Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[KEP-127] Add Pod Security Standards to User Namespaces KEP #4044

Merged
merged 1 commit into from
Jun 15, 2023
Merged

[KEP-127] Add Pod Security Standards to User Namespaces KEP #4044

merged 1 commit into from
Jun 15, 2023

Conversation

saschagrunert
Copy link
Member

@saschagrunert saschagrunert commented May 30, 2023 •
edited
Loading

This KEP update outlines the required changes for Pod Security Standards in relation to the User Namespaces support. We plan to release another alpha version of this feature in 1.28, so no graduation to beta yet.

Refers to #127

PTAL @giuseppe @rata @mrunalp @kubernetes/sig-auth-feature-requests

@k8s-ci-robot k8s-ci-robot added sig/auth Categorizes an issue or PR as relevant to SIG Auth. kind/feature Categorizes issue or PR as related to a new feature. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels May 30, 2023
@k8s-ci-robot k8s-ci-robot added the kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory label May 30, 2023
@k8s-ci-robot k8s-ci-robot added sig/node Categorizes an issue or PR as relevant to SIG Node. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 30, 2023
giuseppe
giuseppe approved these changes May 30, 2023
View reviewed changes
Copy link
Member

@giuseppe giuseppe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

keps/sig-node/127-user-namespaces/README.md Outdated Show resolved Hide resolved
@saschagrunert saschagrunert changed the title Add Pod Security Standards to User Namespaces KEP [KEP-127] Add Pod Security Standards to User Namespaces KEP May 30, 2023
@saschagrunert
Copy link
Member Author

/retest

@SergeyKanzhelev SergeyKanzhelev mentioned this pull request Jun 5, 2023
Open
26 tasks
@saschagrunert saschagrunert force-pushed the user-namespaces branch 3 times, most recently from 2a2a886 to 32eab7e Compare June 7, 2023 09:25
@mrunalp
Copy link
Contributor

mrunalp commented Jun 10, 2023

@liggitt @deads2k for auth review.

@mrunalp
Copy link
Contributor

mrunalp commented Jun 10, 2023

cc: @thockin

@wojtek-t
Copy link
Member

@saschagrunert - so what is the plan with it? The KEP description says we're targetting beta, but it's not anymore in KEP.
If we want to target Beta, it requires deeper PRR review, but if the plan is another Alpha release, this looks good enough.

@wojtek-t wojtek-t self-assigned this Jun 12, 2023
@saschagrunert saschagrunert force-pushed the user-namespaces branch 2 times, most recently from aeb3656 to e242d93 Compare June 13, 2023 07:16
@saschagrunert
Copy link
Member Author

@saschagrunert - so what is the plan with it? The KEP description says we're targetting beta, but it's not anymore in KEP. If we want to target Beta, it requires deeper PRR review, but if the plan is another Alpha release, this looks good enough.

I spoke to @mrunalp and we will target another alpha release of this feature. Updated the KEP to reflect that.

@wojtek-t
Copy link
Member

Thanks - so from PRR pov it's good to go.

@saschagrunert
Add Pod Security Standards to User Namespaces KEP
2cc6dab 
This KEP update outlines the required changes for Pod Security Standards
in relation to the User Namespaces support. Planned graduation to beta
is v1.28, which is now reflected in `kep.yaml` as well.

Updating the PRR for it will follow in another PR.

Signed-off-by: Sascha Grunert <[email protected]>
SergeyKanzhelev
SergeyKanzhelev approved these changes Jun 15, 2023
View reviewed changes
Copy link
Member

@SergeyKanzhelev SergeyKanzhelev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

this is hardly questionable, but would need @LiGgit review of an actual implementation

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 15, 2023
@mrunalp
Copy link
Contributor

mrunalp commented Jun 15, 2023

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe, mrunalp, saschagrunert, SergeyKanzhelev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 15, 2023
@k8s-ci-robot k8s-ci-robot merged commit 7d7cf96 into kubernetes:master Jun 15, 2023
@k8s-ci-robot k8s-ci-robot added this to the v1.28 milestone Jun 15, 2023
@saschagrunert saschagrunert deleted the user-namespaces branch June 16, 2023 06:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mrunalp mrunalp mrunalp left review comments

@giuseppe giuseppe giuseppe approved these changes

@destijl destijl destijl left review comments

@haircommander haircommander haircommander left review comments

@SergeyKanzhelev SergeyKanzhelev SergeyKanzhelev approved these changes

@dchen1107 dchen1107 Awaiting requested review from dchen1107

@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr

Assignees

@SergeyKanzhelev SergeyKanzhelev

@wojtek-t wojtek-t

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory lgtm "Looks good to me", indicates that a PR is ready to be merged. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/node Categorizes an issue or PR as relevant to SIG Node. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
SIG Auth
Archived in project
SIG Node PR Triage
Archived in project
Milestone
v1.28
Development

Successfully merging this pull request may close these issues.
8 participants
@saschagrunert @mrunalp @wojtek-t @k8s-ci-robot @giuseppe @destijl @haircommander @SergeyKanzhelev