Mirrors/flux2
1
0
Fork 0
mirror of synced 2026-02-06 19:05:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

[RFC-0010] Update RFC to include opt-in feature gate

Browse Source 
Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>
This commit is contained in:
Matheus Pimenta
2025-05-15 15:15:12 +01:00
parent 8804b856ea
commit e979df122a
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
rfcs/0010-multi-tenant-workload-identity/README.md
View File

@@ -565,7 +565,7 @@ the Flux APIs is to associate the Flux objects with Kubernetes `ServiceAccounts`
We propose building the `ServiceAccount` token creation and exchange logic into
the Flux controllers through a library in the `github.com/fluxcd/pkg` repository.
### API Changes
### API Changes and Feature Gates
For all the Flux APIs interacting with cloud providers (except `Kustomization`,
see the paragraph below), we propose introducing the field `spec.serviceAccountName`
@@ -597,6 +597,16 @@ the cloud provider in the `Kustomization` API is detected by the SOPS SDK
itself while decrypting the secrets, so we don't need to introduce a new
field for this purpose.
To enable using the new `serviceAccountName` fields, we propose introducing
a feature gate called `ObjectLevelWorkloadIdentity` in the controllers that
would support the feature. In the first release we should make it opt-in so
cluster admins can consciously roll it out. If the feature gate is disabled
and users set the field in Flux APIs that use the field only for this feature,
a terminal error should be returned. If the feature gate is disabled and users
set the field in Flux APIs that use the field for other purposes, like in the
case of the `OCIRepository` and `ImageRepository` APIs, the controller should
just log a warning and ignore the field.
### Workload Identity Library
We propose using the Go package `github.com/fluxcd/pkg/auth`