[KEP-127] Add documentation about user namespaces and PSS #43803

saschagrunert · 2023-11-03T09:30:56Z

Adding required documentation for KEP-127.

Supersedes #43437

Preview: https://deploy-preview-43803--kubernetes-io-vnext-staging.netlify.app/docs/concepts/workloads/pods/user-namespaces

netlify · 2023-11-03T09:31:02Z

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	`4e156c7`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/6565c3d12bcec900080b124b

dipesh-rawat · 2023-11-03T15:11:53Z

/sig node

sftim

Thanks.

This change is actually about Pod security admission, right?

I think we might want to make an associated change to https://kubernetes.io/docs/concepts/security/pod-security-standards/ to explain what the standards are. These standards are not behind a feature gate, even if our in-tree enforcement mechanism is.

content/en/docs/concepts/workloads/pods/user-namespaces.md

content/en/docs/reference/command-line-tools-reference/feature-gates.md

content/en/docs/concepts/workloads/pods/user-namespaces.md

sftim · 2023-11-03T15:15:29Z

content/en/docs/concepts/workloads/pods/user-namespaces.md

I wonder if the change should really be made to https://kubernetes.io/docs/concepts/security/pod-security-admission/, and then have a small section in the user namespaces concept that links to the relevant part of the PSA docs.

Do you mean pod security admission or pod security standards? That page you link doesn't seem related, but this one (about pod security standards) does: https://kubernetes.io/docs/concepts/security/pod-security-standards/

Can you explain why pod security admisions?

Well, because that's where the feature gate has an effect.

Think about it like this: imagine we were adding support for TLS 1.3; we'd document that in our pages about configuring transport layer security and maybe around setting which TLS versions were supported. But we wouldn't propose an update to https://datatracker.ietf.org/doc/html/rfc8446

On the other hand, if someone does want to revise the TLS standard, they don't put the update to the standard behind a feature gate. But they might have a feature gate to - eg - enable the RSASSA-PSS signature scheme.

I don't really understand how you feature gate a standard.

rata

@sftim PTAL. Fixed all the issues, some questions remain open.

rata · 2023-11-09T13:40:41Z

content/en/docs/concepts/workloads/pods/user-namespaces.md

Do you mean pod security admission or pod security standards? That page you link doesn't seem related, but this one (about pod security standards) does: https://kubernetes.io/docs/concepts/security/pod-security-standards/

Can you explain why pod security admisions?

content/en/docs/concepts/workloads/pods/user-namespaces.md

content/en/docs/reference/command-line-tools-reference/feature-gates.md

sftim · 2023-11-09T15:21:35Z

We don't (and IMO shouldn't) have a feature gate that controls Pod Security Standards. That wouldn't fit with what I think standards are.

An analogy: the IEC-60320 standard (for electrical connectors) is one standard that a connector either complies with or not. If you turned on a toggle switch on some appliance, the cable you plug into it either would or wouldn't comply with the standard just the same.

People will want to know what standard their Pod manifest complies with, and if we tell them the answer depends on the cluster where they run it, they might wonder why we (Kubernetes) took that approach.
However, if it really is about enforcement, fine. Lots of new standards or revisions come in with an exception where existing things are still tolerated; there are real-world analogies aplenty.

I've tried to build a mental model where the explanation in this PR makes sense, and I can't. I think we should change at least the explanation and possibly some of the meaning too.
Want some synchronous time on this? Message me on Kubernetes Slack and I'll share a Calendly link, or we can sort out a call some other way.

rata · 2023-11-09T15:57:04Z

Well, the PR is merged and the KEP too, with all the approvals in place. I think we just need to document it.

But if you feel strongly about it, I'll let you discuss it with @saschagrunert when he is back next week. He is the one doing all the work here, so he should be involved in the discussion.

giuseppe · 2023-11-09T16:03:34Z

I am not sure that the website repository is the place to discuss such design issues which were already discussed and agreed upon.

So please, let's just stick to the fact that this PR is about adding documentation for an existing feature.

saschagrunert · 2023-11-14T08:05:10Z

I agree that we should focus on the docs within this PR rather than questioning the whole KEP.

sftim · 2023-11-14T10:17:52Z

I see that https://github.com/kubernetes/enhancements/blob/fa647b424a0b11316e8e31274e50332b14434f9c/keps/sig-node/127-user-namespaces/README.md#pod-security-standards-pss-integration does say that the pod security standards will be gated.

