Projected service account tokens for Kubelet image credential providers

[aramase]

Enhancement Description

• One-line enhancement description (can be used as a release note): Projected service account tokens for authenticated image pulls via kubelet image credential providers
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/4412-projected-service-account-tokens-for-kubelet-image-credential-providers/README.md
• Discussion Link:
• Primary contact (assignee): @aramase @enj @mainred
• Responsible SIGs: sig-auth, sig-node
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): v1.32
  • Beta release target (x.y):
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s): KEP-4412: Projected Service Account Tokens for Kubelet Image Credential Providers #4846
  • Code (k/k) update PR(s):
    • credential provider config: detect typos kubernetes#128062
    • Enforce service account node audience restriction kubernetes#128077
    • KSA token for Kubelet image credential providers alpha kubernetes#128372
  • Docs (k/website) update PR(s):
    • Add blog post for PSAT for Kubelet Image Credential Providers website#48343
    • Add docs for PSAT for Kubelet Image Credential Providers alpha website#48388

[aramase]

/sig auth

[salehsedghpour]

Hello @aramase and @enj 👋, Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 9th February 2024.

This enhancement is targeting for stage alpha for v1.30 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.30.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

For this KEP, we would just need to update the following:

• This enhancement seems to be fresh and thus I was not able to find any information about it in the PRs in k/enhancements. Please make sure to have a merged PR before Enhancements Freeze.

The status of this enhancement is marked as at risk for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[enj]

cc @mikebrow @SergeyKanzhelev @ndixita @ruiwen-zhao @harche @haircommander

Will have an KEP open for this soon.

[enj]

Per the slack thread conversation, I am moving this KEP out of the v1.30 release.

[salehsedghpour]

Hello @enj, thanks for the update. I'm changing the status of this enhancement to deferred. and we are not going to track this enhancement for this release anymore.

[salehsedghpour]

/milestone clear

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[aramase]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[aramase]

/remove-lifecycle stale

[k8s-ci-robot]

@aramase: GitHub didn't allow me to assign the following users: mainred.

Note that only kubernetes members with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

/assign mainred

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[dipesh-rawat]

Hello @aramase @enj @mainred 👋, v1.32 Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 11th October 2024 / 19:00 PDT Thursday 10th October 2024.

This enhancement is targeting for stage alpha for v1.32 (correct me, if otherwise)

/stage alpha

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: v1.32.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here). If your production readiness review is not completed yet, please make sure to fill the production readiness questionnaire in your KEP by the PRR Freeze deadline on Thursday 3rd October 2024 so that the PRR team has enough time to review your KEP.

For this KEP, we would need to update the following:

• Create the KEP readme using the latest template and merge it in the k/enhancements repo.
• Ensure that the KEP has undergone a production readiness review and has been merged into k/enhancements.

It looks like #4846 will address most of these issues.

• Get KEP-4412: Projected Service Account Tokens for Kubelet Image Credential Providers #4846 merged before the enhancements freeze.

The status of this enhancement is marked as at risk for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you!

[dipesh-rawat]

Hi @aramase @enj @mainred 👋, v1.32 Enhancements team here.

Just a quick friendly reminder as we approach the enhancements freeze later this week, at 02:00 UTC Friday 11th October 2024 / 19:00 PDT Thursday 10th October 2024.

The current status of this enhancement is marked as at risk for enhancement freeze. There are a few requirements mentioned in the comment #4412 (comment) still need to be completed.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you!

[enj]

@dipesh-rawat #4846 is merged.

[SergeyKanzhelev]

I'd love to see some thinking done regarding short lived tokens and how image streaming will be able to refresh the token. See comment: #4846 (comment).

[dipesh-rawat]

Hello @aramase @enj @mainred 👋, v1.32 Enhancements team here,

Now that PR #4846 has been merged, all the KEP requirements are in place and merged into k/enhancements.

Before the enhancement freeze, it would be appreciated if following nits could be addressed:

• Update issue description to add direct link to KEP README.md.

  • Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/4412-projected-service-account-tokens-for-kubelet-image-credential-providers/README.md

Aside from the minor nit mentioned above, this enhancement is all good for the upcoming enhancements freeze. 🚀

The status of this enhancement is now marked as tracked for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[mbianchidev]

Hello again @aramase @enj 👋 from the v1.32 Communications Team!

We'd love for you to consider writing a feature blog about your enhancement.
Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and it is graduating.

To opt-in, let us know by opening a Feature Blog placeholder PR against the website repository by 30th Oct 2024. For more information about writing a blog see the blog contribution guidelines.

Note: In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we finalize the blog schedule.

[aramase]

@mbianchidev Thanks for the ping! I've opened kubernetes/website#48343 for the blog placeholder.

[AnshumanTripathi]

Hello @aramase @enj 👋, 1.32 Docs Shadow here.
Does this enhancement work planned for 1.32 require any new docs or modification to existing docs?
If so, please follows the steps here to open a PR against dev-1.32 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday October 24th 2024 18:00 PDT.
Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.
Thank you!

[dipesh-rawat]

Hey again @aramase @enj 👋 v1.32 Enhancements team here,

Just checking in as we approach code freeze at 02:00 UTC Friday 8th November 2024 / 19:00 PDT Thursday 7th November 2024 .

Here's where this enhancement currently stands:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PR/s are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

For this enhancement, it looks like the following PRs are open and need to be merged before code freeze (and we need to update the Issue description to include all the related PRs of this KEP):

• credential provider config: detect typos kubernetes#128062
• Enforce service account node audience restriction kubernetes#128077
• KSA token for Kubelet image credential providers alpha kubernetes#128372

Additionally, please let me know if there are any other PRs in k/k not listed in the description or not linked with this GitHub issue that we should track for this KEP, so that we can maintain accurate status.

The status of this enhancement is marked as at risk for code freeze.

If you anticipate missing code freeze, you can file an exception request in advance. Thank you!

[dipesh-rawat]

Hey again @aramase @enj 👋, v1.32 Enhancements team here,

Just a quick friendly reminder as we approach code freeze in few days, at 02:00 UTC Friday 8th November 2024 / 19:00 PDT Thursday 7th November 2024 .

The current status of this enhancement is marked as at risk for code freeze. There are a few requirements mentioned in the comment #4412 (comment) that still need to be completed.

If you anticipate missing code freeze, you can file an exception request in advance.

[dipesh-rawat]

Hello @aramase @enj 👋 v1.32 Enhancements team here,

Unfortunately, the implementation (code related) PR(s) associated with this enhancement is not in the merge-ready state by code-freeze and hence this enhancement is now removed from the v1.32 milestone.

If you still wish to progress this enhancement in v1.32, please file an exception request as soon as possible, within three days. If you have any questions, you can reach out in the #release-enhancements channel on Slack and we'll be happy to help. Thanks!

/label tracked/no
/remove-label tracked/yes
/milestone clear