From fa16fcb9e9ec8861212097818facbf405bea7d4d Mon Sep 17 00:00:00 2001 From: Bryce Palmer Date: Mon, 28 Sep 2026 14:14:45 -0400 Subject: [PATCH] features: add ServiceAccountTokenMLDSA feature gate Signed-off-by: Bryce Palmer --- pkg/features/kube_features.go | 13 +++++++++++++ .../reference/feature_list.md | 1 + .../reference/versioned_feature_list.yaml | 11 +++++++++++ 3 files changed, 25 insertions(+) diff --git a/pkg/features/kube_features.go b/pkg/features/kube_features.go index c768d4bc30c..1f257ad0825 100644 --- a/pkg/features/kube_features.go +++ b/pkg/features/kube_features.go @@ -1045,6 +1045,12 @@ const ( // kubelet can request a service account token for. ServiceAccountNodeAudienceRestriction featuregate.Feature = "ServiceAccountNodeAudienceRestriction" + // owner: @everettraven + // issue: https://github.com/kubernetes/kubernetes/issues/141838 + // + // Adds support for using ML-DSA private keys for generating service account tokens and adding support for ML-DSA signing algorithms for service account external JWT. + ServiceAccountTokenMLDSA featuregate.Feature = "ServiceAccountTokenMLDSA" + // owner: @jpbetz // // When enabled, the apiserver ignores changes to status fields in writes to the ServiceCIDR root resource. @@ -1974,6 +1980,11 @@ var defaultVersionedKubernetesFeatureGates = map[featuregate.Feature]featuregate {Version: version.MustParse("1.33"), Default: true, PreRelease: featuregate.Beta}, }, + ServiceAccountTokenMLDSA: { + {Version: version.MustParse("1.38"), Default: false, PreRelease: featuregate.Beta}, + {Version: version.MustParse("1.38"), Default: true, PreRelease: featuregate.Beta, MinCompatibilityVersion: version.MustParse("1.38")}, + }, + ServiceCIDRStatusFieldWiping: { {Version: version.MustParse("1.0"), Default: false, PreRelease: featuregate.GA}, {Version: version.MustParse("1.36"), Default: true, PreRelease: featuregate.Deprecated}, @@ -2642,6 +2653,8 @@ var defaultKubernetesFeatureGateDependencies = map[featuregate.Feature][]feature ServiceAccountNodeAudienceRestriction: {}, + ServiceAccountTokenMLDSA: {}, + ServiceCIDRStatusFieldWiping: {}, StaleControllerConsistencyDaemonSet: {featuregate.Feature(clientfeatures.AtomicFIFO)}, diff --git a/test/compatibility_lifecycle/reference/feature_list.md b/test/compatibility_lifecycle/reference/feature_list.md index 038a798f86c..9a6824498e4 100644 --- a/test/compatibility_lifecycle/reference/feature_list.md +++ b/test/compatibility_lifecycle/reference/feature_list.md @@ -199,6 +199,7 @@ | SecurityProfileOCI | | | 1.38– | | | | | [code](https://cs.k8s.io/?q=%5CbSecurityProfileOCI%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSecurityProfileOCI%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | SeparateCacheWatchRPC | :ballot_box_with_check: 1.28+ | :closed_lock_with_key: 1.36+ | | 1.28–1.32 | | 1.33– | | [code](https://cs.k8s.io/?q=%5CbSeparateCacheWatchRPC%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSeparateCacheWatchRPC%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | ServiceAccountNodeAudienceRestriction | :ballot_box_with_check: 1.33+ | | | 1.32– | | | | [code](https://cs.k8s.io/?q=%5CbServiceAccountNodeAudienceRestriction%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbServiceAccountNodeAudienceRestriction%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | +| ServiceAccountTokenMLDSA | :ballot_box_with_check: 1.38+ | | | 1.38– | | | | [code](https://cs.k8s.io/?q=%5CbServiceAccountTokenMLDSA%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbServiceAccountTokenMLDSA%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | ServiceCIDRStatusFieldWiping | :ballot_box_with_check: 1.36+ | | | | 1.0–1.35 | 1.36– | | [code](https://cs.k8s.io/?q=%5CbServiceCIDRStatusFieldWiping%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbServiceCIDRStatusFieldWiping%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | ShardedListAndWatch | :ballot_box_with_check: 1.38+ | | 1.36–1.37 | 1.38– | | | | [code](https://cs.k8s.io/?q=%5CbShardedListAndWatch%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbShardedListAndWatch%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | SizeBasedListCostEstimate | :ballot_box_with_check: 1.34+ | | | 1.34– | | | | [code](https://cs.k8s.io/?q=%5CbSizeBasedListCostEstimate%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSizeBasedListCostEstimate%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | diff --git a/test/compatibility_lifecycle/reference/versioned_feature_list.yaml b/test/compatibility_lifecycle/reference/versioned_feature_list.yaml index 53576b16ca7..506398c3bef 100644 --- a/test/compatibility_lifecycle/reference/versioned_feature_list.yaml +++ b/test/compatibility_lifecycle/reference/versioned_feature_list.yaml @@ -1834,6 +1834,17 @@ lockToDefault: false preRelease: Beta version: "1.33" +- name: ServiceAccountTokenMLDSA + versionedSpecs: + - default: false + lockToDefault: false + preRelease: Beta + version: "1.38" + - default: true + lockToDefault: false + preRelease: Beta + version: "1.38" + minCompatibilityVersion: "1.38" - name: ServiceCIDRStatusFieldWiping versionedSpecs: - default: false