Enhancements: Defend against logging secrets via static analysis

[PurelyApplied]

Enhancement Description

• One-line enhancement description (can be used as a release note):
  Defend against logging secrets via static analysis
• Kubernetes Enhancement Proposal: here
• Primary contact (assignee): @PurelyApplied
• Responsible SIGs: @sig-instrumentation
• Enhancement target (which target equals to which milestone):
  
  
  
  • Alpha release target (1.20)
  
  
  • Beta release target (Pending verification of test configuration and stability)
  
  
  • Stable release target (Pending verification of test stability at scale)
  
  

_Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently._

History:

• Initial Proposal: #1936
• Introduction of test target: kubernetes/kubernetes/pull/94661
• Correction of premature blocking via accidental inclusion in verify-all.sh: kubernetes/kubernetes/pull/96235
• Introduction of non-blocking Prow target: kubernetes/test-infra/pull/19181

[PurelyApplied]

/sig instrumentation
/sig auth

/wg security audit

[k8s-ci-robot]

@PurelyApplied: The label(s) wg/security, wg/audit cannot be applied, because the repository doesn't have them

In response to this:

/sig instrumentation
/sig auth

/wg security audit

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[PurelyApplied]

/wg "security audit"

[k8s-ci-robot]

@PurelyApplied: The label(s) wg/"security, wg/audit" cannot be applied, because the repository doesn't have them

In response to this:

/wg "security audit"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[JayBeale]

Looks like @wg-security-audit tag doesn't exist yet - I'll see if we can do something about that.

[kikisdeliveryservice]

Hi @PurelyApplied

Enhancements Lead here. Any plans for this to be alpha/beta/stable in 1.20?

Thanks!
Kirsten

[ehashman]

We would like to see this included in 1.20 with #1753, assuming it is approved and merged before the enhancements freeze.

[kikisdeliveryservice]

great we will track for now and just let us know if anything changes. thank you!

/milestone v1.20

[kikisdeliveryservice]

As a note, since I see that the KEP draft is provisional to be included in a release by enhancements freeze:

The KEP must be merged in an implementable state
The KEP must have test plans
The KEP must have graduation criteria.

[PurelyApplied]

Duly noted.

I've updated the KEP's Graduation Criteria to reflect a 1.20 target for Alpha.

Proof-of-concept implementations can be found at /kubernetes#94661 and /test-infra#19181. We plan to iterate on these soon, including fleshing out testing / test plans on both sides.

Graduation criteria has been clarified.

[PurelyApplied]

Rather belatedly...

/wg security-audit

[kikisdeliveryservice]

Duly noted.

I've updated the KEP's Graduation Criteria to reflect a 1.20 target for Alpha.

Proof-of-concept implementations can be found at /kubernetes#94661 and /test-infra#19181. We plan to iterate on these soon, including fleshing out testing / test plans on both sides.

Graduation criteria has been clarified.

Awesome, thank you!! Also the KEP should be updated to reflect an implementable state by Enhancements Freeze (Oct 6th) it is currently provisional: https://github.com/kubernetes/enhancements/pull/1936/files#diff-83bc478e0a3c00961b8e714c26c541ed
:+1:

[kikisdeliveryservice]

1936 merged! Updating sheet to tracked!

[mikejoh]

Hi @PurelyApplied ,

Since your Enhancement is scheduled to be in 1.20, please keep in mind the important upcoming dates:

• Friday, Nov 6th: Week 8 - Docs Placeholder PR deadline
• Thursday, Nov 12th: Week 9 - Code Freeze

As a reminder, please link all of your k/k PR as well as docs PR to this issue so we can track them.

Regards,
Mikael

[annajung]

Hello @PurelyApplied 👋 , 1.20 Docs lead here.

Does this enhancement work planned for 1.20 require any new docs or modification to existing docs?

If so, please follows the steps here to open a PR against dev-1.20 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Nov 6th

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!

[annajung]

Hi @PurelyApplied

The docs placeholder deadline is almost here. Please make sure to create a placeholder PR against the dev-1.20 branch in the k/website before the deadline

Also, please keep in mind the important upcoming dates:

• Friday, Nov 6th: Week 8 - Docs Placeholder PR deadline
• Thursday, Nov 12th: Week 9 - Code Freeze
• Monday, Nov 23rd: Week 11 - Docs PR Ready for Review

As a reminder, please link all of your k/k PR as well as docs PR to this issue for the release team to track.

[PurelyApplied]

@annajung Thanks for the reminder.

None of the other verify-* tasks have docs. While it could be argued that they _should_, I think we'll tackle this documentation debt after 1.20.

[annajung]

Thanks for the update! I will update the tracking sheet accordingly.
Please consider docs higher priority when this feature graduates to beta and/or stable. Thank you!