Skip to content

Commit 136a77d

Browse files
c0d3-k1rac0d3-k1ra
authored
Remove the deprecated k8s_sat node attestor plugin (#5703)
Signed-off-by: Amit Upadhyay <amit.upadhyay021@outlook.com>
1 parent 84ef545 commit 136a77d

16 files changed

+0
-1599
lines changed

‎conf/agent/agent_full.conf

-14
Original file line numberDiff line numberDiff line change
@@ -208,20 +208,6 @@ plugins {
208208
}
209209
}
210210

211-
# NodeAttestor "k8s_sat" (deprecated): A node attestor which attests agent identity
212-
# using a Kubernetes Service Account token.
213-
NodeAttestor "k8s_sat" {
214-
plugin_data {
215-
# cluster: Name of the cluster. It must correspond to a cluster
216-
# configured in the server plugin.
217-
# cluster = ""
218-
219-
# token_path: Path to the service account token on disk.
220-
# Default: /var/run/secrets/kubernetes.io/serviceaccount/token.
221-
# token_path = "/var/run/secrets/kubernetes.io/serviceaccount/token"
222-
}
223-
}
224-
225211
# NodeAttestor "sshpop": A node attestor which attests agent identity
226212
# using an existing ssh certificate.
227213
NodeAttestor "sshpop" {

‎conf/server/server_full.conf

-41
Original file line numberDiff line numberDiff line change
@@ -533,47 +533,6 @@ plugins {
533533
# }
534534
# }
535535

536-
# NodeAttestor "k8s_sat" (deprecated): A node attestor which attests agent identity
537-
# using a Kubernetes Service Account token.
538-
# NodeAttestor "k8s_sat" {
539-
# plugin_data {
540-
# # clusters: A map of clusters, keyed by an arbitrary ID, that are
541-
# # authorized for attestation.
542-
# # clusters = {
543-
# # "<arbitrary ID>" = {
544-
# # service_account_allow_list: A list of service account names,
545-
# # qualified by namespace (for example, "default:blog" or
546-
# # "production:web") to allow for node attestation. Attestation
547-
# # will be rejected for tokens bound to service accounts that
548-
# # aren't in the allow list.
549-
# # service_account_allow_list = []
550-
551-
# # use_token_review_api_validation: Specifies how the service
552-
# # account token is validated. If false, validation is done
553-
# # locally using the provided key. If true, validation is done
554-
# # using token review API. Default: false.
555-
# # use_token_review_api_validation = false
556-
557-
# # service_account_key_file: It is only used if
558-
# # use_token_review_api_validation is set to false. Path on disk
559-
# # to a PEM encoded file containing public keys used in
560-
# # validating tokens for that cluster. RSA and ECDSA keys are
561-
# # supported. For RSA, X509 certificates, PKCS1, and PKIX encoded
562-
# # public keys are accepted. For ECDSA, X509 certificates, and
563-
# # PKIX encoded public keys are accepted.
564-
# # service_account_key_file = ""
565-
566-
# # kube_config_file: It is only used if
567-
# # use_token_review_api_validation is set to true. Path to a k8s
568-
# # configuration file for API Server authentication. A kubernetes
569-
# # configuration file must be specified if SPIRE server runs
570-
# # outside of the k8s cluster. If empty, SPIRE server is assumed
571-
# # to be running inside the cluster and in-cluster configuration
572-
# # is used. Default: "".
573-
# # kube_config_file = ""
574-
# }
575-
# }
576-
577536
# NodeAttestor "sshpop": A node attestor which attests agent identity
578537
# using an existing ssh certificate.
579538
# NodeAttestor "sshpop" {

‎doc/plugin_agent_nodeattestor_k8s_sat.md

-50
This file was deleted.

‎doc/plugin_server_nodeattestor_k8s_sat.md

-105
This file was deleted.

