CEL for Admission Control

[jpbetz]

Enhancement Description

• One-line enhancement description (can be used as a release note): CEL for Admission Control

• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/3488-cel-admission-control

• Discussion Link: https://groups.google.com/g/kubernetes-sig-api-machinery/c/WBVf_oWm4kU

• Primary contact (assignee): cici37

• Responsible SIGs: sig-apimachinery

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): 1.26
  • Beta release target (x.y): 1.28
  • Stable release target (x.y): 1.30

• Alpha

  • KEP (k/enhancements) update PR(s):
    • KEP-3488: CEL Admission Control #3492
    • PRR: KEP-3488: Add PRR and test section for Cel admission control #3554
  • Code (k/k) update PR(s):
    • [KEP-3488]Implement CEL for Admission Control kubernetes#113314
    • Refactor matcher interface kubernetes#113349
    • Add metrics for CEL for admission control KEP kubernetes#112994
    • Add feature gate CelValidatingAdmission kubernetes#112792
    • split and move CEL package kubernetes#112926
    • CEL Admission Plugin kubernetes#112858
  • Docs (k/website) update PR(s):
    • Documentation for CEL in Admission Control website#37770
    • [WIP]Feature blog place holder PR for CEL in Admission Control website#37683

• Alpha2(in 1.27)

  • KEP (k/enhancements) update PR(s):
    • KEP-3488: CEL admission: Add graceful rollout, warning and audit support #3732
    • KEP-3488: Add information on expression composition #3669
    • KEP-3488: add spec for supporting custom match criteria #3697
    • KEP-3488: Add proposed design for secondary authz via CEL validation policies. #3812
    • KEP-3488: Adjust for inclusion of string.format in CEL #3736
  • Code (k/k) update PR(s):
    • OpenAPI-based CEL type library kubernetes#113312
    • refactor validatingadmissionpolicy cel validator and compiler to be reusable kubernetes#115816
    • KEP-3488: Implement secondary authz for ValidatingAdmissionPolicy kubernetes#116054
    • Apply cost constraints to ValidatingAdmissionPolicy kubernetes#115747
    • KEP-3488: Implement Enforcement Actions and Audit Annotations kubernetes#115973
    • Apply context cancellation to ValidatingAdmissionPolicy kubernetes#116103
    • MessageExpression for ValidatingAdmissionPolicy kubernetes#116397
    • Type System for ValidatingAdmissionPolicy kubernetes#115668
    • Custom match criteria kubernetes#116350
  • Docs (k/website) update(s):
    • KEP-3488 ValidatingAdmissionPolicy post-1.27 update website#40054
    • KEP-3488 ValidatingAdmissionPolicy: MatchConditions website#40200
    • Documentation for messageExpression update to KEP-2876 website#40019
    • AdmissionWebhookMatchConditions feature documentation website#40058
    • KEP-3488 ValidatingAdmissionPolicy: Enforcement actions, audit annotations, and secondary authz website#40098

• Beta

  • KEP (k/enhancements) update PR(s): KEP-3488: promote validatingadmissionpolicy to beta #3949
  • Code (k/k) update PR(s):
    • Controlled rollout of CEL libraries and language feautres kubernetes#116779
    • Bump cel go to latest version kubernetes#118339
    • add support for authorizer to type checking. kubernetes#118540
    • ValidatingAdmissionPolicy: expended type checking to messageExpression kubernetes#119209
    • Cache authz decisions within the scope of validating policy admission. kubernetes#116443
    • ValidatingAdmissionPolicy controller for Type Checking kubernetes#117377
    • ValidatingAdmissionPolicy: Variable Composition kubernetes#118642
    • Add quantity library to CEL kubernetes#118803
    • ValidatingAdmissionPolicy: support namespace access kubernetes#118267
    • CEL lib: Expose errors on authz decisions instead of raising them from check() kubernetes#118804
    • KEP-3488: Per namespace policy params kubernetes#119215
    • KEP-3488: Promote ValidatingAdmissionPolicy to Beta kubernetes#118644
  • Docs (k/website) update(s): [WIP] Update docs around CEL for Admission Control website#42042

• Stable

  • KEP (k/enhancements) update PR(s): [KEP-3488]Promote ValidatingAdmissionPolicy to GA #4225
  • Code (k/k) update PR(s):
    • ValidatingAdmissionPolicy: exclude brink-able resources. kubernetes#123543
    • [KEP-3488]Promote ValidatingAdmissionPolicy to GA kubernetes#123405
  • Docs (k/website) update(s): [KEP-3488]Promoting ValidatingAdmissionPolicy to GA website#45249

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[jpbetz]

/sig api-machinery

[kikisdeliveryservice]

@jpbetz please provide a Discussion Link. It is required that you "link to SIG mailing list thread, meeting, or recording where the Enhancement was discussed before KEP creation" :)

[logicalhan]

/lead-opted-in

[logicalhan]

/milestone v1.26

[logicalhan]

/lead-opted-in

[logicalhan]

/sig api-machinery

[rhockenbury]

/label tracked/yes

[parul5sahoo]

Hello @jpbetz 👋, 1.26 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PDT on Thursday 6th October 2022.

