Bug 1905328
Summary: | Changing the bound token service account issuer invalids previously issued bound tokens | |||
---|---|---|---|---|
Product: | OpenShift Container Platform | Reporter: | Maru Newby <mnewby> | |
Component: | kube-apiserver | Assignee: | Maru Newby <mnewby> | |
Status: | CLOSED ERRATA | QA Contact: | scheng | |
Severity: | medium | Docs Contact: | ||
Priority: | unspecified | |||
Version: | 4.7 | CC: | aos-bugs, mfojtik, xxia | |
Target Milestone: | --- | |||
Target Release: | 4.7.0 | |||
Hardware: | Unspecified | |||
OS: | Unspecified | |||
Whiteboard: | ||||
Fixed In Version: | Doc Type: | Known Issue | ||
Doc Text: |
Cause: Changing the serviceAccountIssuer field of the authentication resource will update the kube-apiserver to validate tokens with the new issuer and reject tokens with the previous issuer. kube-apiserver does not support multiple issuers at this time, so a graceful transition is not possible.
Consequence: Changing the serviceAccountIssuer has the potential to disrupt applications relying on bound tokens. Unless an application is coded to explicitly request a new token when their existing token starts receiving 401 responses from the apiserver, they will continue to use the invalid token until restarted or until their invalid token exceeds 80% of its duration (at which point the kubelet will request a new token for them).
Workaround (if any): Only change the serviceAccountIssuer field if disruption is acceptable and restarting all pods is an option.
|
Story Points: | --- | |
Clone Of: | ||||
: | 1905573 (view as bug list) | Environment: | ||
Last Closed: | 2021-02-24 15:40:33 UTC | Type: | Bug | |
Regression: | --- | Mount Type: | --- | |
Documentation: | --- | CRM: | ||
Verified Versions: | Category: | --- | ||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
Cloudforms Team: | --- | Target Upstream Version: | ||
Embargoed: | ||||
Bug Depends On: | ||||
Bug Blocks: | 1905573 |
Description
Maru Newby
2020-12-08 03:31:17 UTC
Assigning back for bumping PR to bump the dependency to the right repo. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:5633 |