ClusterTrustBundles (previously Trust Anchor Sets)

[ahmedtd]

Enhancement Description

• One-line enhancement description (can be used as a release note): Define ClusterTrustBundle, a resource for holding X.509 trust anchors

• Kubernetes Enhancement Proposal: link

• Discussion Link: Draft doc w/ comments SIG Auth Meeting

• Primary contact (assignee): @ahmedtd

• Responsible SIGs: sig-auth

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): 1.27 (API), 1.28 (Kubelet)
  • Beta release target (x.y): 1.32
  • Stable release target (x.y): ??

• 1.27 - Alpha

  • KEP (k/enhancements) update PR(s):
    • KEP-3257: Trust Anchor Sets #3258
    • kep-3257: Update target milestone, record reviewers / approvers #3826
  • Code (k/k) update PR(s):
    • Add certificates.k8s.io/v1alpha1 ClusterTrustBundle kubernetes#113218
  • Docs (k/website) update PR(s):
    • ClusterTrustBundles: Add section to certificates page website#40065

• 1.28 - Alpha

  • KEP (k/enhancements) update PR(s):
  • Code (k/k) update PR(s):
    • Implement ClusterTrustBundlePEM projected volume kubernetes#113374
  • Docs (k/website) update PR(s):

• Beta

  • KEP (k/enhancements) update PR(s):
    • KEP-3257: cluster trust bundles: add a new in-tree signer and its CTB #4791
  • Code (k/k) update PR(s):
    • trustbundles: add a new kube-apiserver-serving signer kubernetes#127326
    • ClusterTrustBundles - move to beta kubernetes#128499
  • Docs (k/website) update(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[ahmedtd]

/sig auth

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[ritazh]

/remove-lifecycle rotten

[marosset]

Hello @ahmedtd 👋, 1.26 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PDT on Thursday 6th October 2022.

This enhancement is targeting for stage alpha for 1.26 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.26
• KEP readme has a updated detailed test plan section filled out
• KEP readme has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

For this KEP, we would just need to update the following:

• Merge KEP-3257: Trust Anchor Sets #3258

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[ahmedtd]

I'm planning to address these issues today.

[dipesh-rawat]

Hi @ahmedtd @stlaz 👋, v1.32 Enhancements team here.

Just a quick friendly reminder as we approach the enhancements freeze later this week, at 02:00 UTC Friday 11th October 2024 / 19:00 PDT Thursday 10th October 2024.

The current status of this enhancement is marked as at risk for enhancement freeze. There are a few requirements mentioned in the comment #3257 (comment) that still need to be completed.

It looks like PR #4791 will address most of these issues. The PR #4791 needs to be merged before the enhancements freeze.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you!

[enj]

@dipesh-rawat #4791 is merged.

[dipesh-rawat]

@ahmedtd @stlaz @enj Now that PR #4791 has been merged, all the KEP requirements are in place and merged into k/enhancements.

The status of this enhancement is now marked as tracked for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[edithturn]

Hello @ahmedtd , 👋🏼 this is Edith from the v1.32 Communications Team!
We’d love for you to consider writing a feature blog about your enhancement! ✍
Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and is graduating.

To opt-in, let us know and open a Feature Blog placeholder PR against the website repository by 30th Oct 2024. For more information about writing a blog, see the blog contribution guidelines.

Note: In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.

[aroradaman]

Hello @aroradaman , 👋🏼 this is Edith from the v1.32 Communications Team! We’d love for you to consider writing a feature blog about your enhancement! ✍ Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and is graduating.

To opt-in, let us know and open a Feature Blog placeholder PR against the website repository by 30th Oct 2024. For more information about writing a blog, see the blog contribution guidelines.

Note: In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.

@edithturn I think you meant to tag @ahmedtd here.

[spurin]

Hi @ahmedtd, @stlaz 👋, I'm James Spurin, a 1.32 Docs Shadow. Great to meet you.

Does this enhancement work planned for 1.32 require any new docs or modifications to the existing docs?

