-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Immutable Secrets and ConfigMaps #1412
Comments
/sig storage |
/stage alpha |
@palnabarun - KEP has just been approved as implementable; can we start tracking it? |
Hi @wojtek-t , the 1.18 Enhancements team will reach out when the release cycle for 1.18 begins to flip the tracked status and set the milestone. Thank you for the updates on this enhancement. |
@wojtek-t Thanks for the update. We'll track this for 1.18. For your awareness, the release schedule is: Monday, January 6th - Release Cycle Begins Please make sure all the k/k PRs link here so we can track them. |
/milestone v1.18 |
Hello, @wojtek-t I'm 1.18 docs lead. |
Yes we will add some doc - I will open it by the deadline. |
Hey @wojtek-t, code freeze is March 5. Please link any PRs that are needed to complete this for 1.18, so we can track them in the release team. Thanks! |
We seem to be code-complete, unless we find some issue. So only docs are missing. |
Hello @wojtek-t Thanks! :) |
I opened kubernetes/website#19297 - it's the only remaining thing for Alpha |
We seem to be complete for Alpha. |
I think I'm not fully following. When Kubelet is observing new pod (or update of existing one) it is doing a get (technically it's a list with field selector for metadata.name which translates it to get) for all not yet watched ones. Each of them is pretty cheap on their own as it returns a single item basically. Kubelet is NOT listing/watching anything that none of its own pods are mounting. I didn't read the whole helm/helm#8977 but the initial analysis doesn't seem correct because of the above. You would need to look into what kinds of requests are happening on kube-apiserver to understand better. |
Hmm my assumption was that kubelet was doing a list/watch on all secrets at startup so it could update any mounted secret for it's pods. Let me confirm what were seeing in clusters with heavy large secret usage at kubelet startup |
Yeah - that's not true. Kubelet is not listing everything - it's getting/watching one-by-one and only those that are used by the pods it's running. |
/milestone v1.21 |
Updated KEP is merged: #2179 |
Hi @wojtek-t, 1.21 Enhancements Lead here. |
With kubernetes/kubernetes#97615 we're already code-complete. |
cc @xiaobaitusi |
kubernetes/website#26477 opened for documentation |
kubernetes/website#26477 has merged This is now both:
|
Hi @wojtek-t With code/doc complete, if you update the
|
Let's wait until code-freeze to ensure nothing will get reverted. And I will do that. |
Hi @wojtek-t friendly reminder to update the kep status (#1412 (comment)) so that this issue can be closed out :) thanks! |
#2615 out for review |
Enhancement Description
Please to keep this description up to date. This will help the Enhancement Team track efficiently the evolution of the enhancement
The text was updated successfully, but these errors were encountered: