Remove deprecated `extensions` API group in document #32909

Sea-n · 2022-04-13T18:29:51Z

The extensions API group is deprecated.

Changes in ABAC page

Use networking.k8s.io instead of extensions in apiGroups field.
- Ref: Ingress extensions/v1beta1 -> networking.k8s.io/v1beta1 kubernetes#74057
Add more examples.

Changes in RBAC page

Remove deprecated extensions API group for Jobs
- Ref: Deprecate extensions/v1beta1.Jobs related stuff kubernetes#36355
Remove deprecated extensions API group for Deployments
- Ref: [1.16] Stop serving deprecated beta workload APIs kubernetes#70672

netlify · 2022-04-13T18:52:10Z

✅ Deploy Preview for kubernetes-io-main-staging ready!

Name	Link
🔨 Latest commit	`613bb08`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/625acb2b7fbd85000948ec94
😎 Deploy Preview	https://deploy-preview-32909--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

liggitt · 2022-04-13T19:09:50Z

content/en/docs/reference/access-authn-authz/rbac.md

@@ -407,7 +407,7 @@ rules:
  # objects is "pods"
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["batch", "extensions"]
+- apiGroups: ["batch", "networking.k8s.io"]


jobs don't exist in the networking.k8s.io group... if you want to use a multi-group example, "events" resources in the core "" and "events.k8s.io" API groups would be a current example

Oh! Thanks very much for pointing it out and providing a great example!

I have pushed a new commit, could you please check the correctness again? 🙇‍♂️

liggitt · 2022-04-14T13:10:11Z

/lgtm

k8s-ci-robot · 2022-04-14T13:11:31Z

LGTM label has been added.

Git tree hash: 640be8ca25b8876bfcbe27fc249b7c7fde78356a

sftim

Thanks for proposing the update.

One question, one recommended tweak.

sftim · 2022-04-14T16:48:17Z

content/en/docs/reference/access-authn-authz/rbac.md

+Allow reading/writing Events (at the HTTP level: objects with `"events"` in the
+resource part of their URL) in both the core `""` and `"events.k8s.io"` API groups:


I'd use Deployment, in its GA API group (apps). People rarely patch Events.

Thanks for letting me know that events is not a common resource. 😅

I think this section (Role examples) is about how to write rules instead of most used resources:

Reading pods in the core API group

The most simple one

R/W deployments in extensions and apps API group

Multiple API groups

Reading pods in core API group and R/W jobs in batch and extensions

Multiple rules

Allow reading a ConfigMap named my-config

Must be bound with a RoleBinding to limit to a single ConfigMap in a single namespace.

Allow reading the resource "nodes" in the core group

Because a Node is cluster-scoped, this must be in a ClusterRole bound with a ClusterRoleBinding to be effective.

Allow GET and POST requests to the non-resource endpoint

Example for nonResourceURLs

Since extensions is deprecated, I think it's good to replace it with another (although not that common) example for multiple API groups.

There are only three resources that appeared in multiple API groups:

NAME APIVERSION NAMESPACED KIND events v1 true Event events events.k8s.io/v1 true Event nodes v1 false Node nodes metrics.k8s.io/v1beta1 false NodeMetrics pods v1 true Pod pods metrics.k8s.io/v1beta1 true PodMetrics

I am still a beginner at Kubernetes, could you give me some advice about which could be a better example for this page?

The nodes and pods in v1 and metrics API groups are not the same resource, so I wouldn't expect to grant access to both in the same rule.

events are the only remaining built-in resource that appears in multiple API groups (we had a lot in the extensions API group but those got migrated to dedicated groups and the extensions API group was deprecated and disabled)

Thanks for clarifying! Now I think it's better to change events example back to deployments. 😊

sftim · 2022-04-14T16:49:14Z

content/en/docs/reference/access-authn-authz/abac.md

        - Wildcard: `*` matches all API groups.
      - `namespace`, type string; a namespace.
        - Ex: `kube-system`
        - Wildcard: `*` matches all resource requests.
      - `resource`, type string; a resource type
-        - Ex: `pods`
+        - Ex: `pods`, `events`


Why this change?

I think it would be better to provide multiple examples. Just like you said that it's not common to see events, could you give me some advice on this?

I've change it to deployments, hope it will be more useful for users.

sftim · 2022-04-16T10:18:27Z

@kubernetes/sig-auth-pr-reviews does this look right?

sftim

Markdown LGTM

sftim · 2022-04-16T10:19:24Z

content/en/docs/reference/access-authn-authz/rbac.md

  #
-  # at the HTTP level, the name of the resource for accessing Deployment
+  # at the HTTP level, the name of the resource for accessing Deployments


nit:

Suggested change

# at the HTTP level, the name of the resource for accessing Deployments

# at the HTTP level, the name of the resource for accessing Deployment

In the URL it's /deployments/; in text, it's “Deployments” or “Deployment objects”.