OK, we should document that.

However, we'll need to make it really clear to users what this means. It doesn't make sense to me, and I'm confident I won't be the only puzzled person.

If I get time, I will also PR an update to the KEP.

It turns out the KEP also specifies the problematic framing

drewhagen · 2023-11-21T18:37:45Z

Hello @saschagrunert @onlydole @tengqm @rata @sftim 👋,

Friendly reminder that the deadline to have docs merged is next Tuesday 28th November 2023. If this feature needs documentation and the docs are not ready, the feature may be removed from the milestone.

Let me know if you have any questions. Thank you!

sftim

If folks are willing to make the changes I've proposed, that might be enough.

Should we also add explanatory text to https://kubernetes.io/docs/concepts/security/pod-security-standards/? I really think we should do, even for alpha.

content/en/docs/concepts/workloads/pods/user-namespaces.md

content/en/docs/reference/command-line-tools-reference/feature-gates.md

saschagrunert · 2023-11-28T08:46:21Z

If folks are willing to make the changes I've proposed, that might be enough.

Thanks! I incorporated the changes as suggested.

Should we also add explanatory text to https://kubernetes.io/docs/concepts/security/pod-security-standards/? I really think we should do, even for alpha.

Can I follow-up on that? I assume linking back with a note would be enough, but having that as part of a separate PR would allow us more time.

sftim · 2023-11-28T10:21:27Z

This isn't passing tests. LGTM though.

sftim · 2023-11-28T10:21:45Z

I assume linking back with a note would be enough, but having that as part of a separate PR would allow us more time.

Sure, I was also thinking a separate PR.

Adding required documentation for [KEP-127](kubernetes/enhancements#127). Signed-off-by: Sascha Grunert <sgrunert@redhat.com> Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com> Co-authored-by: Tim Bannister <tim@scalefactory.com> Signed-off-by: Sascha Grunert <sgrunert@redhat.com>

saschagrunert · 2023-11-28T10:45:39Z

This isn't passing tests. LGTM though.

Green now :)

sftim

/lgtm

Thanks

k8s-ci-robot · 2023-11-28T10:47:08Z

LGTM label has been added.

Git tree hash: 5b846f798373c2dafd4c6013fc587ccb2c7643af

sftim · 2023-11-28T10:47:27Z

/assign @kbhawkey

per #43803 (comment)

reylejano · 2023-11-28T22:42:25Z

/approve

k8s-ci-robot · 2023-11-28T22:42:49Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: reylejano

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [reylejano]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sftim · 2023-11-28T23:32:07Z

content/en/docs/reference/command-line-tools-reference/feature-gates.md

+- `UserNamespacesPodSecurityStandards`: Enable Pod Security Standards policies relaxation for pods
+  that run with namespaces. You must set the value of this feature gate consistently across all nodes in
+  your cluster, and you must also enable `UserNamespacesSupport` to use this feature.
+  See [User Namespaces](/docs/concepts/workloads/pods/user-namespaces/#integration-with-pod-security-standards) for more details.


Oops. Should be:

- See [User Namespaces](/docs/concepts/workloads/pods/user-namespaces/#integration-with-pod-security-standards) for more details. + See [User Namespaces](/docs/concepts/workloads/pods/user-namespaces/#integration-with-pod-security-admission-checks) for more details.

Fixing in the follow-up PR.

k8s-ci-robot added this to the 1.29 milestone Nov 3, 2023

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Nov 3, 2023

saschagrunert mentioned this pull request Nov 3, 2023

[WIP] Add documentation about user namespaces and PSS #43437

Closed

k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Nov 3, 2023

k8s-ci-robot requested review from onlydole and tengqm November 3, 2023 09:31

k8s-ci-robot added language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. labels Nov 3, 2023

k8s-ci-robot added the sig/node Categorizes an issue or PR as relevant to SIG Node. label Nov 3, 2023

sftim previously requested changes Nov 3, 2023

View reviewed changes

sftim reviewed Nov 3, 2023

View reviewed changes

pacoxu mentioned this pull request Nov 8, 2023

Support User Namespaces in pods kubernetes/enhancements#127

Open

26 tasks

rata reviewed Nov 9, 2023

View reviewed changes

rata force-pushed the dev-1.29-user-namespaces-pss branch from 38b4d39 to 7eb729d Compare November 9, 2023 13:58

