documentation for the new feature * Validate operation annotation on `Seeds` * Bump `Seed` generation when the operation annotation is set * Allow selecting class in `RenewAccessSecrets` With this, we can renew the garden access secrets in all namespaces in the next commit without renewing shoot access secrets. In the future, the shoot/garden controller should also restrict the call to the `shoot` class. However, the controller in `gardener-resource-manager` is still not configured with the class, hence it is still responsible for all secrets. This is fine for now since resource-manager and the call to `RenewAccessSecrets` are restricted to the `garden` or shoot namespace, but in the future we should make sure that we restrict it to the `shoot` class to prevent potential future responsibility overlaps. * Renew all garden access secrets on seed when triggered by annotation * Verify garden access token renewal in e2e tests * Address review suggestions
rfranzke
added a commit
to rfranzke/gardener
that referenced
this pull request
Nov 30, 2023
follow-up of gardener#8152, released with `v1.74.0`
Merged
gardener-prow bot
pushed a commit
that referenced
this pull request
Dec 5, 2023
* Remove MCM legacy CRD deletion follow-up of #8559, released with `v1.82.0` * Remove legacy `shoot-node-logging` MR cleanup follow-up of #8501, released with `v1.80.0` * Remove MCM legacy resources cleanup in generic `Worker` actuator follow-up of #8596, released with `v1.82.0` * Restrict GRM's token requestor to secrets with `class=shoot` follow-up of #8152, released with `v1.74.0` * Remove support for deprecated `NetworkPolicy` annotations follow-up of #7907, released with `v1.71.0`
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
How to categorize this PR?
/area security usability
/kind enhancement
What this PR does / why we need it:
This PR adds a mechanism for renewing all garden access secrets on a given seed by annotating it with
gardener.cloud/operation=renew-garden-access-secrets.ref #8032 (comment)
Which issue(s) this PR fixes:
Part of #8001
Special notes for your reviewer:
/cc @oliver-goetz @rfranzke
Release note: