RunAsUserName for Windows

[PatrickLang]

Enhancement Description

• One-line enhancement description (can be used as a release note): Add RunAsUserName field to set the user for a container's initial process on Windows
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-windows/20190418-windows-security-context.md
  This covers both APIs that needed to be reviewed together, and it's implementable.
• Primary contact (assignee): @jsturtevant
• Responsible SIGs: SIG-Windows
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y) 1.16
  • Beta release target (x.y) 1.17
    • doc pr Update RunAsUsername to beta website#17460
    • code pr Moving WindowsRunAsUserName to beta kubernetes#84882
  • Stable release target (x.y) 1.18
    • code pr Moving Windows RunAsUserName feature to GA kubernetes#87790
    • doc pr Removing beta references on RunAsUserName page website#19016

Existing issue:
kubernetes/kubernetes#73387

This existing PR will be updated and merged: kubernetes/kubernetes#73609

Past work in CRI layer:
kubernetes/kubernetes#64009

[PatrickLang]

/sig windows
/milestone v1.15

[makoscafee]

Hey, @PatrickLang 👋 I'm the v1.15 docs Lead.
Does this enhancement require any new docs (or modifications)?

Just a friendly reminder we're looking for a PR against k/website (branch dev-1.15) due by Thursday, May 30th. It would be great if it's the start of the full documentation, but even a placeholder PR is acceptable. Let me know if you have any questions

[kacole2]

Hi @PatrickLang, today is code freeze for the 1.15 release cycle. The k/k PRs kubernetes/kubernetes#73609 has not yet been merged. It's now being marked as At Risk in the 1.15 Enhancement Tracking Sheet. Is there a high confidence this will be merged by EOD PST today? After this point, only release-blocking issues and PRs will be allowed in the milestone with an exception.

[PatrickLang]

/milestone clear

[PatrickLang]

/milestone v1.16

[evillgenius75]

Hi @PatrickLang , I'm a 1.16 Enhancement Shadow. Is this feature going to be graduating to alpha stage in 1.16? Please let me know so it can be added to the 1.16 Tracking Spreadsheet. If not's graduating, I will remove it from the milestone and change the tracked label.

If there are any other PRs besides kubernetes/kubernetes#73609, please list all relevant k/k PRs in this issue so they can be tracked properly.

Milestone dates are Enhancement Freeze 7/30 and Code Freeze 8/29.

Thank you.

[PatrickLang]

hi @evilgenius75 - it's merged in kubernetes/kubernetes#79489 :)
/close

[k8s-ci-robot]

@PatrickLang: Closing this issue.

In response to this:

hi @evilgenius75 - it's merged in kubernetes/kubernetes#79489 :)
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[kacole2]

@PatrickLang we need to keep this open until the feature has graduated to stable. Is there any other reason why it should be closed?

[sethmccombs]

Hey @PatrickLang

I'm one of the v1.16 docs shadows.
Does this enhancement (or the work planned for v1.16) require any new docs (or modifications to existing docs)? If not, can you please update the 1.16 Enhancement Tracker Sheet (or let me know and I’ll do so)

If so, just a friendly reminder we're looking for a PR against k/website (branch dev-1.16) due by Friday, August 23rd, it can just be a placeholder PR at this time. Let me know if you have any questions!

[PatrickLang]

doc PR: kubernetes/website#15378

[PatrickLang]

test PR: kubernetes/kubernetes#79539

[kacole2]

@PatrickLang code freeze for 1.16 is on Thursday 8/29. Are there any outstanding k/k PRs that still need to be merged for this to go Alpha? Looks like only thing we're waiting on is kubernetes/kubernetes#79539 to be merged.

[iheanyi1]

Hello @PatrickLang ,

I'm 1.18 docs shadow.

Just want to know if this enhancement work planned for 1.18 require any new docs (or modifications to existing docs)? If not, can you please update the 1.18 Enhancement Tracker Sheet (or let me know and I'll do so)

If so, just a friendly reminder we're looking for a PR against k/website (branch dev-1.18) due by Friday, Feb 28th, it can just be a placeholder PR at this time. Let me know if you have any questions!

Warm regards,

chima

[PatrickLang]

@iheanyi1 - have doc PR attached. code PRs are merged.

/milestone v1.18

[helayoty]

Hi @PatrickLang We're only a few days out from code freeze now. It does not look like your PR has merged yet, are you still feeling like you're on track for code freeze for this enhancement? Do you want to defer this to 1.19 based on the reviewer bandwidth? Or try and make a push?

[marosset]

@helayoty we want to try and get this in for 1.18 since the code PRs already merged.
I DM'd @tengqm on slack to take a look since this just needs approval from sig-docs-en-owners

[PatrickLang]

All PRs merged. Thanks for all the hard work everyone!

[palnabarun]

/stage stable

[palnabarun]

Hi @PatrickLang, since this enhancement graduated to stable in 1.18, can you please mark the KEP as implemented?

[palnabarun]

/reopen
(reopening the issue until the KEP is marked implemented)

[k8s-ci-robot]

@palnabarun: Reopened this issue.

In response to this:

/reopen
(reopening the issue until the KEP is marked implemented)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[marosset]

@palnabarun I can update the KEP.

[palnabarun]

@marosset Thank you 🙂

[marosset]

The KEP covers more than than just the RunAsUserName feature/API work - I think everything in the KEP has been implemented but am checked with @ddebroy

[ddebroy]

All aspects of the KEP (including RunAsUserName and GMSA credspecs) has indeed been implemented and graduated to stable. So I went ahead and marked the KEP implemented in #1743

As @marosset correctly pointed out above, the KEP covers the overall windowsOptions in securityContext in pod specs. We wrote that KEP to drive the API discussion and reviews around windowsOptions - which is a broader topic than runAsUserName that is the focus of this issue. GMSA had it's own dedicated KEP (since there was quite a lot of details to clarify there) but a dedicated KEP for runAsUserName was considered unnecessary as the concept was already well understood from the perspective of API reviews.

[palnabarun]

Thank you @marosset @ddebroy for updating the status of the KEP. 👍

/close

(since the corresponding KEP has been implemented)

[k8s-ci-robot]

@palnabarun: Closing this issue.

In response to this:

Thank you @marosset @ddebroy for updating the status of the KEP. 👍

/close

(since the corresponding KEP has been implemented)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.