The tenant Kubernetes chart renders the aggregation-layer UID flags from v1.32, and on v1.32 that means turning on the RemoteRequestHeaderUID feature gate, which is alpha there. A review round on a follow-up branch argued for moving the floor to v1.33, where the gate is beta and on by default, and I think the argument deserves a decision rather than a doc note.
What the v1.33 floor removes: the standalone gate render for v1.32, the merge of RemoteRequestHeaderUID=true into an operator's own --feature-gates entry, the --emulated-version reading that decides where the gate is needed, and roughly a quarter of the OIDC cases in packages/apps/kubernetes/tests/oidc_test.yaml. It also removes the upgrade window described in #4371 by construction, because a v1.32 aggregator already strips a client-supplied X-Remote-Uid, so a v1.32 to v1.33 roll has no replica that forwards it. And the chart stops enabling an alpha gate on every v1.32 tenant with OIDC on, which upstream does not support in production.
What it costs: tenants pinned to v1.32 do not gain UID propagation through the aggregation layer for ServiceAccount tokens and for CustomConfig users with a uid mapping. They do not have it today either, so nothing regresses against the shipped chart. v1.32 is out of upstream patch support and three minors below the chart default.
Not a bug report. #3539 shipped the v1.32 path as reviewed, and the count of tests it carries is the price of supporting a minor that is leaving. If the maintainers want the floor at v1.33, the change is a deletion with a doc update, and the docs/oidc-tenant.md render table shrinks by one row.
The tenant Kubernetes chart renders the aggregation-layer UID flags from
v1.32, and onv1.32that means turning on theRemoteRequestHeaderUIDfeature gate, which is alpha there. A review round on a follow-up branch argued for moving the floor tov1.33, where the gate is beta and on by default, and I think the argument deserves a decision rather than a doc note.What the
v1.33floor removes: the standalone gate render forv1.32, the merge ofRemoteRequestHeaderUID=trueinto an operator's own--feature-gatesentry, the--emulated-versionreading that decides where the gate is needed, and roughly a quarter of the OIDC cases inpackages/apps/kubernetes/tests/oidc_test.yaml. It also removes the upgrade window described in #4371 by construction, because av1.32aggregator already strips a client-suppliedX-Remote-Uid, so av1.32tov1.33roll has no replica that forwards it. And the chart stops enabling an alpha gate on everyv1.32tenant with OIDC on, which upstream does not support in production.What it costs: tenants pinned to
v1.32do not gain UID propagation through the aggregation layer for ServiceAccount tokens and forCustomConfigusers with a uid mapping. They do not have it today either, so nothing regresses against the shipped chart.v1.32is out of upstream patch support and three minors below the chart default.Not a bug report. #3539 shipped the
v1.32path as reviewed, and the count of tests it carries is the price of supporting a minor that is leaving. If the maintainers want the floor atv1.33, the change is a deletion with a doc update, and thedocs/oidc-tenant.mdrender table shrinks by one row.