Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Blog post about Pod Security admission graduating to stable #35614

Merged
merged 3 commits into from
Aug 25, 2022
Merged

Blog post about Pod Security admission graduating to stable #35614

merged 3 commits into from
Aug 25, 2022

Conversation

tallclair
Copy link
Member

@tallclair tallclair commented Aug 1, 2022 •
edited
Loading

Blog post for v1.25 Pod Security Admission (PSA) graduating to Stable

Topics:

/cc @katcosgrove

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. area/blog Issues or PRs related to the Kubernetes Blog subproject language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. labels Aug 1, 2022
@tallclair tallclair mentioned this pull request Aug 2, 2022
Closed
12 tasks
@sftim
Copy link
Contributor

sftim commented Aug 2, 2022

/retitle [WIP] Add article about Pod Security admission graduating to stable

@k8s-ci-robot k8s-ci-robot changed the title PLACEHOLDER: PSA blog post [WIP] Add article about Pod Security admission graduating to stable Aug 2, 2022
@k8s-ci-robot k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 2, 2022
@sftim
Copy link
Contributor

sftim commented Aug 2, 2022

We should aim to update https://kubernetes.io/blog/2021/12/09/pod-security-admission-beta/ to link to the new article.

@sftim
Copy link
Contributor

sftim commented Aug 2, 2022

We might want to embed https://www.youtube.com/watch?v=gcz5VsvOYmI in the blog article - what do folks think?

@katcosgrove
Copy link
Contributor

Hi from the Comms team! Just a reminder that the Ready to Review deadline for feature blogs is Tuesday, August 16. You will also be assigned a publication date post-release. Is there anything we can do to help you right now?

@tallclair
Copy link
Member Author

I'm drafting the post this afternoon. I'm interested in cross-referencing some of the other posts. Is there a standard way of doing that, or should I just make sure this post goes out after them, and use the permalink? Specifically, I think the PSP history post, and the pod os post.

@katcosgrove
Copy link
Contributor

Hey Tim! Your assigned publication date is 25 August.

As for cross-references, we're aiming to have that history post published before release, but the Pod OS post isn't scheduled until the following week, so you won't be able to link to it immediately.

@katcosgrove
Copy link
Contributor

Do you require any assistance from the comms team in drafting this? We need to begin reviews. :)

@tallclair
Copy link
Member Author

tallclair commented Aug 17, 2022 •
edited
Loading

Sorry this is delinquent. I'm putting the finishing touches on the draft here, and then I'll convert to markdown and update this PR. ETA 2pm pacific. Done!

@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Aug 17, 2022
@tallclair tallclair changed the title [WIP] Add article about Pod Security admission graduating to stable Blog post about Pod Security admission graduating to stable Aug 17, 2022
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 17, 2022
@tallclair
Copy link
Member Author

OK, this is ready for review!

@tallclair
Copy link
Member Author

/assign @samos123

@k8s-ci-robot
Copy link
Contributor

@tallclair: GitHub didn't allow me to assign the following users: samos123.

Note that only kubernetes members, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

/assign @samos123

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@netlify
Copy link

netlify bot commented Aug 17, 2022 •
edited
Loading

✅ Pull request preview available for checking

Built without sensitive environment variables

Name Link
🔨 Latest commit 7926c17
🔍 Latest deploy log https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/63066afbe44d6b0008cf00d3
😎 Deploy Preview https://deploy-preview-35614--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

shannonxtreme
shannonxtreme reviewed Aug 19, 2022
View reviewed changes
content/en/blog/_posts/2022-08-25-pod-security/index.md Outdated Show resolved Hide resolved
content/en/blog/_posts/2022-08-25-pod-security/index.md Outdated Show resolved Hide resolved
content/en/blog/_posts/2022-08-25-pod-security/index.md Outdated Show resolved Hide resolved
content/en/blog/_posts/2022-08-25-pod-security/index.md Outdated Show resolved Hide resolved
content/en/blog/_posts/2022-08-25-pod-security/index.md Show resolved Hide resolved
content/en/blog/_posts/2022-08-25-pod-security/index.md Outdated Show resolved Hide resolved
content/en/blog/_posts/2022-08-25-pod-security/index.md Outdated
Comment on lines 76 to 79
_Note that Kubelets prior to Kubernetes v1.24 did not enforce the Pod OS field, so clusters running
older nodes should explicitly
[pin restricted policies to a version](https://kubernetes.io/docs/concepts/security/pod-security-admission/#pod-security-admission-labels-for-namespaces)
prior to v1.25._
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
_Note that Kubelets prior to Kubernetes v1.24 did not enforce the Pod OS field, so clusters running
older nodes should explicitly
[pin restricted policies to a version](https://kubernetes.io/docs/concepts/security/pod-security-admission/#pod-security-admission-labels-for-namespaces)
prior to v1.25._
In Kubernetes v1.24 and earlier, the kubelet didn't enforce the Pod OS field. If your cluster runs nodes with
earlier version, you should explicitly
[pin Restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-admission/#pod-security-admission-labels-for-namespaces) to a version prior to v1.25.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Went with:

