[Deprecated] Pod Security Policy

[erictune]

Feature Description

• Define policy objects that limit what security-related features pods and containers can use
• Primary contact (assignee): @tallclair
• Responsible SIGs: @kubernetes/sig-auth-feature-requests @kubernetes/sig-node-feature-requests
• Design proposal link (community repo): https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/pod-security-policy.md
• Link to e2e and/or unit tests: https://github.com/kubernetes/kubernetes/blob/master/test/e2e/auth/pod_security_policy.go
• Reviewer(s) - (for LGTM): @liggitt @tallclair
• Approver: @liggitt @tallclair
• Feature target (which target equals to which milestone):
  • Beta release target (extensions/v1beta1) - 1.8
  • Beta release target (policy/v1beta1) - 1.10
  • Stable release target - TBD

Related issues

• https://github.com/kubernetes/kubernetes/issues/43214 - Move out of extensions/v1beta1 API group:
  • 1.10
  • [x] additionally allow authorizing via use verb in policy API group (will need to allow via either group for some time period)
  • [x] update e2e tests (test both for some time period)
  • 1.11
  • [ ] move internal types to policy package (cleanup)
  • [ ] move registry to policy package (cleanup)
  • [ ] update addon manifests to use policy/v1beta1, grant permissions in policy API group
  • [ ] switch admission plugin to use policy group informer
  • [ ] switch preferred storage version to policy group
• https://github.com/kubernetes/kubernetes/issues/56174
• https://github.com/kubernetes/kubernetes/issues/55435
• https://github.com/kubernetes/kubernetes/issues/56173

[tallclair]

/lifecycle frozen

[Priyankasaggu11929]

Hello @tallclair 👋, 1.25 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PST on Thursday June 16, 2022.

For note, This enhancement is targeting for Removal in 1.25 (followed by the Deprecation in 1.21) (correct me, if otherwise)

As discussed with the Release team in this K8s slack thread, the team agreed that we don't require to migrate the old archived design proposal to a KEP template, to just track the deprecation & removal stages for this enhancement.

Since, the new KEP-2579: Pod Security Admission Control KEP is there to explicitly replace PSP, we will align the deprecation & removal stages of this enhancement with that KEP & track both!

For note, the status of this enhancement is marked as tracked. Thank you for keeping the issue description up-to-date!

[Priyankasaggu11929]

Hi @tallclair 👋

Checking in once more as we approach 1.25 code freeze at 01:00 UTC on Wednesday, 3rd August 2022.

Please ensure the following items are completed:

• [ ] All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• [X] All PRs are fully merged by the code freeze deadline.
  • https://github.com/kubernetes/kubernetes/pull/109798

Please verify, if there are any additional k/k PRs besides the ones listed above.

Since all the listed k/k PRs are fully merged, the status of this enhancement is marked as tracked.

Please update the issue description with the relevant links for tracking purposes. Thank you so much!

[tallclair]

All the k/k work for v1.25 is done.

[liggitt]

marked complete in https://github.com/kubernetes/enhancements/pull/3487