Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pod Certificates #4317

Open
1 of 5 tasks
ahmedtd opened this issue Oct 29, 2023 · 21 comments
Open
1 of 5 tasks

Pod Certificates #4317

ahmedtd opened this issue Oct 29, 2023 · 21 comments
Assignees
Labels
lead-opted-in Denotes that an issue has been opted in to a release sig/auth Categorizes an issue or PR as relevant to SIG Auth.
Milestone

Comments

@ahmedtd
Copy link
Contributor

ahmedtd commented Oct 29, 2023

Enhancement Description

  • One-line enhancement description (can be used as a release note): This proposal provides a built-in capability for pods to authenticate to kube-apiserver using mTLS. It's built from pieces that are easy for external projects to reuse to deliver additional functionality using X.509 certificates.
  • Kubernetes Enhancement Proposal: link
  • Discussion Link: SIG Auth meeting minutes
  • Primary contact (assignee): @ahmedtd
  • Responsible SIGs: SIG Auth
  • Enhancement target (which target equals to which milestone):
    • Alpha release target (x.y):
    • Beta release target (x.y):
    • Stable release target (x.y):
  • Alpha
@k8s-ci-robot k8s-ci-robot added the needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. label Oct 29, 2023
@ahmedtd
Copy link
Contributor Author

ahmedtd commented Oct 29, 2023

/sig auth

@k8s-ci-robot k8s-ci-robot added sig/auth Categorizes an issue or PR as relevant to SIG Auth. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Oct 29, 2023
@enj
Copy link
Member

enj commented Jan 8, 2024

/milestone v1.30
/label lead-opted-in

@k8s-ci-robot k8s-ci-robot added this to the v1.30 milestone Jan 8, 2024
@enj
Copy link
Member

enj commented Jan 8, 2024

/assign ahmedtd

@enj
Copy link
Member

enj commented Feb 5, 2024

Per the slack thread conversation, I am moving this KEP out of the v1.30 release.

@enj enj removed the lead-opted-in Denotes that an issue has been opted in to a release label Feb 5, 2024
@enj enj removed this from the v1.30 milestone Feb 5, 2024
@salehsedghpour
Copy link
Contributor

/milestone clear

@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 9, 2024
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle rotten
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

@k8s-ci-robot k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Jun 8, 2024
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Reopen this issue with /reopen
  • Mark this issue as fresh with /remove-lifecycle rotten
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

@k8s-ci-robot k8s-ci-robot closed this as not planned Won't fix, can't repro, duplicate, stale Jul 8, 2024
@k8s-ci-robot
Copy link
Contributor

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Reopen this issue with /reopen
  • Mark this issue as fresh with /remove-lifecycle rotten
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@aramase
Copy link
Member

aramase commented Aug 13, 2024

/reopen

@k8s-ci-robot
Copy link
Contributor

@aramase: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot reopened this Aug 13, 2024
@aramase
Copy link
Member

aramase commented Aug 13, 2024

/remove-lifecycle rotten

@k8s-ci-robot k8s-ci-robot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Aug 13, 2024
@ahmedtd ahmedtd changed the title PodIdentity certificates, PodCertificate volumes, and in-cluster kube-apiserver client certificates Pod Certificates Sep 1, 2024
@enj enj added the lead-opted-in Denotes that an issue has been opted in to a release label Sep 30, 2024
@enj enj added this to the v1.32 milestone Sep 30, 2024
@impact-maker
Copy link
Member

impact-maker commented Oct 1, 2024

Hello @ahmedtd 👋, Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 11th October 2024 / 19:00 PDT Thursday 10th October 2024.

This enhancement is targeting for stage alpha for v1.32 (correct me, if otherwise).

Here's where this enhancement currently stands:

  • KEP readme using the latest template has been merged into the k/enhancements repo.
  • KEP status is marked as implementable for latest-milestone: v1.32.
  • KEP readme has up-to-date graduation criteria
  • KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here). If your production readiness review is not completed yet, please make sure to fill the production readiness questionnaire in your KEP by the PRR Freeze deadline on Thursday, October 3rd, 2024 so that the PRR team has enough time to review your KEP.

For this KEP, we would just need to update the following:

  • KEP readme has up-to-date graduation criteria
  • KEP has a production readiness review that has been completed and merged into k/enhancements.

The status of this enhancement is marked as at risk for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you!

@enj
Copy link
Member

enj commented Oct 10, 2024

@impact-maker #4318 is merged.

@ahmedtd
Copy link
Contributor Author

ahmedtd commented Oct 10, 2024

@impact-maker I believe both missing items are now complete. PRR and graduation criteria were part of #4318

@spurin
Copy link

spurin commented Oct 14, 2024

Hi @ahmedtd 👋, I'm James Spurin, a 1.32 Docs Shadow. Great to meet you again.

Does this enhancement work planned for 1.32 require any new docs or modifications to the existing docs?

If so, please follows the steps here to open a PR against dev-1.32 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday October 24th 2024 18:00 PDT.

Also, take a look at Documenting for a release to familiarise with the docs requirement for the release.

Thank you!

@rytswd
Copy link
Member

rytswd commented Oct 16, 2024

Hi @ahmedtd 👋 -- this is Ryota (@rytswd) from the v1.32 Communications Team!

For the v1.32 release, we are currently in the process of collecting and curating a list of potential feature blogs, and we'd love for you to consider writing one for your enhancement!

As you may be aware, feature blogs are a great way to communicate to users about features which fall into (but not limited to) the following categories:

  • This introduces some breaking change(s)
  • This has significant impacts and/or implications to users
  • ...Or this is a long-awaited feature, which would go a long way to cover the journey more in detail 🎉

To opt in to write a feature blog, could you please let us know and open a "Feature Blog placeholder PR" (which can be only a skeleton at first) against the website repository by Wednesday, 30th Oct 2024? For more information about writing a blog, please find the blog contribution guidelines 📚

Tip

Some timeline to keep in mind:

  • 02:00 UTC Wednesday, 30th Oct: Feature blog PR freeze
  • Monday, 25th Nov: Feature blogs ready for review
  • You can find more in the release document

Note

In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.

@spurin
Copy link

spurin commented Oct 18, 2024

Hi @ahmedtd 👋,

Just a reminder to open a placeholder PR against dev-1.32 branch in the k/website repo for this (steps available here) for this KEP if it requires new or modifications to existing docs.

The deadline for this is Thursday Oct 24 at 18:00 PDT.

Thanks

James Spurin

@ahmedtd
Copy link
Contributor Author

ahmedtd commented Oct 22, 2024

Docs PR: kubernetes/website#48502

@rytswd
Copy link
Member

rytswd commented Oct 29, 2024

Hi @ahmedtd 👋, v1.32 Communications Team here again!

This is a gentle reminder for the feature blog deadline mentioned above, which is 02:00 UTC Wednesday, 30th Oct. To opt in, please let us know and open a Feature Blog placeholder PR against k/website by the deadline. If you have any questions, please feel free to reach out to us!

Tip

Some timeline to keep in mind:

  • 02:00 UTC Wednesday, 30th Oct: Feature blog PR freeze
  • Monday, 25th Nov: Feature blogs ready for review
  • You can find more in the release document

Note

In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.

@tjons
Copy link
Contributor

tjons commented Nov 4, 2024

Hey again @ahmedtd 👋 v1.32 Enhancements team here,

Just checking in as we approach code freeze at 02:00 UTC Friday 8th November 2024 / 19:00 PDT Thursday 7th November 2024 .

Here's where this enhancement currently stands:

  • All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
  • All PR/s are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

For this enhancement, it looks like the following PRs are open and need to be merged before code freeze (and we need to update the Issue description to include all the related PRs of this KEP):

Additionally, please let me know if there are any other PRs in k/k not listed in the description or not linked with this GitHub issue that we should track for this KEP, so that we can maintain accurate status.

The status of this enhancement is marked as at risk for code freeze.

If you anticipate missing code freeze, you can file an exception request in advance. Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
lead-opted-in Denotes that an issue has been opted in to a release sig/auth Categorizes an issue or PR as relevant to SIG Auth.
Projects
Status: Removed from Milestone
Status: At risk for code freeze
Status: Closed / Done
Development

No branches or pull requests

10 participants