Automated cherry pick of #16497: Support multiple service-account-issuer flags

k8s/crds/kops.k8s.io_clusters.yaml

@@ -1568,6 +1568,12 @@ spec:
                 description: KubeAPIServerConfig defines the configuration for the
                   kube api
                 properties:
+                  additionalServiceAccountIssuers:
+                    description: AdditionalServiceAccountIssuers can contain additional
+                      service account token issuers.
+                    items:
+                      type: string
+                    type: array
                   address:
                     description: 'Address is the binding address for the kube api:
                       Deprecated - use insecure-bind-address and bind-address'

nodeup/pkg/model/kube_apiserver.go

@@ -678,6 +678,9 @@ func (b *KubeAPIServerBuilder) buildPod(ctx context.Context, kubeAPIServer *kops
 			"/usr/local/bin/kube-apiserver",
 		}
 		container.Args = append(container.Args, sortedStrings(flags)...)
+		for _, issuer := range kubeAPIServer.AdditionalServiceAccountIssuers {
+			container.Args = append(container.Args, "--service-account-issuer="+issuer)
+		}
 	}
 
 	for _, path := range b.SSLHostPaths() {

nodeup/pkg/model/tests/golden/oidc/cluster.yaml

@@ -38,6 +38,12 @@ spec:
     - claim2=value2
     oidcUsernameClaim: user
     oidcUsernamePrefix: 'oidc:'
+    serviceAccountIssuer: https://huh.com/multisaissuer.example.com
+    additionalServiceAccountIssuers:
+    - https://foobar.com
+    - https://aaa.com
+    - https://hello.com
+    - https://dorld.com
   kubelet:
     anonymousAuth: false
   kubernetesVersion: v1.23.0

nodeup/pkg/model/tests/golden/oidc/tasks-kube-apiserver.yaml

@@ -52,15 +52,19 @@ contents: |
       - --requestheader-group-headers=X-Remote-Group
       - --requestheader-username-headers=X-Remote-User
       - --secure-port=443
-      - --service-account-issuer=https://api.internal.minimal.example.com
-      - --service-account-jwks-uri=https://api.internal.minimal.example.com/openid/v1/jwks
+      - --service-account-issuer=https://huh.com/multisaissuer.example.com
+      - --service-account-jwks-uri=https://huh.com/multisaissuer.example.com/openid/v1/jwks
       - --service-account-key-file=/srv/kubernetes/kube-apiserver/service-account.pub
       - --service-account-signing-key-file=/srv/kubernetes/kube-apiserver/service-account.key
       - --service-cluster-ip-range=100.64.0.0/13
       - --storage-backend=etcd3
       - --tls-cert-file=/srv/kubernetes/kube-apiserver/server.crt
       - --tls-private-key-file=/srv/kubernetes/kube-apiserver/server.key
       - --v=2
+      - --service-account-issuer=https://foobar.com
+      - --service-account-issuer=https://aaa.com
+      - --service-account-issuer=https://hello.com
+      - --service-account-issuer=https://dorld.com
       command:
       - /go-runner
       image: registry.k8s.io/kube-apiserver:v1.23.0

pkg/apis/kops/componentconfig.go

@@ -503,6 +503,9 @@ type KubeAPIServerConfig struct {
 	// in "iss" claim of issued tokens. This value is a string or URI.
 	ServiceAccountIssuer *string `json:"serviceAccountIssuer,omitempty" flag:"service-account-issuer"`
 
+	// AdditionalServiceAccountIssuers can contain additional service account token issuers.
+	AdditionalServiceAccountIssuers []string `json:"additionalServiceAccountIssuers,omitempty"`
+
 	// ServiceAccountJWKSURI overrides the path for the jwks document; this is useful when we are republishing the service account discovery information elsewhere.
 	ServiceAccountJWKSURI *string `json:"serviceAccountJWKSURI,omitempty" flag:"service-account-jwks-uri"`
 

pkg/apis/kops/v1alpha2/componentconfig.go

@@ -510,6 +510,9 @@ type KubeAPIServerConfig struct {
 	// in "iss" claim of issued tokens. This value is a string or URI.
 	ServiceAccountIssuer *string `json:"serviceAccountIssuer,omitempty" flag:"service-account-issuer"`
 
+	// AdditionalServiceAccountIssuers can contain additional service account token issuers.
+	AdditionalServiceAccountIssuers []string `json:"additionalServiceAccountIssuers,omitempty"`
+
 	// ServiceAccountJWKSURI overrides the path for the jwks document; this is useful when we are republishing the service account discovery information elsewhere.
 	ServiceAccountJWKSURI *string `json:"serviceAccountJWKSURI,omitempty" flag:"service-account-jwks-uri"`
 

pkg/apis/kops/v1alpha3/componentconfig.go

@@ -501,6 +501,9 @@ type KubeAPIServerConfig struct {
 	// in "iss" claim of issued tokens. This value is a string or URI.
 	ServiceAccountIssuer *string `json:"serviceAccountIssuer,omitempty" flag:"service-account-issuer"`
 
+	// AdditionalServiceAccountIssuers can contain additional service account token issuers.
+	AdditionalServiceAccountIssuers []string `json:"additionalServiceAccountIssuers,omitempty"`
+
 	// ServiceAccountJWKSURI overrides the path for the jwks document; this is useful when we are republishing the service account discovery information elsewhere.
 	ServiceAccountJWKSURI *string `json:"serviceAccountJWKSURI,omitempty" flag:"service-account-jwks-uri"`