Pod Security Policy replacement

[tallclair]

Enhancement Description

• One-line enhancement description (can be used as a release note): Introduce a new admission controller for enforcing the Pod Security Standards on pods in a namespace.
• Kubernetes Enhancement Proposal: #2582
• Discussion Link: https://docs.google.com/document/d/1woLGRoONE3EBVx-wTb4pvp4CI7tmLZ6lS26VTbosLKM/view#bookmark=id.km06bp3uzuco
• Primary contact (assignee): @tallclair
• Responsible SIGs: sig-auth, sig-security
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.22
  • Beta release target (x.y):
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s):
  • Code (k/k) update PR(s):
  • Docs (k/website) update PR(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[gracenng]

Hi @tallclair 👋 1.22 Enhancements shadow here.

This enhancement is in good shape for 1.22, a couple minor change requests in light of Enhancement Freeze on Thursday May 13th:

• KEP has not been merged to master
• the "reviewers" section in kep.yaml is not filled out
• <<[unresolved]>> in README
• Graduation Criteria in README

Thank you!

[tallclair]

• I'm nagging the approvers daily, and still expect to get this merged by enhancement freeze
• Filled in reviewers
• The only remaining unresolved sections are explicitly flagged as non-blocking for the alpha. Is it OK to leave these sections for beta, or will they cause tooling issues?
• Filled in graduation criteria

[gracenng]

Hi there, thanks for the speedy updates.

• I talked to the team and it is okay to have unresolved sections for alpha
• With regards to graduation criteria, the KEP template has been updated to clarify this. Apologies for the confusion.

[gracenng]

Hi @tallclair 👋 1.22 Enhancements shadow here.
I just wanted to double check to see if SIG-Auth will need to do anything for this enhancement and if so, are they OK with it?
Thanks!

[liggitt]

yes, this is one of the top three items sig-auth is tackling this release