enhancements Add support for IMA namespaces

Signed-off-by: Asier Gutierrez [email protected]

One-line PR description: Add support for IMA namespaces in pods Issue link: https://github.com/kubernetes/enhancements/issues/3702

Dec 22 '22 13:12 asierHuawei

The committers listed above are authorized under a signed CLA.

:white_check_mark: login: asierHuawei / name: Asier Gutierrez (cf433b2eb3de94d3904a3256b3ce5b93df94a019, b1bffa27d8503c7f777725ffb314d3b71d88ba85)

Dec 22 '22 13:12 linux-foundation-easycla[bot]

Hi @asierHuawei. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Dec 22 '22 13:12 k8s-ci-robot

@asierHuawei please sign the CLA do proceed further with this PR.

Jan 04 '23 10:01 bart0sh

Hi, how do we move this PR back to triage?

Jan 16 '23 07:01 asierHuawei

/assign @SergeyKanzhelev /ok-to-test

Jan 16 '23 08:01 bart0sh

@asierHuawei please fix CI test failures, thanks.

Jan 16 '23 21:01 bart0sh

@asierHuawei If you haven't presented your KEP on the SIG-node meeting yet, please consider doing so. It usually speeds up KEP review.

There is also release planning table that includes all KEPS planned by SIG-node for inclusion into certain release. If you want your KEP to be planned for 1.27, you may want to include it there.

Jan 17 '23 11:01 bart0sh

@marquiz is this a place class resources could be used? would it stretch the intended purpose too much (there isn't a limit of ima namespaces that could be passed, but it would provide a mechanism to broadcast nodes that have the specified hardware)

Jan 20 '23 20:01 haircommander

@marquiz is this a place class resources could be used? would it stretch the intended purpose too much (there isn't a limit of ima namespaces that could be passed, but it would provide a mechanism to broadcast nodes that have the specified hardware)

I'm not sure yet. I need to read this KEP to be able to answer this 😊

Jan 24 '23 18:01 marquiz

Discussed at today's SIG Node meeting. Looking forward to the feature coming to Kubernetes. But today the linux support for IMA is still under development, not merged yet. We are expecting the feature being merged into the upstream kernel, and runc has the support, at least a PoC demo on the single node. We can future discuss how to enable the feature for Kubernetes.

Jan 24 '23 18:01 dchen1107

is this a place class resources could be used? would it stretch the intended purpose too much

@haircommander I now skimmed through this KEP. AFAIU, this is basically an IMA on/off flag. Technically QoS-class resources could be used (e.g. resource name ima with two classes [on, off]) but I think specifying it in securityContext is the better thing to do. What QoS-class resources would provide is scheduler support i.e. correctly schedule IMA pods on nodes that have it enabled

Jan 25 '23 15:01 marquiz

Discussed at today's SIG Node meeting. Looking forward to the feature coming to Kubernetes. But today the linux support for IMA is still under development, not merged yet. We are expecting the feature being merged into the upstream kernel, and runc has the support, at least a PoC demo on the single node. We can future discuss how to enable the feature for Kubernetes.

Would it be OK to have a demo with experimental kernel patches? We are working on the kernel side as well as we have some experimental patches now. We hope the Linux community can merge those patches in the next releases.

Jan 26 '23 17:01 asierHuawei

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: asierHuawei Once this PR has been reviewed and has the lgtm label, please assign derekwaynecarr for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

keps/sig-node/OWNERS

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

Feb 20 '23 12:02 k8s-ci-robot

@asierHuawei Please fix failing CI tests, thanks.

Feb 22 '23 10:02 bart0sh

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

May 23 '23 13:05 k8s-triage-robot

/uncc

Jun 08 '23 09:06 palnabarun

The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle rotten
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

Jul 08 '23 09:07 k8s-triage-robot

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Reopen this PR with /reopen
Mark this PR as fresh with /remove-lifecycle rotten
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Jan 19 '24 01:01 k8s-triage-robot

@k8s-triage-robot: Closed this PR.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied

After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied

After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Reopen this PR with /reopen

Mark this PR as fresh with /remove-lifecycle rotten

Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Jan 19 '24 01:01 k8s-ci-robot