This enhancement is targeting for stage alpha for 1.26 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.26
• KEP readme has a updated detailed test plan section filled out
• KEP readme has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

For this KEP, we would just need to update the following before enhancements freeze which is approaching soon:

• update the status of the KEP in the kep.yaml to implemetable.
• check the agreement in the test plan section and add graduation criteria for alpha phase(if need being).
• Complete and merge the PRR for the kep

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[jpbetz]

#3554 contains PRR, test, graduation and implementable, we are aiming to merge it today

[cici37]

@parul5sahoo Thanks for reaching out! We have everything merged. The KEP can be tracked now. Please let us know of anything is missing :)

[parul5sahoo]

Hello @cici37 , although I see that the release sign off checklist and the test agreement have been included but they are all unchecked. so could you please check the items that meet the criteria in the release check list and also the check the test agreement. And since these are minor details I am marking the KEP as tracked.

[cici37]

Hello @cici37 , although I see that the release sign off checklist and the test agreement have been included but they are all unchecked. so could you please check the items that meet the criteria in the release check list and also the check the test agreement. And since these are minor details I am marking the KEP as tracked.

#3592 to address this. Thanks for marking this tracked!

[cici37]

/assign

[cici37]

Yes we plan to promote this to GA in 1.30.

/milestone v1.30

@jpbetz Could you please tag the leader opt in label here? Thanks!

[jpbetz]

/lead opt-in

[jpbetz]

/label lead-opted-in

[sreeram-venkitesh]

Hello @cici37, @jpbetz 👋, v1.30 Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 9th February 2024.

This enhancement is targeting for stage stable for v1.30 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.30. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

The status of this enhancement is marked as tracked for enhancement freeze 🎉 Thank you!

[Princesso]

Hello @jpbetz , 👋 1.30 Docs Shadow here.
Does this enhancement work planned for 1.30 require any new docs or modifications to existing docs?
If so, please follow the steps here to open a PR against the dev-1.30 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday, February 22nd, 2024 18:00 PDT.
Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.
Thank you!

[kcmartin]

Hi @jpbetz, @cici37,

👋 from the v1.30 Communications Team! We'd love for you to opt in to write a feature blog about your enhancement!

We encourage blogs for features including, but not limited to: breaking changes, features and changes important to our users, and features that have been in progress for a long time and are graduating.

To opt in, you need to open a Feature Blog placeholder PR against the website repository.
The placeholder PR deadline is 27th February, 2024.
Here's the 1.30 Release Calendar

[fkautz]

Hi @jpbetz, @cici37

👋 from the v1.30 Communications Team!

We are currently working on the midcycle blog. We are looking for a paragraph or two about significant enhancements. Are you interested in participating?

Here's the link for general access (commenter permissions). We can extend editor permissions if you choose to author an entry in this blog post.

Also, please get in touch with us if there are other changes you believe could impact users that we should highlight. We can be reached at #release-comms in the Kubernetes Slack.

Cheers,
Frederick

[sreeram-venkitesh]

Hey again @jpbetz, @cici37 👋 v1.30 Enhancements team here,

Just checking in as we approach code freeze at 02:00 UTC Wednesday 6th March 2024.

Here's where this enhancement currently stands:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PR/s are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

For this enhancement, it looks like the following PRs are open and need to be merged before code freeze (and we need to update the issue description to include all the related PRs of this KEP):

• [KEP-3488]Promote ValidatingAdmissionPolicy to GA kubernetes#123405

Currently, I'm marking this KEP as At Risk for Code Freeze. Also, please let me know if there are other PRs in k/k we should be tracking for this KEP. As always, we are here to help if any questions come up. Thanks!

[sreeram-venkitesh]

@cici37, @jpbetz Please let me know if kubernetes/kubernetes#123405 is the only code PR that needs to be merged for this KEP. Pinging again since code freeze is tomorrow.

[jpbetz]

Please let me know if kubernetes/kubernetes#123405 is the only code PR that needs to be merged for this KEP. Pinging again since code freeze is tomorrow.

We're also merging kubernetes/kubernetes#123543. It's in the merge queue now. I've added it to the description for tracking. kubernetes/kubernetes#123405 is ready and will be merged after.

[sreeram-venkitesh]

Thank you @jpbetz, @cici37!

With all the implementation (code related) PRs merged as per the issue description:

• ValidatingAdmissionPolicy: exclude brink-able resources. kubernetes#123543
• [KEP-3488]Promote ValidatingAdmissionPolicy to GA kubernetes#123405

This enhancement is now marked as tracked for code freeze for the 1.30 Code Freeze!

[sreeram-venkitesh]

Hi @jpbetz 👋, 1.31 Enhancements Lead here.

Since this KEP has graduated to GA in 1.30, please update the status here in the kep.yaml to implemented so that we can close this issue.

/remove-label lead-opted-in

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten