Trust Anchor Sets

[ahmedtd]

Enhancement Description

• One-line enhancement description (can be used as a release note): Define TrustAnchorSets, a resource for holding X.509 trust anchors
• Kubernetes Enhancement Proposal: KEP-3257: Trust Anchor Sets #3258
• Discussion Link: Draft doc w/ comments SIG Auth Meeting
• Primary contact (assignee):
• Responsible SIGs: sig-auth
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.27
  • Beta release target (x.y): ??
  • Stable release target (x.y): ??
• Alpha
  • KEP (k/enhancements) update PR(s):
  • Code (k/k) update PR(s):
    • Add certificates.k8s.io/v1alpha1 ClusterTrustBundle kubernetes#113218
    • Define ClusterTrustBundlePEM projected volume kubernetes#113374
    • One more not yet mailed
  • Docs (k/website) update PR(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[ahmedtd]

/sig auth

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[ritazh]

/remove-lifecycle rotten

[marosset]

Hello @ahmedtd 👋, 1.26 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PDT on Thursday 6th October 2022.

This enhancement is targeting for stage alpha for 1.26 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.26
• KEP readme has a updated detailed test plan section filled out
• KEP readme has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

For this KEP, we would just need to update the following:

• Merge KEP-3257: Trust Anchor Sets #3258

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[ahmedtd]

I'm planning to address these issues today.

[enj]

@marosset #3258 has been approved by SIG Auth leads and PRR #3258 (comment) - we are just waiting on explicit /approve from PRR folks.

[enj]

@marosset and #3258 is merged :)

[rhockenbury]

With #3258 merged, I have this down as tracked for v1.26. Thanks!

[marosset]

Hi @ahmedtd 👋,

Checking in once more as we approach 1.26 code freeze at 17:00 PDT on Tuesday 8th November 2022.

Please ensure the following items are completed:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PRs are fully merged by the code freeze deadline.

For this enhancement, please link all relevant k/k PRs in the initial issue description for tracking.

As always, we are here to help should questions come up. Thanks!

[katmutua]

Hello @ahmedtd ! 👋🏾,

@katmutua 1.26 Release Docs shadow here. This enhancement is marked as ‘Needs Docs’ for 1.26 release.

Please follow the steps detailed in the documentation to open a PR against dev-1.26 branch in the k/website repo. This PR can be just a placeholder at this time, and must be created by November 9.

Also, take a look at Documenting for a release to familiarize yourself with the docs requirement for the release.
As a reminder, please link all of your docs PR to this issue so we can easily track it.

[marosset]

Hi @ahmedtd👋,

Checking in once more as we approach 1.26 code freeze at 17:00 PDT on Tuesday 8th November 2022.

Please ensure the following items are completed:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PRs are fully merged by the code freeze deadline.

For this enhancement, it looks like the following PRs are open and need to be merged before code freeze:

• Add certificates.k8s.io/v1alpha1 ClusterTrustBundle kubernetes#113218
• Define ClusterTrustBundlePEM projected volume kubernetes#113374

As always, we are here to help should questions come up. Thanks!

[rhockenbury]

Hello 👋, 1.26 Enhancements Lead here.

Unfortunately, this enhancement did not meet requirements for code freeze.
If you still wish to progress this enhancement in v1.26, please file an exception request. Thanks!

/milestone clear
/label tracked/no
/remove-label tracked/yes
/remove-label lead-opted-in