Suggested change
_Note that Kubelets prior to Kubernetes v1.24 did not enforce the Pod OS field, so clusters running
older nodes should explicitly
[pin restricted policies to a version](https://kubernetes.io/docs/concepts/security/pod-security-admission/#pod-security-admission-labels-for-namespaces)
prior to v1.25._
In Kubernetes v1.23 and earlier, the kubelet didn't enforce the Pod OS field. If your cluster runs
nodes with any of those versions, you should explicitly
[pin Restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-admission/#pod-security-admission-labels-for-namespaces)
to a version prior to v1.25.

content/en/blog/_posts/2022-08-25-pod-security/index.md Outdated Show resolved Hide resolved
content/en/blog/_posts/2022-08-25-pod-security/index.md Outdated
Comment on lines 84 to 86
A [guide](https://kubernetes.io/docs/tasks/configure-pod-container/migrate-from-psp/) was published
to make the process of migrating from PSP to PSA easier, and to help you choose the best migration
strategy for your use case. In addition, a tool called
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
A [guide](https://kubernetes.io/docs/tasks/configure-pod-container/migrate-from-psp/) was published
to make the process of migrating from PSP to PSA easier, and to help you choose the best migration
strategy for your use case. In addition, a tool called
For instructions to migrate from PodSecurityPolicy to the PodSecurity admission controller, and for help
choosing a migration strategy, refer to the [migration guide](https://kubernetes.io/docs/tasks/configure-pod-container/migrate-from-psp/).
We're also developing a tool called

content/en/blog/_posts/2022-08-25-pod-security/index.md Outdated Show resolved Hide resolved
@shannonxtreme
Copy link
Contributor

Congrats on the graduation @tallclair @samos123 et al 🥳

@sftim
Copy link
Contributor

sftim commented Aug 22, 2022

Please make the title change as per #35614 (comment)

@tallclair
Copy link
Member Author

Thanks for all the feedback. I applied most of the suggestions, and responded to those that I deviated from.

The main difference is referring to the feature as Pod Security Admission rather than PodSecurity in most places.

@sftim
Copy link
Contributor

sftim commented Aug 23, 2022

@tallclair could you take a look at #35614 (comment) and #35614 (comment) ? Those are things we could leave in for publication, but that I'd really prefer to fix.

@shannonxtreme
Copy link
Contributor

@tallclair yeah sorry haha I was doing it for technical accuracy but it's a blog post not a doc. If you don't have it already, I'd recommend mentioning somewhere that Pod Security Admission uses the PodSecurity admission controller to function. Ignore if that exists in the text already!

@tallclair
Copy link
Member Author

/label tide/merge-method-squash

@k8s-ci-robot k8s-ci-robot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Aug 24, 2022
@reylejano
Copy link
Member

Thank you for addressing feedback
/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 24, 2022
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: c7969a1eb822457738bab5512edc70239b4a306d

@reylejano
Copy link
Member

Hi @kubernetes/sig-docs-blog-owners , ptal

@sftim
Copy link
Contributor

sftim commented Aug 25, 2022

Thanks

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rolfedh, sftim

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 25, 2022
@k8s-ci-robot k8s-ci-robot merged commit d795e02 into kubernetes:main Aug 25, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@shannonxtreme shannonxtreme shannonxtreme left review comments

@sftim sftim sftim left review comments

@rolfedh rolfedh rolfedh approved these changes

@katcosgrove katcosgrove Awaiting requested review from katcosgrove

Assignees

@reylejano reylejano

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/blog Issues or PRs related to the Kubernetes Blog subproject cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. language/en Issues or PRs related to English language lgtm "Looks good to me", indicates that a PR is ready to be merged. sig/docs Categorizes an issue or PR as relevant to SIG Docs. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges.
Projects
SIG Docs Blog Project Board
Archived in project
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@tallclair @sftim @katcosgrove @k8s-ci-robot @shannonxtreme @reylejano @rolfedh