Authorize with Field and Label Selectors

[deads2k]

Enhancement Description

• One-line enhancement description (can be used as a release note): allow using field and label selectors in authorization decisions

• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/4601-authorize-with-selectors

• Discussion Link:

• Primary contact (assignee): @deads2k

• Responsible SIGs: sig-auth

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): 1.31
  • Beta release target (x.y): 1.32
  • Stable release target (x.y): 1.34

• Alpha

  • KEP (k/enhancements) update PR(s):
    • KEP-4601: authorize with field and label selectors #4600
    • KEP-4601: add graduation criteria for selector based authorization #4730
  • Code (k/k) update PR(s):
    • add field and label selectors to authorization kubernetes#125571
  • Docs (k/website) update PR(s):
    • KEP-4601: alpha docs website#46986

• Beta

  • KEP (k/enhancements) update PR(s): KEP-4601: Beta updates for 1.32 #4894
  • Code (k/k) update PR(s): KEP-4601: AuthorizeNodeWithSelectors / AuthorizeWithSelectors to beta kubernetes#128168
  • Docs (k/website) update(s): KEP-4601: Promote AuthorizeWithSelectors / AuthorizeNodeWithSelectors to beta website#48411

• Stable

  • KEP (k/enhancements) update PR(s):
  • Code (k/k) update PR(s):
  • Docs (k/website) update(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[deads2k]

/sig auth
/milestone 1.31
/stage alpha
/lead opt-in

[k8s-ci-robot]

@deads2k: The provided milestone is not valid for this repository. Milestones in this repository: [v1.25, v1.27, v1.28, v1.29, v1.30, v1.31]

Use /milestone clear to clear the milestone.

In response to this:

/sig auth
/milestone 1.31
/stage alpha
/lead opt-in

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[deads2k]

/milestone v1.31

[deads2k]

/label lead-opted-in

[sreeram-venkitesh]

Hello @deads2k 👋, v1.31 Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 14th June 2024 / 19:00 PDT Thursday 13th June 2024.

This enhancement is targeting for stage alpha for v1.31 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: v1.31. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here). If your production readiness review is not completed yet, please make sure to fill the production readiness questionnaire in your KEP by the PRR Freeze deadline so that the PRR team has enough time to review your KEP before the enhancements freeze.

For this KEP, we need to do the following:

• Get KEP-4601: authorize with field and label selectors #4600 merged before the enhancements freeze. The files look good, but I couldn't find the graduation criteria, please fill in these too.

Rest everything looks good to me, everything seems to be taken care of in #4600. Please get the KEP files merged before the enhancements freeze and update the issue description with the links to the KEP and the PR.

The status of this enhancement is marked as at risk for enhancement freeze. But I can mark it as tracked as soon as the above changes are merged. Please make sure to get this done before the enhancements freeze.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Let me know if you have any questions! Thank you!

[liggitt]

#4600 merged, @deads2k, can you make sure any relevant graduation criteria is mentioned

[MaryamTavakkoli]

Hello @deads2k 👋, 1.31 Docs Shadow here.
Does this enhancement work planned for 1.31 require any new docs or modifications to existing docs?
If so, please follow the steps here to open a PR against the dev-1.31 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday, June 27, 2024, 18:00 PDT.
Also, take a look at Documenting for a release to get yourself familiarised with the docs requirement for the release.
Thank you!

[deads2k]

Graduation criteria added in https://github.com/kubernetes/enhancements/pull/4730/files

[sreeram-venkitesh]

Thanks @deads2k! Marking this KEP as tracked for enhancements freeze! 🎉

[a-mccarthy]

Hi @deads2k,

👋 from the v1.31 Communications Team! We'd love for you to opt in to write a feature blog about your enhancement!
Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and is graduating.

To opt in, let us know and open a Feature Blog placeholder PR against the website repository by 3rd July, 2024. For more information about writing a blog see the blog contribution guidelines.

Note: In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.

[Princesso]

Graduation criteria added in https://github.com/kubernetes/enhancements/pull/4730/files

Hi @deads2k does this mean that this enhancement does not need any new documentation updates?

[liggitt]

placeholder doc PR open at kubernetes/website#46986

[a-mccarthy]

@deads2k, friendly reminder about the upcoming blog opt-in and placeholder deadline on July 3rd. Please open a blog placeholder PR if you are interested in contributing a blog.

[liggitt]

#4894 should address the outstanding items in #4601 (comment)

[impact-maker]

@liggitt thanks! Everything looks good, I have updated the issue status to tracked for enhancements freeze

[rashansmith]

Hello @deads2k @liggitt 👋 from the v1.32 Communications Team!
We'd love for you to consider writing a feature blog about your enhancement! Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and is graduating.

To opt-in, let us know and open a Feature Blog placeholder PR against the website repository by 30th Oct 2024. For more information about writing a blog see the blog contribution guidelines.

[AnshumanTripathi]

Hello @deads2k @liggitt 👋, 1.32 Docs Shadow here.
Does this enhancement work planned for 1.32 require any new docs or modification to existing docs?
If so, please follows the steps here to open a PR against dev-1.32 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday October 24th 2024 18:00 PDT.
Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.
Thank you!

[liggitt]

Does this enhancement work planned for 1.32 require any new docs or modification to existing docs?
If so, please follows the steps here to open a PR against dev-1.32 branch in the k/website repo.

opened kubernetes/website#48411

[rashansmith]

Hello @deads2k @liggitt !

This is a reminder to author your feature blog post!

To opt-in, let us know and open a Feature Blog placeholder PR against the website repository by 30th Oct 2024. For more information about writing a blog see the blog contribution guidelines.

Please feel free to reach out if you have any questions!

[sftim]

(blog articles are optional)

[tjons]

Hello @deads2k 👋, Enhancements team here

With all the implementation(code related) PRs merged as per the issue description:

• KEP-4601: AuthorizeNodeWithSelectors / AuthorizeWithSelectors to beta kubernetes#128168

This enhancement is now marked as tracked for code freeze for the v1.32 Code Freeze!

Please note that KEPs targeting stable need to have the status field marked as implemented in the kep.yaml file after code PRs are merged and the feature gates are removed.

[dipesh-rawat]

Hello 👋, 1.33 Enhancements Lead here.

I’m closing milestone 1.32 now. If you'd like to work on this enhancement in v1.33, please have the SIG lead opt-in by adding the lead-opted-in label, which ensures it gets added to the tracking board. Also, please set the milestone to v1.33 using /milestone v1.33.
Thanks!

/remove-label lead-opted-in
/milestone clear

[liggitt]

This is staying as-is in 1.33 for user feedback

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[liggitt]

Targeting stable promotion for 1.34 with no changes

[sathieu]

(I know that Create a generic in-tree authorizer that manages field or label selectors is an explicit non-goal of this KEP).

Will there be another KEP to add label selector to in-tree RBAC? i.e. to Roles/ClusterRoles or RoleBindings/ClusterRoleBindings. The typical usecase for this would be to limit access to secrets from operators (I don't want ingress controllers to access application secrets or Prometheus Operator to access TLS secrets).