KEP-5018: move to beta in 1.34 #5327

ritazh · 2025-05-21T15:49:32Z

One-line PR description: Update KEP to prepare for beta in 1.34

Issue link: DRA: AdminAccess for ResourceClaims and ResourceClaimTemplates #5018

Other comments: Some of the material is already covered in KEP-4381: DRA Structure Parameters, so that KEP is referenced in some places.

/wg device-management
/assign @liggitt for sig auth
/assign @pohly
/assign @soltysh for PRR

Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

k8s-ci-robot · 2025-05-21T15:49:36Z

@ritazh: GitHub didn't allow me to assign the following users: for, sig, auth, PRR.

Note that only kubernetes members with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

One-line PR description: Update KEP to prepare for beta in 1.34

Issue link: DRA: AdminAccess for ResourceClaims and ResourceClaimTemplates #5018

Other comments: Some of the material is already covered in KEP-4381: DRA Structure Parameters, so that KEP is referenced in some places.

/wg device-management
/assign @liggitt for sig auth
/assign @pohly
/assign @soltysh for PRR

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

liggitt

update lgtm, just had a couple questions

liggitt · 2025-05-21T15:54:53Z

keps/sig-auth/5018-dra-adminaccess/README.md

 - Gather feedback
 - Additional tests are in Testgrid and linked in KEP
- Implementations in the kubernetes-sigs/dra-example-driver
+- Implementations in the kubernetes-sigs/dra-example-driver: https://github.com/kubernetes-sigs/dra-example-driver/issues/97 and the NVIDIA dra driver: https://github.com/NVIDIA/k8s-dra-driver-gpu/issues/337


do those issues mean we will show those repos labeling namespaces as admin access and using devices as admin access before promoting the gate to beta?

Yes, Implementations in the kubernetes-sigs/dra-example-driver was part of the original beta criteria. I think we should be able to add an example there. I'm less certain about the exact timeline of the Nvidia one. I could remove that one for now and add it back AFTER it's done. wdyt?

let's not take dependencies on consumers we're not sure will be ready as a beta graduation criteria ... one example use seems sufficient

liggitt · 2025-05-21T15:57:11Z

keps/sig-auth/5018-dra-adminaccess/README.md


-Will be considered for beta.
+- kube-controller-manager: If the kube-controller-manager fails to create `ResourceClaim` objects from `ResourceClaimTemplate` due to misconfigurations or permission issues relating to `adminAccess`, then the associated Pods will remain in a pending state and won't be scheduled.
+- kube-scheduler: Bugs in the scheduler might lead to Pods not being scheduled even when resources are available or, scheduling Pods that shouldn't be scheduled due to unmet `adminAccess` requirements. If the `DRAAdminAccess` feature gate isn't enabled or is misconfigured, the scheduler might not recognize ResourceClaim requirements, leading to scheduling failures.


is this thinking of something more than generic scheduler backoff behavior when it encounters failed API requests?

No, this should be part of the generic scheduler backoff behavior.

ok, maybe clarify that... otherwise this line sounds scarier or more specific to this feature than it actually is

liggitt · 2025-05-21T15:58:11Z

keps/sig-auth/5018-dra-adminaccess/README.md

 -->

-Will be considered for beta.
+".status.allocation.devices.results[*].adminaccess" will be set to true for a claim using adminAccess when needed by a pod.


Suggested change

".status.allocation.devices.results[*].adminaccess" will be set to true for a claim using adminAccess when needed by a pod.

".status.allocation.devices.results[*].adminAccess" will be set to true for a claim using adminAccess when needed by a pod.

liggitt · 2025-05-21T15:58:50Z

keps/sig-auth/5018-dra-adminaccess/README.md


-Will be considered for beta.
+- The DynamicResourceAllocation feature gate must be enabled to create ResourceClaim, ResourceClaimTemplate. More details at [KEP-4381 - DRA Structured Parameters](https://github.com/kubernetes/enhancements/issues/4381)
+- A third-party DRA driver is required for how the driver should interpret the AdminAcess field to get acess to device specific resources without allocating them.


Suggested change

- A third-party DRA driver is required for how the driver should interpret the AdminAcess field to get acess to device specific resources without allocating them.

- A third-party DRA driver is required for how the driver should interpret the AdminAcess field to get access to device specific resources without allocating them.

Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

liggitt · 2025-05-21T21:46:23Z

/lgtm
/approve

soltysh

Mostly the integration links are missing, otherwise it's good to go.

soltysh · 2025-05-22T14:30:54Z

keps/sig-auth/5018-dra-adminaccess/README.md


 #### Beta

 - Gather feedback


Missing bits higher in the doc:

make sure to check appropriate boxes in Release Singoff Checklist

In Integration tests section, please make sure to link tests according to the template, especially the newly added that are called out there, since looking at the PRs submitted during alpha they did add new tests.

These comments still hold.

keps/sig-auth/5018-dra-adminaccess/README.md

liggitt · 2025-05-22T18:03:09Z

keps/sig-auth/5018-dra-adminaccess/README.md

while reviewing an unrelated DRA KEP, we realized this is using an inconsistent label key ...

labels / annotations are expected to use $group.kubernetes.io/... domain prefixes, so this should really be resource.kubernetes.io/admin-access

https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#label-selector-and-annotation-conventions

"kubernetes.io" is the preferred form for labels and annotations, "k8s.io" should not be used for new map keys.

Sorry I didn't catch that last release

/hold

so do we need to update this label in 1.34? and if so, is that still ok to move to beta?

so do we need to update this label in 1.34?

I would say so, yes.

and if so, is that still ok to move to beta?

