Enhancements: Support GMSA for Windows workloads

[ddebroy]

Enhancement Description

• One-line enhancement description (can be used as a release note): Enable support for Group Managed Service Account (gMSA) for Windows workloads on Kubernetes.
• Primary contact (assignee): @ddebroy
• Responsible SIGs: sig-windows, sig-auth, sig-node
• Design proposal link (community repo): https://github.com/kubernetes/enhancements/blob/master/keps/sig-windows/20181221-windows-group-managed-service-accounts-for-container-identity.md
  and
  https://github.com/kubernetes/enhancements/blob/master/keps/sig-windows/20190418-windows-security-context.md
• Link to e2e and/or unit tests: Coming soon
• Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred: @PatrickLang [Windows changes overall] @yujuhong [dockershim changes around Windows] @mikedanese, @liggitt [overall pod spec/container spec changes + authorization/security]
• Approver (likely from SIG/area to which enhancement belongs): @PatrickLang @yujuhong @liggitt @mikedanese
• Enhancement target (which target equals to which milestone):
  
  
  
  • Alpha release target (1.14)
  
  
  • Beta release target (1.16)
  
  
  • Stable release target (1.18)
  
  

_Please to keep this description up to date. This will help the Enhancement Team track efficiently the evolution of the enhancement_

[ddebroy]

/sig windows auth node

[claurence]

@ddebroy - Hi I'm the enhancements lead for 1.14 - it looks like this issue is targeting Alpha for 1.14. Just want to remind that enhancements freeze is 1/29

[ddebroy]

/milestone v1.14

[k8s-ci-robot]

@ddebroy: You must be a member of the kubernetes/kubernetes-milestone-maintainers github team to set the milestone.

In response to this:

/milestone v1.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[claurence]

/milestone v1.14

[k8s-ci-robot]

@claurence: You must be a member of the kubernetes/kubernetes-milestone-maintainers github team to set the milestone.

In response to this:

/milestone v1.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[claurence]

@ddebroy are there any open PRs that should be tracked for this issue for the 1.14 release?

[ddebroy]

@claurence we were trying to lock down the design and get to implementable state for the KEP this week (https://github.com/kubernetes/enhancements/pull/694, https://github.com/kubernetes/enhancements/pull/710 and https://github.com/kubernetes/enhancements/pull/722).

We will have PRs for the alpha implementations out shortly.

[ddebroy]

With https://github.com/kubernetes/enhancements/pull/710 merged, the feature should now be in approved/implementable state.

[liggitt]

I'll take API review on this (if there ends up being any for the alpha version) since I have context on the KEP

[ddebroy]

In-tree PR tracking the Alpha enhancements implemented through annotations and dockershim: https://github.com/kubernetes/kubernetes/pull/73726/files

[npentrel]

Hey @ddebroy 👋! I'm Naomi, a v1.14 docs release shadow.

Does this enhancement require any new docs (or modifications)?

Just a friendly reminder we're looking for a PR against k/website (branch dev-1.14) due by Friday, March 1. It would be great if it's the start of the full documentation, but even a placeholder PR is acceptable. Let me know if you have any questions!

[neolit123]

@npentrel hello, given the target for this cycle is alpha as per the first post, it would be OK if this feature is mentioned as "experimental" with only minimal to no-documentation if possible.

i would leave further clarification and comments to @ddebroy

[ddebroy]

@JeremyWx is working on docs for GMSA support. Jeremy, will it be possible to get a placeholder PR started against k/website as mentioned by Naomi above? We can then iterate on it. I think it will be great to aim for some docs around this although the feature is in Alpha.

[ddebroy]

@npentrel docs PR placeholder opened: https://github.com/kubernetes/website/pull/12936

[ddebroy]

The two main in-tree PRs for this feature include: https://github.com/kubernetes/kubernetes/pull/73726 (merged) and https://github.com/kubernetes/kubernetes/pull/74737 (reviewed/approved/waiting-to-merge).

It also requires a webhook from https://github.com/kubernetes-sigs/windows-gmsa where necessary PRs have merged.

With these, we are ready for Alpha.

Work has commenced on e2e tests but full e2e tests + execution environment and signals will be ready for Beta in 1.15

[shahiddev]

The link to the proposal is broken in the issue description
Should be https://github.com/kubernetes/enhancements/blob/master/keps/sig-windows/20181221-windows-group-managed-service-accounts-for-container-identity.md

[kacole2]

Hello @ddebroy , I'm the Enhancement Lead for 1.15. Is this feature going to be graduating alpha/beta/stable stages in 1.15? Please let me know so it can be tracked properly and added to the spreadsheet.

Once coding begins, please list all relevant k/k PRs in this issue so they can be tracked properly.

/milestone clear

[ddebroy]

Hi @kacole2, yes we are aiming for Beta in 1.15.

Main PR for the move to Beta: https://github.com/kubernetes/kubernetes/pull/75459

[kacole2]

/milestone v.1.15
/stage beta

[k8s-ci-robot]

@kacole2: The provided milestone is not valid for this repository. Milestones in this repository: [keps-beta, keps-ga, v1.14, v1.15]

Use /milestone clear to clear the milestone.

In response to this:

/milestone v.1.15
/stage beta

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ddebroy]

Hey @kacole2 just wanted to make sure the above version type /milestone v.1.15 is taken care of. I think you meant /milestone v1.15

[ddebroy]

@kacole2 one update wrt GMSA for Windows: due to the API changes we are bringing in 1.15 for GMSA, we will need to keep the feature in feature-gated/alpha state for one more release. So the plan now is to drive towards beta in 1.16. For 1.15 this will stay alpha/feature-gated by default.

