Fine-grained SupplementalGroups control

[everpeace]

Enhancement Description

• One-line enhancement description (can be used as a release note): Add new API surface to control and track how supplemental groups are applied in the container.
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/3619-supplemental-groups-policy
• Discussion Link: Can bypass PodSecurityContext.SupplementalGroups by custom container image although PSP(or other policy engines) enforces the field kubernetes#112879
• Primary contact (assignee):　@everpeace
• Responsible SIGs: sig-node
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.31
  • Beta release target (x.y): 1.33
  • Stable release target (x.y):
• Alpha: v1.31
  • KEP (k/enhancements) update PR(s):
    • KEP-3169: Fine-grained SupplementalGroups control #3620
    • KEP-3619: update Test Plan and Graduation Criteria for KEP freeze #3862
    • KEP-3619: Cleanup After Freeze #3874
    • KEP-3619: update the latest milestone to v1.31 #4628
    • KEP-3619: Add SupplementalGroupsPolicy feature fields in Kubernetes API(Node.Status) and CRI(RuntimeStatusResponse) #4728
  • Code (k/k) update PR(s):
    • KEP-3619: Fine-grained SupplementalGroups control kubernetes#117842
    • KEP-3619: Add NodeStatus.Features.SupplementalGroupsPolicy API and e2e kubernetes#125470
  • Docs (k/website) update PR(s):
    • [dev-1.31] KEP-3619: Fine-grained SupplementalGroups control website#46920
    • blog post for KEP-3619: Fine-grained SupplementalGroups control website#46921
  • contained (optional):
    • Fine-grained SupplementalGroups control containerd/containerd#9737
    • Implement RuntimeStatus.features.supplemental_groups_policy from KEP-3619 containerd/containerd#10410
  • CRI-O (optional):
    • server/*: add fine-grained SupplementalGroups control for enhanced security cri-o/cri-o#8268
    • KEP-3619: implement RuntimeStatus.features.supplemental_groups_policy cri-o/cri-o#8386
  • cri-tools (optional):
    • KEP-3619: Fine-grained SupplementalGroups control kubernetes-sigs/cri-tools#1438
• Beta: v1.33
  • KEP (k/enhancements) update PR(s):
    • KEP-3619: updated KEP with alpha release status, and added haircommander as a reviewer #4809
    • KEP-3619: updated Production Readiness Review Questionnaire for beta release #4895
    • KEP-3619: update latest-milestone to v1.33 #5165
  • Code (k/k) update PR(s):
    • KEP-3619: Promote SupplementalGroupsPolicy feature to Beta kubernetes#130210
  • Docs (k/website) update(s):
    • [dev-1.33] KEP-3619: Promote Fine-grained SupplementalGroups control to Beta website#49880
  • cri-tools (optional)
    • KEP-3619: Support RuntimeFeatures(.features) in "crictl info" command kubernetes-sigs/cri-tools#1772

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

/assign
/sig node
/kind feature

[k8s-ci-robot]

@everpeace: The label(s) /remove-label sig/scheduling cannot be applied. These labels are supported: api-review, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, team/katacoda, refactor, lead-opted-in, tracked/no, tracked/out-of-tree, tracked/yes. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

In response to this:

/remove-label sig/scheduling

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[everpeace]

/remove-lifecycle stale

[SergeyKanzhelev]

/milestone v1.27

let's see if we can start it in 1.27

[SergeyKanzhelev]

/label lead-opted-in

[SergeyKanzhelev]

/stage alpha

[npolshakova]

Hello @everpeace 👋, 1.27 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PDT Thursday 9th February 2023.

This enhancement is targeting for stage alpha for 1.27 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.27
• KEP readme has a updated detailed test plan section filled out
• KEP readme has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

It looks like #3620 will address most of these issues.

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[everpeace]

/remove-lifecycle stale

[dipesh-rawat]

Hello 👋, 1.33 Enhancements Lead here.

