Consul-auth-method service account auto generate token is impacted by Kubernetes 1.29 release KEP-2799

Consul
1

Kubernetes 1.29 has released a feature that will impact the service account tokens that are auto-generated

The secret of the service account consul-auth-method is impacted by this issue

Change the service account control loop in Token Controller to not auto-create secret for service accounts. At the same time, warn usage of auto-created secret-based service account tokens and encourage users to use TokenRequest API or manually-created secret-based service account tokens

image
image1032×162 6.9 KB

As we can see the below secret is updated with label kubernetes.io/legacy-token-last-used

kind: Secret
metadata:
  annotations:
    kubernetes.io/service-account.name: consul-auth-method
    meta.helm.sh/release-name: consul
    meta.helm.sh/release-namespace: consul
  labels:
    app: consul
    app.kubernetes.io/managed-by: Helm
    chart: consul-helm
    component: auth-method
    heritage: Helm
    kubernetes.io/legacy-token-last-used: "2024-06-17"
    release: consul
  name: consul-auth-method
  namespace: consul
type: kubernetes.io/service-account-token

How is the consul planning to address this issue?

2

@blake Can someone please comment on this on how to proceed further?