Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Migrate remaining auth keps to new template #2208

Merged
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -1,25 +1,3 @@
---
title: Extended NodeRestrictions for Pods
authors:
- "tallclair"
owning-sig: sig-auth
participating-sigs:
- sig-node
- sig-cluster-lifecycle
reviewers:
- derekwaynecarr
- neolit123
- deads2k
approvers:
- liggitt
- derekwaynecarr
- neolit123
- deads2k
editor: TBD
creation-date: 2019-09-16
status: implementable
---

# Extended NodeRestrictions for Pods

## Table of Contents
Expand Down
20 changes: 20 additions & 0 deletions keps/sig-auth/1314-node-restriction-pods/kep.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
title: Extended NodeRestrictions for Pods
kep-number: 1314
authors:
- "tallclair"
owning-sig: sig-auth
participating-sigs:
- sig-node
- sig-cluster-lifecycle
reviewers:
- derekwaynecarr
- neolit123
- deads2k
approvers:
- liggitt
- derekwaynecarr
- neolit123
- deads2k
editor: TBD
creation-date: 2019-09-16
status: implementable
Original file line number Diff line number Diff line change
@@ -1,30 +1,3 @@
---
title: Service Account signing key retrieval
authors:
- "@mikedanese"
- "@cceckman"
- "@mtaufen"
owning-sig: sig-auth
participating-sigs:
- sig-auth
reviewers:
- "@liggitt"
- "@enj"
- "@micahhausler"
- "@ericchiang"
approvers:
- "@liggitt"
- "@enj"
- "@micahhausler"
- "@ericchiang"
editor: TBD
creation-date: 2018-06-26
last-updated: 2020-01-25
status: implementable
replaces:
- "https://github.com/kubernetes/community/pull/2314/"
---

# Service Account signing key retrieval

## Table of Contents
Expand Down
25 changes: 25 additions & 0 deletions keps/sig-auth/1393-oidc-discovery/kep.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
title: Service Account signing key retrieval
kep-number: 1393
authors:
- "@mikedanese"
- "@cceckman"
- "@mtaufen"
owning-sig: sig-auth
participating-sigs:
- sig-auth
reviewers:
- "@liggitt"
- "@enj"
- "@micahhausler"
- "@ericchiang"
approvers:
- "@liggitt"
- "@enj"
- "@micahhausler"
- "@ericchiang"
editor: TBD
creation-date: 2018-06-26
last-updated: 2020-01-25
status: implementable
replaces:
- "https://github.com/kubernetes/community/pull/2314/"
Original file line number Diff line number Diff line change
@@ -1,21 +1,3 @@
---
title: Certificates API
authors:
- "@mikedanese"
- "@deads2k"
owning-sig: sig-auth
reviewers:
- "@liggitt"
- "@smarterclayton"
- "@munnerz"
approvers:
- "@liggitt"
- "@smarterclayton"
creation-date: 2019-06-07
last-updated: 2020-09-14
status: implemented
---

# Certificates API

<!-- toc -->
Expand Down Expand Up @@ -130,7 +112,7 @@ This is typical of many PKI architectures.

A typical successful issuance proceeds as follows:

![CSR](/keps/sig-auth/csr.png)
![CSR](/keps/sig-auth/1513-certificate-signing-request/csr.png)

1. The requestor generates a private key, builds a certificate signing request,
and submits the `CertificateSigningRequest` to the Kubernetes certificates
Expand Down
File renamed without changes
16 changes: 16 additions & 0 deletions keps/sig-auth/1513-certificate-signing-request/kep.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
title: Certificates API
kep-number: 1513
authors:
- "@mikedanese"
- "@deads2k"
owning-sig: sig-auth
reviewers:
- "@liggitt"
- "@smarterclayton"
- "@munnerz"
approvers:
- "@liggitt"
- "@smarterclayton"
creation-date: 2019-06-07
last-updated: 2020-09-14
status: implemented
Original file line number Diff line number Diff line change
@@ -1,23 +1,3 @@
---
title: Bounding Self-Labeling Kubelets
authors:
- "@mikedanese"
- "@liggitt"
owning-sig: sig-auth
participating-sigs:
- sig-node
- sig-storage
reviewers:
- "@saad-ali"
- "@tallclair"
approvers:
- "@thockin"
- "@smarterclayton"
creation-date: 2017-08-14
last-updated: 2020-05-01
status: implemented
---