‎doc/spire_agent.md

-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ This document is a configuration reference for SPIRE Agent. It includes informat
2121
| NodeAttestor | [azure_msi](/doc/plugin_agent_nodeattestor_azure_msi.md) | A node attestor which attests agent identity using an Azure MSI token |
2222
| NodeAttestor | [gcp_iit](/doc/plugin_agent_nodeattestor_gcp_iit.md) | A node attestor which attests agent identity using a GCP Instance Identity Token |
2323
| NodeAttestor | [join_token](/doc/plugin_agent_nodeattestor_jointoken.md) | A node attestor which uses a server-generated join token |
24-
| NodeAttestor | [k8s_sat](/doc/plugin_agent_nodeattestor_k8s_sat.md) (deprecated) | A node attestor which attests agent identity using a Kubernetes Service Account token |
2524
| NodeAttestor | [k8s_psat](/doc/plugin_agent_nodeattestor_k8s_psat.md) | A node attestor which attests agent identity using a Kubernetes Projected Service Account token |
2625
| NodeAttestor | [sshpop](/doc/plugin_agent_nodeattestor_sshpop.md) | A node attestor which attests agent identity using an existing ssh certificate |
2726
| NodeAttestor | [x509pop](/doc/plugin_agent_nodeattestor_x509pop.md) | A node attestor which attests agent identity using an existing X.509 certificate |

‎doc/spire_server.md

-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ This document is a configuration reference for SPIRE Server. It includes informa
2727
| NodeAttestor | [azure_msi](/doc/plugin_server_nodeattestor_azure_msi.md) | A node attestor which attests agent identity using an Azure MSI token |
2828
| NodeAttestor | [gcp_iit](/doc/plugin_server_nodeattestor_gcp_iit.md) | A node attestor which attests agent identity using a GCP Instance Identity Token |
2929
| NodeAttestor | [join_token](/doc/plugin_server_nodeattestor_jointoken.md) | A node attestor which validates agents attesting with server-generated join tokens |
30-
| NodeAttestor | [k8s_sat](/doc/plugin_server_nodeattestor_k8s_sat.md) (deprecated) | A node attestor which attests agent identity using a Kubernetes Service Account token |
3130
| NodeAttestor | [k8s_psat](/doc/plugin_server_nodeattestor_k8s_psat.md) | A node attestor which attests agent identity using a Kubernetes Projected Service Account token |
3231
| NodeAttestor | [sshpop](/doc/plugin_server_nodeattestor_sshpop.md) | A node attestor which attests agent identity using an existing ssh certificate |
3332
| NodeAttestor | [tpm_devid](/doc/plugin_server_nodeattestor_tpm_devid.md) | A node attestor which attests agent identity using a TPM that has been provisioned with a DevID certificate |

‎pkg/agent/catalog/nodeattestor.go

-2
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ import (
88
"github.com/spiffe/spire/pkg/agent/plugin/nodeattestor/httpchallenge"
99
"github.com/spiffe/spire/pkg/agent/plugin/nodeattestor/jointoken"
1010
"github.com/spiffe/spire/pkg/agent/plugin/nodeattestor/k8spsat"
11-
"github.com/spiffe/spire/pkg/agent/plugin/nodeattestor/k8ssat"
1211
"github.com/spiffe/spire/pkg/agent/plugin/nodeattestor/sshpop"
1312
"github.com/spiffe/spire/pkg/agent/plugin/nodeattestor/tpmdevid"
1413
"github.com/spiffe/spire/pkg/agent/plugin/nodeattestor/x509pop"
@@ -41,7 +40,6 @@ func (repo *nodeAttestorRepository) BuiltIns() []catalog.BuiltIn {
4140
httpchallenge.BuiltIn(),
4241
jointoken.BuiltIn(),
4342
k8spsat.BuiltIn(),
44-
k8ssat.BuiltIn(),
4543
sshpop.BuiltIn(),
4644
tpmdevid.BuiltIn(),
4745
x509pop.BuiltIn(),

0 commit comments

Comments
 (0)