Structured Authorization Configuration

[palnabarun]

Enhancement Description

• One-line enhancement description: Adds ability to structure configuring authorizers and add multiple webhooks to the kube-apiserver authorization chain
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/3221-structured-authorization-configuration
• Discussion Link: https://github.com/kubernetes/kubernetes/issues/101762
• Primary contact (assignee): @palnabarun @ritazh
• Responsible SIGs: sig-auth
• Enhancement target (which target equals to which milestone):
  • Alpha release target: 1.29
  • Beta release target: 1.30
  • Stable release target (x.y): 1.32
• [x] Alpha
  • [x] KEP (k/enhancements) update PR(s):
  • [x] https://github.com/kubernetes/enhancements/pull/3376
  • [x] https://github.com/kubernetes/enhancements/pull/4161
  • [x] https://github.com/kubernetes/enhancements/pull/4248
  • [x] Code (k/k) update PR(s):
  • [x] Issue: https://github.com/kubernetes/kubernetes/issues/118872
    • [x] https://github.com/kubernetes/kubernetes/pull/119099
    • [x] https://github.com/kubernetes/kubernetes/pull/120154
  • [x] Issue: https://github.com/kubernetes/kubernetes/issues/118873,
    • [x] https://github.com/kubernetes/kubernetes/pull/121223
  • [x] Docs (k/website) update PR(s)
  • [x] https://github.com/kubernetes/website/pull/41892
• [x] Beta
  • [x] KEP (k/enhancements) update PR(s):
  • [x] https://github.com/kubernetes/enhancements/pull/4456
  • [x] https://github.com/kubernetes/enhancements/pull/4485
  • [x] Code (k/k) update PR(s):
  • [x] https://github.com/kubernetes/kubernetes/pull/121946
  • [x] https://github.com/kubernetes/kubernetes/pull/123333
  • [x] https://github.com/kubernetes/kubernetes/pull/123611
  • [x] https://github.com/kubernetes/kubernetes/pull/123639
  • [x] https://github.com/kubernetes/kubernetes/pull/123640
  • [x] https://github.com/kubernetes/kubernetes/pull/123641
  • [x] Docs (k/website) update(s): https://github.com/kubernetes/website/pull/45138
• [x] Stable
  • [x] KEP (k/enhancements) update PR(s):
  • https://github.com/kubernetes/enhancements/pull/4796
  • [x] Code (k/k) update PR(s): https://github.com/kubernetes/kubernetes/pull/128172
  • [x] Docs (k/website) update(s): https://github.com/kubernetes/website/pull/48424

/assign /sig auth

[AnaMMedina21]

@liggitt ah, yes, thanks for that correction! sorry about that. I will update my comment above to reflect this

[liggitt]

https://github.com/kubernetes/enhancements/pull/4485 is merged, I think we're set for enhancements freeze

[AnaMMedina21]

Hello @palnabarun 👋, Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 9th February 2024.

This enhancement is targeting for stage beta for v1.30 (correct me, if otherwise)

Here's where this enhancement currently stands:

• [x] KEP readme using the latest template has been merged into the k/enhancements repo.
• [x] KEP status is marked as implementable for latest-milestone: v1.30. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• [x] KEP readme has up-to-date graduation criteria
• [x] KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

The status of this enhancement is marked as tracked for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[chanieljdan]

Hi @palnabarun 👋, 1.30 Docs Shadow here.

Does this enhancement work planned for 1.30 require any new docs or modification to existing docs? If so, please follows the steps here to open a PR against dev-1.30 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday February 22nd 2024 18:00 PDT.

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!

[AnaMMedina21]

Hey again @palnabarun 👋 Enhancements team here,

Just checking in as we approach code freeze at 02:00 UTC Wednesday 6th March 2024 .

Here's where this enhancement currently stands:

• [x] All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• [ ] All PR/s are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

Also, please let me know if there are other PRs in k/k we should be tracking for this KEP. These are the two I have:

• https://github.com/kubernetes/kubernetes/issues/119102
• https://github.com/kubernetes/kubernetes/pull/121946 As always, we are here to help if any questions come up. Thanks!

