Support for ambient capabilities in kubernetes.

[vinayakankugoyal]

Enhancement Description

• One-line enhancement description (can be used as a release note): Support ambient capabilities in kubernetes.
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-security/2763-ambient-capabilities/README.md
• Discussion Link: Kubernetes should configure the ambient capability set kubernetes#56374
• Primary contact (assignee): @vinayakankugoyal
• Responsible SIGs: sig-security
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.24
  • Beta release target (x.y):
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s):
    • KEP 2763: Ambient capabilities in Kubernetes #2757
  • Code (k/k) update PR(s):
    • Update CRI-API Capabilities to include a field that allows us to set … kubernetes#104620
  • Docs (k/website) update PR(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[vinayakankugoyal]

/sig security

[vinayakankugoyal]

/assign @vinayakankugoyal

[vinayakankugoyal]

/milestone 1.23

[k8s-ci-robot]

@vinayakankugoyal: You must be a member of the kubernetes/milestone-maintainers GitHub team to set the milestone. If you believe you should be able to issue the /milestone command, please contact your and have them propose you as an additional delegate for this responsibility.

In response to this:

/milestone 1.23

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Priyankasaggu11929]

Hello @vinayakankugoyal, 1.23 Enhancements shadow here. Just checking in as we approach enhancements freeze on Thursday 09/09. Here's where this enhancement currently stands:

• KEP file using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable
• KEP has a test plan section filled out.
• KEP has up to date gradution criteria.
• KEP has a production readiness review that has been completed and merged into k/enhancements.

Starting with 1.23, we have implented a soft freeze on production readiness reviews beginning on Thursday 09/02. If your enhancement needs a PRR, please make sure to try and complete it by that date!

For this enhancement, it looks like we need the following to be updated in the PR #2757:

• KEP status marked as implementable.
• KEP's test plan section filled out
• A completed PRR for the alpha release

Thanks!

[Priyankasaggu11929]

Hello @vinayakankugoyal, 1.23 Enhancements shadow here. Just checking in once again as we approach more closer to the enhancements freeze on Thursday 09/09. Here's where this enhancement currently stands:

• KEP file using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable
• KEP has a test plan section filled out.
• KEP has up to date gradution criteria.
• KEP has a production readiness review that has been completed and merged into k/enhancements.

For this enhancement, we need the following to be updated in the PR #2757 to be tracked under the kubernetes 1.23 release:

• KEP status must be marked as implementable.
• KEP's test plan section filled out
• Update the kep.yaml file in the PR to fill all the TODO/TBC/TBD placeholders.
• Add the PRR file for the alpha release stage & have it merged into the k/enhancements repo

Thanks!

[vinayakankugoyal]

Woops, completely missed your previous messages. Sorry about that!
We are still discussing how the K8S API changes would look like, we need to figure those out before we can mark this as implementable. I don't think we would be able to meet the KEP deadline as the SIG security meeting is on 09/09.

[Priyankasaggu11929]

@vinayakankugoyal , thank you so much for providing more information on the current status of the enhancement.

We are still discussing how the K8S API changes would look like, we need to figure those out before we can mark this as implementable. I don't think we would be able to meet the KEP deadline as the SIG security meeting is on 09/09.

As stated above, that this enhancement would not be able to the meet the requirements by the enhancements freeze time, would it be alright then if I remove the 1.23 release milestone for now?

And when you have more information in favor of marking it as implementable, you could raise an exception request for the enhancement?

Thanks once again. :)

[Priyankasaggu11929]

@vinayakankugoyal, Thanks for the confirmation. I'll remove the 1.23 release milestone.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[vinayakankugoyal]

/remove-lifecycle stale

[gracenng]

Hi @vinayakankugoyal ! 1.24 Enhancements team here. Just checking in as we approach enhancements freeze on 18:00pm PT on Thursday Feb 3rd. This enhancements is targeting beta for 1.24, is that correct?.
Here’s where this enhancement currently stands:

• Updated KEP file using the latest template has been merged into the k/enhancements repo - this will be KEP file with test plan filled out
• KEP status is marked as implementable for this release with latest-milestone: 1.24
• KEP has a test plan section filled out.
• KEP has up to date graduation criteria.
• KEP has a production readiness review that has been completed and merged into k/enhancements.

The status of this enhancement is track as at risk. Please update this issue description to reflect enhancements target
Thanks!

[vinayakankugoyal]

Hello @gracenng - This KEP is targeting alpha for 1.24. I have updated the description to reflect the current status. Thanks!

[ehashman]

@vinayakankugoyal can you please update your PR to ensure that the KEP is marked implementable and not provisional? It has me listed as the PRR approver but I did not review this.

[gracenng]

Hi @vinayakankugoyal , 1.24 Enhancements Team here.

Reaching out as we're less than a week away from Enhancement Freeze on Thursday, February 3rd.
There's no update for this enhancement since last checkin, let me know if I missed anything.
Current status is at risk

[vinayakankugoyal]

We still haven't agreed upon the field to mark it implementable. I am going to remove it from milestone.

/remove milestone 1.24

[ehashman]

/milestone clear

[tallclair]

I just noticed this is owned by SIG-Security, but the sig-security charter explicitly states that

SIG Security does not own any Kubernetes cluster component code

https://github.com/kubernetes/community/blob/master/sig-security/charter.md#out-of-scope

I think this feature should probably be owned by SIG-Node, with SIG-Security as a participating SIG.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[tallclair]

/remove-lifecycle stale
/lifecycle frozen
/sig node

[pacoxu]

Link the related pr

• [v1.24] Update CRI-API Capabilities to include a field that allows us to set … kubernetes#104620

[tallclair]

Are there any plans to make progress on this in the v1.26 cycle?

[tamalsaha]

I would appreciate if this KEP could get some love. At least this limitation should be documented in https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container and the current workaround to use setcap in the dockerfile.

[pacoxu]

The feature PRs in CRI-O and Containerd are all closed now.

• containerd: Ambient capability containerd/containerd#6153 (containerd should set ambient capabilities containerd/containerd#5644)
• cri-o: If capabilities are explicitly added then also add them to the ambien… cri-o/cri-o#5043

@mrunalp @vinayakankugoyal Should we revisit the feature at this point(v1.32 KEP planning)?