add ProcMount option

[haircommander]

Enhancement Description

• One-line enhancement description (can be used as a release note):

• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/4265-proc-mount

• Discussion Link:

• Primary contact (assignee): @sohankunkerkar @haircommander

• Responsible SIGs: node

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): 1.12
  • Beta release target (x.y): 1.31
  • Stable release target (x.y):

• Alpha

  • KEP (k/enhancements) update PR(s):
    • add ProcMount option community#1934
    • Add restrospetive KEP for ProcMount and target at Beta #4266
  • Code (k/k) update PR(s):
    • Add a ProcMount option to the SecurityContext & AllowedProcMountTypes to PodSecurityPolicy kubernetes#64283
    • KEP-4265: Update Unmasked ProcMountType to fail validation without a pod level user namespace kubernetes#123520
  • Docs (k/website) update PR(s):
    • ProcMount 1.30 update website#45152

• Beta

  • KEP (k/enhancements) update PR(s):
    • KEP-4265: promote ProcMount option to beta #4679
    • KEP-4265: move to on by default beta #5120
  • Code (k/k) update PR(s):
    • KEP-4265: add e2e tests for ProcMountType kubernetes#123303
    • [KEP-4265] promote ProcMountType feature gate to beta kubernetes#125259
  • Docs (k/website) update(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[haircommander]

replaces kubernetes/community#1934
/sig node
/sig auth

[mrunalp]

/label lead-opted-in

[AnaMMedina21]

Hola @haircommander 👋, v1.29 Enhancements team here.

I am just checking in as we approach enhancements freeze on 18:00 PDT on Thursday 6th October 2023..

This enhancement is targeting stage beta for v1.29 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: { v1.29}. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

For this KEP, we would just need to update the following:

• For this PR to be approved: Add restrospetive KEP for ProcMount and target at Beta #4266

The status of this enhancement is marked as Tracked for Enhancements Freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[npolshakova]

Sorry for the confusion @haircommander, this is actually currently At Risk for Enhancement Freeze until #4266 is approved. We'll update the status once the PR goes in. Let me know if you have any questions- Thanks!

[npolshakova]

Hello 👋, 1.29 Enhancements Lead here.
Unfortunately, this enhancement did not meet requirements for v1.29 enhancements freeze.
Feel free to file an exception to add this back to the release tracking process.

#4266 is awaiting PRR approval. Please file an exception and once the PRR review is complete this should fulfill all the enhancement freeze requirements.

Thanks!

/milestone clear

[sftim]

@haircommander, what's the “One-line enhancement description” for this KEP?

[pacoxu]

@npolshakova https://groups.google.com/g/kubernetes-sig-release/c/emPOBgXxu0Q/m/JxEx-ZrcBgAJ?utm_medium=email&utm_source=footer

Your updated deadline to make any changes to your KEP is 18:00 PST Monday 9th October 2023.

The exception is approved by v1.29 release team. However, we may miss the deadline again 🤣.

[npolshakova]

@pacoxu It looks like this won't be making it into 1.29 from the slack discussion: https://kubernetes.slack.com/archives/C2C40FMNF/p1697033013866149?thread_ts=1696609849.513439&cid=C2C40FMNF

[stlaz]

/triage accepted

[salehsedghpour]

/remove-label lead-opted-in

[sohankunkerkar]

@sohankunkerkar can you do that please?

kubernetes/website#46953

[a-mccarthy]

hello @haircommander @sohankunkerkar, friendly reminder about the upcoming blog opt-in and placeholder deadline on July 3rd. Please open a blog placeholder PR if you are interested in contributing a blog.

[tjons]

Hey again @haircommander - 👋 Enhancements team here,

Just checking in as we approach code freeze at 02:00 UTC Wednesday 24th July 2024 / 19:00 PDT Tuesday 23rd July 2024. .

Here's where this enhancement currently stands:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PR/s are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

For this enhancement, it looks like the following PRs are open and need to be merged before code freeze:

• KEP-4265: add e2e tests for ProcMountType kubernetes#123303
• [KEP-4265] promote ProcMountType feature gate to beta kubernetes#125259 - this one should also be added to the issue description above.

If you anticipate missing code freeze, you can file an exception request in advance.

Also, please let me know if there are other PRs in k/k we should be tracking for this KEP.
As always, we are here to help if any questions come up. Thanks!

[sohankunkerkar]

xref: kubernetes/kubernetes#125259

[tjons]

Hello @haircommander 👋, Enhancements team here.

With all the implementation (code related) PRs merged as per the issue description:

• KEP-4265: add e2e tests for ProcMountType kubernetes#123303
• [KEP-4265] promote ProcMountType feature gate to beta kubernetes#125259

This enhancement is now marked as tracked for code freeze for the 1.31 Code Freeze!

[tjons]

Hi, enhancements lead here - I inadvertently added this to the 1.32 tracking board 😀. Please readd it if you wish to progress this enhancement in 1.32.

/remove-label lead-opted-in

[haircommander]

/label lead-opted-in
/milestone v1.33

there won't be a code change, but we'll set this to on by default in 1.33 #5120 (in conjunction with user namespaces)

[dipesh-rawat]

Hello @haircommander 👋, v1.33 Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 14th February 2025 / 19:00 PDT Thursday 13th February 2025.

This enhancement is targeting stage beta for v1.33 (correct me, if otherwise)
/stage beta

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: v1.33.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here). If your production readiness review is not completed yet, please make sure to fill the production readiness questionnaire in your KEP by the PRR Freeze deadline on Thursday 6th February 2025 so that the PRR team has enough time to review your KEP.

For this KEP, we would need to update the following:

• Ensure that the kep.yaml is update to mention latest-milestone: v1.33 and beta: "v1.33"

The status of this enhancement is marked as At risk for enhancements freeze. Please keep the issue description up-to-date with appropriate stages as well.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you!

[dipesh-rawat]

Hello @haircommander 👋, 1.33 Enhancements team here.

Now that PR #5120 has been merged, all the KEP requirements are in place and merged into k/enhancements, this enhancement is all good for the upcoming enhancements freeze. 🚀

The status of this enhancement is marked as tracked for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!