ClusterTrustBundles (previously Trust Anchor Sets)

[ahmedtd]

Enhancement Description

• One-line enhancement description (can be used as a release note): Define ClusterTrustBundle, a resource for holding X.509 trust anchors

• Kubernetes Enhancement Proposal: link

• Discussion Link: Draft doc w/ comments SIG Auth Meeting

• Primary contact (assignee): @ahmedtd

• Responsible SIGs: sig-auth

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): 1.27 (API), 1.28 (Kubelet)
  • Beta release target (x.y): 1.32
  • Stable release target (x.y): ??

• [x] 1.27 - Alpha

  • [x] KEP (k/enhancements) update PR(s):
    • https://github.com/kubernetes/enhancements/pull/3258
    • https://github.com/kubernetes/enhancements/pull/3826
  • [x] Code (k/k) update PR(s):
    • https://github.com/kubernetes/kubernetes/pull/113218
  • [ ] Docs (k/website) update PR(s):
    • https://github.com/kubernetes/website/pull/40065

• [x] 1.28 - Alpha

  • [ ] KEP (k/enhancements) update PR(s):
  • [x] Code (k/k) update PR(s):
    • https://github.com/kubernetes/kubernetes/pull/113374
  • [ ] Docs (k/website) update PR(s):

• [ ] Beta

  • [x] KEP (k/enhancements) update PR(s):
    • https://github.com/kubernetes/enhancements/pull/4791
  • [ ] Code (k/k) update PR(s):
  • [ ] Docs (k/website) update(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[ahmedtd]

/sig auth

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[ritazh]

/remove-lifecycle rotten

[marosset]

Hello @ahmedtd 👋, 1.26 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PDT on Thursday 6th October 2022.

This enhancement is targeting for stage alpha for 1.26 (correct me, if otherwise)

Here's where this enhancement currently stands:

• [ ] KEP readme using the latest template has been merged into the k/enhancements repo.
• [ ] KEP status is marked as implementable for latest-milestone: 1.26
• [ ] KEP readme has a updated detailed test plan section filled out
• [ ] KEP readme has up to date graduation criteria
• [ ] KEP has a production readiness review that has been completed and merged into k/enhancements.

For this KEP, we would just need to update the following:

• Merge https://github.com/kubernetes/enhancements/pull/3258

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[ahmedtd]

I'm planning to address these issues today.

[enj]

@marosset #3258 has been approved by SIG Auth leads and PRR https://github.com/kubernetes/enhancements/pull/3258#issuecomment-1268854253 - we are just waiting on explicit /approve from PRR folks.

[enj]

@marosset and #3258 is merged :)

[rhockenbury]

With #3258 merged, I have this down as tracked for v1.26. Thanks!

[marosset]

Hi @ahmedtd 👋,

Checking in once more as we approach 1.26 code freeze at 17:00 PDT on Tuesday 8th November 2022.

Please ensure the following items are completed:

• [ ] All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• [ ] All PRs are fully merged by the code freeze deadline.

For this enhancement, please link all relevant k/k PRs in the initial issue description for tracking.

As always, we are here to help should questions come up. Thanks!

[katmutua]

Hello @ahmedtd ! 👋🏾,

@katmutua 1.26 Release Docs shadow here. This enhancement is marked as ‘Needs Docs’ for 1.26 release.

Please follow the steps detailed in the documentation to open a PR against dev-1.26 branch in the k/website repo. This PR can be just a placeholder at this time, and must be created by November 9.

Also, take a look at Documenting for a release to familiarize yourself with the docs requirement for the release. As a reminder, please link all of your docs PR to this issue so we can easily track it.

[marosset]

Hi @ahmedtd👋,

Checking in once more as we approach 1.26 code freeze at 17:00 PDT on Tuesday 8th November 2022.

Please ensure the following items are completed:

• [x] All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• [ ] All PRs are fully merged by the code freeze deadline.

For this enhancement, it looks like the following PRs are open and need to be merged before code freeze:

• https://github.com/kubernetes/kubernetes/pull/113218
• https://github.com/kubernetes/kubernetes/pull/113374

As always, we are here to help should questions come up. Thanks!

[rhockenbury]

Hello 👋, 1.26 Enhancements Lead here.