Oh no, it's a typo when I manually revert the change. 😢

How could I miss that, thanks for pointing it out! 🙇‍♂️

Sea-n · 2022-04-20T00:24:01Z

Hi @liggitt,

I've force-pushed the changes according to your suggestions, could you take a look? 🙇‍♂️

liggitt · 2022-04-20T13:57:32Z

/lgtm

k8s-ci-robot · 2022-04-20T13:57:50Z

LGTM label has been added.

Git tree hash: e259f32eb38a33a1d6ac1ddecae0747fab41efb6

sftim · 2022-04-20T15:55:28Z

/approve

k8s-ci-robot · 2022-04-20T15:55:46Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sftim

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [sftim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. language/en Issues or PRs related to English language labels Apr 13, 2022

k8s-ci-robot requested review from lavalamp and liggitt April 13, 2022 18:30

k8s-ci-robot added the sig/docs Categorizes an issue or PR as relevant to SIG Docs. label Apr 13, 2022

liggitt reviewed Apr 13, 2022

View reviewed changes

Sea-n force-pushed the deprecate-ext branch 2 times, most recently from 1d30612 to d508d28 Compare April 14, 2022 03:23

Sea-n changed the title ~~Use networking.k8s.io instead of extensions in document~~ Remove deprecated extensions API group in document Apr 14, 2022

k8s-ci-robot assigned liggitt Apr 14, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 14, 2022

sftim reviewed Apr 14, 2022

View reviewed changes

Sea-n force-pushed the deprecate-ext branch from d508d28 to 467cf91 Compare April 15, 2022 12:27

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 15, 2022

k8s-ci-robot requested a review from liggitt April 15, 2022 12:27

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Apr 16, 2022

sftim reviewed Apr 16, 2022

View reviewed changes

Remove deprecated extensions API group in document

613bb08

Sea-n force-pushed the deprecate-ext branch from 467cf91 to 613bb08 Compare April 16, 2022 13:56

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 20, 2022

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 20, 2022

k8s-ci-robot merged commit c62c9e9 into kubernetes:main Apr 20, 2022

Sea-n deleted the deprecate-ext branch May 24, 2022 12:35

Sea-n mentioned this pull request May 25, 2022

REQUEST: New membership for Sea-n kubernetes/org#3440

Closed

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove deprecated `extensions` API group in document #32909

Remove deprecated `extensions` API group in document #32909

Sea-n commented Apr 13, 2022 •

edited

netlify bot commented Apr 13, 2022 •

edited

liggitt Apr 13, 2022

Sea-n Apr 14, 2022

liggitt commented Apr 14, 2022

k8s-ci-robot commented Apr 14, 2022

sftim left a comment

sftim Apr 14, 2022

Sea-n Apr 15, 2022

liggitt Apr 15, 2022

Sea-n Apr 15, 2022

sftim Apr 14, 2022

Sea-n Apr 15, 2022

Sea-n Apr 15, 2022

sftim commented Apr 16, 2022

sftim left a comment

sftim Apr 16, 2022

Sea-n Apr 16, 2022

Sea-n commented Apr 20, 2022

liggitt commented Apr 20, 2022

k8s-ci-robot commented Apr 20, 2022

sftim commented Apr 20, 2022

k8s-ci-robot commented Apr 20, 2022

		Allow reading/writing Events (at the HTTP level: objects with `"events"` in the
		resource part of their URL) in both the core `""` and `"events.k8s.io"` API groups:

	# at the HTTP level, the name of the resource for accessing Deployments
	# at the HTTP level, the name of the resource for accessing Deployment

Remove deprecated extensions API group in document #32909

Remove deprecated extensions API group in document #32909

Conversation

Sea-n commented Apr 13, 2022 • edited

Changes in ABAC page

Changes in RBAC page

netlify bot commented Apr 13, 2022 • edited

✅ Deploy Preview for kubernetes-io-main-staging ready!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt commented Apr 14, 2022

k8s-ci-robot commented Apr 14, 2022

sftim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sftim commented Apr 16, 2022

sftim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Sea-n commented Apr 20, 2022

liggitt commented Apr 20, 2022

k8s-ci-robot commented Apr 20, 2022

sftim commented Apr 20, 2022

k8s-ci-robot commented Apr 20, 2022

Remove deprecated `extensions` API group in document #32909

Remove deprecated `extensions` API group in document #32909

Sea-n commented Apr 13, 2022 •

edited

netlify bot commented Apr 13, 2022 •

edited