Enhancements: TokenRequest API and Kubelet integration

[mikedanese]

Improved service account tokens

• One-line enhancement description (can be used as a release note): Improve security of service account tokens
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/1205-bound-service-account-tokens
• Primary contact (assignee): @zshihang
• Responsible SIGs: auth
• Enhancement target (which target equals to which milestone):
  
  
  
  • feature gates: TokenRequest / TokenRequestProjection
  
  
  • One-line description: Pods can request service account tokens with improved security.
  
  
  • Documentation: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection
  
  
  • Alpha: v1.10
  
  
  • Beta: v1.12
  
  
  • GA: v1.20
    
    
    
    
    
    • PR: https://github.com/kubernetes/kubernetes/pull/93258
    
    
    
    • Docs: https://github.com/kubernetes/website/pull/24823
    
    
    
  
  
  • feature gate: RootCAConfigMap
  
  
  • One-line description: Cluster CA information is available in a configmap in each namespace
  
  
  • Alpha: v1.13 (part of BoundServiceAccountTokenVolume)
  
  
  • Beta: v1.20
    
    
    
    
    
    • PR: https://github.com/kubernetes/kubernetes/pull/96197
    
    
    
    • Docs:
    
    
    
  
  
  • GA: v1.21 (planned)
  
  
  • feature gate: BoundServiceAccountTokenVolume
  
  
  • One-line description: The default service account token injected into pods uses service account tokens with improved security
  
  
  • Alpha: v1.13
  
  
  • Beta: v1.21
    
    
    
    
    
    • PR: https://github.com/kubernetes/kubernetes/pull/95667
    
    
    
    • Docs: https://github.com/kubernetes/website/pull/24854
    
    
    
  
  
  • GA: v1.22 (planned)
  
  

[smarterclayton]

Should we add the use of the token request API to this bug as well? Specifically, consuming those tokens and allowing the service account token injector to be specialized?

[mikedanese]

@smarterclayton added that to this feature.

[Bradamant3]

@mikedanese this item is listed on the feature tracking spreadsheet for 1.10 as needing docs. Does it in fact need them? If not, could you please update here? If so, could you please get a docs PR in against the 1.10 branch of the k8s/website repo asap? Thanks!

[Bradamant3]

@mikedanese @smarterclayton docs update please? We need to get docs PRs merged by this Friday (March 9). Thanks!
/cc @idvoretskyi

[mikedanese]

I added a comment. No docs needed.

[justaugustus]

@mikedanese
Any plans for this in 1.11?

If so, can you please ensure the feature is up-to-date with the appropriate:

• Description
• Milestone
• Assignee(s)
• Labels:
  
  
  
  • stage/{alpha,beta,stable}
  
  
  • sig/*
  
  
  • kind/feature
  
  

cc @idvoretskyi

[mdlinville]

@mikedanese please fill out the appropriate line item of the
1.11 feature tracking spreadsheet
and open a placeholder docs PR against the
release-1.11 branch
by 5/25/2018 (tomorrow as I write this) if new docs or docs changes are
needed and a relevant PR has not yet been opened.

[justaugustus]

@mikedanese -- We're doing one more sweep of the 1.11 Features tracking spreadsheet.
Would you mind filling in any incomplete / blank fields for this feature's line item?

[kacole2]

@mikedanese This feature was worked on in the previous milestone, so we'd like to check in and see if there are any plans for this to graduate stages in Kubernetes 1.12.

If there are any updates, please explicitly ping @justaugustus, @kacole2, @robertsandoval, @rajendar38 to note that it is ready to be included in the Features Tracking Spreadsheet for Kubernetes 1.12.

---

Please note that the Features Freeze is July 31st, after which any incomplete Feature issues will require an Exception request to be accepted into the milestone.

In addition, please be aware of the following relevant deadlines:

• Docs deadline (open placeholder PRs): 8/21
• Test case freeze: 8/28

Please make sure all PRs for features have relevant release notes included as well.

Happy shipping!

