Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Kubelet Server TLS Certificate Rotation #267

Open
jcbsmpsn opened this issue Apr 24, 2017 · 71 comments
Open

Kubelet Server TLS Certificate Rotation #267

jcbsmpsn opened this issue Apr 24, 2017 · 71 comments
Assignees
@liggitt @mikedanese @kannon92
Labels
kind/feature Categorizes issue or PR as related to a new feature. lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. sig/auth Categorizes an issue or PR as relevant to SIG Auth. stage/stable Denotes an issue tracking an enhancement targeted for Stable/GA status
Projects
Kubernetes 1.7 features SIG-Auth: CertificateSigningRequests SIG Auth Old

Comments

@jcbsmpsn
Copy link
Contributor

jcbsmpsn commented Apr 24, 2017 •
edited by liggitt
Loading

Feature Description

  • One-line feature description (can be used as a release note):
    Rotation of the server TLS certificate on the kubelet.

  • Primary contact (assignee):
    @mikedanese @liggitt

  • Responsible SIGs:
    sig-auth

  • Design proposal link (community repo): Kubelet server certificate bootstrap and rotation community#602

  • Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred:
    @mikedanese @awly

  • Approver (likely from SIG/area to which feature belongs):
    @tallclair

  • Initial target stage (alpha/beta/stable) and release (x.y):

    • alpha 1.7
    • beta 1.12
@ericchiang
Copy link
Contributor

I'm assuming this encompasses initial bootstrapping of the serving cert too?

@jcbsmpsn
Copy link
Contributor Author

Yes, initial bootstrapping of the server cert will be covered by this. Would you like a separate one, or just checking that feature wasn't lost in the shuffle?

@ericchiang
Copy link
Contributor

Just checking, thanks.

@idvoretskyi idvoretskyi added sig/auth Categorizes an issue or PR as relevant to SIG Auth. stage/alpha Denotes an issue tracking an enhancement targeted for Alpha status labels May 3, 2017
@idvoretskyi idvoretskyi added this to the v1.7 milestone May 3, 2017
@idvoretskyi
Copy link
Member

@jcbsmpsn please, provide us with the design proposal link

@idvoretskyi idvoretskyi added the help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. label May 3, 2017
@idvoretskyi idvoretskyi added this to Action required in Kubernetes 1.7 features May 3, 2017
@jcbsmpsn
Copy link
Contributor Author

jcbsmpsn commented May 8, 2017

Design proposal: kubernetes/community#602

@idvoretskyi
Copy link
Member

@jcbsmpsn updated the feature description with the link, thanks.

@idvoretskyi idvoretskyi removed the help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. label May 9, 2017
@idvoretskyi idvoretskyi moved this from Action required to In Progress in Kubernetes 1.7 features May 9, 2017
@jcbsmpsn jcbsmpsn changed the title Server TLS Certificate Rotation Kubelet Server TLS Certificate Rotation Jun 5, 2017
@ericchiang
Copy link
Contributor

Going to merge this into #266

@liggitt
Copy link
Member

liggitt commented Jun 22, 2017

Actually, I wouldn't. There's more work to do here with determining which SANs a node is allowed to serve.

@liggitt liggitt reopened this Jun 22, 2017
@apsinha
Copy link

apsinha commented Jun 27, 2017 •
edited
Loading

@jcbsmpsn
What is the link for the documentation update for certificate rotation? Is there no docs that need update?

ericchiang added a commit to ericchiang/website that referenced this issue Jun 27, 2017
@ericchiang
Update TLS bootstrapping with 1.7 features
7ab4289 
This includes documenting the new CSR approver built into the
controller manager and the kubelet alpha features for certifiate
rotation.

ref:

- kubernetes/kubernetes#45030
- kubernetes/enhancements#266
- kubernetes/enhancements#267
ericchiang added a commit to ericchiang/website that referenced this issue Jun 27, 2017
@ericchiang
Update TLS bootstrapping with 1.7 features
f6ed129 
This includes documenting the new CSR approver built into the
controller manager and the kubelet alpha features for certifiate
rotation.

