add ProcMount option

[haircommander]

Enhancement Description

• One-line enhancement description (can be used as a release note):

• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/4265-proc-mount

• Discussion Link:

• Primary contact (assignee): @sohankunkerkar @haircommander

• Responsible SIGs: node

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): 1.12
  • Beta release target (x.y): 1.31
  • Stable release target (x.y):

• Alpha

  • KEP (k/enhancements) update PR(s):
    • add ProcMount option community#1934
    • Add restrospetive KEP for ProcMount and target at Beta #4266
  • Code (k/k) update PR(s):
    • Add a ProcMount option to the SecurityContext & AllowedProcMountTypes to PodSecurityPolicy kubernetes#64283
    • KEP-4265: Update Unmasked ProcMountType to fail validation without a pod level user namespace kubernetes#123520
  • Docs (k/website) update PR(s):
    • ProcMount 1.30 update website#45152

• Beta

  • KEP (k/enhancements) update PR(s): KEP-4265: promote ProcMount option to beta #4679
  • Code (k/k) update PR(s):
    • KEP-4265: add e2e tests for ProcMountType kubernetes#123303
    • [KEP-4265] promote ProcMountType feature gate to beta kubernetes#125259
  • Docs (k/website) update(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[haircommander]

replaces kubernetes/community#1934
/sig node
/sig auth

[mrunalp]

/label lead-opted-in

[AnaMMedina21]

Hola @haircommander 👋, v1.29 Enhancements team here.

I am just checking in as we approach enhancements freeze on 18:00 PDT on Thursday 6th October 2023..

This enhancement is targeting stage beta for v1.29 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: { v1.29}. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

For this KEP, we would just need to update the following:

• For this PR to be approved: Add restrospetive KEP for ProcMount and target at Beta #4266

The status of this enhancement is marked as Tracked for Enhancements Freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[npolshakova]

Sorry for the confusion @haircommander, this is actually currently At Risk for Enhancement Freeze until #4266 is approved. We'll update the status once the PR goes in. Let me know if you have any questions- Thanks!

[npolshakova]

Hello 👋, 1.29 Enhancements Lead here.
Unfortunately, this enhancement did not meet requirements for v1.29 enhancements freeze.
Feel free to file an exception to add this back to the release tracking process.

#4266 is awaiting PRR approval. Please file an exception and once the PRR review is complete this should fulfill all the enhancement freeze requirements.

Thanks!

/milestone clear

[sftim]

@haircommander, what's the “One-line enhancement description” for this KEP?

[pacoxu]

@npolshakova https://groups.google.com/g/kubernetes-sig-release/c/emPOBgXxu0Q/m/JxEx-ZrcBgAJ?utm_medium=email&utm_source=footer

Your updated deadline to make any changes to your KEP is 18:00 PST Monday 9th October 2023.

The exception is approved by v1.29 release team. However, we may miss the deadline again 🤣.

[npolshakova]

@pacoxu It looks like this won't be making it into 1.29 from the slack discussion: https://kubernetes.slack.com/archives/C2C40FMNF/p1697033013866149?thread_ts=1696609849.513439&cid=C2C40FMNF

[stlaz]

/triage accepted

[salehsedghpour]

/remove-label lead-opted-in

[haircommander]

@SergeyKanzhelev @mrunalp a little late but I have decided to update the KEP. can you PTAL and opt-in as discussed in sig node meeting?

[mrunalp]

/stage beta
/milestone v1.30
/label lead-opted-in

[tjons]

Hello @haircommander 👋, Enhancements team here.

Just checking in as we approach enhancements freeze on Friday, February 9th, 2024 at 02:00 UTC.

This enhancement is targeting for stage beta for 1.30 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.30. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

For this KEP, we would just need to complete the following:

• Merge the updates to the KEP readme into the k/enhancements repo.
• Complete the PRR review process and merge it into k/enhancements.

The status of this enhancement is marked as at risk for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[tjons]

With all the requirements fulfilled this enhancement is now marked as tracked for the upcoming enhancements freeze 🚀

[Checksumz]

Hi @haircommander ,

👋 from the v1.30 Communications Team! We'd love for you to opt in to write a feature blog about your enhancement!

We encourage blogs for features including, but not limited to: breaking changes, features and changes important to our users, and features that have been in progress for a long time and are graduating.

To opt in, you need to open a Feature Blog placeholder PR against the website repository.
The placeholder PR deadline is 27th February, 2024.
Here's the 1.30 Release Calendar

[Vyom-Yadav]

Hello @haircommander 👋, v1.30 Docs Shadow here.

Does this enhancement work planned for v1.30 require any new docs or modification to existing docs?

If so, please follows the steps here to open a PR against dev-1.30 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday, February 22nd, 2024 18:00 PDT

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!

---

Does this enhancement work planned for v1.30 require any new docs or modification to existing docs?

At a minimum, we'll need bumping ProcMountType feature gate to beta in docs, so marking as Need Docs. If there are some logical changes, we'll need a PR for that too. Thanks!

