search

kubernetes / enhancements

Enhancements tracking repo for Kubernetes
Apache License 2.0
3.45k stars 1.49k forks source link

Run control-plane as non-root in kubeadm. #2568

Open vinayakankugoyal opened 3 years ago

vinayakankugoyal commented 3 years ago

Enhancement Description

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

k/kubeadm tracking issue: https://github.com/kubernetes/kubeadm/issues/1367 https://github.com/kubernetes/kubeadm/issues/2473

pacoxu commented 3 years ago

/sig cluster-lifecycle

vinayakankugoyal commented 3 years ago

/milestone 1.22

k8s-ci-robot commented 3 years ago

@vinayakankugoyal: You must be a member of the kubernetes/milestone-maintainers GitHub team to set the milestone. If you believe you should be able to issue the /milestone command, please contact your and have them propose you as an additional delegate for this responsibility.

In response to [this](https://github.com/kubernetes/enhancements/issues/2568#issuecomment-818313191): >/milestone 1.22 Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
pacoxu commented 3 years ago

Feel free to ping me if any help is needed on this feature. (develop/reviewing/testing)

BenTheElder commented 3 years ago

/milestone v1.22

jrsapi commented 3 years ago

Greetings @vinayakankugoyal! 1.22 Enhancement shadow checking in. After reviewing the KEP and PRR this has been marked as "Tracked" for 1.22. A reminder that the enhancement freeze starts Thursday, 5/13 at 23:59:59 PST.

Thanks!

vinayakankugoyal commented 3 years ago

Thanks @jrsapi. Is there any other action we need to take before 05/13?

jrsapi commented 3 years ago

No other action is needed. The KEP will be reviewed after the freeze by the release lead.

Thanks!

ritpanjw commented 3 years ago

Hello @vinayakankugoyal 👋 , 1.22 Docs Shadow here.

This enhancement is marked as Needs Docs for 1.22 release. Please follow the steps detailed in the documentation to open a PR against dev-1.22 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Fri July 9, 11:59 PM PDT. Also, take a look at Documenting for a release to familiarize yourself with the docs requirement for the release.

Thank you!

vinayakankugoyal commented 3 years ago

/assign @vinayakankugoyal

neolit123 commented 3 years ago

note for the release team, this feature has just graduated to Alpha from our perspective:

thanks to @vinayakankugoyal

punch card of the PRs is here: https://github.com/kubernetes/kubeadm/issues/2473

sftim commented 3 years ago

Do we list kubeadm feature gates in https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/ ?

If not, where do we document those?

neolit123 commented 3 years ago

Do we list kubeadm feature gates in https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/ ?

no, that page is only for core k8s FGs.

If not, where do we document those?

alpha kubeadm features behind a FGs are commonly not ducumented at k8s.io. users can see it in a release note and can try it. once a feature moves to beta. we document it as part of existing pages like "kubeadm init", "kubeadm join", etc.

BenTheElder commented 3 years ago

no, that page is only for core k8s FGs.

aside: I actually feel like this might need calling out there, most binaries in the Kubernetes release have a unified set of featuregates and kubeadm's being distinct is perhaps not the most obvious.

dims commented 3 years ago

@neolit123 @BenTheElder just one more reason kubeadm should be out-of-tree ...

jrsapi commented 3 years ago

Greetings @vinayakankugoyal, This is a reminder that code freeze is coming up this Thursday, July 8th. All PR's need to be code complete and merged by the freeze. Can you update this issue if all PR's have been merged? Also, this Friday, July 9th is the Docs placeholder PR deadline. Please follow the steps detailed in the documentation to open a PR against dev-1.22 branch in the k/website repo.

neolit123 commented 3 years ago

@jrsapi we consider this feature graduated to alpha.

documentation updates are not needed, e2e tests are running here: https://k8s-testgrid.appspot.com/sig-cluster-lifecycle-kubeadm#kubeadm-kinder-rootless-latest

https://github.com/kubernetes/website/issues/28788 is out of band for 1.22.

PI-Victor commented 3 years ago

@jrsapi we consider this feature graduated to alpha.

documentation updates are not needed, e2e tests are running here: https://k8s-testgrid.appspot.com/sig-cluster-lifecycle-kubeadm#kubeadm-kinder-rootless-latest

kubernetes/website#28788 is out of band for 1.22.

based on this comment, i will remove the 'Needs Docs' from this enhancements, thanks!

neolit123 commented 3 years ago

we discussed in the kubeadm office hours for Sep 1st 2021 that we might want to delay the graduation to Beta to 1.24 to give the users one more release to find potential problems. none thus far.

i have updated the OP with BETA targeting 1.24.

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

BenTheElder commented 2 years ago

/remove-lifecycle stale

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

BenTheElder commented 2 years ago

we discussed in the kubeadm office hours for Sep 1st 2021 that we might want to delay the graduation to Beta to 1.24 to give the users one more release to find potential problems. none thus far.

with 1.24 pending tomorrow, is this still the current state?

neolit123 commented 2 years ago

a good summary is here: https://github.com/kubernetes/kubeadm/issues/2473#issuecomment-1005986114

we are considering user namespaces vs managed non-root users (this)

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

LyKos4 commented 2 months ago

Is this expected to be completed? For which pods it is expected to change the user to non root?

neolit123 commented 2 months ago

Is this expected to be completed? For which pods it is expected to change the user to non root?

https://github.com/kubernetes/kubeadm/issues/2473#issuecomment-2331676354