Since the CSR approver changed over the 1.7 release cycle we need
to call out the migration steps for those using the alpha feature.
This document as a whole could probably use some updates, but the
main focus of this PR is just to get these features minimally
documented before the release.

ref:

- kubernetes/kubernetes#45030
- kubernetes/enhancements#266
- kubernetes/enhancements#267
@ericchiang ericchiang mentioned this issue Jun 27, 2017
Merged
@jcbsmpsn
Copy link
Contributor Author

jcbsmpsn commented Jun 27, 2017 •
edited
Loading

@apsinha Some documentation for this is included in kubernetes/website#4208

ericchiang added a commit to ericchiang/website that referenced this issue Jun 27, 2017
@ericchiang
Update TLS bootstrapping with 1.7 features
4b88f61 
This includes documenting the new CSR approver built into the
controller manager and the kubelet alpha features for certificate
rotation.

Since the CSR approver changed over the 1.7 release cycle we need
to call out the migration steps for those using the alpha feature.
This document as a whole could probably use some updates, but the
main focus of this PR is just to get these features minimally
documented before the release.

ref:

- kubernetes/kubernetes#45030
- kubernetes/enhancements#266
- kubernetes/enhancements#267
ericchiang added a commit to ericchiang/website that referenced this issue Jun 27, 2017
@ericchiang
Update TLS bootstrapping with 1.7 features
24a0436 
This includes documenting the new CSR approver built into the
controller manager and the kubelet alpha features for certificate
rotation.

Since the CSR approver changed over the 1.7 release cycle we need
to call out the migration steps for those using the alpha feature.
This document as a whole could probably use some updates, but the
main focus of this PR is just to get these features minimally
documented before the release.

ref:

- kubernetes/kubernetes#45030
- kubernetes/enhancements#266
- kubernetes/enhancements#267
@luxas
Copy link
Member

luxas commented Aug 14, 2017

@jcbsmpsn Can you please update this feature's status for v1.8?
Is beta targeted or will this be still in alpha?

@luxas luxas modified the milestones: 1.8, 1.7 Aug 14, 2017
@luxas luxas mentioned this issue Aug 14, 2017
Closed
@mikedanese mikedanese added the lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. label Dec 7, 2022
@liggitt
Copy link
Member

liggitt commented Jan 5, 2023

Discussed in sig-auth on 2022-12-07 - https://docs.google.com/document/d/1woLGRoONE3EBVx-wTb4pvp4CI7tmLZ6lS26VTbosLKM/edit#bookmark=id.52okchz28cmr

the functionality that exists is stable, in use, working successfully, but requires bringing your own CSR approver; it's a little weird to have a GA feature with no project-provided approver, but since kubernetes is agnostic about how nodes get IPs/DNS names, it also currently has to be agnostic about how to verify a given node owns a given IP/DNS name; I would +1 marking the current functionality stable and deferring a project-provided node address validation / serving CSR approver to a separate effort; would be good to capture the design and production implications of the current approach in a KEP and note the remaining/future possible related work

@liggitt liggitt added this to the v1.27 milestone Jan 5, 2023
@liggitt
Copy link
Member

liggitt commented Jan 5, 2023

capturing current state in a retroactive KEP, ensuring test coverage exists, and marking as GA in 1.27 seems achievable

@liggitt liggitt modified the milestones: v1.27, v1.28 Jan 30, 2023
@liggitt
Copy link
Member

liggitt commented Jan 30, 2023 •
edited
Loading

work to capture this in a retroactive KEP for 1.27 got preempted by #3744

@SergeyKanzhelev SergeyKanzhelev mentioned this issue Jan 31, 2023
Closed
@SergeyKanzhelev
Copy link
Member

SergeyKanzhelev commented Jan 31, 2023 •
edited
Loading

capturing current state in a retroactive KEP, ensuring test coverage exists, and marking as GA in 1.27 seems achievable

I looked at work needed to GA. Retrospective KEP: #3806

Couple things stand out:

  1. Metrics are still ALPHA. I'm not sure if it's OK to GA feature while metrics are ALPHA or BETA.
  2. There is no e2e coverage for the functionality. Not even the happy path, and no failure modes are tested.

Depending on the bar we want to use here, we may get it for 1.27. If not, I'd suggest we at least promote metrics to BETA in 1.27

@sftim
Copy link
Contributor

sftim commented Feb 1, 2023 •
edited
Loading

We should document this - or commit resources to doing that documentation work - before we make it GA.

