Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fine-grained SupplementalGroups control #3619

Open
4 tasks
Tracked by #112879
everpeace opened this issue Oct 14, 2022 · 34 comments
Open
4 tasks
Tracked by #112879

Fine-grained SupplementalGroups control #3619

everpeace opened this issue Oct 14, 2022 · 34 comments
Assignees
@everpeace
Labels
kind/feature Categorizes issue or PR as related to a new feature. sig/node Categorizes an issue or PR as relevant to SIG Node. stage/alpha Denotes an issue tracking an enhancement targeted for Alpha status

Comments

@everpeace
Copy link
Contributor

everpeace commented Oct 14, 2022 •
edited by Atharva-Shinde

Enhancement Description

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

/assign
/sig node
/kind feature
@k8s-ci-robot k8s-ci-robot added the needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. label Oct 14, 2022
@everpeace

This comment was marked as off-topic.

Sign in to view
@k8s-ci-robot k8s-ci-robot added sig/scheduling Categorizes an issue or PR as relevant to SIG Scheduling. sig/node Categorizes an issue or PR as relevant to SIG Node. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Oct 14, 2022
@k8s-ci-robot
Copy link
Contributor

@everpeace: The label(s) /remove-label sig/scheduling cannot be applied. These labels are supported: api-review, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, team/katacoda, refactor, lead-opted-in, tracked/no, tracked/out-of-tree, tracked/yes. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

In response to this:

/remove-label sig/scheduling

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot removed the sig/scheduling Categorizes an issue or PR as relevant to SIG Scheduling. label Oct 14, 2022
@everpeace

This comment was marked as off-topic.

Sign in to view
@k8s-ci-robot k8s-ci-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Oct 14, 2022
@everpeace everpeace changed the title SupplementalGroupsPolicy: fine grained SupplementalGroups control Fine grained SupplementalGroups control Oct 14, 2022
@everpeace everpeace mentioned this issue Oct 17, 2022
Merged
@everpeace everpeace changed the title Fine grained SupplementalGroups control Fine-grained SupplementalGroups control Oct 17, 2022
@everpeace everpeace mentioned this issue Oct 17, 2022
Merged
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle stale
  • Mark this issue or PR as rotten with /lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 15, 2023
@everpeace
Copy link
Contributor Author

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 15, 2023
@SergeyKanzhelev
Copy link
Member

/milestone v1.27

let's see if we can start it in 1.27

@k8s-ci-robot k8s-ci-robot added this to the v1.27 milestone Feb 2, 2023
@SergeyKanzhelev
Copy link
Member

/label lead-opted-in

@k8s-ci-robot k8s-ci-robot added the lead-opted-in Denotes that an issue has been opted in to a release label Feb 2, 2023
@SergeyKanzhelev
Copy link
Member

/stage alpha

@k8s-ci-robot k8s-ci-robot added the stage/alpha Denotes an issue tracking an enhancement targeted for Alpha status label Feb 3, 2023
@npolshakova
Copy link

Hello @everpeace 👋, 1.27 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PDT Thursday 9th February 2023.

This enhancement is targeting for stage alpha for 1.27 (correct me, if otherwise)

Here's where this enhancement currently stands:

  • KEP readme using the latest template has been merged into the k/enhancements repo.
  • KEP status is marked as implementable for latest-milestone: 1.27
  • KEP readme has a updated detailed test plan section filled out
  • KEP readme has up to date graduation criteria
  • KEP has a production readiness review that has been completed and merged into k/enhancements.

It looks like #3620 will address most of these issues.

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

@everpeace everpeace mentioned this issue Feb 9, 2023
Merged
5 tasks
@SergeyKanzhelev
Copy link
Member

SergeyKanzhelev commented Feb 9, 2023 •
edited

@npolshakova, kep yaml has correct values for stage, milestone, etc:

enhancements/keps/sig-node/3619-supplemental-groups-policy/kep.yaml

Lines 8 to 30 in 472a381

status: implementable
creation-date: 2022-10-14
reviewers:
- "@thockin"
- "@mrunalp"
- "@SergeyKanzhelev"
approvers:
- "@mrunalp"
see-also: []
replaces: []
# The target maturity stage in the current dev cycle for this KEP.
stage: alpha
# The most recent milestone for which work toward delivery of this KEP has been
# done. This can be the current (upcoming) milestone, if it is being actively
# worked on.
latest-milestone: "v1.27"
# The milestone at which this feature was, or is targeted to be, at each stage.
milestone:
alpha: "v1.27"

This KEP updates to the latest template and covers testing section: #3862

PRR review completed:

enhancements/keps/prod-readiness/sig-node/3619.yaml

Lines 1 to 6 in 472a381

# The KEP must have an approver from the
# "prod-readiness-approvers" group
# of http://git.k8s.io/enhancements/OWNERS_ALIASES
kep-number: 3619
alpha:
approver: "@johnbelamaric"

So once #3862 is merged, this KEP is ready for the milestone

@npolshakova
Copy link

Great! Looks like #3862 went in so this enhancement as tracked for v1.27.
Thanks!