I think so, for the following reasons:

pre-1.34 clusters default the feature off, so the adminAccess field is forcibly cleared on creation, so there's no existing objects with this field set unless someone opted into an alpha feature

ResourceClaim / ResourceClaimTemplate only check admin access on create, since their specs are immutable, so no 1.33 server would have to handle authorizing an update to an adminAccess: true object persisted by a 1.34 server

If someone was using the feature in alpha, it's easy to double-label their namespace until they complete upgrading to 1.34 to let both 1.33 and 1.34 be happy.

Thanks for catching this now! and +1 on moving to beta.
I can add a validation and warning for using the old label, not sure if it's worth the effort to maintain the code though.

Thanks for catching this now! and +1 on moving to beta. I can add a validation and warning for using the old label, not sure if it's worth the effort to maintain the code though.

I think just a release note is fine for something changed before exiting alpha.

Looks good to me, thanks to both of you for taking care of this.

Now I just need to erase k8s.io from my own memory to avoid using it for future extensions...

Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

liggitt · 2025-05-22T20:24:21Z

/lgtm
/approve

liggitt · 2025-05-22T21:31:30Z

/hold cancel

keps/sig-auth/5018-dra-adminaccess/README.md

soltysh · 2025-05-23T17:09:24Z

keps/sig-auth/5018-dra-adminaccess/README.md


 #### Beta

 - Gather feedback


These comments still hold.

Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

soltysh

/approve
the PRR

soltysh · 2025-05-28T11:21:52Z

keps/sig-auth/5018-dra-adminaccess/README.md

+- 1 example of real-world usage
 - Allowing time for feedback
+- All issues and gaps identified as feedback during beta are resolved
+**Note:** GA criteria must not include any functional, security, monitoring, or testing requirements.  Those must be beta requirements.


ritazh · 2025-05-28T14:59:00Z

/assign @enj

enj · 2025-05-28T15:54:32Z

/lgtm
/approve

k8s-ci-robot · 2025-05-28T15:54:41Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enj, liggitt, ritazh, soltysh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~keps/prod-readiness/OWNERS~~ [soltysh]
~~keps/sig-auth/OWNERS~~ [enj,liggitt,ritazh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

5018-update beta

49db474

Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

k8s-ci-robot assigned liggitt, pohly and soltysh May 21, 2025

k8s-ci-robot added the wg/device-management Categorizes an issue or PR as relevant to WG Device Management. label May 21, 2025

github-project-automation bot added this to Dynamic Resource Allocation May 21, 2025

k8s-ci-robot added the kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory label May 21, 2025

github-project-automation bot moved this to 🆕 New in Dynamic Resource Allocation May 21, 2025

k8s-ci-robot requested a review from kikisdeliveryservice May 21, 2025 15:49

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label May 21, 2025

k8s-ci-robot requested a review from micahhausler May 21, 2025 15:49

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 21, 2025

liggitt mentioned this pull request May 21, 2025

DRA: AdminAccess for ResourceClaims and ResourceClaimTemplates #5018

Open

8 tasks

liggitt reviewed May 21, 2025

View reviewed changes

address comments

420ef20

Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 21, 2025

enj added this to SIG Auth May 22, 2025

enj moved this to Needs Triage in SIG Auth May 22, 2025

soltysh reviewed May 22, 2025

View reviewed changes

liggitt reviewed May 22, 2025

View reviewed changes

k8s-ci-robot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. labels May 22, 2025

update label

4d27a7d

Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

ritazh force-pushed the kep-5018-beta branch from 9afca23 to 4d27a7d Compare May 22, 2025 20:14

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 22, 2025

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 22, 2025

soltysh reviewed May 23, 2025

View reviewed changes

pohly moved this from 🆕 New to 👀 In review in Dynamic Resource Allocation May 25, 2025

address comments

f059494

Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 28, 2025

soltysh approved these changes May 28, 2025

View reviewed changes

github-project-automation bot moved this from Needs Triage to In Review in SIG Auth May 28, 2025

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 28, 2025

k8s-ci-robot assigned enj May 28, 2025

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 28, 2025

k8s-ci-robot merged commit fc234c1 into kubernetes:master May 28, 2025
4 checks passed

k8s-ci-robot added this to the v1.34 milestone May 28, 2025

github-project-automation bot moved this from In Review to Closed / Done in SIG Auth May 28, 2025

ritazh deleted the kep-5018-beta branch May 29, 2025 01:21

pohly moved this from 👀 In review to ✅ Done in Dynamic Resource Allocation Jun 3, 2025

liggitt mentioned this pull request Jul 3, 2025

podtopologylabels: update topology.k8s.io->topology.kubernetes.io kubernetes/kubernetes#132462

Merged

	".status.allocation.devices.results[*].adminaccess" will be set to true for a claim using adminAccess when needed by a pod.
	".status.allocation.devices.results[*].adminAccess" will be set to true for a claim using adminAccess when needed by a pod.

	- A third-party DRA driver is required for how the driver should interpret the AdminAcess field to get acess to device specific resources without allocating them.
	- A third-party DRA driver is required for how the driver should interpret the AdminAcess field to get access to device specific resources without allocating them.

KEP-5018: move to beta in 1.34 #5327

KEP-5018: move to beta in 1.34 #5327

Uh oh!

Conversation

ritazh commented May 21, 2025

Uh oh!

k8s-ci-robot commented May 21, 2025

Uh oh!

liggitt left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liggitt commented May 21, 2025

Uh oh!

soltysh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

liggitt May 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liggitt commented May 22, 2025

Uh oh!

liggitt commented May 22, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

soltysh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ritazh commented May 28, 2025

Uh oh!

enj commented May 28, 2025

Uh oh!

k8s-ci-robot commented May 28, 2025

Uh oh!

Uh oh!

Uh oh!

liggitt May 22, 2025 •

edited

Loading