Fine grained Kubelet API authorization

[pacoxu]

Enhancement Description

• One-line enhancement description (can be used as a release note): The node API authorization is too coarse. We need finer grained authorization of different request types, and maybe resources acted on.
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/2862-fine-grained-kubelet-authz/README.md
• Discussion Link: Fine grained Kubelet API authorization kubernetes#83465
• Primary contact (assignee): @vinayakankugoyal @tallclair
• Responsible SIGs: auth node
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.32
  • Beta release target (x.y): 1.33
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s): KEP-2862: Fine-grained Kubelet API Authorization #4760
  • Code (k/k) update PR(s):
    • KEP-2862: Fine-grained Kubelet API Authorization kubernetes#126347
  • Docs (k/website) update PR(s): KEP-2862: Fine-grained Authz for Kubelet API. website#48412
• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP-2862: Graduate to BETA. #5016
  • Code (k/k) update PR(s):
    • KEP-2862: Graduate to BETA. kubernetes#129656
  • Docs (k/website) update PR(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[pacoxu]

/sig auth
/sig node
/kind feature
/area kubelet-api
/priority important-longterm

See also:

• Deprecate Kubelet Read-only port kubernetes#12968
• Implement a kubelet pod api kubernetes#28138
• Clean up Kubelet RESTful APIs kubernetes#2098

[k8s-ci-robot]

@pacoxu: The label(s) area/kubelet-api cannot be applied, because the repository doesn't have them.

In response to this:

/sig auth
/sig node
/kind feature
/area kubelet-api
/priority important-longterm

See also:

• Deprecate Kubelet Read-only port kubernetes#12968
• Implement a kubelet pod api kubernetes#28138
• Clean up Kubelet RESTful APIs kubernetes#2098

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[pacoxu]

/assign
I will start to work on the KEP.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[enj]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[pacoxu]

/remove-lifecycle stale
still have no enough time to work on this.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[tallclair]

/lifecycle frozen

[vinayakankugoyal]

/assign @vinayakankugoyal

[pacoxu]

@dipesh-rawat I don't seem to have permissions to edit the issue description. @pacoxu could you do it?

Updated.

[chanieljdan]

Hi @vinayakankugoyal @pacoxu 👋, 1.32 Release Docs Lead here.

Does this enhancement work planned for 1.32 require any new docs or modification to existing docs?

If so, please follows the steps here to open a PR against dev-1.32 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday October 24th 2024 18:00 PDT.

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!

[chanieljdan]

Hi @vinayakankugoyal @pacoxu 👋, 1.32 Release Docs Lead here.

Does this enhancement work planned for 1.32 require any new docs or modification to existing docs?

If so, please follows the steps here to open a PR against dev-1.32 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday October 24th 2024 18:00 PDT.

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!

Hi @vinayakankugoyal @pacoxu 👋,

Just a reminder to open a placeholder PR against dev-1.32 branch in the k/website repo for this (steps available here). The deadline for this is a week away at Thursday October 24, 2024 18:00 PDT.

Thanks,

Daniel

[vinayakankugoyal]

@chanieljdan - thanks for the reminder. I created a PR for the docs here: kubernetes/website#48412

[vinayakankugoyal]

@pacoxu - do you mind adding the docs PR link in the issue description?

[SergeyKanzhelev]

Added it for you

[dipesh-rawat]

Hello @vinayakankugoyal 👋, v1.32 Enhancements team here

With all the implementation(code related) PRs merged as per the issue description:

• KEP-2862: Fine-grained Kubelet API Authorization kubernetes#126347

This enhancement is now marked as tracked for code freeze for the v1.32 Code Freeze!

Additionally, please do let me know if there are any other PRs in k/k not listed in the description or not linked with this GitHub issue that we should track for this KEP, so that we can maintain accurate status.

[wrkode]

👋 Hi there, William here from v1.32 Comms
We'd love for you to consider writing a feature blog about your enhancement! Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and is graduating.

To opt-in, let us know and open a Feature Blog placeholder PR against the website repository by 30th Oct 2024. For more information about writing a blog see the blog contribution guidelines.

Note: In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.

[pacoxu]

@vinayakankugoyal do you plan to promote it to beta in v1.33 or later?

[vinayakankugoyal]

@vinayakankugoyal do you plan to promote it to beta in v1.33 or later?

I am planning to promote to beta in 1.33. I'll get the KEP updated.

[vinayakankugoyal]

@SergeyKanzhelev and @tallclair - could you help adding this to the 1.33 milestone. Thanks!

[tallclair]

/milestone v1.33

[liggitt]

@vinayakankugoyal are you planning to leave this in alpha for 1.32 or progress it to beta?

[vinayakankugoyal]

@vinayakankugoyal are you planning to leave this in alpha for 1.32 or progress it to beta?

We are planning BETA in 1.33 - I opened a PR to update the KEP - #5016

[vinayakankugoyal]

@pacoxu - can you add the following to the description

• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP-2862: Graduate to BETA. #5016
  • Code (k/k) update PR(s):
    • KEP-2862: Graduate to BETA. kubernetes#129656
  • Docs (k/website) update PR(s):

[pacoxu]

Updated.