Fine grained Kubelet API authorization

[pacoxu]

Enhancement Description

• One-line enhancement description (can be used as a release note): The node API authorization is too coarse. We need finer grained authorization of different request types, and maybe resources acted on.
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/2862-fine-grained-kubelet-authz/README.md
• Discussion Link: Fine grained Kubelet API authorization kubernetes#83465
• Primary contact (assignee): @vinayakankugoyal @tallclair
• Responsible SIGs: auth node
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.32
  • Beta release target (x.y): 1.33
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s): KEP-2862: Fine-grained Kubelet API Authorization #4760
  • Code (k/k) update PR(s):
    • KEP-2862: Fine-grained Kubelet API Authorization kubernetes#126347
  • Docs (k/website) update PR(s): KEP-2862: Fine-grained Authz for Kubelet API. website#48412
• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP-2862: Graduate to BETA. #5016
  • Code (k/k) update PR(s):
    • KEP-2862: Graduate KubeletFineGrainedAuthz to BETA. kubernetes#129656
  • Docs (k/website) update PR(s):
    • KEP-2862: KubeletFineGrainedAuthz Graduate to BETA website#49578

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[pacoxu]

/sig auth
/sig node
/kind feature
/area kubelet-api
/priority important-longterm

See also:

• Deprecate Kubelet Read-only port kubernetes#12968
• Implement a kubelet pod api kubernetes#28138
• Clean up Kubelet RESTful APIs kubernetes#2098

[k8s-ci-robot]

@pacoxu: The label(s) area/kubelet-api cannot be applied, because the repository doesn't have them.

In response to this:

/sig auth
/sig node
/kind feature
/area kubelet-api
/priority important-longterm

See also:

• Deprecate Kubelet Read-only port kubernetes#12968
• Implement a kubelet pod api kubernetes#28138
• Clean up Kubelet RESTful APIs kubernetes#2098

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[pacoxu]

/assign
I will start to work on the KEP.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[enj]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[pacoxu]

/remove-lifecycle stale
still have no enough time to work on this.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[tallclair]

/lifecycle frozen

[vinayakankugoyal]

/assign @vinayakankugoyal

[vinayakankugoyal]

@tallclair - I started a KEP for this one. Would you be able to take a look? #4760

[liggitt]

@vinayakankugoyal are you planning to leave this in alpha for 1.32 or progress it to beta?

[vinayakankugoyal]

@vinayakankugoyal are you planning to leave this in alpha for 1.32 or progress it to beta?

We are planning BETA in 1.33 - I opened a PR to update the KEP - #5016

[vinayakankugoyal]

@pacoxu - can you add the following to the description

• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP-2862: Graduate to BETA. #5016
  • Code (k/k) update PR(s):
    • KEP-2862: Graduate KubeletFineGrainedAuthz to BETA. kubernetes#129656
  • Docs (k/website) update PR(s):

[pacoxu]

Updated.

[SergeyKanzhelev]

/stage beta

[vinayakankugoyal]

@pacoxu - could you add kubernetes/website#49578 to the BETA docs, please. Thanks!

[dipesh-rawat]

Hello @vinayakankugoyal 👋, v1.33 Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 14th February 2025 / 19:00 PDT Thursday 13th February 2025.

This enhancement is targeting stage beta for v1.33 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: v1.33.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here). If your production readiness review is not completed yet, please make sure to fill the production readiness questionnaire in your KEP by the PRR Freeze deadline on Thursday 6th February 2025 so that the PRR team has enough time to review your KEP.

For this KEP, we would need to update the following:

• Update the KEP README to include graduation criteria (here) for the Beta stage.

The status of this enhancement is marked as At risk for enhancements freeze. Please keep the issue description up-to-date with appropriate stages as well.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you!

[vinayakankugoyal]

Hello @vinayakankugoyal 👋, v1.33 Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 14th February 2025 / 19:00 PDT Thursday 13th February 2025.

