retrospective add of RotateKubeletServerCertificate

[SergeyKanzhelev]

• Issue link: Kubelet Server TLS Certificate Rotation #267

• Other comments: This is a baseline KEP that can be used to initiate the GA of the feature

[sftim]

Watch out that:

• these URLs may go stale
• we don't yet have a way to make a durable “permalink” to docs at a point in time

[enj]

@SergeyKanzhelev are we targeting v1.27 for this retroactive KEP?

[SergeyKanzhelev]

@SergeyKanzhelev are we targeting v1.27 for this retroactive KEP?

This PR only fills out what is done. I cannot commit on promoting metrics, writing a tests and docs. So ideally we want this PR merged and then separate PR that initiates GA-ing of this feature. Likely in next release

[enj]

@SergeyKanzhelev are we targeting v1.27 for this retroactive KEP?

This PR only fills out what is done. I cannot commit on promoting metrics, writing a tests and docs. So ideally we want this PR merged and then separate PR that initiates GA-ing of this feature. Likely in next release

SGTM!

/milestone v1.28

[aramase]

@SergeyKanzhelev Is this still planned for v1.28?

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle stale
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[kannon92]

@SergeyKanzhelev What is needed to get this KEP merged?

I am tasked with leading the GA for RotateKubeletServerCertificate so I think this is the first step for this.

If you don't have the bandwidth, please feel free to give me access to your fork so I can push changes during the review process.

[sftim]

@kannon92 you can also copy this commit onto your own fork and iterate from there (ie, a separate PR)

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: SergeyKanzhelev
Once this PR has been reviewed and has the lgtm label, please assign enj for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• keps/sig-auth/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kannon92]

/lgtm

I'll be taking over this work so our hope is that we can at least merge this as is and iterate.

[kannon92]

It seems that there will be a lot more work needed to get this PR to merge as a even a restrospective.

I met with sig-auth and I will hopefully try and get some knowledge transfer around this work.
From what I understand, I will need to find authors of the PRs and poke them around design decisions made for this feature.

Metrics should be beta also.

Integration tests should be sufficient (cc @deads2k ).

I opened up #4411 so I can edit this with my research.

@SergeyKanzhelev I am going to close this PR.

/close

[k8s-ci-robot]

@kannon92: Closed this PR.

In response to this:

It seems that there will be a lot more work needed to get this PR to merge as a even a restrospective.

I met with sig-auth and I will hopefully try and get some knowledge transfer around this work.
From what I understand, I will need to find authors of the PRs and poke them around design decisions made for this feature.

Metrics should be beta also.

Integration tests should be sufficient (cc @deads2k ).

I opened up #4411 so I can edit this with my research.

@SergeyKanzhelev I am going to close this PR.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.