/label tracked/yes

@k8s-ci-robot k8s-ci-robot added the tracked/yes Denotes an enhancement issue is actively being tracked by the Release Team label Feb 9, 2023
@everpeace everpeace mentioned this issue Feb 13, 2023
Merged
@everpeace everpeace mentioned this issue May 6, 2023
Open
@everpeace
Copy link
Contributor Author

Memo: Tasklist to alpha(v1.28)

  • implement SupplementalGroupsPolicy in k/k (incl. updating cri-api)
  • implement cri-api's SupplementalGroupsPolicy in containerd
  • release containerd with cri-api's SupplementalGroupsPolicy support
  • implement e2e for SupplementalGroupsPolicy
  • add SupplementalGroupsPolicy to cri-test
  • add SupplementalGroupsPolicy to k/website (https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)

@everpeace everpeace mentioned this issue May 6, 2023
Open
@Atharva-Shinde Atharva-Shinde removed tracked/no Denotes an enhancement issue is NOT actively being tracked by the Release Team lead-opted-in Denotes that an issue has been opted in to a release labels May 14, 2023
@SergeyKanzhelev
Copy link
Member

/milestone v1.28

@k8s-ci-robot k8s-ci-robot added this to the v1.28 milestone May 26, 2023
@thockin
Copy link
Member

thockin commented Jun 2, 2023

Is this still hoping to land alpha in 1.28?

@SergeyKanzhelev
Copy link
Member

/label lead-opted-in

@k8s-ci-robot k8s-ci-robot added the lead-opted-in Denotes that an issue has been opted in to a release label Jun 8, 2023
@npolshakova
Copy link

Hello @everpeace 👋, 1.28 Enhancements team here!

Just checking in as we approach enhancements freeze on 18:00 PDT Thursday 9th February 2023.

This enhancement is targeting for stage alpha for 1.28 (correct me, if otherwise)

Here's where this enhancement currently stands:

  • KEP readme using the latest template has been merged into the k/enhancements repo.
  • KEP status is marked as implementable for latest-milestone: 1.28
  • KEP readme has a updated detailed test plan section filled out
  • KEP readme has up to date graduation criteria
  • KEP has a production readiness review that has been completed and merged into k/enhancements.

For this KEP, we would just need to update the following:

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

@everpeace everpeace mentioned this issue Jun 13, 2023
Merged
@SergeyKanzhelev
Copy link
Member

For this KEP, we would just need to update the following:

this is done, KEP should be ok to be tracked

@npolshakova
Copy link

With all the requirements fulfilled this enhancement is marked as tracked for the Enhancements freeze 🚀

@taniaduggal
Copy link

Hello @everpeace 1.28 Docs Shadow here.

Does this enhancement work planned for 1.28 require any new docs or modification to existing docs?

If so, please follows the steps here to open a PR against dev-1.28 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday 20th July 2023.

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!

@npolshakova
Copy link

Hey again @everpeace 👋

Just checking in as we approach Code freeze at 01:00 UTC Friday, 19th July 2023 .

Here’s the enhancement’s state for the upcoming code freeze:

  • All the PRs that are related to your enhancement are linked in the above issue description (for tracking purposes). This includes code, tests, and documentation related PR/s.
  • All code related PR/s are merged or are in merge-ready state ( i.e they have approved and lgtm labels applied) by the code freeze deadline. This includes any tests related PR/s too.

Also please let me know if there are other PRs in k/k we should be tracking for this KEP.
As always, we are here to help if any questions come up. Thanks!

@Rishit-dagli
Copy link
Member

Hey @everpeace , could you please create a docs PR even if it is a draft PR with no content yet against dev-1.28 branch in the k/website repo. The deadline to create this draft PR is Thursday 20th July 2023.

This was referenced Jul 14, 2023
Merged
Merged
@taniaduggal
Copy link

Hey @everpeace, Docs Shadow here! could you please create a docs PR even if it is a draft PR with no content yet against dev-1.28 branch in the k/website repo. The deadline to create this draft PR is Thursday 20th July 2023.

@Atharva-Shinde
Copy link
Contributor

Hello @everpeace 👋, 1.28 Enhancements Lead here.

Unfortunately, the implementation (code related) PR associated with this enhancement was not in the merge-ready state by the code-freeze and hence this enhancement is now being removed from the v1.28 milestone.

If you still wish to progress this enhancement in v1.28, please file an exception request. Thanks!

/milestone clear

@k8s-ci-robot k8s-ci-robot removed this from the v1.28 milestone Jul 19, 2023
@SergeyKanzhelev
Copy link
Member

SergeyKanzhelev commented Sep 15, 2023 •
edited

@everpeace do you plan to keep working on this KEP for 1.29?

@SergeyKanzhelev
Copy link
Member

/remove-label lead-opted-in

while we are confirming the owner for the KEP

@k8s-ci-robot k8s-ci-robot removed the lead-opted-in Denotes that an issue has been opted in to a release label Sep 15, 2023
@everpeace
Copy link
Contributor Author

everpeace commented Sep 16, 2023 •
edited

@SergeyKanzhelev Sorry for my long absence. Yes, let me work on this for 1.29.

@npolshakova
Copy link

Hello @everpeace, 1.29 Enhancements team here! Is this enhancement targeting 1.29? If it is, can you follow the instructions here to opt in the enhancement and make sure the lead-opted-in label is set so it can get added to the tracking board? Thanks!

@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 29, 2024
@thockin thockin removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 31, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@everpeace everpeace

Labels
kind/feature Categorizes issue or PR as related to a new feature. sig/node Categorizes an issue or PR as relevant to SIG Node. stage/alpha Denotes an issue tracking an enhancement targeted for Alpha status
Projects
1.27 Enhancements Tracking
Status: Removed From Milestone
1.28 Enhancements Tracking
Status: Removed from Milestone
Milestone
No milestone
Development

No branches or pull requests
9 participants
@everpeace @thockin @SergeyKanzhelev @npolshakova @k8s-ci-robot @Rishit-dagli @k8s-triage-robot @Atharva-Shinde @taniaduggal