Projected service account tokens for Kubelet image credential providers

[aramase]

Enhancement Description

• One-line enhancement description (can be used as a release note): Projected service account tokens for authenticated image pulls via kubelet image credential providers
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/4412-projected-service-account-tokens-for-kubelet-image-credential-providers/README.md
• Discussion Link:
• Primary contact (assignee): @aramase @enj @mainred
• Responsible SIGs: sig-auth, sig-node
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): v1.33
  • Beta release target (x.y):
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s):
    • KEP-4412: Projected Service Account Tokens for Kubelet Image Credential Providers #4846
    • KEP-4412: update alpha and latest milestone to v1.33 #4996
  • Code (k/k) update PR(s):
    • credential provider config: detect typos kubernetes#128062
    • Enforce service account node audience restriction kubernetes#128077
    • KSA token for Kubelet image credential providers alpha kubernetes#128372
  • Docs (k/website) update PR(s):
    • Add docs for PSAT for Kubelet Image Credential Providers alpha website#49884

[aramase]

/sig auth

[salehsedghpour]

Hello @aramase and @enj 👋, Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 9th February 2024.

This enhancement is targeting for stage alpha for v1.30 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.30.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

For this KEP, we would just need to update the following:

• This enhancement seems to be fresh and thus I was not able to find any information about it in the PRs in k/enhancements. Please make sure to have a merged PR before Enhancements Freeze.

The status of this enhancement is marked as at risk for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[enj]

cc @mikebrow @SergeyKanzhelev @ndixita @ruiwen-zhao @harche @haircommander

Will have an KEP open for this soon.

[enj]

Per the slack thread conversation, I am moving this KEP out of the v1.30 release.

[salehsedghpour]

Hello @enj, thanks for the update. I'm changing the status of this enhancement to deferred. and we are not going to track this enhancement for this release anymore.

[salehsedghpour]

/milestone clear

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[aramase]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[aramase]

/remove-lifecycle stale

[mbianchidev]

Hello again @aramase @enj 👋 from the v1.32 Communications Team!

We'd love for you to consider writing a feature blog about your enhancement.
Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and it is graduating.

To opt-in, let us know by opening a Feature Blog placeholder PR against the website repository by 30th Oct 2024. For more information about writing a blog see the blog contribution guidelines.

Note: In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we finalize the blog schedule.

[aramase]

@mbianchidev Thanks for the ping! I've opened kubernetes/website#48343 for the blog placeholder.

[AnshumanTripathi]

Hello @aramase @enj 👋, 1.32 Docs Shadow here.
Does this enhancement work planned for 1.32 require any new docs or modification to existing docs?
If so, please follows the steps here to open a PR against dev-1.32 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday October 24th 2024 18:00 PDT.
Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.
Thank you!

[dipesh-rawat]

Hey again @aramase @enj 👋 v1.32 Enhancements team here,

Just checking in as we approach code freeze at 02:00 UTC Friday 8th November 2024 / 19:00 PDT Thursday 7th November 2024 .

Here's where this enhancement currently stands:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PR/s are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

For this enhancement, it looks like the following PRs are open and need to be merged before code freeze (and we need to update the Issue description to include all the related PRs of this KEP):

• credential provider config: detect typos kubernetes#128062
• Enforce service account node audience restriction kubernetes#128077
• KSA token for Kubelet image credential providers alpha kubernetes#128372

Additionally, please let me know if there are any other PRs in k/k not listed in the description or not linked with this GitHub issue that we should track for this KEP, so that we can maintain accurate status.

The status of this enhancement is marked as at risk for code freeze.

If you anticipate missing code freeze, you can file an exception request in advance. Thank you!

[dipesh-rawat]

Hey again @aramase @enj 👋, v1.32 Enhancements team here,

Just a quick friendly reminder as we approach code freeze in few days, at 02:00 UTC Friday 8th November 2024 / 19:00 PDT Thursday 7th November 2024 .

The current status of this enhancement is marked as at risk for code freeze. There are a few requirements mentioned in the comment #4412 (comment) that still need to be completed.

If you anticipate missing code freeze, you can file an exception request in advance.

[dipesh-rawat]

Hello @aramase @enj 👋 v1.32 Enhancements team here,

Unfortunately, the implementation (code related) PR(s) associated with this enhancement is not in the merge-ready state by code-freeze and hence this enhancement is now removed from the v1.32 milestone.

If you still wish to progress this enhancement in v1.32, please file an exception request as soon as possible, within three days. If you have any questions, you can reach out in the #release-enhancements channel on Slack and we'll be happy to help. Thanks!

/label tracked/no
/remove-label tracked/yes
/milestone clear

[liggitt]

This is targeting merging as alpha in 1.33
/milestone v1.33
/label lead-opted-in

[dipesh-rawat]

Hello @aramase @enj @mainred 👋, v1.33 Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 14th February 2025 / 19:00 PDT Thursday 13th February 2025.

This enhancement is targeting stage alpha for v1.33 (correct me, if otherwise)
/stage alpha

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: v1.33.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here). If your production readiness review is not completed yet, please make sure to fill the production readiness questionnaire in your KEP by the PRR Freeze deadline on Thursday 6th February 2025 so that the PRR team has enough time to review your KEP.

With all the KEP requirements in place and merged into k/enhancements, this enhancement is all good for the upcoming enhancements freeze. 🚀

The status of this enhancement is marked as Tracked for enhancements freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[rayandas]

Hello @aramase @enj @mainred 👋, v1.33 Docs Lead here.

Does this enhancement work planned for v1.33 require any new docs or modification to existing docs?

If so, please follow the steps here to open a PR against dev-1.33 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday 27th February 2025 18:00 PDT.

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!