Also, I edited the issue desc to update the target version :)

- Beta release target (x.y): 1.29
+ Beta release target (x.y): 1.30

[sreeram-venkitesh]

Hi @haircommander 👋, 1.31 Enhancements Lead here.

If you wish to progress this enhancement in v1.31, please have the SIG lead opt-in your enhancement by adding the lead-opted-in label and set the milestone to v1.31 before the Production Readiness Review Freeze.

/remove-label lead-opted-in

[sohankunkerkar]

/stage beta

[k8s-ci-robot]

@sohankunkerkar: Can not set label lead-opted-in: Must be member in one of these teams: [release-team-enhancements release-team-leads sig-api-machinery-leads sig-apps-leads sig-architecture-leads sig-auth-leads sig-autoscaling-leads sig-cli-leads sig-cloud-provider-leads sig-cluster-lifecycle-leads sig-contributor-experience-leads sig-docs-leads sig-instrumentation-leads sig-k8s-infra-leads sig-multicluster-leads sig-network-leads sig-node-leads sig-release-leads sig-scalability-leads sig-scheduling-leads sig-security-leads sig-storage-leads sig-testing-leads sig-windows-leads]

In response to this:

/stage beta
/label lead-opted-in

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[mrunalp]

/milestone v1.31
/stage beta
/label lead-opted-in

[tjons]

Hello @haircommander 👋, Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 14th June 2024 / 19:00 PDT Thursday 13th June 2024.

This enhancement is targeting for stage beta for 1.31 (correct me, if otherwise)

Here’s where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: { 1.31 }. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

For this KEP, we would just need to complete the following:

• KEP has a production readiness review that has been completed and merged into k/enhancements.

The status of this enhancement is marked as at risk for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you!

[sohankunkerkar]

@tjons, this KEP has already undergone PRR reviews in the previous release. We were waiting for userns support, which wasn't available at that time. So from a PRR perspective, we are already covered.

[tjons]

OK, thanks! Updated to tracked for enhancement freeze 🚀

[hacktivist123]

Hello @haircommander 👋, 1.31 Docs Shadow here.

Does this enhancement work planned for 1.31 require any new docs or modification to existing docs?
If so, please follows the steps here to open a PR against dev-1.31 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday June 27, 2024 18:00 PDT.

Also, take a look at Documenting for a release to get yourself familiarised with the docs requirement for the release.

Thank you!

[sohankunkerkar]

/assign sohankunkerkar

[a-mccarthy]

Hi @sohankunkerkar,

👋 from the v1.31 Communications Team! We'd love for you to opt in to write a feature blog about your enhancement!
Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and is graduating.

To opt in, let us know and open a Feature Blog placeholder PR against the website repository by 3rd July, 2024. For more information about writing a blog see the blog contribution guidelines.

Note: In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.

[Princesso]

Hello @haircommander 👋, 1.31 Docs Shadow here.

Does this enhancement work planned for 1.31 require any new docs or modification to existing docs? If so, please follows the steps here to open a PR against dev-1.31 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday June 27, 2024 18:00 PDT.

Also, take a look at Documenting for a release to get yourself familiarised with the docs requirement for the release.

Thank you!

Hi @haircommander , good day. Gentle reminder to open a Doc placeholder for beta updates to this enhancement before June 27th, 2024 which is the deadline for having a doc PR up. Thank you!

[haircommander]

@sohankunkerkar can you do that please?

[sohankunkerkar]

@sohankunkerkar can you do that please?

kubernetes/website#46953

[a-mccarthy]

hello @haircommander @sohankunkerkar, friendly reminder about the upcoming blog opt-in and placeholder deadline on July 3rd. Please open a blog placeholder PR if you are interested in contributing a blog.

[tjons]

Hey again @haircommander - 👋 Enhancements team here,

Just checking in as we approach code freeze at 02:00 UTC Wednesday 24th July 2024 / 19:00 PDT Tuesday 23rd July 2024. .

Here's where this enhancement currently stands:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PR/s are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

For this enhancement, it looks like the following PRs are open and need to be merged before code freeze:

• KEP-4265: add e2e tests for ProcMountType kubernetes#123303
• [KEP-4265] promote ProcMountType feature gate to beta kubernetes#125259 - this one should also be added to the issue description above.

If you anticipate missing code freeze, you can file an exception request in advance.

Also, please let me know if there are other PRs in k/k we should be tracking for this KEP.
As always, we are here to help if any questions come up. Thanks!

[sohankunkerkar]

xref: kubernetes/kubernetes#125259

[tjons]

Hello @haircommander 👋, Enhancements team here.

With all the implementation (code related) PRs merged as per the issue description:

• KEP-4265: add e2e tests for ProcMountType kubernetes#123303
• [KEP-4265] promote ProcMountType feature gate to beta kubernetes#125259

This enhancement is now marked as tracked for code freeze for the 1.31 Code Freeze!

[tjons]

Hi, enhancements lead here - I inadvertently added this to the 1.32 tracking board 😀. Please readd it if you wish to progress this enhancement in 1.32.

/remove-label lead-opted-in