Enhancements: External client-go credential providers

[ericchiang]

Enhancement Description

• One-line enhancement description: external client-go credential providers
• Kubernetes Enhancement Proposal: KEP
• Primary contact: @ankeesler
• Responsible SIGs: sig-auth
• Enhancement target:
  
  
  
  • Alpha release target: 1.10
  
  
  • Beta release target: 1.11
  
  
  • Stable release target: (1.19)
  
  

[idvoretskyi]

/assign @ericchiang

[Bradamant3]

@ericchiang does this feature need docs? Could you please update the tracking spreadsheet for 1.10? And get your PR in asap if docs are needed? lmk if I can help further.

[ericchiang]

Docs have been submitted here https://github.com/kubernetes/website/pull/7648

[justaugustus]

@ericchiang
Any plans for this in 1.11?

If so, can you please ensure the feature is up-to-date with the appropriate:

• Description
• Milestone
• Assignee(s)
• Labels:
  
  
  
  • stage/{alpha,beta,stable}
  
  
  • sig/*
  
  
  • kind/feature
  
  

cc @idvoretskyi

[justaugustus]

This feature current has no milestone, so we'd like to check in and see if there are any plans for this in Kubernetes 1.12.

If so, please ensure that this issue is up-to-date with ALL of the following information:

• One-line feature description (can be used as a release note):
• Primary contact (assignee):
• Responsible SIGs:
• Design proposal link (community repo):
• Link to e2e and/or unit tests:
• Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred:
• Approver (likely from SIG/area to which feature belongs):
• Feature target (which target equals to which milestone):
  
  
  
  • Alpha release target (x.y)
  
  
  • Beta release target (x.y)
  
  
  • Stable release target (x.y)
  
  

Set the following:

• Description
• Assignee(s)
• Labels:
  
  
  
  • stage/{alpha,beta,stable}
  
  
  • sig/*
  
  
  • kind/feature
  
  

Once this feature is appropriately updated, please explicitly ping @justaugustus, @kacole2, @robertsandoval, @rajendar38 to note that it is ready to be included in the Features Tracking Spreadsheet for Kubernetes 1.12.

---

Please note that Features Freeze is tomorrow, July 31st, after which any incomplete Feature issues will require an Exception request to be accepted into the milestone.

In addition, please be aware of the following relevant deadlines:

• Docs deadline (open placeholder PRs): 8/21
• Test case freeze: 8/28

Please make sure all PRs for features have relevant release notes included as well.

Happy shipping!

P.S. This was sent via automation

[ericchiang]

This feature was promoted to beta during 1.11 https://github.com/kubernetes/kubernetes/pull/64482

/stage beta

I'm not aware of plans for 1.12, though I'm also not actively contributing to Kubernetes. It'd probably be good if someone with a more vested interest in the exec plugin framework would like to volunteer to own this feature going forward.

cc @awly @nckturner @dbenhur

[awly]

I volunteer as tribute! Unless anyone objects of course.

For 1.12 I don't think it's ready to go beyond Beta.

[ericchiang]

Thanks for volunteering Andrew, that works for me!

/assign @awly
/unassign

[justaugustus]

@ericchiang -- Thanks for checking in!
@awly -- Thanks for volunteering to pick this up! :)

[kacole2]

Hi @ericchiang
This enhancement has been tracked before, so we'd like to check in and see if there are any plans for this to graduate stages in Kubernetes 1.13. This release is targeted to be more ‘stable’ and will have an aggressive timeline. Please only include this enhancement if there is a high level of confidence it will meet the following deadlines:
Docs (open placeholder PRs): 11/8
Code Slush: 11/9
Code Freeze Begins: 11/15
Docs Complete and Reviewed: 11/27

Please take a moment to update the milestones on your original post for future tracking and ping @kacole2 if it needs to be included in the 1.13 Enhancements Tracking Sheet

We are also now encouraging that every new enhancement aligns with a KEP. If a KEP has been created, please link to it in the original post or take the opportunity to develop a KEP.

Thanks!

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Enhancement issues opened in kubernetes/enhancements should never be marked as frozen.
Enhancement Owners can ensure that enhancements stay fresh by consistently updating their states across release cycles.

/remove-lifecycle frozen

[awly]

/remove-lifecycle stale
This feature is still Beta as of 1.14.

