Add token revocation note and example to authentication docs #51093
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
|
Welcome @AumPatel1! |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
size/S
✅ Pull request preview available for checkingBuilt without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
lmktfy
left a comment
lmktfy
left a comment
There was a problem hiding this comment.
Overall, we should think about keeping the reference page factual and straightforward.
However, the reference docs can and should link to task pages that explain how to achieve relevant outcomes.
| - expression: "user.groups.all(group, !group.startsWith('system:'))" | ||
| message: 'groups cannot used reserved system: prefix' | ||
| ``` | ||
| ### Token Revocation |
There was a problem hiding this comment.
nit: headings should be sentence case (lowercase "r" please)
| ``` | ||
| ### Token Revocation | ||
|
|
||
| Kubernetes does not currently support full token revocation for authentication tokens. To mitigate this, use short-lived tokens to reduce the risk of compromised tokens being used for an extended period. As an alternative, you can approximate revocation by writing user validation rules using Common Expression Language (CEL). For example, you can use the `jti` claim (if present) or any unique token identifier to check against a denylist or revocation list. Note that managing revocation this way can be complex and may not scale well for large systems. |
There was a problem hiding this comment.
Odd to have a section about Token revocation in a reference page, and then explain it's not a thing. That's not the usual way to write reference documentation.
Maybe this should be a task page: how to implement token revocation for your cluster.
What do you think?
| Example of a revocation rule using the `jti` claim: | ||
|
|
||
| ```yaml | ||
| userValidationRules: |
There was a problem hiding this comment.
Make sure to explain what component implements userValidationRules
|
/sig auth |
k8s-ci-robot
added
the
sig/auth
k8s-ci-robot
added
the
needs-rebase
|
PR needs rebase. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
Description
This pull request adds a new subsection, "Token Revocation," to the Kubernetes authentication documentation under the "Using Authentication Configuration" section. The changes address the absence of full token revocation support in Kubernetes by:
jticlaim to check a token’s credential ID against a denylist.These updates aim to guide users on managing token security effectively, based on discussions in issue #51015. The subsection is placed after an existing YAML example and includes a formatted code block for clarity.
Issue
Closes: #51015
Issue
Closes: #