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Nov 9, 2023

sftim reviewed Nov 27, 2023

View reviewed changes

saschagrunert force-pushed the dev-1.29-user-namespaces-pss branch from f3ede39 to cf53f8c Compare November 28, 2023 08:44

saschagrunert force-pushed the dev-1.29-user-namespaces-pss branch from cf53f8c to 4e156c7 Compare November 28, 2023 10:41

sftim reviewed Nov 28, 2023

View reviewed changes

k8s-ci-robot assigned sftim Nov 28, 2023

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 28, 2023

k8s-ci-robot assigned kbhawkey Nov 28, 2023

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 28, 2023

k8s-ci-robot merged commit 8a29190 into kubernetes:dev-1.29 Nov 28, 2023
6 checks passed

sftim reviewed Nov 28, 2023

View reviewed changes

saschagrunert deleted the dev-1.29-user-namespaces-pss branch November 29, 2023 07:55

saschagrunert mentioned this pull request Nov 30, 2023

Dev 1.29 user namespaces pss update #44156

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[KEP-127] Add documentation about user namespaces and PSS #43803

[KEP-127] Add documentation about user namespaces and PSS #43803

saschagrunert commented Nov 3, 2023 •

edited

Loading

netlify bot commented Nov 3, 2023 •

edited

Loading

dipesh-rawat commented Nov 3, 2023

sftim left a comment

sftim Nov 3, 2023

rata Nov 9, 2023

sftim Nov 27, 2023

rata left a comment

rata Nov 9, 2023

sftim commented Nov 9, 2023 •

edited

Loading

rata commented Nov 9, 2023

giuseppe commented Nov 9, 2023

saschagrunert commented Nov 14, 2023

sftim commented Nov 14, 2023

drewhagen commented Nov 21, 2023

sftim left a comment

saschagrunert commented Nov 28, 2023 •

edited

Loading

sftim commented Nov 28, 2023

sftim commented Nov 28, 2023

saschagrunert commented Nov 28, 2023

sftim left a comment

k8s-ci-robot commented Nov 28, 2023

sftim commented Nov 28, 2023

reylejano commented Nov 28, 2023

k8s-ci-robot commented Nov 28, 2023

sftim Nov 28, 2023

saschagrunert Nov 30, 2023

[KEP-127] Add documentation about user namespaces and PSS #43803

[KEP-127] Add documentation about user namespaces and PSS #43803

Conversation

saschagrunert commented Nov 3, 2023 • edited Loading

netlify bot commented Nov 3, 2023 • edited Loading

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

dipesh-rawat commented Nov 3, 2023

sftim left a comment

Choose a reason for hiding this comment

sftim Nov 3, 2023

Choose a reason for hiding this comment

rata Nov 9, 2023

Choose a reason for hiding this comment

sftim Nov 27, 2023

Choose a reason for hiding this comment

rata left a comment

Choose a reason for hiding this comment

rata Nov 9, 2023

Choose a reason for hiding this comment

sftim commented Nov 9, 2023 • edited Loading

rata commented Nov 9, 2023

giuseppe commented Nov 9, 2023

saschagrunert commented Nov 14, 2023

sftim commented Nov 14, 2023

drewhagen commented Nov 21, 2023

sftim left a comment

Choose a reason for hiding this comment

saschagrunert commented Nov 28, 2023 • edited Loading

sftim commented Nov 28, 2023

sftim commented Nov 28, 2023

saschagrunert commented Nov 28, 2023

sftim left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Nov 28, 2023

sftim commented Nov 28, 2023

reylejano commented Nov 28, 2023

k8s-ci-robot commented Nov 28, 2023

sftim Nov 28, 2023

Choose a reason for hiding this comment

saschagrunert Nov 30, 2023

Choose a reason for hiding this comment

saschagrunert commented Nov 3, 2023 •

edited

Loading

netlify bot commented Nov 3, 2023 •

edited

Loading

sftim commented Nov 9, 2023 •

edited

Loading

saschagrunert commented Nov 28, 2023 •

edited

Loading