[liggitt]

All implementation PRs are now merged for beta / 1.30

[sreeram-venkitesh]

Hi @palnabarun 👋, 1.31 Enhancements Lead here.

If you wish to progress this enhancement in v1.31, please have the SIG lead opt-in your enhancement by adding the lead-opted-in label and set the milestone to v1.31 before the Production Readiness Review Freeze.

/remove-label lead-opted-in

[liggitt]

opting in for stable graduation in 1.32

[shecodesmagic]

Hello @palnabarun @ritazh 👋, Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 11th October 2024 / 19:00 PDT Thursday 10th October 2024.

This enhancement is targeting for stage stable for v.132 (correct me, if otherwise)

Here’s where this enhancement currently stands:

• [X] KEP readme using the latest template has been merged into the k/enhancements repo.
• [X] KEP status is marked as implementable for latest-milestone: { CURRENT_RELEASE }. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• [X] KEP readme has up-to-date graduation criteria.
• [X] KEP has submitted a production readiness review request for approval and has a reviewer assigned.
• [X] KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

With all the KEP requirements in place and merged into k/enhancements, this enhancement is all good for the upcoming enhancements freeze. 🚀

The status of this enhancement is marked as tracked for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[michellengnx]

Hello @palnabarun, @ritazh, @liggitt and @deads2k :wave:, 1.32 Docs Shadow here. Does this enhancement work planned for 1.32 require any new docs or modification to existing docs? If so, please follows the steps here to open a PR against dev-1.32 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday October 24th 2024 18:00 PDT. Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release. Thank you!

[sftim]

(this will need a docs update PR; pretty much all beta to stable graduations should have one)

[rytswd]

Hi @palnabarun @ritazh 👋 -- this is Ryota (@rytswd) from the v1.32 Communications Team!

For the v1.32 release, we are currently in the process of collecting and curating a list of potential feature blogs, and we'd love for you to consider writing one for your enhancement!

As you may be aware, feature blogs are a great way to communicate to users about features which fall into (but not limited to) the following categories:

• This introduces some breaking change(s)
• This has significant impacts and/or implications to users
• ...Or this is a long-awaited feature, which would go a long way to cover the journey more in detail 🎉

To opt in to write a feature blog, could you please let us know and open a "Feature Blog placeholder PR" (which can be only a skeleton at first) against the website repository by Wednesday, 30th Oct 2024? For more information about writing a blog, please find the blog contribution guidelines 📚

[!Tip] Some timeline to keep in mind:

• 02:00 UTC Wednesday, 30th Oct: Feature blog PR freeze
• Monday, 25th Nov: Feature blogs ready for review
• You can find more in the release document

[!Note] In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.

[liggitt]

Docs PR open at https://github.com/kubernetes/website/pull/48424

[rytswd]

Hi @palnabarun @ritazh @liggitt 👋, v1.32 Communications Team here again!

This is a gentle reminder for the feature blog deadline mentioned above, which is 02:00 UTC Wednesday, 30th Oct. To opt in, please let us know and open a Feature Blog placeholder PR against k/website by the deadline. If you have any questions, please feel free to reach out to us!

[!Tip] Some timeline to keep in mind:

• 02:00 UTC Wednesday, 30th Oct: Feature blog PR freeze
• Monday, 25th Nov: Feature blogs ready for review
• You can find more in the release document

[!Note] In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.

[shecodesmagic]

Hello @ritazh @palnabarun :wave:, Enhancements team here (again 😁 )

With all the implementation(code related) PRs merged as per the issue description:

• https://github.com/kubernetes/kubernetes/pull/128172

This enhancement is now marked as tracked for code freeze for the v1.32 Code Freeze!

Please note that KEPs targeting stable need to have the status field marked as implemented in the kep.yaml file after code PRs are merged and the feature gates are removed.