[kacole2]

/milestone clear
/stage alpha

[ddebroy]

hi @kacole2 we are planning to move this feature to Beta in v1.16. So wanted to make sure it is tracked appropriately. Thanks!

[kacole2]

/milestone v1.16
/stage beta

[VineethReddy02]

Hi @ddebroy , I'm the v1.16 docs release shadow.

Does this enhancement require any new docs (or modifications)?

Just a friendly reminder we're looking for a PR against k/website (branch dev-1.16) due by Friday,August 23rd. It would be great if it's the start of the full documentation, but even a placeholder PR is acceptable. Let me know if you have any questions!

Thanks!

[ddebroy]

@VineethReddy02 yes, we will have doc changes as part of the v1.16. Will open PRs on the repo you pointed.

[ddebroy]

docs PR: https://github.com/kubernetes/website/pull/15706

[ddebroy]

PRs for this for 1.16:
https://github.com/kubernetes/kubernetes/pull/80320
To enable e2e testing and look at signals through AKS testgrids:
https://github.com/kubernetes-sigs/windows-testing/pull/98

[ddebroy]

https://github.com/kubernetes/kubernetes/pull/82110 is the PR to move the feature to Beta and have GMSA support enabled by default.

[mrbobbytables]

Hey there @ddebroy -- 1.17 Enhancements lead here. I wanted to check in and see if you think this Enhancement will be graduating to alpha/beta/stable in 1.17?

The current release schedule is:

• Monday, September 23 - Release Cycle Begins
• Tuesday, October 15, EOD PST - Enhancements Freeze
• Thursday, November 14, EOD PST - Code Freeze
• Tuesday, November 19 - Docs must be completed and reviewed
• Monday, December 9 - Kubernetes 1.17.0 Released

If you do, please list all relevant k/k PRs in this issue so they can be tracked properly. 👍

/milestone clear

[ddebroy]

@mrbobbytables plan right now is to stay in beta for v1.17

[mrbobbytables]

Noted -- thank you for the quick response! 👍

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[palnabarun]

/remove-lifecycle stale

[palnabarun]

Hey there @ddebroy -- 1.18 Enhancements shadow here. I wanted to check in and see if you think this Enhancement will be graduating to stable in 1.18 or having a major change in its current level?

The current release schedule is:

• Monday, January 6th - Release Cycle Begins
• Tuesday, January 28th EOD PST - Enhancements Freeze
• Thursday, March 5th, EOD PST - Code Freeze
• Monday, March 16th - Docs must be completed and reviewed
• Tuesday, March 24th - Kubernetes 1.18.0 Released

If you would like to include this enhancement, once coding begins please list all relevant k/k PRs in this issue so they can be tracked properly. 👍

We'll be tracking enhancements here: http://bit.ly/k8s-1-18-enhancements

Thanks! :)

[ddebroy]

@palnabarun We want to move GMSA support to stable in 1.18

[palnabarun]

Thank you @ddebroy for the updates. I will update the tracking sheet accordingly.

[PatrickLang]

/milestone v1.18

[palnabarun]

Hi @ddebroy, just a friendly reminder that the Code Freeze will go into effect on Thursday 5th March.

Can you please link all the k/k PRs or any other PRs which should be tracked for this enhancement?

Thank You :)

[irvifa]

Hello @ddebroy I'm one of the v1.18 docs shadows.
Does this enhancement for (or the work planned for v1.18) require any new docs (or modifications to existing docs)? If not, can you please update the 1.18 Enhancement Tracker Sheet (or let me know and I'll do so)

If so, just a friendly reminder we're looking for a PR against k/website (branch dev-1.18) due by Friday, Feb 28th., it can just be a placeholder PR at this time. Let me know if you have any questions!

[irvifa]

Hello @ddebroy I'm one of the v1.18 docs shadows.

Does this enhancement for (or the work planned for v1.18) require any new docs (or modifications to existing docs)? If not, can you please update the 1.18 Enhancement Tracker Sheet (or let me know and I'll do so)

If so, just a friendly reminder we're looking for a PR against k/website (branch dev-1.18) due by Friday, Feb 28th, which is roughly 1 weeks from now. It can just be a placeholder PR at this time. Let me know if you have any questions!

[jeremyrickard]

Hey @ddebroy @PatrickLang,

Following up on the ask from @palnabarun, can you please link to all the k/k PRs (or PRs in other repos) that we need to track for this enhancement? Code freeze is quickly approaching on 05 March 2020.

Thanks!

[irvifa]

Hi @ddebroy :wave: Kind reminder.. have you created the placeholder PR? I know you’re keeping a tab on this, but the deadline will be this Friday..

[ddebroy]

Docs placeholder PR: https://github.com/kubernetes/website/pull/19349
Feature Graduation PR: https://github.com/kubernetes/kubernetes/pull/88654

[palnabarun]

Hi @ddebroy, this a reminder that we are just two days away from Code Freeze on 5th March.

By the Code Freeze, https://github.com/kubernetes/kubernetes/pull/88654 should be merged else you would need to file an exception request.

[palnabarun]

Hi @ddebroy, since this enhancement graduated to Stable this release :rocket:, the status can now be set to be Implemented.

Can you please update the status? After that, we will close this issue.

[ddebroy]

@palnabarun done at https://github.com/kubernetes/enhancements/pull/1626

[palnabarun]

Thank you @ddebroy :)

[palnabarun]

/milestone clear

(removing this enhancement issue from the v1.18 milestone as the milestone is complete)

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[LorbusChris]

/remove-lifecycle rotten

[LorbusChris]

Looks like this has been implemented. Can this issue be closed now?

[marosset]

@LorbusChris - yes we can close this now. (sorry, just saw this issue)

[marosset]

/stage stable
/close

[k8s-ci-robot]

@marosset: Closing this issue.

In response to this:

/stage stable
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.