If you'd like to work on this enhancement in v1.33, please have the SIG lead opt-in by adding the lead-opted-in label, which ensures it gets added to the tracking board. Also, please set the milestone to v1.33 using /milestone v1.33.
Thanks!

/remove-label lead-opted-in

[everpeace]

@haircommander Hi, I would like to work on this KEP for beta release in v1.33! I will update my beta PRR PR(#4895) this week.

[everpeace]

@haircommander Hi, I noticed this KEP has not been lead-opted-in. Would you mind doing this for me??? Is it still possible?

[k8s-ci-robot]

@everpeace: You must be a member of the kubernetes/milestone-maintainers GitHub team to set the milestone. If you believe you should be able to issue the /milestone command, please contact your Milestone Maintainers Team and have them propose you as an additional delegate for this responsibility.

In response to this:

@haircommander Hi, I noticed this KEP has not been lead-opted-in. Would you mind doing this for me??? Is it still possible?

/milestone v1.33

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[haircommander]

we can opt in but the SIG has a lot of work so I'm not sure it will make it at this point.

/label lead-opted-in
/milestone v1.33

[dipesh-rawat]

Hello @everpeace 👋, v1.33 Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 14th February 2025 / 19:00 PDT Thursday 13th February 2025.

This enhancement is targeting stage beta for v1.33 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: v1.33.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here). If your production readiness review is not completed yet, please make sure to fill the production readiness questionnaire in your KEP by the PRR Freeze deadline on Thursday 6th February 2025 so that the PRR team has enough time to review your KEP.

For this KEP, we would need to update the following:

• Update the kep.yaml to reflect the following:

  • Add latest-milestone: v1.33.

• Also, please make sure to update the issue description with the correct stages and PRs. This will assist the release team in tracking progress more effectively.

The status of this enhancement is marked as At risk for enhancements freeze. Please keep the issue description up-to-date with appropriate stages as well.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you!

[everpeace]

we can opt in but the SIG has a lot of work so I'm not sure it will make it at this point.

Thanks! Ok, I understood🙇

[dipesh-rawat]

@everpeace It looks like PR #4895 covers most of the updates we need for inclusion of this KEP in v1.33. To ensure it’s tracked for the release, we also need latest-milestone: "v1.33" updated in kep.yaml (here).

[dipesh-rawat]

Hello @everpeace 👋, 1.33 Enhancements team here,

Now that PRs #4895 #5165 has been merged, all the KEP requirements are in place and merged into k/enhancements, this enhancement is all good for the upcoming enhancements freeze. 🚀

The status of this enhancement is marked as tracked for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

/label tracked/yes

[sreeram-venkitesh]

Hi @everpeace! 👋 v1.33 Docs Shadow here.

Does this enhancement work planned for v1.33 require any new docs or modification to existing docs?

If so, please follow the steps here to open a PR against dev-1.33 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday 27th February 2025 18:00 PDT.

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.

Thank you!

[aibarbetta]

Hi @everpeace👋 -- this is Agustina (@aibarbetta) from the 1.33 Communications Team!

For the 1.33 release, we are currently in the process of collecting and curating a list of potential feature blogs, and we'd love for you to consider writing one for your enhancement!

As you may be aware, feature blogs are a great way to communicate to users about features which fall into (but not limited to) the following categories:

• This introduces some breaking change(s)
• This has significant impacts and/or implications to users
• ...Or this is a long-awaited feature, which would go a long way to cover the journey more in detail 🎉

To opt in to write a feature blog, could you please let us know and open a "Feature Blog placeholder PR" (which can be only a skeleton at first) against the website repository by Wednesday, 5th March, 2025? For more information about writing a blog, please find the blog contribution guidelines 📚

Tip

Some timeline to keep in mind:

• 02:00 UTC Wednesday, 5th March, 2025: Feature blog PR freeze
• Monday, 7th April, 2025: Feature blogs ready for review
• You can find more in the release document

Note

In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we have a final number of feature blogs for this release.