Unfortunately, this enhancement did not meet requirements for code freeze. If you still wish to progress this enhancement in v1.26, please file an exception request. Thanks!

/milestone clear /label tracked/no /remove-label tracked/yes /remove-label lead-opted-in

[liggitt]

@enj and I are doing API review for this one

[marosset]

Hello @ahmedtd 👋, Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PDT Thursday 9th February 2023.

This enhancement is targeting for stage alpha for v1.27 (correct me, if otherwise)

Here's where this enhancement currently stands:

• [x] KEP readme using the latest template has been merged into the k/enhancements repo.
• [ ] KEP status is marked as implementable for latest-milestone: v1.27
• [x] KEP readme has a updated detailed test plan section filled out
• [x] KEP readme has up to date graduation criteria
• [x] KEP has a production readiness review that has been completed and merged into k/enhancements.

For this KEP, we would just need to update the following:

• Please update the latest-milestone and alpha target in the kep.yaml

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[wojtek-t]

@ahmedtd @liggitt - can you please take a look at: https://github.com/kubernetes/enhancements/pull/3258#discussion_r1030221962 and ensure that either it is answered in the KEP or it will be added as a thing to resolve in Beta criteria?

[liggitt]

@marosset the last item mentioned in https://github.com/kubernetes/enhancements/issues/3257#issuecomment-1409600888 should be complete now, can you verify this is tracked for freeze?

[marosset]

This enhancement meets all the requirements to be tracked for v1.27 Thanks everyone!

/label tracked/yes /remove-label tracked/no

[marosset]

Hi @ahmedtd :wave:,

Checking in as we approach 1.27 code freeze at 17:00 PDT on Tuesday 14th March 2023.

Please ensure the following items are completed:

• [x] All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• [ ] All PRs are fully merged by the code freeze deadline.

For this enhancement, it looks like the following PRs are open and need to be merged before code freeze:

• https://github.com/kubernetes/kubernetes/pull/113218
• https://github.com/kubernetes/kubernetes/pull/113374

Please let me know if there are any other PRs in k/k I should be tracking for this KEP. As always, we are here to help should questions come up. Thanks!

[katmutua]

Hello @ahmedtd ! 👋🏾,

@katmutua 1.27 Release Docs shadow here. This enhancement is marked as ‘Needs Docs’ for 1.27 release.

Please follow the steps detailed in the documentation to open a PR against dev-1.27 branch in the k/website repo. This PR can be just a placeholder at this time, and must be created by March 16. For more information, please take a look at Documenting for a release to familiarize yourself with the documentation requirements for the release.

If you already have existing open PRs please link them to the description so we can easily track them. Thanks!

[marosset]

Unfortunately the implementation PRs associated with this enhancement have not merged by code-freeze so this enhancement is getting removed from the release.

If you would like to file an exception please see https://github.com/kubernetes/sig-release/blob/master/releases/EXCEPTIONS.md

/milestone clear /remove-label tracked/yes /label tracked/no

[salaxander]

/milestone v1.27

[sftim]

@ahmedtd you might like to change the issue description to strike through TrustAnchorSet and write ClusterTrustBundle in its place.

[ahmedtd]

Done --- updated the description as well.

[ahmedtd]

Docs for the Alpha API landed in 1.27: https://github.com/kubernetes/website/pull/40065

[salaxander]

Hey @ahmedtd - just a reminder that the exception request expires at 5pm pacific time today. https://github.com/kubernetes/kubernetes/pull/113374 will need to merge before that time.

Thanks!

[liggitt]

https://github.com/kubernetes/kubernetes/pull/113374 was moved to 1.28, only https://github.com/kubernetes/kubernetes/pull/113218 was part of the exception request for 1.27

[enj]

@salaxander only https://github.com/kubernetes/kubernetes/pull/113218 is targeting v1.27. https://github.com/kubernetes/kubernetes/pull/113374 will wait until v1.28 (while the PRs are for the same overall KEP, each PR has a different feature gate / functionality).

[salaxander]

kubernetes/kubernetes#113374 was moved to 1.28, only kubernetes/kubernetes#113218 was part of the exception request for 1.27

Ah sounds good! I'll mark you as complete then. Thanks!!

[aramase]

@ahmedtd Is the KEP updated to reflect the current state and implementation plan for v1.28?