I'd like to experiment with adding TLS oracles to it, for HSM/TPM-stored keys.

[kacole2]

Hello @awly @ericchiang I'm the Enhancement Lead for 1.15. Is this feature going to be graduating alpha/beta/stable stages in 1.15? Please let me know so it can be tracked properly and added to the spreadsheet. This looks like it also needs a KEP to be promoted.

Once coding begins, please list all relevant k/k PRs in this issue so they can be tracked properly.

[mariantalla]

Hi @awly - I'm an Enhancements shadow for 1.16.

Is this feature going to be graduating alpha/beta/stable stages in 1.16? Please let me know so it can be added to the 1.16 Tracking Spreadsheet.

Once development begins or if it already has, please list all relevant k/k PRs in this issue so they can be tracked properly.

As a reminder, 1.16 milestone dates are: Enhancement Freeze 7/30 and Code Freeze 8/29.

Thanks!

[awly]

Hi @mariantalla
This feature is (most likely) not graduating in 1.16.

I will propose some changes for stable graduation after https://github.com/kubernetes/enhancements/pull/1137 is merged, but it's all up for discussion still.

[mariantalla]

Sounds good @awly , thanks for the heads up!

[palnabarun]

Hey there @awly, 1.17 Enhancements shadow here. I wanted to check in and see if you think this Enhancement will be graduating to stable in 1.17?

The current release schedule is:

• Monday, September 23 - Release Cycle Begins
• Tuesday, October 15, EOD PST - Enhancements Freeze
• Thursday, November 14, EOD PST - Code Freeze
• Tuesday, November 19 - Docs must be completed and reviewed
• Monday, December 9 - Kubernetes 1.17.0 Released

If you do, I'll add it to the 1.17 tracking sheet (https://bit.ly/k8s117-enhancement-tracking). Once coding begins please list all relevant k/k PRs in this issue so they can be tracked properly. 👍

Thanks!

[awly]

Sorry for the delay.
I won't have time to push this to stable in 1.17.

If anyone wants to take a stab at updating the KEP, please do.

[palnabarun]

Thank you @awly for the updates. I have removed it from the 1.17 tracking spreadsheet.

[helayoty]

Hey there @awly -- 1.18 Enhancements shadow here. I wanted to check in and see if you think this Enhancement will be graduating to stable in 1.18 or having a major change in its current level?

The current release schedule is:

Tuesday, January 28th EOD PST - Enhancements Freeze
Thursday, March 5th, EOD PST - Code Freeze
Monday, March 16th - Docs must be completed and reviewed
Tuesday, March 24th - Kubernetes 1.18.0 Released

The KEP must also have graduation criteria and a Test Plan defined.

If you would like to include this enhancement, once coding begins please list all relevant k/k PRs in this issue so they can be tracked properly. 👍

[awly]

Hi @helayoty, no progress planned in 1.18 on this one

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[palnabarun]

/remove-lifecycle stale

[enj]

I am going to work on updating the KEP to the new format along with getting the functionality to GA.

/assign
/unassign @awly

[msedzins]

Hey there @enj -- 1.19 Enhancements shadow here. I wanted to check in and see if you think this Enhancement will be graduating in 1.19?

In order to have this part of the release:

1. The KEP PR must be merged in an implementable state
2. The KEP must have test plans
3. The KEP must have graduation criteria.

The current release schedule is:

• Monday, April 13: Week 1 - Release cycle begins
• Tuesday, May 19: Week 6 - Enhancements Freeze
• Thursday, June 25: Week 11 - Code Freeze
• Thursday, July 9: Week 14 - Docs must be completed and reviewed
• Tuesday, August 4: Week 17 - Kubernetes v1.19.0 released
• Thursday, August 20: Week 19 - Release Retrospective

If you do, I'll add it to the 1.19 tracking sheet (http://bit.ly/k8s-1-19-enhancements). Once coding begins please list all relevant k/k PRs in this issue so they can be tracked properly. 👍

Thanks!

[enj]

@msedzins we are actively working on defining the GA requirements in #1711 - PTAL and confirm it meets all requirements to be part of the v1.19 release. It is possible that we may not finish the work in time for the v1.19 release, but we will definitely define all the work that is needed to get this feature to GA.

[msedzins]

Thank you for letting me know @enj.
I will update tracking sheet accordingly.

