diff --git a/keps/provider-aws/20181126-aws-k8s-tester-figure-01.png b/keps/provider-aws/2313-aws-k8s-tester/20181126-aws-k8s-tester-figure-01.png similarity index 100% rename from keps/provider-aws/20181126-aws-k8s-tester-figure-01.png rename to keps/provider-aws/2313-aws-k8s-tester/20181126-aws-k8s-tester-figure-01.png diff --git a/keps/provider-aws/20181126-aws-k8s-tester-figure-02.png b/keps/provider-aws/2313-aws-k8s-tester/20181126-aws-k8s-tester-figure-02.png similarity index 100% rename from keps/provider-aws/20181126-aws-k8s-tester-figure-02.png rename to keps/provider-aws/2313-aws-k8s-tester/20181126-aws-k8s-tester-figure-02.png diff --git a/keps/provider-aws/20181126-aws-k8s-tester.md b/keps/provider-aws/2313-aws-k8s-tester/README.md similarity index 96% rename from keps/provider-aws/20181126-aws-k8s-tester.md rename to keps/provider-aws/2313-aws-k8s-tester/README.md index 588c94ff5462..78ea1a539958 100644 --- a/keps/provider-aws/20181126-aws-k8s-tester.md +++ b/keps/provider-aws/2313-aws-k8s-tester/README.md @@ -1,20 +1,3 @@ ---- -title: aws-k8s-tester -authors: - - "@gyuho" -owning-sig: sig-cloud-provider -reviewers: - - "@d-nishi" - - "@shyamjvs" -approvers: - - "@d-nishi" - - "@shyamjvs" -editor: TBD -creation-date: 2018-11-26 -last-updated: 2018-11-29 -status: provisional ---- - # aws-k8s-tester - kubetest plugin for AWS and EKS ## Table of Contents @@ -97,6 +80,6 @@ We implement kubetest plugin, out-of-tree and provided as a single binary file. ## Implementation History -* Initial integration with upstream has been tracked +* Initial integration with upstream has been tracked * Initial proposal to SIG 2018-11-26 * Initial KEP draft 2018-11-26 diff --git a/keps/provider-aws/2313-aws-k8s-tester/kep.yaml b/keps/provider-aws/2313-aws-k8s-tester/kep.yaml new file mode 100644 index 000000000000..9e1037e1836f --- /dev/null +++ b/keps/provider-aws/2313-aws-k8s-tester/kep.yaml @@ -0,0 +1,15 @@ +title: aws-k8s-tester +kep-number: 2313 +authors: + - "@gyuho" +owning-sig: sig-cloud-provider +reviewers: + - "@d-nishi" + - "@shyamjvs" +approvers: + - "@d-nishi" + - "@shyamjvs" +editor: TBD +creation-date: 2018-11-26 +last-updated: 2018-11-29 +status: provisional diff --git a/keps/provider-aws/20190128-cloud-controller-custom-endpoints.md b/keps/provider-aws/2314-custom-endpoints-support-for-aws-cloud-provider/README.md similarity index 80% rename from keps/provider-aws/20190128-cloud-controller-custom-endpoints.md rename to keps/provider-aws/2314-custom-endpoints-support-for-aws-cloud-provider/README.md index afd9d5c27e88..63be5d9e67f3 100644 --- a/keps/provider-aws/20190128-cloud-controller-custom-endpoints.md +++ b/keps/provider-aws/2314-custom-endpoints-support-for-aws-cloud-provider/README.md @@ -1,24 +1,3 @@ ---- -title: Custom endpoints support for AWS Cloud Provider -authors: - - "@micahhausler" -owning-sig: sig-cloud-provider -participating-sigs: - - sig-cloud-provider -reviewers: - - "@justinsb" - - "@mcrute" -approvers: - - "@justinsb" -editor: "@micahhausler" -creation-date: 2019-01-28 -last-updated: 2019-01-28 -status: provisional -see-also: -replaces: -superseded-by: ---- - # Custom endpoint support for AWS Cloud Provider ## Table of Contents diff --git a/keps/provider-aws/2314-custom-endpoints-support-for-aws-cloud-provider/kep.yaml b/keps/provider-aws/2314-custom-endpoints-support-for-aws-cloud-provider/kep.yaml new file mode 100644 index 000000000000..f7900bcdb096 --- /dev/null +++ b/keps/provider-aws/2314-custom-endpoints-support-for-aws-cloud-provider/kep.yaml @@ -0,0 +1,19 @@ +title: Custom endpoints support for AWS Cloud Provider +kep-number: 2314 +authors: + - "@micahhausler" +owning-sig: sig-cloud-provider +participating-sigs: + - sig-cloud-provider +reviewers: + - "@justinsb" + - "@mcrute" +approvers: + - "@justinsb" +editor: "@micahhausler" +creation-date: 2019-01-28 +last-updated: 2019-01-28 +status: provisional +see-also: +replaces: +superseded-by: diff --git a/keps/provider-aws/2315-aws-loadbalancer-prefix/README.md b/keps/provider-aws/2315-aws-loadbalancer-prefix/README.md new file mode 100644 index 000000000000..44a55dcd7f2b --- /dev/null +++ b/keps/provider-aws/2315-aws-loadbalancer-prefix/README.md @@ -0,0 +1,48 @@ +# AWS LoadBalancer Prefix Annotation Proposal + +## Table of Contents + + +- [Summary](#summary) +- [Motivation](#motivation) + - [Goals](#goals) + - [Non-Goals](#non-goals) +- [Proposal](#proposal) + - [User Stories [optional]](#user-stories-optional) + - [Implementation Details/Notes/Constraints [optional]](#implementation-detailsnotesconstraints-optional) + - [Risks and Mitigations](#risks-and-mitigations) +- [Graduation Criteria](#graduation-criteria) +- [Implementation History](#implementation-history) +- [Drawbacks [optional]](#drawbacks-optional) +- [Alternatives [optional]](#alternatives-optional) +- [Infrastructure Needed [optional]](#infrastructure-needed-optional) + + +## Summary +AWS load balancer prefix annotation adds a control over the naming of the AWS ELB resources that are being generated when provisioning a Kubernetes service of type `LoadBalancer`. The current implementation provisions AWS ELB with a unique name based on the resource UID. The resulted unpredicted name makes it impossible to integrate the provisioning with existing IAM policies in situations when these two operations are controlled by two different groups. For example, IAM policies are defined and controlled by InfoSec team while provisioning of resources is under CloudOps team. The AWS IAM policies allow definition when only a prefix of the resource identifier is known. Using Kubernetes service with this annotation when it is provisioned in AWS, will allow an integration with existing IAM policies. + +## Motivation +Current way of provisioning load balancer (for a Kubernetes service of the type `LoadBalancer`) is to use the service's UID and to follow Cloud naming conventions for load balancers (for AWS it is a 32 character sequence of alphanumeric characters or hyphens that cannot begin or end with hypen [link1](https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_CreateLoadBalancer.html), [link2](https://docs.aws.amazon.com/cli/latest/reference/elbv2/create-load-balancer.html)). When it is provisioned on AWS account with predefined IAM policies that limit access to ELB resources using wildcarded paths (IAM identifiers), the Kubernetes service cannot be provisioned. Providing a way to define a short known prefix to ELB resource makes it possible to match IAM policies conditions regarding the resource identifiers. + +### Goals +* Support provisioning of AWS ELB resources for Kubernetes services of the type `LoadBalancer` that match AWS IAM policies +### Non-Goals +* Provide meaningful names for AWS ELB resources generated for Kubernetes services of the type `LoadBalancer` + +## Proposal + +### User Stories [optional] + +### Implementation Details/Notes/Constraints [optional] + +### Risks and Mitigations + +## Graduation Criteria + +## Implementation History + +## Drawbacks [optional] + +## Alternatives [optional] + +## Infrastructure Needed [optional] diff --git a/keps/provider-aws/2315-aws-loadbalancer-prefix/kep.yaml b/keps/provider-aws/2315-aws-loadbalancer-prefix/kep.yaml new file mode 100644 index 000000000000..f4ff3f84d1d4 --- /dev/null +++ b/keps/provider-aws/2315-aws-loadbalancer-prefix/kep.yaml @@ -0,0 +1,17 @@ +title: AWS LoadBalancer Prefix +kep-number: 2315 +authors: + - "@minherz" +owning-sig: sig-cloud-provider +participating-sigs: +reviewers: + - TBD +approvers: + - TBD +editor: TBD +creation-date: 2018-11-02 +last-updated: 2018-11-02 +status: provisional +see-also: +replaces: +superseded-by: diff --git a/keps/provider-aws/aws-lb-prefix-annotation.md b/keps/provider-aws/aws-lb-prefix-annotation.md index 303014158570..e69de29bb2d1 100644 --- a/keps/provider-aws/aws-lb-prefix-annotation.md +++ b/keps/provider-aws/aws-lb-prefix-annotation.md @@ -1,67 +0,0 @@ ---- -title: AWS LoadBalancer Prefix -authors: - - "@minherz" -owning-sig: sig-cloud-provider -participating-sigs: -reviewers: - - TBD -approvers: - - TBD -editor: TBD -creation-date: 2018-11-02 -last-updated: 2018-11-02 -status: provisional -see-also: -replaces: -superseded-by: ---- - -# AWS LoadBalancer Prefix Annotation Proposal - -## Table of Contents - - -- [Summary](#summary) -- [Motivation](#motivation) - - [Goals](#goals) - - [Non-Goals](#non-goals) -- [Proposal](#proposal) - - [User Stories [optional]](#user-stories-optional) - - [Implementation Details/Notes/Constraints [optional]](#implementation-detailsnotesconstraints-optional) - - [Risks and Mitigations](#risks-and-mitigations) -- [Graduation Criteria](#graduation-criteria) -- [Implementation History](#implementation-history) -- [Drawbacks [optional]](#drawbacks-optional) -- [Alternatives [optional]](#alternatives-optional) -- [Infrastructure Needed [optional]](#infrastructure-needed-optional) - - -## Summary -AWS load balancer prefix annotation adds a control over the naming of the AWS ELB resources that are being generated when provisioning a Kubernetes service of type `LoadBalancer`. The current implementation provisions AWS ELB with a unique name based on the resource UID. The resulted unpredicted name makes it impossible to integrate the provisioning with existing IAM policies in situations when these two operations are controlled by two different groups. For example, IAM policies are defined and controlled by InfoSec team while provisioning of resources is under CloudOps team. The AWS IAM policies allow definition when only a prefix of the resource identifier is known. Using Kubernetes service with this annotation when it is provisioned in AWS, will allow an integration with existing IAM policies. - -## Motivation -Current way of provisioning load balancer (for a Kubernetes service of the type `LoadBalancer`) is to use the service's UID and to follow Cloud naming conventions for load balancers (for AWS it is a 32 character sequence of alphanumeric characters or hyphens that cannot begin or end with hypen [link1](https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_CreateLoadBalancer.html), [link2](https://docs.aws.amazon.com/cli/latest/reference/elbv2/create-load-balancer.html)). When it is provisioned on AWS account with predefined IAM policies that limit access to ELB resources using wildcarded paths (IAM identifiers), the Kubernetes service cannot be provisioned. Providing a way to define a short known prefix to ELB resource makes it possible to match IAM policies conditions regarding the resource identifiers. - -### Goals -* Support provisioning of AWS ELB resources for Kubernetes services of the type `LoadBalancer` that match AWS IAM policies -### Non-Goals -* Provide meaningful names for AWS ELB resources generated for Kubernetes services of the type `LoadBalancer` - -## Proposal - -### User Stories [optional] - -### Implementation Details/Notes/Constraints [optional] - -### Risks and Mitigations - -## Graduation Criteria - -## Implementation History - -## Drawbacks [optional] - -## Alternatives [optional] - -## Infrastructure Needed [optional]