Extended NodeRestrictions for Pods

[tallclair]

Enhancement Description

• One-line enhancement description: Add node restrictions to mirror pods and pod metadata updates to prevent compromises in node isolation.
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/1314-node-restriction-pods
• Primary contact (assignee): @tallclair
• Responsible SIGs: sig/auth
• Enhancement target (which target equals to which milestone):
  • Alpha release target: v1.17
  • Beta release target: v1.19
  • Stable release target: v1.20

[neolit123]

tracking issue for kubeadm:
kubernetes/kubeadm#1835
tracking issue for /cluster addons:
kubernetes/kubernetes#83977

[palnabarun]

/stage alpha

[daminisatya]

Hello, @tallclair I'm 1.17 docs lead.

Does this enhancement (or the work planned for v1.17) require any new docs (or modifications to existing docs)? If not, can you please update the 1.17 Enhancement Tracker Sheet (or let me know and I'll do so)

If so, just a friendly reminder we're looking for a PR against k/website (branch dev-1.17) due by Friday, November 8th, it can just be a placeholder PR at this time. Let me know if you have any questions!