This enhancement is targeting stage beta for v1.33 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.[x] KEP status is marked as implementable for latest-milestone: v1.33.[ ] KEP readme has up-to-date graduation criteria[x] KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here). If your production readiness review is not completed yet, please make sure to fill the production readiness questionnaire in your KEP by the PRR Freeze deadline on Thursday 6th February 2025 so that the PRR team has enough time to review your KEP.

For this KEP, we would need to update the following:

• Update the KEP README to include graduation criteria (here) for the Beta stage.

The status of this enhancement is marked as At risk for enhancements freeze. Please keep the issue description up-to-date with appropriate stages as well.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you!

Hi Dipesh,
We updated the graduation criteria: #5099. Are we good to go?

[dipesh-rawat]

Hello @vinayakankugoyal 👋,

Now that PR adding the Graduation criteria #5099 has been merged, all the KEP requirements are in place and merged into k/enhancements. This enhancement is all good for the upcoming enhancements freeze. 🚀

The status of this enhancement is marked as Tracked for enhancements freeze.
Thank you!

[rayandas]

Hello @vinayakankugoyal 👋, v1.33 Docs Lead here.

Does this enhancement work planned for v1.33 require any new docs or modification to existing docs?

If so, please follow the steps here to open a PR against dev-1.33 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday 27th February 2025 18:00 PDT.

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!

[vinayakankugoyal]

Hello @vinayakankugoyal 👋, v1.33 Docs Lead here.

Does this enhancement work planned for v1.33 require any new docs or modification to existing docs?

If so, please follow the steps here to open a PR against dev-1.33 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday 27th February 2025 18:00 PDT.

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!

Thanks already done kubernetes/website#49578. Waiting for someone to Approve.

[rayandas]

Thanks Vinayak!

[rytswd]

Hi @vinayakankugoyal 👋 -- this is Ryota (@rytswd) from the 1.33 Communications Team!

For the 1.33 release, we are currently in the process of collecting and curating a list of potential feature blogs, and we'd love for you to consider writing one for your enhancement!

As you may be aware, feature blogs are a great way to communicate to users about features which fall into (but not limited to) the following categories:

• This introduces some breaking change(s)
• This has significant impacts and/or implications to users
• ...Or this is a long-awaited feature, which would go a long way to cover the journey more in detail 🎉

To opt in to write a feature blog, could you please let us know and open a "Feature Blog placeholder PR" (which can be only a skeleton at first) against the website repository by Wednesday, 5th March, 2025? For more information about writing a blog, please find the blog contribution guidelines 📚

Tip

Some timeline to keep in mind:

• 02:00 UTC Wednesday, 5th March, 2025: Feature blog PR freeze
• Monday, 7th April, 2025: Feature blogs ready for review
• You can find more in the release document

Note

In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.

[dipesh-rawat]

Hey again @vinayakankugoyal 👋, 1.33 Enhancements team here,

Just checking in as we approach code freeze at 02:00 UTC Friday 21st March 2025 / 19:00 PDT Thursday 20th March 2025.

Here's where this enhancement currently stands:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PR/s are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

With all the implementation(code related) PRs merged as per the issue description:

• KEP-2862: Graduate KubeletFineGrainedAuthz to BETA. kubernetes#129656

Additionally, please let me know if there are any other PRs in k/k not listed in the description that we should track for this KEP, so that we can maintain accurate status.

This enhancement is now marked as tracked for code freeze for the 1.33 Code Freeze!

[rytswd]

Hi @vinayakankugoyal 👋, 1.33 Communications Team here again!

This is a gentle reminder for the feature blog deadline mentioned above, which is 02:00 UTC Wednesday, 5th March, 2025. To opt in, please let us know and open a Feature Blog placeholder PR against k/website by the deadline. If you have any questions, please feel free to reach out to us!

Tip

Some timeline to keep in mind:

• 02:00 UTC Wednesday, 5th March, 2025: Feature blog PR freeze
• Monday, 7th April, 2025: Feature blogs ready for review
• You can find more in the release document

Note

In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.