CSR Duration

[enj]

Enhancement Description

• One-line enhancement description (can be used as a release note): CSR Duration

• Kubernetes Enhancement Proposal: KEP

• Discussion Link:

  • CSR API: cluster signing duration is not flexible and has unsafe defaulting kubernetes#92678
  • SIG Auth 2021-03-17 Meeting
  • SIG Auth 2021-05-26 Meeting

• Primary contact (assignee): @enj

• Responsible SIGs: Auth

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): (skipped)
  • Beta release target (x.y): v1.22
  • Stable release target (x.y): v1.24

• Beta

  • KEP (k/enhancements) update PR(s):
    • CSR Duration KEP #2788
    • KEP-2784: Update CSR Duration KEP to match implementation #2820
  • Code (k/k) update PR(s):
    • csr: correctly handle backdating of short lived certs kubernetes#99412
    • csr: add expirationSeconds field to control cert lifetime kubernetes#99494
  • Docs (k/website) update(s): Update CSR docs with expirationSeconds field details website#28070

• Stable

  • KEP (k/enhancements) update PR(s):
    • KEP-2784: Update CSR Duration KEP with GA details #3197
    • KEP-2784: CSR Duration: address all GA items #3250
    • KEP-2784: CSR Duration: mark as implemented #3253
  • Code (k/k) update PR(s):
    • Promote CertificateSigningRequest's Spec.ExpirationSeconds field to GA kubernetes#108782
  • Docs (k/website) update(s):
    • Graduate CSRDuration to GA website#32405

[kikisdeliveryservice]

As this is being submitted well after the enhancments freeze author has submitted an exception request:
https://groups.google.com/g/kubernetes-sig-release/c/UZUQAIfizkY/m/0g3TxofwAwAJ

removing from milestone until it is evaluated.

[kikisdeliveryservice]

As per a comment here:
kubernetes/kubernetes#99412 (comment)

kubernetes/kubernetes#99412 is a bug fix (and prereq for this KEP) that will go into the 1.22 release regardless of whether or not this KEP (and other associate work) is included in the 1.22 release.

[kikisdeliveryservice]

The exception request to the enhancements freeze for this KEP has been approved: https://groups.google.com/g/kubernetes-sig-release/c/UZUQAIfizkY/m/PIyu2HBZBQAJ

@JamesLaverack can you please ensure the KEP is tracked?

Once the KEP is finished/merged, we can remove the holds from the implementation PRs.