Structured Authorization Configuration

[palnabarun]

Enhancement Description

• One-line enhancement description: Adds ability to structure configuring authorizers and add multiple webhooks to the kube-apiserver authorization chain
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/3221-structured-authorization-configuration
• Discussion Link: Add a provision to add multiple authorization webhooks kubernetes#101762
• Primary contact (assignee): @palnabarun @ritazh
• Responsible SIGs: sig-auth
• Enhancement target (which target equals to which milestone):
  • Alpha release target: 1.29
  • Beta release target: 1.30
  • Stable release target (x.y): 1.32
• Alpha
  • KEP (k/enhancements) update PR(s):
    • KEP-3221: Add Structured Authorization Configuration KEP #3376
    • KEP-3221: Update for 1.29 #4161
    • 3221: update KEP according to 1.29 requirements #4248
  • Code (k/k) update PR(s):
    • Issue: [StructuredAuthorizationConfig] - Implement AuthorizationConfiguration kubernetes#118872
      • [StructuredAuthorizationConfiguration] Implement API types and wire kube-apiserver to use them kubernetes#119099
      • [StructuredAuthorizationConfiguration] Add --authorization-config flag and guard it using a Feature Gate kubernetes#120154
    • Issue: [StructuredAuthorizationConfig] - CEL integration kubernetes#118873,
      • [StructuredAuthorizationConfig] - CEL integration kubernetes#121223
  • Docs (k/website) update PR(s)
    • Add docs for Authorization Configuration website#41892
• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP-3221 - WIP 1.30 update #4456
    • KEP-3221: Add PRR, update metrics #4485
  • Code (k/k) update PR(s):
    • KEP-3221: Implement authorization configuration file reloading kubernetes#121946
    • Add allowed/denied metrics for authorizers kubernetes#123333
    • Add authz webhook matchcondition metrics kubernetes#123611
    • Add authorization webhook duration/count/failopen metrics kubernetes#123639
    • Duplicate v1alpha1 AuthorizationConfiguration to v1beta1 kubernetes#123640
    • Promote StructuredAuthorizationConfiguration feature gate to beta kubernetes#123641
  • Docs (k/website) update(s): Add docs for Structured Authz beta website#45138
• Stable
  • KEP (k/enhancements) update PR(s):
    • KEP-3221: update kep milestone and stage #4796
  • Code (k/k) update PR(s): KEP-3221: Promote StructuredAuthorizationConfiguration to GA kubernetes#128172
  • Docs (k/website) update(s): KEP-3221: Promote StructuredAuthorizationConfiguration to GA website#48424

/assign
/sig auth

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[tallclair]

/remove-lifecycle stale

I think we're open to adding this feature, but need someone to drive it forward.

[ritazh]

@palnabarun Are you able to drive this KEP for 1.25?

[palnabarun]

@ritazh -- yes, I am going to drive this in 1.25.

[ritazh]

Hi @palnabarun, any progress on this KEP? Just checking in as enhancements freeze is at 18:00 PST on Thursday June 16, 2022.

[Priyankasaggu11929]

/milestone v1.25

[parul5sahoo]

Hello @palnabarun 👋, 1.25 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PST on Thursday June 23, 2022.

For note, This enhancement is targeting for stage alpha for 1.25 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP file using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable
• KEP has a updated detailed test plan section filled out
• KEP has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

Looks like for this one, we would need to update the above mentioned list items before enhancements freeze and update the test plan in the KEP README.md in the PR according to the latest changes in the proposal template incase you wish to add any more information to that section.

For note, the status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!