Skip to content

v0.3.0
Compare
Choose a tag to compare
@pinniped-ci-bot pinniped-ci-bot released this 18 Dec 03:06
v0.3.0
6c210b6
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.

Release v0.3.0

Release Images

Image Registry
ghcr.io/vmware-tanzu/pinniped/pinniped-server:v0.3.0 GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.3.0 DockerHub

Changes

Major Changes

  • Implemented core login functionality of the Pinniped supervisor.
    The supervisor is an OpenID Connect (OIDC) server that passes identities from an upstream identity provider down to your Kubernetes clusters.
    In this release, we finish what we started in v0.2.0 by adding several new APIs and implementing all the core login functionality:

    • config.supervisor.pinniped.dev/FederationDomain configures the "downstream" behavior of the supervisor as an OIDC issuer.

    • idp.supervisor.pinniped.dev/OIDCIdentityProvider configures an "upstream" OIDC provider which will be the source of identities.

    The supervisor is a standards-compliant OIDC provider supporting the authorization code and refresh token flows.
    It also includes support for a RFC8693 token exchange grant flow.
    This new flow is key to supporting smooth login flows involving multiple clusters.

  • Added support for JSON Web Token (JWT) validation to the Pinniped concierge. This is configured with a new API type:

    • authentication.concierge.pinniped.dev/JWTAuthenticator configures JWT validation parameters for the cluster.

  • Added a new comprehensive command line interface that unifies the concierge and supervisor functionality:

    • pinniped get kubeconfig generates a Pinniped-based kubeconfig YAML.
      This command can autodiscover all required parameters in most cases, and supports using only a subset of Pinniped components.

Minor Changes

  • Extended the pinniped login oidc subcommand.
    This command is normally not called directly, but via a kubeconfig generated by pinniped get kubeconfig.
    It now supports login flows combining OIDC browser-based login and the concierge TokenCredentialRequest API.
    It also now supports the RFC8693 token exchange functionality via a new --request-audience flag.

  • Added a new pinniped login static subcommand which is similar to pinniped login oidc but using static tokens.
    Tokens can be passed in the kubeconfig or via environment variable.

  • Deprecated the pinniped get-kubeconfig subcommand.
    This has been replaced with pinniped get kubeconfig and will be removed in a future release.

  • Deprecated the pinniped exchange-credential subcommand.
    This has been replaced with pinniped login static and will be removed in a future release.

  • Adjusted the default logging level to be less verbose.
    Debug log output can now be enabled via a configuration field.

  • Increased the overall timeout for pinniped login oidc to 90 minutes and added shorter timeouts for non-interactive portions of the login flow.

  • Reduced the lifetime of concierge-issued client certificates from 1 hour to 5 minutes.

  • Upgraded to Go 1.15.6.

  • Upgraded container base image to Debian 10.7 (slim).

  • Upgraded Kubernetes library components to v1.19.5.

  • Moved some stable OIDC client functionality from ./internal to ./pkg so it can be more easily imported by other projects.

Diffs

A complete list of changes (450 commits, 622 changed files with 38,117 additions and 16,689 deletions!) can be found here.

Updates

The attached yaml files were updated on May 6, 2024 to use ghcr.io/vmware-tanzu/pinniped/pinniped-server instead of projects.registry.vmware.com/pinniped/pinniped-server.

Assets 9
Loading