[mikedanese]

This is going to beta in 1.12

[justaugustus]

Thanks for the update. I've added this to the 1.12 tracking sheet.

cc: @kacole2 @wadadli @robertsandoval @rajendar38

[zparnold]

Hey there! @mikedanese I'm the wrangler for the Docs this release. Is there any chance I could have you open up a docs PR against the release-1.12 branch as a placeholder? That gives us more confidence in the feature shipping in this release and gives me something to work with when we start doing reviews/edits. Thanks! If this feature does not require docs, could you please update the features tracking spreadsheet to reflect it?

[justaugustus]

@mikedanese --
Any update on docs status for this feature? Are we still planning to land it for 1.12?
At this point, code freeze is upon us, and docs are due on 9/7 (2 days).
If we don't here anything back regarding this feature ASAP, we'll need to remove it from the milestone.

cc: @zparnold @jimangel @tfogo

[mikedanese]

Placeholder PR here: https://github.com/kubernetes/website/pull/10216

[justaugustus]

Hey @mikedanese, as the docs are overdue, I'm removing this from the milestone.
If this assessment is incorrect, please let me know ASAP.

/milestone clear

[mikedanese]

My understanding is that we have until Friday for docs. What am I missing?

[liggitt]

9/7 ready for review per https://github.com/kubernetes/sig-release/blob/master/releases/release-1.12/README.md#timeline

[justaugustus]

@mikedanese -- yep, what Jordan said. Docs submission deadline for SIGs was 9/7. The time between that deadline and the "Docs ready" date (9/18) is for the Docs team to do final copyedits.

Where are you at with docs for this?

[kacole2]

/milestone v1.13

[mikedanese]

Removing from v1.13. This will move from Beta to GA in a milestone after v1.13.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[claurence]

@mikedanese Hello - I’m the enhancement’s lead for 1.14 and I’m checking in on this issue to see what work (if any) is being planned for the 1.14 release. Enhancements freeze is Jan 29th and I want to remind that all enhancements must have a KEP

[fejta-bot]

Enhancement issues opened in kubernetes/enhancements should never be marked as frozen.
Enhancement Owners can ensure that enhancements stay fresh by consistently updating their states across release cycles.

/remove-lifecycle frozen

[krmayankk]

/remove-lifecycle stale

[krmayankk]

The docs for this beta feature are missing, it seems.

[mikedanese]

Docs for the beta release were in 1.12.

https://github.com/kubernetes/website/pull/10295
https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection

[WanLinghao]

/cc

[kacole2]

Hello @mikedanese, I'm the Enhancement Lead for 1.15. Is this feature going to be graduating alpha/beta/stable stages in 1.15? Please let me know so it can be tracked properly and added to the spreadsheet.

Once coding begins, please list all relevant k/k PRs in this issue so they can be tracked properly.

[mariantalla]

Hi @mikedanese - I'm an Enhancements shadow for 1.16.

Is this feature going to be graduating alpha/beta/stable stages in 1.16? Please let me know so it can be added to the 1.16 Tracking Spreadsheet.

Once development begins or if it already has, please list all relevant k/k PRs in this issue so they can be tracked properly.

As a reminder, 1.16 milestone dates are: Enhancement Freeze 7/30 and Code Freeze 8/29.

Thanks!

[jeremyrickard]

Hey there @mikedanese -- 1.17 Enhancements shadow here. I wanted to check in and see if you think this Enhancement will be graduating to alpha/beta/stable in 1.17?

The current release schedule is:

• Monday, September 23 - Release Cycle Begins
• Tuesday, October 15, EOD PST - Enhancements Freeze
• Thursday, November 14, EOD PST - Code Freeze
• Tuesday, November 19 - Docs must be completed and reviewed
• Monday, December 9 - Kubernetes 1.17.0 Released

If you do, I'll add it to the 1.17 tracking sheet (https://bit.ly/k8s117-enhancements). Once coding begins please list all relevant k/k PRs in this issue so they can be tracked properly. 👍

We'll also need to convert the design proposal into a KEP. To be accepted in the release, all enhancements MUST have a KEP, the KEP MUST be merged, in an implementable state, and have both graduation criteria/test plan.

Thanks!

