-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Only allow anonymous auth for configured endpoints. #4633
Comments
/sig auth |
/milestone v1.31 |
@vinayakankugoyal: You must be a member of the kubernetes/milestone-maintainers GitHub team to set the milestone. If you believe you should be able to issue the /milestone command, please contact your Milestone Maintainers Team and have them propose you as an additional delegate for this responsibility. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
/milestone v1.31 |
PRR Approver /assign @jpbetz |
/retitle Only allow anonymous auth for health endpoints |
Hello @vinayakankugoyal 👋, Enhancements team here. Just checking in as we approach enhancements freeze on 02:00 UTC Friday 14th June 2024 / 19:00 PDT Thursday 13th June 2024. This enhancement is targeting stage Here's where this enhancement currently stands:
For this KEP, it looks like we still need to do the following:
The status of this enhancement is marked as If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you! |
Hi @prianna - thanks a lot for the heads up. We were granted the PRR approval #4634 (comment) and the reviewers have agreed that we can set the status to |
@prianna - The KEP was merged as implementable in milestone 1.31 with a PRR approval. Are we all good on the KEP freeze front? |
Hello @jpbetz @liggitt @vinayakankugoyal 👋, 1.31 Docs Shadow here. |
Hey folks, with the merge of #4634, here's where this KEP currently stands:
With all the KEP requirements in place and merged into k/enhancements, this enhancement is all good for the upcoming enhancements freeze. 🚀 The status of this enhancement is marked as |
Hi @jpbetz @liggitt @vinayakankugoyal 👋 from the v1.31 Communications Team! We'd love for you to opt in to write a feature blog about your enhancement! Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and is graduating. To opt in, let us know and open a Feature Blog placeholder PR against the website repository by 3rd July, 2024. For more information about writing a blog see the blog contribution guidelines. Note: In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release. |
Hi @jpbetz @liggitt @vinayakankugoyal, gentle reminder to raise a draft doc PR before the Placeholder PR deadline, scheduled for June 27, 2024. |
Hi @jpbetz @liggitt @vinayakankugoyal, This is a friendly reminder that the deadline for the draft Doc PR is tomorrow, Thursday, June 27, 2024, 18:00 PDT. |
@MaryamTavakkoli - thanks opened a draft PR here: kubernetes/website#46988 |
Hello @vinayakankugoyal @jpbetz @liggitt, friendly reminder about the upcoming blog opt-in and placeholder deadline on July 3rd. Please open a blog placeholder PR if you are interested in contributing a blog. |
Hey again @vinayakankugoyal 👋 Enhancements team here, Just checking in as we approach code freeze at 02:00 UTC Wednesday 24th July 2024 / 19:00 PDT Tuesday 23rd July 2024. Here's where this enhancement currently stands:
For this enhancement, it looks like the following PRs are open and need to be merged before code freeze: If you anticipate missing code freeze, you can file an exception request in advance. Also, please let me know if there are other PRs in k/k we should be tracking for this KEP. As always, we are here to help if any questions come up. Thanks! |
Thanks @prianna! kubernetes/kubernetes#125967 is the only remaining action item for this KEP. I am just waiting for someone from sig-auth to Approve. Other than that the docs PR kubernetes/website#46988 is also waiting for review and approval. |
Looks like this was merged. With the merge of kubernetes/kubernetes#125967 as per the issue, this enhancement is now marked as |
opting in for beta for 1.32 |
Hello @vinayakankugoyal 👋, Enhancements team here. Just checking in as we approach enhancements freeze on 02:00 UTC Friday 11th October 2024 / 19:00 PDT Thursday 10th October 2024. This enhancement is targeting for stage Here’s where this enhancement currently stands:
Please consider asnwering With all the KEP requirements in place and merged into k/enhancements, this enhancement is all good for the upcoming enhancements freeze. 🚀 The status of this enhancement is marked as |
Enhancement Description
Allow users to specify which endpoints are allowed for anonymous requests. This allows the admin to only allow access to health endpoints like
healthz
,livez
andreadyz
anonymously while making sure other cluster endpoints or resources cannot be access anonymously even if a user misconfigures RBAC.One-line enhancement description (can be used as a release note): Only allow anonymous auth for health endpoints.
Kubernetes Enhancement Proposal: KEP-4633: Only allow anonymous auth for configured endpoints #4634
Discussion Link: https://docs.google.com/document/d/1woLGRoONE3EBVx-wTb4pvp4CI7tmLZ6lS26VTbosLKM/edit#bookmark=id.ehlt47tezzsk
Primary contact (assignee): @vinayakankugoyal
Responsible SIGs: sig-auth
Enhancement target (which target equals to which milestone):
Alpha
k/enhancements
) update PR(s):k/k
) update PR(s):k/website
) update PR(s):Beta
k/enhancements
) update PR(s):k/k
) update PR(s):k/website
) update(s):Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.
The text was updated successfully, but these errors were encountered: