Authorize with Field and Label Selectors

[deads2k]

Enhancement Description

• One-line enhancement description (can be used as a release note): allow using field and label selectors in authorization decisions

• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/4601-authorize-with-selectors

• Discussion Link:

• Primary contact (assignee): @deads2k

• Responsible SIGs: sig-auth

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): 1.31
  • Beta release target (x.y): 1.32
  • Stable release target (x.y): 1.34

• Alpha

  • KEP (k/enhancements) update PR(s):
    • KEP-4601: authorize with field and label selectors #4600
    • KEP-4601: add graduation criteria for selector based authorization #4730
  • Code (k/k) update PR(s):
    • add field and label selectors to authorization kubernetes#125571
  • Docs (k/website) update PR(s):
    • KEP-4601: alpha docs website#46986

• Beta

  • KEP (k/enhancements) update PR(s): KEP-4601: Beta updates for 1.32 #4894
  • Code (k/k) update PR(s): KEP-4601: AuthorizeNodeWithSelectors / AuthorizeWithSelectors to beta kubernetes#128168
  • Docs (k/website) update(s): KEP-4601: Promote AuthorizeWithSelectors / AuthorizeNodeWithSelectors to beta website#48411

• Stable

  • KEP (k/enhancements) update PR(s): KEP-4601: Graduate authorize with selector to stable #5326
  • Code (k/k) update PR(s): KEP-4601: Graduate selector authorization to stable kubernetes#132656
  • Docs (k/website) update(s): KEP-4601: promote AuthorizeWithSelectors / AuthorizeNodeWithSelectors to stable website#51461

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[deads2k]

/sig auth
/milestone 1.31
/stage alpha
/lead opt-in

[k8s-ci-robot]

@deads2k: The provided milestone is not valid for this repository. Milestones in this repository: [v1.25, v1.27, v1.28, v1.29, v1.30, v1.31]

Use /milestone clear to clear the milestone.

Details

In response to this:

/sig auth
/milestone 1.31
/stage alpha
/lead opt-in

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[deads2k]

/milestone v1.31

[deads2k]

/label lead-opted-in

[sreeram-venkitesh]

Hello @deads2k 👋, v1.31 Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 14th June 2024 / 19:00 PDT Thursday 13th June 2024.

This enhancement is targeting for stage alpha for v1.31 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: v1.31. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here). If your production readiness review is not completed yet, please make sure to fill the production readiness questionnaire in your KEP by the PRR Freeze deadline so that the PRR team has enough time to review your KEP before the enhancements freeze.

For this KEP, we need to do the following:

• Get KEP-4601: authorize with field and label selectors #4600 merged before the enhancements freeze. The files look good, but I couldn't find the graduation criteria, please fill in these too.

Rest everything looks good to me, everything seems to be taken care of in #4600. Please get the KEP files merged before the enhancements freeze and update the issue description with the links to the KEP and the PR.

The status of this enhancement is marked as at risk for enhancement freeze. But I can mark it as tracked as soon as the above changes are merged. Please make sure to get this done before the enhancements freeze.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Let me know if you have any questions! Thank you!