Add exec as user KEP #1224

max88991 · 2019-08-29T08:37:39Z

Signed-off-by: Lei Gong lgong@alauda.io

Signed-off-by: Lei Gong <lgong@alauda.io>

k8s-ci-robot · 2019-08-29T08:37:40Z

Welcome @max88991!

It looks like this is your first PR to kubernetes/enhancements 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/enhancements has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2019-08-29T08:37:46Z

Hi @max88991. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2019-08-29T08:38:08Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: max88991
To complete the pull request process, please assign dchen1107
You can assign the PR to them by writing /assign @dchen1107 in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

keps/sig-node/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

max88991 · 2019-08-29T08:39:16Z

/assign @dchen1107

max88991 · 2019-08-31T08:18:33Z

/sig nodes

max88991 · 2019-08-31T08:37:20Z

@mattjmcnaughton @smarterclayton please take a look at this

mattjmcnaughton

Thanks for your kep here!

Left some initial thoughts here - interested to know what other members of sig-node and sig-auth think.

mattjmcnaughton · 2019-08-31T13:52:17Z

keps/sig-node/20190825-exec-as-specified-user.md

+  - sig-cli
+  - sig-auth
+reviewers:
+  - "@smarterclayton"


Could we please add a reviewer from @kubernetes/sig-auth-api-reviews ?

mattjmcnaughton · 2019-08-31T13:54:59Z

keps/sig-node/20190825-exec-as-specified-user.md

+
+>  In the Kubernetes 1.5 release, we are proud to introduce the Container Runtime Interface (CRI) – a plugin interface which enables kubelet to use a wide variety of container runtimes, without the need to recompile. CRI consists of a protocol buffers and gRPC API, and libraries, with additional specifications and tools under active development. CRI is being released as Alpha in Kubernetes 1.5.
+
+But There are many container runtime implementation, e.g Docker, Kata, gVisior, most of which provide a way to enter the container as a special `user`.


To be sure I'm understanding, are you saying that this exec as user feature will only work for certain container runtime implementations (i.e. Docker, Kata...)?

That's interesting to me - my sense is that k8s is trying to move towards less special casing of certain container runtime implementations.

I'd be interested to hear from others in the community about the risk of increasing featuring between different container runtime implementations.

mattjmcnaughton · 2019-08-31T13:57:29Z

keps/sig-node/20190825-exec-as-specified-user.md

+
+> User specifies specific user (and group) information for the container process
+
+It brings convenience to debugging, and users are used to it. Adding a `user` option with `exec`  in Kubernetes seems reasonable.


Can you share a little bit more about the debugging experience?

What are the specific types of problems this would allow you to debug that you couldn't debug before?

I'm also curious about if some of the ideas proposed in the Ephemeral Containers KEP could be helpful w.r.t. these types of debugging (cc @verb ).

Currently we don't allow changing user in an ephemeral container, so what you get is what is in the dockerfile of the ephemeral container image. Likely some of the use cases here could be solved with an ephemeral debugging container (for example troubleshooting as root when a container image specifies a non-root user), but I see value in both approaches. They would be complementary.

I, too, would like to hear more about the debugging experience and agree that adding examples of things one cannot currently accomplish would help quite a bit.

mattjmcnaughton · 2019-08-31T13:58:06Z

keps/sig-node/20190825-exec-as-specified-user.md

+Since the container does not have a uniform `exec` format, the format of `user` should be just a string.
+
+#### Story 2
+By providing the `user` option for `exec`, user can do the auit inside the container.


Apologies for not knowing this :) but what is auit?

It's a typo :)

fejta-bot · 2019-08-31T14:27:18Z

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

smarterclayton · 2019-09-03T03:10:45Z

keps/sig-node/20190825-exec-as-specified-user.md

+#### Story 2
+By providing the `user` option for `exec`, user can do the auit inside the container.
+
+## Design Details


There’s a lot of additional security protection which is required to make arbitrary exec safe, especially by username (which is only mappable inside a container).

Anyone using PSP or similar systems would need a way to control which users are allowed to exec.

The use of username is contrary to how kubernetes pods run so it needs substantially more justification.

The design would also have to take into account how windows exec would support exec, and how runtimes that don’t support exec changes would communicate that to users.

keps/sig-node/20190825-exec-as-specified-user.md

Co-Authored-By: Slava Semushin <slava.semushin@gmail.com>

k8s-ci-robot · 2019-09-25T02:10:43Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please log a ticket with the Linux Foundation Helpdesk: https://support.linuxfoundation.org/
Should you encounter any issues with the Linux Foundation Helpdesk, send a message to the backup e-mail support address at: login-issues@jira.linuxfoundation.org

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Co-Authored-By: Slava Semushin <slava.semushin@gmail.com>

yujuhong · 2019-09-25T21:20:45Z

keps/sig-node/20190825-exec-as-specified-user.md

+
+### User Stories [optional]
+
+As a Kubernetes User, I should be able to control how people can enter the container, by default kubernetes use the default user in docker image.


This doesn't control how people access the containers. They'll have to specify user name when exec'ing, or are you suggesting using PSP to further restrict users?

yujuhong · 2019-09-25T21:26:10Z

keps/sig-node/20190825-exec-as-specified-user.md

+-u, --user="" Username or UID (format: <string>]) format
+```
+
+Since the container does not have a uniform `exec` format, the format of `user` should be just a string.


