Kubelet option to enable seccomp by default

[saschagrunert]

Enhancement Description

• One-line enhancement description (can be used as a release note): The kubelet now has an option to enable a default seccomp profile for workloads that do not specify a seccomp profile
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/2413-seccomp-by-default/README.md
• Discussion Link:
  • SIG Node weekly meeting:
    https://docs.google.com/document/d/1Ne57gvidMEWXR70OxxnRkYquAoMpt56o75oZtg-OeBg/edit
  • SIG Node planning doc for v1.21:
    https://docs.google.com/document/d/1U10J0WwgWXkdYrqWGGvO8iH2HKeerQAlygnqgDgWv4E/edit#
• Primary contact (assignee): @saschagrunert / @mrunalp
• Responsible SIGs: SIG Node
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): v1.22
  • Beta release target (x.y): v1.25
  • Stable release target (x.y): v1.27
• Alpha
  • KEP (k/enhancements) update PR(s): Add KEP for enabling seccomp by default #2414 Update SeccompDefault KEP upgrade strategy #2773
  • Code (k/k) update PR(s): Add kubelet SeccompDefault alpha feature kubernetes#101943
  • Docs (k/website) update PR(s): Add documentation about SeccompDefault feature website#27957
• Beta
  • KEP (k/enhancements) update PR(s): KEP-2413: Graduate SeccompDefault feature to beta #3240
  • Code (k/k) update PR(s): Graduate SeccompDefault feature to beta kubernetes#110805
  • Docs (k/website) update(s):
    Graduate SeccompDefault feature to beta website#34640
    Improve 'Seccomp defaulting' feature name website#35121
• Stable
  • KEP (k/enhancements) update PR(s):
    • KEP-2413: Graduate SeccompDefault to stable #3718
    • KEP-2413 Add new PRR question to SeccompDefault KEP #3864
  • Code (k/k) update PR(s):
    • Graduate SeccompDefault feature to stable / GA kubernetes#115719
  • Docs (k/website) update(s): [KEP-2413] Add docs for SeccompDefault graduation website#39906

/sig node
/cc @mrunalp

[sftim]

Is this also relevant to SIG Security?

[saschagrunert]

Is this also relevant to SIG Security?

Yes, I think so:
/sig security

[annajung]

Hi @saschagrunert

Enhancements Freeze is 2 days away, Feb 9th EOD PST

Enhancements team is aware that KEP update is currently in progress (PR #2414). Please make sure to work on missing requirements and get it merged before the freeze. For PRR related questions or to boost the PR for PRR review, please reach out in slack #prod-readiness

Any enhancements that do not complete the KEP requirements by the freeze will require an exception.

[saschagrunert]

Hi @annajung, thank you for the reminder, I doubt that this enhancement will make it into the current cycle since we're too close to the deadlines now. This is not a big deal-we can shift the review to this cycle and target implementing it in the next one. WDYT, @mrunalp?

[annajung]

Hi @saschagrunert,

Thank you for the update! With Enhancements Freeze now in effect, I will clear the milestone to reflect that this enhancement is not being tracked for 1.21.

If you change your mind and like to be included in the 1.21 Release, please submit an Exception Request as soon as possible.

/milestone clear

[ehashman]

/milestone v1.22