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[helayoty]

Hey there @mikedanese -- 1.18 Enhancements shadow here. I wanted to check in and see if you think this Enhancement will be graduating to stable in 1.18 or having a major change in its current level?

The current release schedule is:

Tuesday, January 28th EOD PST - Enhancements Freeze
Thursday, March 5th, EOD PST - Code Freeze
Monday, March 16th - Docs must be completed and reviewed
Tuesday, March 24th - Kubernetes 1.18.0 Released

To be included in the release, this enhancement must have a merged KEP in the implementable status.

If you would like to include this enhancement, once coding begins please list all relevant k/k PRs in this issue so they can be tracked properly. 👍

Thanks!

[helayoty]

Hey @mikedanese -- 1.18 Enhancements team shadow here. We're about 5 days away from Enhancement Freeze on Jan 28th. Wanted to check to see if you'll be graduating this to stable in 1.18?

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[palnabarun]

/remove-lifecycle stale

[msedzins]

Hey there @mikedanese -- 1.19 Enhancements shadow here. I wanted to check in and see if you think this Enhancement will be graduating in 1.19?

In order to have this part of the release:

1. The KEP PR must be merged in an implementable state
2. The KEP must have test plans
3. The KEP must have graduation criteria.

The current release schedule is:

• Monday, April 13: Week 1 - Release cycle begins
• Tuesday, May 19: Week 6 - Enhancements Freeze
• Thursday, June 25: Week 11 - Code Freeze
• Thursday, July 9: Week 14 - Docs must be completed and reviewed
• Tuesday, August 4: Week 17 - Kubernetes v1.19.0 released
• Thursday, August 20: Week 19 - Release Retrospective

If you do, I'll add it to the 1.19 tracking sheet (http://bit.ly/k8s-1-19-enhancements). Once coding begins please list all relevant k/k PRs in this issue so they can be tracked properly. 👍

Thanks!

[msedzins]

Hi @mikedanese , kind reminder about my question above.

Thx!

[msedzins]

Hi @mikedanese , kind reminder about my question above.

Thx!

[mikedanese]

This will not be graduating in 1.19, although we have some improvements landing: https://github.com/kubernetes/enhancements/pull/1598

[msedzins]

thank you @mikedanese for letting me know!

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[redbaron]

/remove-lifecycle stale

[kikisdeliveryservice]

Hi @mikedanese

Enhancements Lead here. Any plans to graduate this in 1.20?

Thanks,
Kirsten

[kikisdeliveryservice]

Hi @mikedanese

Following up: 1.20 Enhancements Freeze is October 6th. Could you let us know if you are planning to GA in 1.20? To be included in the milestone:
The KEP must be merged in an implementable state
The KEP must have test plans
The KEP must have graduation criteria

Could you please update the description to link to the KEP? Since that linked PR, the format has changed. See for ref https://github.com/kubernetes/enhancements/tree/master/keps/NNNN-kep-template

Best,
Kirsten

[liggitt]

/unassign @mikedanese
/assign @zshihang

[kikisdeliveryservice]

This is now on the tracking sheet.

cc: @annajung

[kikisdeliveryservice]

As a note this was approved via an exception request (can't get a google groups link tho)

PR: https://github.com/kubernetes/kubernetes/pull/95667
docs; https://github.com/kubernetes/website/pull/24823

[kikisdeliveryservice]

Hi @zshihang @liggitt

Just a reminder that Code Freeze is coming up in 2 days on Thursday, November 12th. All PRs must be merged by that date, otherwise an Exception is required.

I see that the remaining PR is for 1.21: https://github.com/kubernetes/kubernetes/pull/95667#issuecomment-722555425

So can you confirm that everything required for 1.20 is in?

Thanks,
Kirsten

[liggitt]

https://github.com/kubernetes/kubernetes/pull/95667#issuecomment-722555425 is retargeted to 1.21

All PRs required for 1.20 code freeze are already merged.

https://github.com/kubernetes/kubernetes/pull/96322 is pending to promote a test to conformance, and will merge before 1.20 test freeze

[kikisdeliveryservice]

Sounds perfect, thank you for the update!