Windows does not support uid. For Linux, kubelet uses uid when starting the containers.
The current design may be confusing for cross-platform support.

fejta-bot · 2019-12-24T21:27:29Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

fejta-bot · 2020-01-23T22:12:56Z

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

fejta-bot · 2020-02-22T22:54:32Z

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

k8s-ci-robot · 2020-02-22T22:54:40Z

@fejta-bot: Closed this PR.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

mikebrow · 2022-06-01T17:24:40Z

@max88991 are you still working this KEP?

zqzten · 2022-08-14T14:56:56Z

@mikebrow There's a new on-going KEP: #3372. I've been watching on that but it also seems to be inactive for some while.

Add exec as user KEP

ebb7685

Signed-off-by: Lei Gong <lgong@alauda.io>

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Aug 29, 2019

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 29, 2019

k8s-ci-robot requested review from dchen1107 and derekwaynecarr August 29, 2019 08:37

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory sig/node Categorizes an issue or PR as relevant to SIG Node. labels Aug 29, 2019

k8s-ci-robot assigned dchen1107 Aug 29, 2019

max88991 mentioned this pull request Aug 31, 2019

[WIP]exec: supprt exec as a specific user kubernetes/kubernetes#81883

Closed

mattjmcnaughton reviewed Aug 31, 2019

View reviewed changes

k8s-ci-robot added sig/auth Categorizes an issue or PR as relevant to SIG Auth. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API labels Aug 31, 2019

smarterclayton suggested changes Sep 3, 2019

View reviewed changes

php-coder reviewed Sep 24, 2019

View reviewed changes

keps/sig-node/20190825-exec-as-specified-user.md Outdated Show resolved Hide resolved

php-coder reviewed Sep 24, 2019

View reviewed changes

keps/sig-node/20190825-exec-as-specified-user.md Outdated Show resolved Hide resolved

Update keps/sig-node/20190825-exec-as-specified-user.md

cf0d941

Co-Authored-By: Slava Semushin <slava.semushin@gmail.com>

k8s-ci-robot removed the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Sep 25, 2019

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Sep 25, 2019

Update keps/sig-node/20190825-exec-as-specified-user.md

17c9ebe

Co-Authored-By: Slava Semushin <slava.semushin@gmail.com>

yujuhong reviewed Sep 25, 2019

View reviewed changes

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 24, 2019

k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Jan 23, 2020

k8s-ci-robot closed this Feb 22, 2020

SimonHeimberg mentioned this pull request Apr 27, 2020

Implement --user option for 'kubectl exec' kubernetes/kubernetes#59092

Closed

hanamantagoudvk mentioned this pull request Jun 1, 2022

kubectl exec does not have a -user option containerd/containerd#6662

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add exec as user KEP #1224

Add exec as user KEP #1224

max88991 commented Aug 29, 2019

k8s-ci-robot commented Aug 29, 2019

k8s-ci-robot commented Aug 29, 2019

k8s-ci-robot commented Aug 29, 2019

max88991 commented Aug 29, 2019

max88991 commented Aug 31, 2019

max88991 commented Aug 31, 2019

mattjmcnaughton left a comment

mattjmcnaughton Aug 31, 2019

mattjmcnaughton Aug 31, 2019

mattjmcnaughton Aug 31, 2019

verb Sep 2, 2019

mattjmcnaughton Aug 31, 2019

php-coder Sep 24, 2019

fejta-bot commented Aug 31, 2019

smarterclayton Sep 3, 2019

k8s-ci-robot commented Sep 25, 2019

yujuhong Sep 25, 2019

yujuhong Sep 25, 2019

fejta-bot commented Dec 24, 2019

fejta-bot commented Jan 23, 2020

fejta-bot commented Feb 22, 2020

k8s-ci-robot commented Feb 22, 2020

mikebrow commented Jun 1, 2022

zqzten commented Aug 14, 2022


		> In the Kubernetes 1.5 release, we are proud to introduce the Container Runtime Interface (CRI) – a plugin interface which enables kubelet to use a wide variety of container runtimes, without the need to recompile. CRI consists of a protocol buffers and gRPC API, and libraries, with additional specifications and tools under active development. CRI is being released as Alpha in Kubernetes 1.5.

		But There are many container runtime implementation, e.g Docker, Kata, gVisior, most of which provide a way to enter the container as a special `user`.


		> User specifies specific user (and group) information for the container process

		It brings convenience to debugging, and users are used to it. Adding a `user` option with `exec` in Kubernetes seems reasonable.


		### User Stories [optional]

		As a Kubernetes User, I should be able to control how people can enter the container, by default kubernetes use the default user in docker image.

Add exec as user KEP #1224

Add exec as user KEP #1224

Conversation

max88991 commented Aug 29, 2019

k8s-ci-robot commented Aug 29, 2019

k8s-ci-robot commented Aug 29, 2019

k8s-ci-robot commented Aug 29, 2019

max88991 commented Aug 29, 2019

max88991 commented Aug 31, 2019

max88991 commented Aug 31, 2019

mattjmcnaughton left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fejta-bot commented Aug 31, 2019

Choose a reason for hiding this comment

k8s-ci-robot commented Sep 25, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fejta-bot commented Dec 24, 2019

fejta-bot commented Jan 23, 2020

fejta-bot commented Feb 22, 2020

k8s-ci-robot commented Feb 22, 2020

mikebrow commented Jun 1, 2022

zqzten commented Aug 14, 2022