# Bounding Self-Labeling Kubelets

## Table of Contents
Expand Down
18 changes: 18 additions & 0 deletions keps/sig-auth/279-limit-node-access/kep.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
title: Bounding Self-Labeling Kubelets
kep-number: 279
authors:
- "@mikedanese"
- "@liggitt"
owning-sig: sig-auth
participating-sigs:
- sig-node
- sig-storage
reviewers:
- "@saad-ali"
- "@tallclair"
approvers:
- "@thockin"
- "@smarterclayton"
creation-date: 2017-08-14
last-updated: 2020-05-01
status: implemented
Original file line number Diff line number Diff line change
@@ -1,25 +1,3 @@
---
title: Dynamic Audit Configuration
authors:
- "@pbarker"
owning-sig: sig-auth
participating-sigs:
- sig-api-machinery
reviewers:
- "@tallclair"
- "@yliaog"
- "@caesarxuchao"
- "@liggitt"
approvers:
- "@tallclair"
- "@liggitt"
- "@yliaog"
editor: TBD
creation-date: 2018-05-18
last-updated: 2018-07-31
status: implementable
---

# Dynamic Audit Control

## Table of Contents
Expand Down Expand Up @@ -283,4 +261,4 @@ it was ruled out for the following reasons:
* The use of CRDs would be difficult to bound

The dynamic policy feature is gated by runtime flags. This still provides the cluster provisioner a means to limit audit logging to the
single runtime object if needed.
single runtime object if needed.
20 changes: 20 additions & 0 deletions keps/sig-auth/600-dynamic-audit-configuration/kep.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
title: Dynamic Audit Configuration
kep-number: 600
authors:
- "@pbarker"
owning-sig: sig-auth
participating-sigs:
- sig-api-machinery
reviewers:
- "@tallclair"
- "@yliaog"
- "@caesarxuchao"
- "@liggitt"
approvers:
- "@tallclair"
- "@liggitt"
- "@yliaog"
editor: TBD
creation-date: 2018-05-18
last-updated: 2018-07-31
status: implementable
Original file line number Diff line number Diff line change
@@ -1,26 +1,3 @@
---
title: Support external signing of service account keys
authors:
- "@micahhausler"
owning-sig: sig-auth
participating-sigs: []
reviewers:
- "@mikedanese"
- "@liggit"
- "@tallclair"
approvers:
- "@mikedanese"
- "@liggit"
- "@tallclair"
editor: '@micahhausler'
creation-date: 2019-01-16
last-updated: 2019-05-17
status: implementable
see-also: []
replaces: []
superseded-by: []
---

# Support external signing of service account keys

## Table of Contents
Expand Down
21 changes: 21 additions & 0 deletions keps/sig-auth/740-service-account-external-signing/kep.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
title: Support external signing of service account keys
kep-number: 740
authors:
- "@micahhausler"
owning-sig: sig-auth
participating-sigs: []
reviewers:
- "@mikedanese"
- "@liggit"
- "@tallclair"
approvers:
- "@mikedanese"
- "@liggit"
- "@tallclair"
editor: '@micahhausler'
creation-date: 2019-01-16
last-updated: 2019-05-17
status: implementable
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is incorrect as #1564 never made it. I have opened #3653 to fix this.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, let me fix up my description.

see-also: []
replaces: []
superseded-by: []
Original file line number Diff line number Diff line change
@@ -1,25 +1,3 @@
---
title: Harden Default RBAC Discovery ClusterRole(Binding)s
authors:
- "@dekkagaijin"
owning-sig: sig-auth
participating-sigs:
- sig-auth
- sig-api-machinery
reviewers:
- "@liggitt"
- "@tallclair"
- "@deads2k"
approvers:
- "@liggitt"
- "@tallclair"
- "@deads2k"
editor: TBD
creation-date: 2019-01-28
last-updated: 2019-01-31
status: implementable
---

# Harden Default RBAC Discovery ClusterRole(Binding)s

## Table of Contents
Expand Down
20 changes: 20 additions & 0 deletions keps/sig-auth/789-harden-default-discover-bindings/kep.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
title: Harden Default RBAC Discovery ClusterRole(Binding)s
kep-number: 789
authors:
- "@dekkagaijin"
owning-sig: sig-auth
participating-sigs:
- sig-auth
- sig-api-machinery
reviewers:
- "@liggitt"
- "@tallclair"
- "@deads2k"
approvers:
- "@liggitt"
- "@tallclair"
- "@deads2k"
editor: TBD
creation-date: 2019-01-28
last-updated: 2019-01-31
status: implementable