If so, please follows the steps here to open a PR against dev-1.32 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday October 24th 2024 18:00 PDT.

Also, take a look at Documenting for a release to familiarise with the docs requirement for the release.

Thank you!

[spurin]

Hi @ahmedtd, @stlaz 👋,

Just a reminder to open a placeholder PR against dev-1.32 branch in the k/website repo for this (steps available here) for this KEP if it requires new or modifications to existing docs. The deadline for this is Thursday Oct 24 at 18:00 PDT. Thanks! 🚀

Thanks

James Spurin

[dipesh-rawat]

Hey again @ahmedtd @stlaz 👋 v1.32 Enhancements team here,

Just checking in as we approach code freeze at 02:00 UTC Friday 8th November 2024 / 19:00 PDT Thursday 7th November 2024 .

Here's where this enhancement currently stands:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PR/s are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

For this enhancement, it looks like the following PRs are open and need to be merged before code freeze (and we need to update the Issue description to include all the related PRs of this KEP):

• trustbundles: add a new kube-apiserver-serving signer kubernetes#127326
• ClusterTrustBundles - move to beta kubernetes#128499

Additionally, please let me know if there are any other PRs in k/k not listed in the description or not linked with this GitHub issue that we should track for this KEP, so that we can maintain accurate status.

The status of this enhancement is marked as at risk for code freeze.

If you anticipate missing code freeze, you can file an exception request in advance. Thank you!

[edithturn]

Hello @ahmedtd , 👋🏼 this is Edith from the v1.32 Communications Team! We’d love for you to consider writing a feature blog about your enhancement! ✍ Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and is graduating.
To opt-in, let us know and open a Feature Blog placeholder PR against the website repository by 30th Oct 2024. For more information about writing a blog, see the blog contribution guidelines.
Note: In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.

@edithturn I think you meant to tag @ahmedtd here.

Thank you, I just fixed it!

[edithturn]

Hello @ahmedtd @stlaz! 🙂

This is a reminder to author your feature blog post!

To opt-in, let us know and open a Feature Blog placeholder PR against the website repository by 30th Oct 2024. For more information about writing a blog see the blog contribution guidelines.

Please feel free to reach out if you have any questions!

Thank you very much!
Edith from the v1.32 Shadow Communications Team

[dipesh-rawat]

Hey again @ahmedtd @stlaz 👋, v1.32 Enhancements team here,

Just a quick friendly reminder as we approach code freeze in few days, at 02:00 UTC Friday 8th November 2024 / 19:00 PDT Thursday 7th November 2024 .

The current status of this enhancement is marked as at risk for code freeze. There are a few requirements mentioned in the comment #3257 (comment) that still need to be completed.

If you anticipate missing code freeze, you can file an exception request in advance.

[dipesh-rawat]

Hello @ahmedtd @stlaz 👋 v1.32 Enhancements team here,

Unfortunately, the implementation (code related) PR(s) associated with this enhancement is not in the merge-ready state by code-freeze and hence this enhancement is now removed from the v1.32 milestone.

If you still wish to progress this enhancement in v1.32, please file an exception request as soon as possible, within three days. If you have any questions, you can reach out in the #release-enhancements channel on Slack and we'll be happy to help. Thanks!

/label tracked/no
/remove-label tracked/yes
/milestone clear

[Ritikaa96]

Hey all!! while checking out this KEP there was a label that wasnt documented in the k8s docs , we tried searching for its use but couldnt find any in the current code.
So a per this comment, can we change this label kubernetes.io/cluster-trust-bundle-version to be, eg, k8s.example/cluster-trust-bundle-version ?

[sftim]

If the change is OK to make, that's a change to the KEP itself, and not to any code.

[Ritikaa96]

yes, so the change will be only in the KEP-3257: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/3257-cluster-trust-bundles
The only place it is used is here in the KEP, for ref

[Ritikaa96]

Just updated the label kubernetes.io/cluster-trust-bundle-version in PR: #4971

[sftim]

How do we feel about v1.33 for the beta promotion?