This release marks the transition of KubeUser from a series of development tags to a formal, production-ready Release Candidate. We have centralized the identity logic, synchronized the operator with Helm deployment patterns, and implemented cluster-wide safety guardrails.
Breaking Changes
- Mandatory Identity: The
spec.authsection andspec.auth.typeare now required pointers. The API server will reject anyUserresource missing these fields with a400 Bad Request. - Validation Rejection: Certificate TTLs under 24 hours are now strictly rejected by the Validating Webhook to prevent aggressive renewal loops.
Key Features: Auth & Renewal
1. Unified Authentication Model
- Environmental Bridge: The operator now dynamically reads authentication defaults from environment variables (
KUBEUSER_DEFAULT_TTL,KUBEUSER_DEFAULT_AUTORENEW), allowing SREs to configure global policies via Helm. - Mutation Persistence: Defaults are now persisted into the resource Spec during the admission phase. This ensures that "what you see is what you get" when describing a resource in etcd.
- Absolute Nil-Safety: All call-sites have been refactored to use the centralized
GetSafeAuthSpecgetter, eliminating potential controller panics.
2. Advanced Renewal Guardrails
- 50% Renewal Cap: To ensure operational stability, the
renewBeforesetting is now strictly capped at 50% of the total TTL. - 5-Minute Safety Floor: Every certificate is guaranteed a minimum of 5 minutes of valid life after the renewal threshold is reached.
- Atomic Rotation: Renewal uses a Shadow Secret pattern to manage new private keys and CSR metadata, performing a zero-downtime "flip" only after the certificate is signed.
3. Managed Kubernetes Support
- Configurable CSR Signers: Added support for custom and managed signers (e.g., AWS EKS
beta.eks.amazonaws.com/app-client) via theKUBEUSER_SIGNER_NAMEenvironment variable. - Dynamic RBAC: The Helm chart now dynamically populates the
ClusterRolesigner approval list based on yourvalues.yamlconfiguration.