Tweak authentication advice about command line arguments #53397

lmktfy · 2025-11-23T14:33:26Z

PR #52907 added a page about user impersonation that will go live when v1.35 is released.

Build on that to:

make it clear that the authenticating reverse proxy mode is separate from user impersonation
help readers find the command line options that are relevant to authentication

Based on PR #50364 but not directly derived from it.

/language en
/sig auth

netlify · 2025-11-23T14:33:35Z

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	`483c821`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-io-vnext-staging/deploys/69234bdbf2bd170008822eaa

k8s-ci-robot · 2025-11-23T14:33:40Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign reylejano for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

content/en/docs/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

netlify · 2025-11-23T14:42:56Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`483c821`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/69234bdbb4fce6000881e78a
😎 Deploy Preview	https://deploy-preview-53397--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

lmktfy · 2025-11-23T17:58:54Z

content/en/docs/reference/access-authn-authz/authentication.md

-{{< note >}}
-Prior to Kubernetes 1.11.3 (and 1.10.7, 1.9.11), the `extra` key could only contain characters that
-were [legal in HTTP header labels](https://tools.ietf.org/html/rfc7230#section-3.2.6).
-{{< /note >}}


I propose to remove this because none of those older versions have been supported for some time.

Those old releases are definitely out of support.

pmengelbert · 2025-11-24T17:33:57Z

/assign @aramase

dipesh-rawat · 2025-12-11T00:40:23Z

Hello @kubernetes/sig-auth-pr-reviews, we would appreciate your review of these proposed changes ahead of the v1.35 release next week. Please add LGTM if everything looks good. Thank you!

liggitt · 2025-12-11T15:36:37Z

content/en/docs/reference/access-authn-authz/authentication.md

+#### Bootstrap token configuration {#api-server-authn-config-cli-bootstrap}
+
+`--enable-bootstrap-token-auth`
+: When this flag is set, you can use [bootstrap tokens](#bootstrap-tokens) to authenticate.


Do we want to indicate the default values for these flags? This one defaults to false.

liggitt · 2025-12-11T15:36:41Z

content/en/docs/reference/access-authn-authz/authentication.md

+
+#### Anonymous authentication configuration {#api-server-authn-config-cli-anonymous}
+
+`--anonymous-auth`


Do we want to indicate the default values for these flags? This one defaults to true.

liggitt · 2025-12-11T15:38:32Z

content/en/docs/reference/access-authn-authz/authentication.md

+#### Certificate authentication configuration {#api-server-authn-config-cli-x-509}
+
+`--client-ca-file`
+: The path to the trust anchor for validating client identity, when clients use X.509 certificate authentication.


Suggested change

: The path to the trust anchor for validating client identity, when clients use X.509 certificate authentication.

: The path to the trust anchor(s) for validating client identity, when clients use X.509 certificate authentication.

Also, we could note that the contents of this file can be changed while the apiserver is running and is re-read. Modifications to this file should be done in an atomic way (writing to a peer temporary file, then renaming the temporary file to replace this file, etc).

liggitt · 2025-12-11T15:39:46Z

content/en/docs/reference/access-authn-authz/authentication.md

+#### OIDC configuration {#api-server-authn-config-cli-oidc}
+
+`--oidc-ca-file`
+: The path to the trust anchor for validating client identity, when clients use OIDC.


Suggested change

: The path to the trust anchor for validating client identity, when clients use OIDC.

: The path to the trust anchor(s) for validating client identity, when clients use OIDC.

This file is not re-read if modified while the apiserver is running.

liggitt · 2025-12-11T15:41:10Z

content/en/docs/reference/access-authn-authz/authentication.md

+: Defines the authentication audience for service account tokens.
+
+`--service-account-extend-token-expiration`
+: This flag turns on projected service account expiration extension during token generation, which helps safe transition from legacy tokens to bound service account token feature. See [authenticating service account credentials](/docs/concepts/security/service-accounts/#authenticating-credentials).


This defaults to true

liggitt · 2025-12-11T15:43:07Z

content/en/docs/reference/access-authn-authz/authentication.md

+: Path to socket where an external JWT signer is listening. You can use this to integrate with an external token signer.
+
+`--service-account-signing-key-file`
+: Path to the file that contains the current private key of the service account token issuer.


Changes to this file while the API server is running are not re-read.

liggitt · 2025-12-11T15:43:18Z

content/en/docs/reference/access-authn-authz/authentication.md

+#### Static token configuration {#api-server-authn-config-cli-bearer}
+
+`--token-auth-file`
+: Path to the configuration file for [static bearer tokens](#static-token-file).


Changes to this file while the API server is running are not re-read.

liggitt · 2025-12-11T15:44:12Z

content/en/docs/reference/access-authn-authz/authentication.md

+: How long (as a Kubernetes duration specification) the API server should cache the outcome of HTTP callouts to validate tokens.
+
+`--authentication-token-webhook-config-file`
+: The path to a kubeconfig format client configuration, that specifies how the API server authenticates when making HTTP callouts.


Changes to this file while the API server is running are not re-read.

liggitt · 2025-12-11T15:44:53Z

content/en/docs/reference/access-authn-authz/authentication.md

+
+`--requestheader-client-ca-file`
+: _Required._
+  Path to a PEM-encoded certificate bundle.  


Suggested change

Path to a PEM-encoded certificate bundle.

Path to a PEM-encoded certificate bundle containing trust anchor(s) for validating authenticating proxy identity.

liggitt · 2025-12-11T15:45:43Z

content/en/docs/reference/access-authn-authz/authentication.md

+#### Configuration file path {#api-server-authn-config-cli-general}
+
+`--authentication-config`
+: This special command line argument specifies that you want to [configure authentication using a configuration file](#api-server-authn-config-file).


The contents of this file can be changed while the apiserver is running and is re-read. Modifications to this file should be done in an atomic way (writing to a peer temporary file, then renaming the temporary file to replace this file, etc).

lmktfy · 2025-12-11T16:50:27Z

Feedback noted, but I don't plan to do any fixups this year, 2025, to the authn pages work stream from
PR #52907 and predecessors.
Maybe I'll revisit next year

If it's an improvement on the current state of dev-1.35, merge it
if not, someone else can build on the PR, or the fixes will happen later

(bear in mind that every push back on a PR is a message of discouragement…)

k8s-ci-robot added this to the 1.35 milestone Nov 23, 2025

k8s-ci-robot added language/en Issues or PRs related to English language sig/auth Categorizes an issue or PR as relevant to SIG Auth. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Nov 23, 2025

k8s-ci-robot requested a review from deads2k November 23, 2025 14:33

k8s-ci-robot requested a review from liggitt November 23, 2025 14:33

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Nov 23, 2025

lmktfy commented Nov 23, 2025

View reviewed changes

lmktfy added 3 commits November 23, 2025 18:00

Explain authn command line and file-based configuration

cf0567a

Explain reverse authn proxy is not impersonation

189c5b2

Drop info about very stale releases

483c821

Those old releases are definitely out of support.

lmktfy force-pushed the 20251123_explain_authn_configuration branch from ee512b1 to 483c821 Compare November 23, 2025 18:00

enj moved this to Needs Triage in SIG Auth Nov 24, 2025

enj added this to SIG Auth Nov 24, 2025

k8s-ci-robot assigned aramase Nov 24, 2025

liggitt reviewed Dec 11, 2025

View reviewed changes

aramase moved this from Needs Triage to Changes Requested in SIG Auth Dec 15, 2025


		#### Anonymous authentication configuration {#api-server-authn-config-cli-anonymous}

		`--anonymous-auth`

	: The path to the trust anchor for validating client identity, when clients use X.509 certificate authentication.
	: The path to the trust anchor(s) for validating client identity, when clients use X.509 certificate authentication.

	Path to a PEM-encoded certificate bundle.
	Path to a PEM-encoded certificate bundle containing trust anchor(s) for validating authenticating proxy identity.

Tweak authentication advice about command line arguments #53397

Are you sure you want to change the base?

Tweak authentication advice about command line arguments #53397

Uh oh!

Conversation

lmktfy commented Nov 23, 2025

Uh oh!

netlify bot commented Nov 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Uh oh!

k8s-ci-robot commented Nov 23, 2025

Uh oh!

netlify bot commented Nov 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Pull request preview available for checking

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmengelbert commented Nov 24, 2025

Uh oh!

dipesh-rawat commented Dec 11, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lmktfy commented Dec 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

netlify bot commented Nov 23, 2025 •

edited

Loading

netlify bot commented Nov 23, 2025 •

edited

Loading