Add FileEnvSource and FileKeySelector to add environment generated on the fly

[QuentinN42]

Enhancement Description

• One-line enhancement description (can be used as a release note): Add FileEnvSource and FileKeySelector to add environment generated on the fly.
• Kubernetes Enhancement Proposal: No PR now.
• Discussion Link: https://github.com/kubernetes/kubernetes/issues/114674
• Primary contact (assignee): @QuentinN42
• Responsible SIGs: sig-node
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y):
  • Beta release target (x.y):
  • Stable release target (x.y):
• [ ] Alpha
  • [ ] KEP (k/enhancements) update PR(s):
  • [ ] Code (k/k) update PR(s):
  • [ ] Docs (k/website) update PR(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[QuentinN42]

/sig node

[QuentinN42]

Some questions still needs to be discuss :

• [ ] [ERRORS] How do we handle errors ? (if the file is not an env file / if there is some errors in it)
• [ ] [ORDER] Sourcing from some file inside container might be not feaseable if env is generated before container is created.
• [ ] [NRI] Investigate NRI hook to do it ? (I have no idea what it is, need to read the docs)
• [ ] [SECU] Sourcing from arbitrary path may have security concerns, validate files trough security context ?
• [ ] [SCOPE] The root path may be too large scope. Would limiting this to empty dir files be enough ?

[QuentinN42]

Some uses for an emptyDir are:

• scratch space, such as for a disk-based merge sort
• checkpointing a long computation for recovery from crashes
• holding files that a content-manager container fetches while a webserver container serves the data K8s volumes docs

This is exactly a checkpointing for env var so I think using emptydir is totally ok, but the 3rd party init container can export it's data not in an emptydir ...

[QuentinN42]

So maybe to solve [ORDER], [SECU] and [SCOPE] at once, we can reference a file path of a volume like in the VolumeMount.

• [ORDER] It can be done before the ct is created so no order problems.
• [SECU] / [SCOPE] This will only allow the operator to read files that he can already mount in an alpine container and read it.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[SergeyKanzhelev]

/remove-lifecycle stale

[SergeyKanzhelev]

xlink: https://github.com/kubernetes/kubernetes/issues/116993

[SergeyKanzhelev]

@QuentinN42 do you want to work on this for 1.28 milestone?

[QuentinN42]

Yes ! I'm still not sure in which sig this goes, it will probably use volumes from empty dir so need I go to the sig storage meetings or it's a sig apps feature only ?

[SergeyKanzhelev]

It is likely a sig node meeting as sig node will need to read and set those variables. Sig storage may help with feedback on storage types we should support. SIG Apps can help with more scenarios where this feature will be useful.

[SergeyKanzhelev]

@QuentinN42 if you plan to have it in 1.28, can you please submit the PR with the kep's readme and kep.yaml to start the process following this template: https://github.com/kubernetes/enhancements/tree/master/keps/NNNN-kep-template?

[QuentinN42]

What is the timetable ? I'm currently heading to my exams so I think it will be hard to contribute until July. If you think this feature must be in 1.28 and the timeline is short I can find some time, just give me some deadline. In any case I really want to contribute on this as OP.

[SergeyKanzhelev]

for the KEP approval - needs to happen next week.

Implementation July 18th

https://www.kubernetes.dev/resources/release/#summary

[Sharpz7]

I am going to take this over if that is okay. /assign @Sharpz7

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[AnishShah]

@Sharpz7 mentioned in Slack and in this comment that he doesn't have cycles to work on this. So I would like to take this.

/assign @AnishShah

[vaibhav2107]

/remove-lifecycle stale

[FirePing32]

@AnishShah are you working on it ?

[AnishShah]

Yeah, I'm working on it.

[FirePing32]

@AnishShah I have a small design for this feature. I am new to K8s, how can I start contributing to this KEP ?

[SergeyKanzhelev]

/label lead-opted-in /milestone v1.31

[tjons]

Hello @AnishShah 👋, Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 14th June 2024 / 19:00 PDT Thursday 13th June 2024.

This enhancement is targeting for stage alpha for 1.31 (correct me, if otherwise)

Here’s where this enhancement currently stands:

• [ ] KEP readme using the latest template has been merged into the k/enhancements repo.
• [ ] KEP status is marked as implementable for latest-milestone: { 1.31 }. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• [x] KEP readme has up-to-date graduation criteria
• [ ] KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

For this KEP, we would just need to complete the following:

• [ ] Merge the KEP readme using the latest template into the k/enhancements repo. Please ensure that you provide details about your testing plan.
• [ ] Mark the KEP status as implementable for latest-milestone: { 1.31 }. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• [ ] KEP has a production readiness review that has been completed and merged into k/enhancements.

The status of this enhancement is marked as at risk for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you!

[sreeram-venkitesh]

/stage alpha

[sreeram-venkitesh]

Hello 👋, v1.31 Enhancements team here.

Unfortunately, this enhancement did not meet requirements for enhancements freeze.

If you still wish to progress this enhancement in v1.31, please file an exception request as soon as possible, within three days. If you have any questions, you can reach out in the #release-enhancements channel on Slack and we'll be happy to help. Thanks!

/milestone clear

[sreeram-venkitesh]

/label tracked/no

[lironcomonday]

Any plans to implement this any time in the future?

[SergeyKanzhelev]

Any plans to implement this any time in the future?

The current state is we are collecting more use cases to justify the need for it. See comment https://github.com/kubernetes/enhancements/pull/4524#discussion_r1637285014.

@lironcomonday what is your scenario and whether the workaround with sourcing the file explicitly works for you?

[tjons]

Hi, enhancements lead here - I inadvertently added this to the 1.32 tracking board 😀. Please readd it if you wish to progress this enhancement in 1.32.

/remove-label lead-opted-in

[aojea]

/stage alpha

Is this alpha? This should have the description with the links to be able to track it

I'm going to remove the alpha if you don't mind, to avoid confusions

[SergeyKanzhelev]

hm, I used to set a stage to what is targeted, not what is actual stage is. Did it change? Would be nice to have some clarity on what labels to use when