Kubelet's ability to generate service account tokens is restricted by
the noderestriction admission plugin, which checks to make sure that the
relevant pod actually mounts a token volume with the requested audience.
This commit adds an analogous mechanism for Pod Certificates,
restricting the signer names that Kubelet can request.
The feature includes a similar authorizer-based override, where granting
the "request-podcertificate-signer" verb for a given signer name allows
bypassing the restriction.
Prepared with Claude Code.
The NodeRestriction admission plugin forbids the kubelet from mutating
pod.status.ResourceClaimStatuses and pod.status.ExtendedResourceClaimStatus
but not the sibling pod.status.NodeAllocatableResourceClaimStatuses field
added for DRANodeAllocatableResources.
The kubelet status manager already treats the field as not-kubelet-owned
and preserves it across status syncs (see "kubelet: do not destroy
nodeAllocatableResourceClaimStatuses"). Mirror that boundary in admission
so a kubelet cannot stomp on a value the scheduler is responsible for.
Use apiequality.Semantic.DeepEqual inline rather than introducing a third
hand-rolled helper next to resourceClaimStatusesEqual and
extendedResourceClaimStatusEqual: NodeAllocatableResourceClaimStatus.Resources
is a map[ResourceName]resource.Quantity, and Semantic.DeepEqual already
canonicalises resource.Quantity comparisons.
DRANodeAllocatableResources is alpha and default-off, so this is
future-proofing rather than a fix for an observed bug.
Signed-off-by: Fagani Hajizada <fhajizada@nvidia.com>
The previous error message said the audience was "not found in pod
spec volume", which led users to mount a spurious projected service
account token volume in the pod spec to satisfy the check. That is
not the intended remedy: kubelets should be authorized via RBAC to
request tokens for the configured audience.
Reword the error to a generic "is not authorized to request tokens
for audience %q" so users are not pushed toward modifying pod specs.
The valid authorization paths (pod spec volume, CSIDriver tokenRequests,
or the request-serviceaccounts-token-audience verb) are documented
in the kubelet credential provider task page.
Update the unit and integration test expectations to match.
- Refine doc comment to note ExtendedResourceClaimStatus may change under
rare condition after a pod is bound to a node.
- Seed the initial pod with ExtendedResourceClaimStatus{extended-claim-0}
and RequestMappings so the test exercises the change scenario yliaog
described rather than nil-to-set.
- Update the inline comment and assertion messages to reflect the swap
from extended-claim-0 to extended-claim-1.
Pods using DRAExtendedResource (e.g. nvidia.com/gpu) have no
Spec.ResourceClaims, so ResourceClaimStatuses stays nil. The updatePod
fast-path skipped AddPod when only ExtendedResourceClaimStatus changed,
leaving the synthesized claim→pod→node edge out of the authorization graph.
Add PodExtendedStatusEqual to the fast-path guard, matching what the
scheduler event handler already does in events.go.
This commit introduces the DRAResourceClaimGranularStatusAuthorization
feature gate (Beta in 1.36) to enforce fine-grained authorization checks
on ResourceClaim status updates.
Previously, 'update' permission on 'resourceclaims/status' allowed modifying
the entire status. To enforce the principle of least privilege for DRA
drivers and the scheduler, this change introduces synthetic subresources and
verb prefixes:
- 'resourceclaims/binding': Required to update 'status.allocation' and
'status.reservedFor'.
- 'resourceclaims/driver': Required to update 'status.devices'. Evaluated
on a per-driver basis using 'associated-node:<verb>' (for node-local
ServiceAccounts) or 'arbitrary-node:<verb>' (for cluster-wide controllers).
Implement the RPSR controller that watches ResourcePoolStatusRequest
objects and aggregates pool status from DRA drivers. Add the API server
registry (strategy, storage), handwritten validation, RBAC bootstrap
policy for the controller, kube-controller-manager wiring, table
printer columns, and storage factory registration.
Michael Aspinwall