Please remember about point 2 from the requirement list:
"2. The KEP must have test plans"

[enj]

@msedzins tests plans are included in #1711.

[msedzins]

Indeed, thank you.

[msedzins]

/milestone v1.19

[msedzins]

Hi @enj ,

Note that recently the KEP format has changed.

1620 merged recently, adding production readiness review questions to the KEP template. Please take this opportunity to reformat your KEP and also answer the questions add to the template in that PR.

Thanks!

[msedzins]

Hey @enj ,

Enhancement shadow for the v1.19 release cycle here. Just following up on my earlier update to inform you of the
upcoming Enhancement Freeze scheduled on Tuesday, May 19.

I noticed that the KEP #1711 is still in flight. As per the requirements, the KEP should be merged and implementable for it to be
considered for the release v1.19.

We would really appreciate if you can get the KEP merged in-time for the Enhancement freeze. Please feel free to reach out in case if you need any more information.

Thx!

[annajung]

Hi @enj 👋 1.19 docs shadow here! Does this enhancement work planned for 1.19 require new or modification to docs?

Friendly reminder that if new/modification to docs are required, a placeholder PR against k/website (branch dev-1.19) are needed by Friday, June 12.

[msedzins]

Hi @enj, enhancement shadow here -- Can you please link to all the implementation PR's here - k/k or otherwise? :slightly_smiling_face:

---

The current release schedule is:

• ~Monday, April 13: Week 1 - Release cycle begins~
• ~Tuesday, May 19: Week 6 - Enhancements Freeze~
• Thursday, June 25: Week 11 - Code Freeze
• Thursday, July 9: Week 14 - Docs must be completed and reviewed
• Tuesday, August 4: Week 17 - Kubernetes v1.19.0 released

[annajung]

Hi @enj hope you're doing well, checking in again to see if docs are required for this or not. Could you confirm?

[msedzins]

H @enj, just a friendly reminder about my question.

[msedzins]

H @enj, just a friendly reminder about my question.

[annajung]

Hi @enj 👋 Checking in again. Please note if new or modification to current doc is required, then a placeholder PR against k/website (branch dev-1.19) is needed by Friday, June 12.

[annajung]

Hi @enj just adding on the comment above. If you're waiting to see if this will make it into 1.19 or be pushed to future release, Docs team still highly recommend getting the draft PR in before the due date as it's easier to clean up a draft PR then not having the draft in place to move this enhancement forward :)

[enj]

@msedzins the in-flight PRs are:

1. https://github.com/kubernetes/kubernetes/pull/91192
2. https://github.com/kubernetes/kubernetes/pull/91305
3. https://github.com/kubernetes/kubernetes/pull/91745

@annajung placeholder doc PR is https://github.com/kubernetes/website/pull/21626

[annajung]

Thank you! I will update the tracking sheet accordingly

[msedzins]

Thank you very much @enj.

[msedzins]

Hi, @enj

This is a follow-up to the communication that went out to k-dev today. There has been a revision to the release schedule of v1.19 as follows.

Thursday, July 9th: Week 13 - Code Freeze
Thursday, July 16th: Week 14 - Docs must be completed and reviewed
Tuesday, August 25th: Week 20 - Kubernetes v1.19.0 released
Thursday, August 27th: Week 20 - Release Retrospective

You can find the revised Schedule in the sig-release Repo

Please let me know if you have any questions. 🖖

[annajung]

Hi @enj, a friendly reminder of the next deadline coming up.
Please remember to populate your placeholder doc PR and get it ready for review by Monday, July 6th.

[msedzins]

Hi @enj , I've noticed that there are still 3 opened PRs against k/k for this enhancement.

Code freeze deadline is Thursday, July 9th: Week 13

Please let me know if for any reason you can see the risk of not including this enhancement as part of v.1.19 release.

Thank you!

[annajung]

Hi @enj, just a quick reminder to get your doc PR ready for review (Remove WIP/rebased/all ready to go) by EOD. Thank you!

[msedzins]

Hi @enj,

This is just a follow up to my earlier messages on the upcoming deadlines. The code freeze deadline is Thursday, July 9th and I noticed that there are still 3 opened PRs against k/k for this enhancement.

For the enhancement to be included into v1.19 those PRs needs to be merged before the code freeze deadline.

Please refer to the Exception Process documentation in case if there is a need for one.

