Structured Authorization Configuration

[palnabarun]

Enhancement Description

• One-line enhancement description: Adds ability to structure configuring authorizers and add multiple webhooks to the kube-apiserver authorization chain
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/3221-structured-authorization-configuration
• Discussion Link: Add a provision to add multiple authorization webhooks kubernetes#101762
• Primary contact (assignee): @palnabarun
• Responsible SIGs: sig-auth
• Enhancement target (which target equals to which milestone):
  • Alpha release target: 1.29
  • Beta release target (x.y): TBD
  • Stable release target (x.y): TBD
• Alpha
  • KEP (k/enhancements) update PR(s):
    • KEP-3221: Add Structured Authorization Configuration KEP #3376
    • KEP-3221: Update for 1.29 #4161
    • 3221: update KEP according to 1.29 requirements #4248
  • Code (k/k) update PR(s):
    • Issue: [StructuredAuthorizationConfig] - Implement AuthorizationConfiguration kubernetes#118872
      • [StructuredAuthorizationConfiguration] Implement API types and wire kube-apiserver to use them kubernetes#119099
      • [StructuredAuthorizationConfiguration] Add --authorization-config flag and guard it using a Feature Gate kubernetes#120154
    • Issue: [StructuredAuthorizationConfig] - CEL integration kubernetes#118873,
      • [StructuredAuthorizationConfig] - CEL integration kubernetes#121223
  • Docs (k/website) update PR(s)
    • Add docs for Authorization Configuration website#41892

Deferred for next milestone:

• Issue: [StructuredAuthorizationConfig] Implement reloading of configuration kubernetes#119102, PR: TBD

/assign
/sig auth

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[tallclair]

/remove-lifecycle stale

I think we're open to adding this feature, but need someone to drive it forward.

[ritazh]

@palnabarun Are you able to drive this KEP for 1.25?

[palnabarun]

@ritazh -- yes, I am going to drive this in 1.25.

[ritazh]

Hi @palnabarun, any progress on this KEP? Just checking in as enhancements freeze is at 18:00 PST on Thursday June 16, 2022.

[Priyankasaggu11929]

/milestone v1.25

[parul5sahoo]

Hello @palnabarun 👋, 1.25 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PST on Thursday June 23, 2022.

For note, This enhancement is targeting for stage alpha for 1.25 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP file using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable
• KEP has a updated detailed test plan section filled out
• KEP has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

Looks like for this one, we would need to update the above mentioned list items before enhancements freeze and update the test plan in the KEP README.md in the PR according to the latest changes in the proposal template incase you wish to add any more information to that section.

For note, the status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[palnabarun]

Hi @parul5sahoo, the KEP PR (#3376) under discussion has been filed with the latest template, has test plans, graduation criteria and a production readiness review is under progress.

[Priyankasaggu11929]

Just for record & to keep the history intact. (While deleting one of my own), I ended up deleting one of the bot comments by mistake. 😓

The deleted bot comment read following:

@Priyankasaggu11929: The provided milestone is not valid for this repository. Milestones in this repository: [keps-beta, keps-ga, v1.17, v1.18, v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26]

Use /milestone clear to clear the milestone.

In response to this:

/milestone v.125

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[parul5sahoo]

Hello @palnabarun 👋, 1.25 Enhancements team here.
The enhancements freeze on 18:00 PST on Thursday June 23, 2022. The enhancements is currently marked as at risk and will be marked as tracked once the PR #3376 is merged. And then it shall be ready for enhancements freeze.

[palnabarun]

We are not targetting it for 1.25 anymore.

ref: #3376 (comment)

[Priyankasaggu11929]

Thanks so much for the update @palnabarun. 🙂

/milestone clear

[enj]

/milestone v1.26

[liggitt]

we're picking this back up for 1.28

[salehsedghpour]

Hello @palnabarun 👋, Enhancements team here.

Just checking in as we approach enhancements freeze on 01:00 UTC Friday, 16th June 2023.

This enhancement is targeting for stage alpha for 1.28 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.28
• KEP readme has a updated detailed test plan section filled out
• KEP readme has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

For this KEP, we would just need to update the following:

• Ensure that the PRs are merged.

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[enj]

@salehsedghpour #3376 is merged, is this good for v1.28?

[palnabarun]

KEP readme using the latest template has been merged into the k/enhancements repo.
KEP has a production readiness review that has been completed and merged into k/enhancements.

@salehsedghpour -- both of the remaining items are done now.

[Atharva-Shinde]

With all the KEP requirements in place and merged into k/enhancements, this enhancement is all good for the upcoming enhancements freeze 🚀

The status of this enhancement is marked as tracked. Please keep the issue description up-to-date with appropriate stages as well. Thank you :)

[VibhorChinda]

Hello @palnabarun 👋, 1.28 Docs Shadow here.

Does this enhancement work planned for 1.28 require any new docs or modification to existing docs?

If so, please follows the steps here to open a PR against dev-1.28 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday 20th July 2023.

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!

[salehsedghpour]

Hey again @palnabarun 👋
Just checking in as we approach Code freeze at 01:00 UTC Friday, 19th July 2023 .
Here’s the enhancement’s state for the upcoming code freeze:

• All the PRs that are related to your enhancement are linked in the above issue description (for tracking purposes). This includes code, tests, and documentation related PR/s.
• All code related PR/s are merged or are in merge-ready state ( i.e they have approved and lgtm labels applied) by the code freeze deadline. This includes any tests related PR/s too.
  For this enhancement, it looks like the following code related PR/s are open and they need to be merged or should be in merge-ready state before the code freeze commences :
  • [StructuredAuthorizationConfiguration] Implement API types and wire kube-apiserver to use them kubernetes#119099

Please keep the issue description up-to-date with all the PR/s that are associated with this KEP and let me know if there are other PR/s in k/k we should be tracking for this KEP.
As always, we are here to help if any questions come up. Thanks!

[Atharva-Shinde]

Hello @palnabarun 👋, 1.28 Enhancements Lead here.

Unfortunately, the implementation (code related) PR associated with this enhancement is not in the merge-ready state by code-freeze and hence this enhancement is now removed from the v1.28 milestone.

If you still wish to progress this enhancement in v1.28, please file an exception request. Thanks!

/milestone clear

[ritazh]

Let's make sure this KEP addresses kubernetes/kubernetes#118571

[ritazh]

/label lead-opted-in

[sanchita-07]

Hello @palnabarun 👋, 1.29 Enhancements team here!

Just checking in as we approach enhancements freeze on 01:00 UTC, Friday, 6th October, 2023.

This enhancement is targeting for stage alpha for 1.29 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.29. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

For this KEP, it looks like merging of #4248 will be good to go for marking the KEP as tracked for enhancement freeze.

The status of this enhancement is marked as at risk for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well.

Thank you!

[ritazh]

@palnabarun looks like we are missing this. Can you ptal?

KEP readme using the latest template has been merged into the k/enhancements repo.

[sanchita-07]

Hi @palnabarun, checking in once more as we approach the 1.29 enhancement freeze deadline on 01:00 UTC, Friday, 6th October, 2023. The status of this enhancement is marked as at risk for enhancement freeze. It looks like #4248 will address the requirements. Let me know if I missed anything. Thanks!

[palnabarun]

@sanchita-07 -- checking in here, does the KEP not conform to the template or the only blocker is that the pending PR needs to be merged?

[liggitt]

#4248 is merged, I think we should be all set for 1.29. @sanchita-07, can you confirm?

[sanchita-07]

Thanks @palnabarun @liggitt :)
With all the KEP requirements in place and merged into k/enhancements, this enhancement is all good for the upcoming enhancements freeze 🚀.
The status of this enhancement is marked as tracked for enhancement freeze. 😃

[katcosgrove]

Hey there @liggitt @deads2k @palnabarun and @ritazh 👋, v1.29 Docs Lead here.
Does this enhancement work planned for v1.29 require any new docs or modification to existing docs?
If so, please follows the steps here to open a PR against dev-1.29 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday, 19 October 2023.
Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.
Thank you!

[palnabarun]

kubernetes/website#41892 is the docs PR. The feature would require docs.

[James-Quigley]

Hi @palnabarun 👋 from the v1.29 Communications Release Team! We would like to check if you have any plans to publish blogs for this KEP regarding new features, removals, and deprecations for this release.
If so, you need to open a PR placeholder in the website repository.
The deadline will be on Tuesday 14th November 2023 (after the Docs deadline PR ready for review)
Here's the 1.29 Calendar

[sanchita-07]

Hey again @palnabarun 👋, 1.29 Enhancements team here,

Just checking in as we approach code freeze at 01:00 UTC Wednesday 1st November 2023:

Here's where this enhancement currently stands:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PR/s are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

For this enhancement, it looks like the following PRs are merged before code freeze:

• [StructuredAuthorizationConfiguration] Implement API types and wire kube-apiserver to use them kubernetes#119099
• [StructuredAuthorizationConfiguration] Add --authorization-config flag and guard it using a Feature Gate kubernetes#120154

Are there additional code related PRs that need to be merged for 1.29? It looks like the above mentioned 2 issues are open and its PRs are TBD.

• [StructuredAuthorizationConfig] Implement reloading of configuration kubernetes#119102
• [StructuredAuthorizationConfig] - CEL integration kubernetes#118873

The status for this KEP is currently at risk for code freeze.

Also, please let me know if there are other PRs in k/k we should be tracking for this KEP.
As always, we are here to help if any questions come up ✌. Thanks :)

[palnabarun]

kubernetes/kubernetes#118873 is the only PR remaining to be merged. We will get it merged before the freeze.

[palnabarun]

kubernetes/kubernetes#119102 is optional for Alpha graduation of the feature.

[sanchita-07]

Hey @palnabarun 👋, 1.29 Enhancements team here!

With all the implementation(code related) PRs merged as per the issue description,
and kubernetes/kubernetes#119102 being optional for alpha, this enhancement is now marked as tracked for code freeze for the 1.29 Code Freeze! 🚀