ClusterTrustBundles (previously Trust Anchor Sets)

[ahmedtd]

Enhancement Description

• One-line enhancement description (can be used as a release note): Define ClusterTrustBundle, a resource for holding X.509 trust anchors

• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/3257-trust-anchor-sets/

• Discussion Link: Draft doc w/ comments SIG Auth Meeting

• Primary contact (assignee): @ahmedtd

• Responsible SIGs: sig-auth

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): 1.27 (API), 1.28 (Kubelet)
  • Beta release target (x.y): ??
  • Stable release target (x.y): ??

• 1.27 - Alpha

  • KEP (k/enhancements) update PR(s):
    • KEP-3257: Trust Anchor Sets #3258
    • kep-3257: Update target milestone, record reviewers / approvers #3826
  • Code (k/k) update PR(s):
    • Add certificates.k8s.io/v1alpha1 ClusterTrustBundle kubernetes#113218
  • Docs (k/website) update PR(s):
    • ClusterTrustBundles: Add section to certificates page website#40065

• 1.28 - Alpha

  • KEP (k/enhancements) update PR(s):
  • Code (k/k) update PR(s):
    • Implement ClusterTrustBundlePEM projected volume kubernetes#113374
  • Docs (k/website) update PR(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[ahmedtd]

/sig auth

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[ritazh]

/remove-lifecycle rotten

[marosset]

Hello @ahmedtd 👋, 1.26 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PDT on Thursday 6th October 2022.

This enhancement is targeting for stage alpha for 1.26 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.26
• KEP readme has a updated detailed test plan section filled out
• KEP readme has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

For this KEP, we would just need to update the following:

• Merge KEP-3257: Trust Anchor Sets #3258

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[ahmedtd]

I'm planning to address these issues today.

[enj]

@marosset #3258 has been approved by SIG Auth leads and PRR #3258 (comment) - we are just waiting on explicit /approve from PRR folks.

[enj]

@marosset and #3258 is merged :)

[rhockenbury]

With #3258 merged, I have this down as tracked for v1.26. Thanks!

[marosset]

Hi @ahmedtd 👋,

Checking in once more as we approach 1.26 code freeze at 17:00 PDT on Tuesday 8th November 2022.

Please ensure the following items are completed:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PRs are fully merged by the code freeze deadline.

For this enhancement, please link all relevant k/k PRs in the initial issue description for tracking.

As always, we are here to help should questions come up. Thanks!

[katmutua]

Hello @ahmedtd ! 👋🏾,

@katmutua 1.26 Release Docs shadow here. This enhancement is marked as ‘Needs Docs’ for 1.26 release.

Please follow the steps detailed in the documentation to open a PR against dev-1.26 branch in the k/website repo. This PR can be just a placeholder at this time, and must be created by November 9.

Also, take a look at Documenting for a release to familiarize yourself with the docs requirement for the release.
As a reminder, please link all of your docs PR to this issue so we can easily track it.

[marosset]

Hi @ahmedtd👋,

Checking in once more as we approach 1.26 code freeze at 17:00 PDT on Tuesday 8th November 2022.

Please ensure the following items are completed:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PRs are fully merged by the code freeze deadline.

For this enhancement, it looks like the following PRs are open and need to be merged before code freeze:

• Add certificates.k8s.io/v1alpha1 ClusterTrustBundle kubernetes#113218
• Implement ClusterTrustBundlePEM projected volume kubernetes#113374

As always, we are here to help should questions come up. Thanks!

[rhockenbury]

Hello 👋, 1.26 Enhancements Lead here.

Unfortunately, this enhancement did not meet requirements for code freeze.
If you still wish to progress this enhancement in v1.26, please file an exception request. Thanks!

/milestone clear
/label tracked/no
/remove-label tracked/yes
/remove-label lead-opted-in

[salaxander]

kubernetes/kubernetes#113374 was moved to 1.28, only kubernetes/kubernetes#113218 was part of the exception request for 1.27

Ah sounds good! I'll mark you as complete then. Thanks!!

[aramase]

@ahmedtd Is the KEP updated to reflect the current state and implementation plan for v1.28?

[Kasambx]

Hello @ahmedtd👋, Enhancements team here.

Just checking in as we approach enhancements freeze on 1:00 UTC on Friday 16th June 2023..

This enhancement is targeting for stage alpha for v 1.28 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: v 1.28
• KEP readme has a updated detailed test plan section filled out
• KEP readme has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

For this KEP, we would just need to update the following:

• Answer the questions on the readme 1.Rollout, Upgrade and Rollback Planning , 2.Troubleshooting

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[ahmedtd]

I will do the updates today.

[ahmedtd]

#4099

@Kasambx Can you clarify what you mean by "Answer the questions on the readme"? As far as I can tell, the testing section of KEP-3257 is up-to-date with the template, and I've filled out everything that's necessary on for Alpha stage.

I was able to list the affected packages for the unit testing, but the testgrid tab where it's suggested that I gather the existing coverage data is so large that it just crashes a few seconds after it loads (at least for me).

Update: I was able to pull the data by using IncludeFilterByRegex

[enj]

@Atharva-Shinde does this need anything else for 1.28? PRR is good for alpha.

[Atharva-Shinde]

Thanks @ahmedtd @enj :)
With all the KEP requirements in place and merged into k/enhancements, this enhancement is all good for the upcoming enhancements freeze 🚀.
The status of this enhancement is marked as tracked. Please keep the issue description up-to-date with appropriate stages as well.

[Kasambx]

@ahmedtd Unit test are now covered by #4099 please refer back to the notification that i had given you earlier.

[katcosgrove]

Hello @ahmedtd! 1.28 Docs Shadow here.

Does this enhancement work planned for 1.28 require any new docs or modification to existing docs?

If so, please follows the steps here to open a PR against dev-1.28 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday 20th July 2023.

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!

[Rishit-dagli]

Hey @ahmedtd , could you please create a docs PR even if it is a draft PR with no content yet against dev-1.28 branch in the k/website repo. The deadline to create this draft PR is Thursday 20th July 2023.

[Atharva-Shinde]

Hey again @ahmedtd 👋

Just checking in as we approach Code freeze at 01:00 UTC Wednesday, 19th July 2023 .

Here’s the enhancement’s state for the upcoming code freeze:

• All the PRs that are related to your enhancement are linked in the above issue description (for tracking purposes). This includes code, tests, and documentation related PR/s.
• All code related PR/s are merged or are in merge-ready state ( i.e they have approved and lgtm labels applied) by the code freeze deadline. This includes any tests related PR/s too.

For this enhancement, it looks like the following code related PR is open and it needs to be merged or should be in merge-ready state before the code freeze commences :

• Implement ClusterTrustBundlePEM projected volume kubernetes#113374

This is the code related PR that I found on this KEP issue

• Implement ClusterTrustBundlePEM projected volume kubernetes#113374

Please keep the issue description up-to-date with all the PR/s that are associated with this KEP and let me know if there are other PR/s in k/k we should be tracking for this KEP.

As always, we are here to help if any questions come up. Thanks!

[Atharva-Shinde]

Hello @ahmedtd 👋, 1.28 Enhancements Lead here.

Unfortunately, the implementation (code related) PR associated with this enhancement was not in the merge-ready state by code-freeze and hence this enhancement is now being removed from the v1.28 milestone.

If you still wish to progress this enhancement in v1.28, please file an exception request. Thanks!

/milestone clear