[palnabarun]

@enj -- We are into the Code Freeze now.

Since this enhancement still has pending work left - https://github.com/kubernetes/kubernetes/pull/91192 is yet to Approved/LGTM'ed, I am going ahead and removing this enhancement from the milestone.

You will need to file an Exception Request in order to get this back into 1.19.

Thank you!

---

Code Freeze begins on Thursday, July 9th EOD PST

[palnabarun]

/milestone clear

[kikisdeliveryservice]

Hi @enj !

Enhancements Lead here, do you intend to go to stable in 1.20?

Thanks!
Kirsten

[kikisdeliveryservice]

Hi @enj

Circling back around any plans for 1.20? Enhancements Freeze is on October 6th.

Thanks,
Kirsten

[liggitt]

yes, design was just updated in https://github.com/kubernetes/enhancements/pull/2023 and exception requested at https://groups.google.com/g/kubernetes-sig-release/c/x75-HY7h7P4

[kikisdeliveryservice]

Hi @ankeesler

Added this issue to the milestone, since it was granted an exception and updated to add all missing items. :+1:

Also, please keep in mind the important upcoming dates:
Friday, Nov 6th: Week 8 - Docs Placeholder PR deadline
Thursday, Nov 12th: Week 9 - Code Freeze

As a reminder, please link all of your k/k PRs as well as docs PRs to this issue so we can track them.

Thanks!
Kirsten :smile_cat:

[kikisdeliveryservice]

Also @liggitt @ankeesler who should be the primary contact for this issue? @enj is listed, but should this be updated?

[ankeesler]

Thank you @kikisdeliveryservice ! Why don't you make me primary contact on this issue until @enj gets back. @enj is certainly more competent than me when it comes to this stuff, but I will be able to carry it in his absence!

[kikisdeliveryservice]

Done, thanks @ankeesler !

[ankeesler]

I dunno where to put delivery status information on this feature set, so I'm gonna stick it here and someone can correct me if there is a better place. :)

1.20 Delivery Status (as of 2020-10-19):

• cluster info k/k pr (targeted at 1.20) is assigned for review: https://github.com/kubernetes/kubernetes/pull/95489
• website pr (targeted at 1.20) is opened, blocked until k/k pr is merged: https://github.com/kubernetes/website/pull/24639
• enhancements pr with touchups that fell out of cluster info implementation, blocked until k/k pr is merged: https://github.com/kubernetes/enhancements/pull/2103
• metrics updates for production readiness, not started, in response to this comment: https://github.com/kubernetes/enhancements/pull/2096/files#r503517168

[kikisdeliveryservice]

This is perfect thank you @ankeesler :heart:

[ankeesler]

1.20 Delivery Status (as of 2020-10-30):

• cluster info k/k pr (targeted at 1.20) is merged (thank you @liggitt): https://github.com/kubernetes/kubernetes/pull/95489
• website pr (targeted at 1.20): is now assigned for review: https://github.com/kubernetes/website/pull/24639
• enhancements pr with touchups that fell out of cluster info implementation (not necessarily tied to a release), assigned for review: https://github.com/kubernetes/enhancements/pull/2103
• metrics updates for production readiness (not targeted at 1.20, maybe 1.21?), not started, in response to this comment: https://github.com/kubernetes/enhancements/pull/2096/files#r503517168

[ankeesler]

all of the 1.20 items for this issue are merged!

Delivery Status (as of 2020-11-05)

1.20:

• cluster info k/k pr (targeted at 1.20) is merged: https://github.com/kubernetes/kubernetes/pull/95489
• website pr (targeted at 1.20): is now merged: https://github.com/kubernetes/website/pull/24639
• enhancements pr with touchups that fell out of cluster info implementation (not necessarily tied to a release), merged: https://github.com/kubernetes/enhancements/pull/2103

1.21+:

• metrics updates for production readiness (maybe 1.21?), not started, in response to this comment: https://github.com/kubernetes/enhancements/pull/2096/files#r503517168
• create kubernetes-approved example exec plugin (maybe 1.21?), awaiting sig-auth meeting next week to propose, a la https://kubernetes.slack.com/archives/C0EN96KUY/p1604415173138000
• all of the other beta -> GA graduation stuff in the KEP, not started: :)

[dims]

thanks a ton @ankeesler !