Limit node access to API

[saad-ali]

Limit node access to API

• One-line feature description (can be used as a release note):
  • A new Node authorization mode and NodeRestriction admission plugin, when used in combination, limit nodes' access to specific APIs, so that they may only modify their own Node API object, only modify Pod objects bound to themselves, and only retrieve secrets and configmaps referenced by pods bound to themselves.
• Primary contact (assignee):
  • @liggitt, @saad-ali
• Responsible SIGs:
  • sig/auth
• Design proposal link (community repo):
  • kubernetes/community#585
  • kubernetes/community#911
• Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred:
  • @deads2k
  • @timstclair
  • @ericchiang
• Approver (likely from SIG/area to which feature belongs):
  • @smarterclayton
• Feature target (which target equals to which milestone):
  • 1.7
    • node authorizer and noderestriction admission beta release
  • 1.13
    • continued beta work
    • restrict node label addition (kubernetes/community#911)
  • 1.14
    • restrict node address self-modification
    • stable release

[liggitt]

c.f. kubernetes/kubernetes#40476

[liggitt]

c.f. kubernetes/community#585

[idvoretskyi]

/kind feature

[idvoretskyi]

@liggitt am I right that it's still beta for 1.10?

[liggitt]

correct, it is beta until kubernetes/community#911 is resolved

work on that is occurring in the 1.10 timeframe

[idvoretskyi]

@liggitt great, thanks

[adohe]

@liggitt I am looking at this feature description limit nodes' access to specific APIs, so that they may only modify their own Node API object, only modify Pod objects bound to themselves, and only retrieve secrets and configmaps referenced by pods bound to themselves, IIUC if I enable this feature, the node access to API will be limited to quite narrow scope, and in a multitenant environment, this will bring more high level security.

[Bradamant3]

@liggitt does this need docs for 1.10? Maybe not? (can't quite tell from comments) Could you please update the 1.10 tracking spreadsheet and any related docs PR? Thanks!

[liggitt]

@liggitt does this need docs for 1.10? Maybe not? (can't quite tell from comments) Could you please update the 1.10 tracking spreadsheet and any related docs PR? Thanks!

no updates in 1.10

[justaugustus]

@mikedanese @liggitt
Any plans for this in 1.11?

If so, can you please ensure the feature is up-to-date with the appropriate:

• Description
• Milestone
• Assignee(s)
• Labels:
  • stage/{alpha,beta,stable}
  • sig/*
  • kind/feature

cc @idvoretskyi

[mistyhacks]

@liggitt @mikedanese please fill out the appropriate line item of the
1.11 feature tracking spreadsheet
and open a placeholder docs PR against the
release-1.11 branch
by 5/25/2018 (tomorrow as I write this) if new docs or docs changes are
needed and a relevant PR has not yet been opened.

[justaugustus]

@liggitt @mikedanese -- We're doing one more sweep of the 1.11 Features tracking spreadsheet.
Would you mind filling in any incomplete / blank fields for this feature's line item?

[kacole2]

@saad-ali This feature was worked on in the previous milestone, so we'd like to check in and see if there are any plans for this to graduate stages in Kubernetes 1.12 since you've marked it as beta in 1.12. This still has the 1.11 milestone as well so we need to update it accordingly.

If there are any updates, please explicitly ping @justaugustus, @kacole2, @robertsandoval, @rajendar38 to note that it is ready to be included in the Features Tracking Spreadsheet for Kubernetes 1.12.

---

Please note that the Features Freeze is July 31st, after which any incomplete Feature issues will require an Exception request to be accepted into the milestone.

In addition, please be aware of the following relevant deadlines:

• Docs deadline (open placeholder PRs): 8/21
• Test case freeze: 8/28

Please make sure all PRs for features have relevant release notes included as well.

Happy shipping!

[tallclair]

Still beta in 1.12, with some incremental improvements.

[kacole2]

Hi
This enhancement has been tracked before, so we'd like to check in and see if there are any plans for this to graduate stages in Kubernetes 1.13. This release is targeted to be more ‘stable’ and will have an aggressive timeline. Please only include this enhancement if there is a high level of confidence it will meet the following deadlines:

• Docs (open placeholder PRs): 11/8
• Code Slush: 11/9
• Code Freeze Begins: 11/15
• Docs Complete and Reviewed: 11/27

Please take a moment to update the milestones on your original post for future tracking and ping @kacole2 if it needs to be included in the 1.13 Enhancements Tracking Sheet

Thanks!

[liggitt]

Yes, limiting self-labeling capabilities is being worked on for 1.13

[kacole2]

@liggitt still considered beta or graduating to stable?

[liggitt]

Updated milestones to reflect the work targeted for 1.13. Node address reporting remains before this will be promoted to stable (looking toward 1.14 for that)