Doing so helps but does not fully close kubernetes/website#30575 (which happens to be the oldest open issue against k/website).

We do have https://kubernetes.io/docs/tasks/tls/certificate-rotation/ but it's pretty short, looks inaccurate, and doesn't cover the process clearly enough. Imagine that you're studying for the CKS and you're relying on the open source materials only; do you think the explanation covers what you need to learn?

@liggitt liggitt removed this from the v1.28 milestone Apr 19, 2023
@scfast scfast mentioned this issue May 4, 2023
Open
@Atharva-Shinde Atharva-Shinde removed the tracked/no Denotes an enhancement issue is NOT actively being tracked by the Release Team label May 14, 2023
@mtaufen
Copy link
Contributor

mtaufen commented Oct 7, 2023

Is SIG-Node interested in bringing this to GA in an upcoming cycle? Was any progress made on graduating metrics? @SergeyKanzhelev

@liggitt liggitt mentioned this issue Dec 6, 2023
Closed
@SergeyKanzhelev
Copy link
Member

  1. Metrics are still ALPHA. I'm not sure if it's OK to GA feature while metrics are ALPHA or BETA.
    Is SIG-Node interested in bringing this to GA in an upcoming cycle? Was any progress made on graduating metrics? @SergeyKanzhelev

Metrics are not supporting beta. At least they were not when I checked. And making metrics Stable needs to be done with GA-ing of this feature

@SergeyKanzhelev
Copy link
Member

@kannon92 expressed interest moving this forward.

@kannon92
Copy link
Contributor

kannon92 commented Dec 7, 2023

/assign

@logicalhan
Copy link
Member

  1. Metrics are still ALPHA. I'm not sure if it's OK to GA feature while metrics are ALPHA or BETA.
    Is SIG-Node interested in bringing this to GA in an upcoming cycle? Was any progress made on graduating metrics? @SergeyKanzhelev

Metrics are not supporting beta. At least they were not when I checked. And making metrics Stable needs to be done with GA-ing of this feature

It's supported now: https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/component-base/metrics/opts.go#L80-L82. The guidance for BETA metrics is here and the policy for deprecation is in the official deprecation policy.

@kannon92 kannon92 mentioned this issue Jan 17, 2024
Open
@kannon92
Copy link
Contributor

@logicalhan I opened up kubernetes/kubernetes#122834 to promote these metrics to beta. Not entirely sure if this has to be done before/after the retrospective KEP.

@kannon92
Copy link
Contributor

/cc @tallclair

@SergeyKanzhelev
Copy link
Member

/stage stable
/milestone v1.30

@k8s-ci-robot k8s-ci-robot removed the stage/beta Denotes an issue tracking an enhancement targeted for Beta status label Jan 26, 2024
@k8s-ci-robot k8s-ci-robot added this to the v1.30 milestone Jan 26, 2024
@k8s-ci-robot k8s-ci-robot added the stage/stable Denotes an issue tracking an enhancement targeted for Stable/GA status label Jan 26, 2024
@kannon92
Copy link
Contributor

/stage stable /milestone v1.30

Just to be clear, I took this KEP to sig-auth and I don't think there was any commitment from sig-auth to include this for 1.30. My hope is to get the retrospective KEP approved and maybe promote some metrics to beta in 1.30. I still need to find someone who can help with some historical context on this KEP as I am afraid I don't have that.

@salehsedghpour
Copy link
Contributor

/milestone clear

@k8s-ci-robot k8s-ci-robot removed this from the v1.30 milestone Feb 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@liggitt liggitt

@mikedanese mikedanese

@kannon92 kannon92

Labels
kind/feature Categorizes issue or PR as related to a new feature. lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. sig/auth Categorizes an issue or PR as relevant to SIG Auth. stage/stable Denotes an issue tracking an enhancement targeted for Stable/GA status
Projects
SIG Auth
Status: KEP Backlog
SIG-Auth: CertificateSigningRequests
In progress
Kubernetes 1.7 features
In Progress
SIG Auth Old
Closed / Done
Milestone
No milestone
Development

No branches or pull requests