Extended NodeRestrictions for Pods

[tallclair]

Enhancement Description

• One-line enhancement description: Add node restrictions to mirror pods and pod metadata updates to prevent compromises in node isolation.
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/1314-node-restriction-pods
• Primary contact (assignee): @tallclair
• Responsible SIGs: sig/auth
• Enhancement target (which target equals to which milestone):
  • Alpha release target: v1.17
  • Beta release target: v1.19
  • Stable release target: v1.20

[neolit123]

tracking issue for kubeadm:
kubernetes/kubeadm#1835
tracking issue for /cluster addons:
kubernetes/kubernetes#83977

[palnabarun]

/stage alpha

[daminisatya]

Hello, @tallclair I'm 1.17 docs lead.

Does this enhancement (or the work planned for v1.17) require any new docs (or modifications to existing docs)? If not, can you please update the 1.17 Enhancement Tracker Sheet (or let me know and I'll do so)

If so, just a friendly reminder we're looking for a PR against k/website (branch dev-1.17) due by Friday, November 8th, it can just be a placeholder PR at this time. Let me know if you have any questions!

[tallclair]

Yes, I think this should be highlighted in a short amendment to https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#NodeRestriction

[daminisatya]

+1 thank you @tallclair

[tallclair]

Work tracker for alpha in v1.17:

• Inject owner reference into mirror pods by the Kubelet: Mirror owner kubernetes#84485
• Implement restrictions in NodeRestriction: Restrict mirror pod owner references kubernetes#84657
• Add E2E test for node restrictions
• Whitelist static labels on kube-system for
  • kubeadm (annotate the kube-system namespace to allow kubeadm managed static Pod labels kubeadm#1835): WIP: kubeadm: enable whitelisting of static Pod labels kubernetes#83975 (WIP)
  • kube-up.sh (the k8s-app label in /cluster addons should be disallowed kubernetes#83977)
  • minikube?
  • kops?
• Update documentation
  https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#NodeRestriction

[daminisatya]

Hi @tallclair,
Just a friendly reminder, We're hoping to have a placeholder Docs PR against k/website (branch dev-1.17) by Friday, Nov 8th. (4 more days left)

[daminisatya]

Hi @tallclair

Just a friendly reminder, We're hoping to have a placeholder Docs PR against k/website (branch dev-1.17) by Friday, Nov 8th. (2 more days left)

[mrbobbytables]

👋 @tallclair 1.17 Enhancement lead here -- Just a heads up, an open Docs PR is needed by the end of the day today to remain in the milestone. 😬 If there isn't a PR by EoD, an exception will need to be filed to remain in the 1.17 release.

Please link it here as soon as it's created.

Thanks!

[palnabarun]

Hi @tallclair ,

Unfortunately the deadline for filing the docs PR has passed. For now, this enhancement is being removed from the milestone and 1.17 tracking sheet.

If you want to still get this is into this release, please file an enhancement exception.

Thanks!

[palnabarun]

/milestone clear
/tracked no

[tallclair]

I'm not really satisfied with the whitelist mechanism currently proposed on this feature, and with the time crunch & overdue docs, I'm content with removing the feature piece from v1.17.

I will update kubernetes/kubernetes#84657 to remove the feature gated parts (but keep the non-feature gated parts). We can work on refining the labels proposal for v1.18.

/milestone v1.18

[palnabarun]

Thank you @tallclair for the updates. I marked this as Deferred in the tracking sheet.

[ehashman]

/remove-lifecycle rotten
/reopen

[k8s-ci-robot]

@ehashman: Reopened this issue.

In response to this:

/remove-lifecycle rotten
/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-triage-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[enj]

/remove-lifecycle stale

@tallclair what exactly is the state of this KEP? Is the functionality implemented and GA?

[tallclair]

Implemented:

• OwnerReference requirements for mirror pods
• Metadata update restrictions through pod/status updates

Not implemented:

• Label restrictions on mirror pods

I'm not satisfied with the label restriction design, but I'm not sufficiently invested in fixing it at this point. If someone is interested in picking it up, I'd be happy to talk through the design, but otherwise I think we should just archive it.

[ritazh]

Next step: Need to confirm if there is a KEP contains Label restrictions on mirror pods and remove it or move it to "withdraw"

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[pacoxu]

/reopen

[k8s-ci-robot]

@pacoxu: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[tallclair]

/lifecycle frozen