Pod Certificates

[ahmedtd]

Enhancement Description

• One-line enhancement description (can be used as a release note): This proposal provides a built-in capability for pods to authenticate to kube-apiserver using mTLS. It's built from pieces that are easy for external projects to reuse to deliver additional functionality using X.509 certificates.
• Kubernetes Enhancement Proposal: link
• Discussion Link: SIG Auth meeting minutes
• Primary contact (assignee): @ahmedtd
• Responsible SIGs: SIG Auth
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.34
  • Beta release target (x.y): 1.35
  • Stable release target (x.y):
• Alpha 1.34
  • KEP (k/enhancements) update PR(s): KEP-4317: Pod Certificates #4318
  • Code (k/k) update PR(s):
    • Pod Certificates: Preliminary implementation of KEP-4317 kubernetes#128010
    • Pod Certificates: Fix kubelet volume host arg order; improve logging kubernetes#133242
  • Docs (k/website) update PR(s):
    • Pod Certificate: Document PodCertificate and podCertificate projected volumes website#51817
• Beta
  • KEP (k/enhancements) update PR(s): KEP-4317: (Pod Certificates) Update for beta #5565
    • 1.36 KEP-4317: Add PKCS#10 CSR to Pod Certificates #5807
  • Code (k/k) update PR(s):
    • Promote Pod Certificates feature to beta kubernetes#134624
    • Promote Pod Certificates feature to beta-with metrics/events and e2e tests. kubernetes#134790
    • 1.36 Push ClusterTrustBundles v1beta1 deprecation to 1.37 kubernetes#136787
    • 1.36 Pod Certificates: Add StubPKCS10Request; migrate in-tree usages kubernetes#136729
  • Docs (k/website) update(s): KEP-4317: Pod Certificates Docs website#52918
    • 1.36 (Placeholder) Pod Certificate blog post website#54536
    • 1.36 KEP-4317: Document PodCertificateRequest StubPKCS10Request website#54535
• Stable
  • KEP (k/enhancements) update PR(s): KEP-4317: Move PodCertificates to GA #6158
  • Code (k/k) update PR(s):
    • kep-4317: add an in-cluster serving signer #5784
  • Docs (k/website) update(s):

[ahmedtd]

/sig auth

[enj]

/milestone v1.30
/label lead-opted-in

[enj]

/assign ahmedtd