External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-29 22:03:22 -02:30
Code Issues Packages Projects Releases Wiki Activity

Allow setting --service-account-extend-token-expiration for kube-apiserver in hardening.yaml (#13616)

Browse Source 
* kube-apiserver: add --service-account-extend-token-expiration

* Update docs/ansible/vars.md

Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>

* Update docs/operations/hardening.md

* Update docs/operations/hardening.md

Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>

---------

Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
This commit is contained in:
Jay.H
2026-10-12 03:57:19 +00:00
committed by GitHub
co-authored by Ali Afsharzadeh
parent 131fd144cc
commit 457217aaa0
4 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ansible/vars.md
+1
View File
@@ -171,6 +171,7 @@ kube_apiserver_admission_event_rate_limits:
```
* *kube_apiserver_service_account_lookup* - Enable validation service account before validating token. Default `true`.
* *kube_apiserver_service_account_extend_token_expiration* - Extend admission-injected service account tokens to 1 year (kube-apiserver `--service-account-extend-token-expiration`). Not set by default (kube-apiserver default `true`). Set to `false` to disable.
Note, if cloud providers have any use of the ``10.233.0.0/16``, like instances'
private addresses, make sure to pick another values for ``kube_service_addresses``
docs/operations/hardening.md
+2
View File
@@ -20,6 +20,7 @@ The **kubernetes** version should be at least `v1.23.6` to have all the most rec
authorization_modes: ['Node', 'RBAC']
kube_apiserver_request_timeout: 120s
kube_apiserver_service_account_lookup: true
kube_apiserver_service_account_extend_token_expiration: false
# enable kubernetes audit
kubernetes_audit: true
@@ -120,6 +121,7 @@ kube_pod_security_default_enforce: restricted
Let's take a deep look to the resultant **kubernetes** configuration:
* The `anonymous-auth` (on `kube-apiserver`) is set to `true` by default. This is fine, because it is considered safe if you enable `RBAC` for the `authorization-mode`.
* The `service-account-extend-token-expiration` (on `kube-apiserver`) is set to `false`. Admission-injected service account tokens then expire at their normal lifetime (about 1 hour), not after 1 year. Workloads with client libraries that do not reload the token from disk can get authentication errors. To find these workloads before you set it, use the `authentication.k8s.io/stale-token` audit annotation or the `serviceaccount_stale_tokens_total` metric.
* The `enable-admission-plugins` includes `PodSecurity` (for more details, please take a look here: <https://kubernetes.io/docs/concepts/security/pod-security-admission/>). Then, we set the `EventRateLimit` plugin, providing additional configuration files (that are automatically created under the hood and mounted inside the `kube-apiserver` container) to make it work.
* The `encryption-provider-config` provide encryption at rest. This means that the `kube-apiserver` encrypt data that is going to be stored before they reach `etcd`. So the data is completely unreadable from `etcd` (in case an attacker is able to exploit this).
* The `rotateCertificates` in `KubeletConfiguration` is set to `true` along with `serverTLSBootstrap`. This could be used in alternative to `tlsCertFile` and `tlsPrivateKeyFile` parameters. Additionally it automatically generates certificates by itself. By default the CSRs are approved automatically via [kubelet-csr-approver](https://github.com/postfinance/kubelet-csr-approver). You can customize approval configuration by modifying Helm values via `kubelet_csr_approver_values`.