KEP: Promote sysctl annotations to fields #2093

ingvagabund · 2018-04-30T13:29:12Z

Setting the sysctl parameters through annotations provided a successful story
for defining better constraints of running applications.
The sysctl feature has been tested by a number of people without any serious
complaints. Promoting the annotations to fields (i.e. to beta) is another step in making the
sysctl feature closer towards the stable API.

ingvagabund · 2018-04-30T15:43:59Z

@sjenning @derekwaynecarr @sttts

sjenning · 2018-04-30T16:11:25Z

Thanks Jan 👍

/sig node

php-coder · 2018-04-30T16:47:20Z

keps/0008-20180430-promote-sysctl-annotations-to-fields.md

+authors:
+  - "@ingvagabund"
+owning-sig: sig-node
+participating-sigs:


As it touches PSP, I think that we may mention sig-auth here.

php-coder · 2018-04-30T16:59:55Z

keps/0008-20180430-promote-sysctl-annotations-to-fields.md

+// SecurityContext holds security configuration that will be applied to a container.
+// Some fields are present in both SecurityContext and PodSecurityContext.  When both
+// are set, the values in SecurityContext take precedence.
+type SecurityContext struct {


SecurityContext is for container-scoped restrictions. If we want to make it pod-scoped only, we need to modify PodSecurityContext instead.

php-coder · 2018-04-30T17:01:01Z

@ingvagabund Thank you for working on this!

php-coder · 2018-04-30T17:01:29Z

/sig auth

derekwaynecarr · 2018-05-01T02:56:49Z

Please add section for following:

How to enable unsafe sysctls on node should move away from an experimental flag and become kubelet config api option

derekwaynecarr · 2018-05-01T03:09:04Z

The original support predates feature gates, but it’s move to first class fields should come with feature gate. Can you add details on feature gate?

ingvagabund · 2018-05-02T13:11:54Z

@derekwaynecarr updated, PTAL

derekwaynecarr

please just make the one update so this doc is a record of changes rather than link to various WIP prs and dev branches.

this is then LGTM from me.

derekwaynecarr · 2018-05-07T18:04:33Z

keps/0008-20180430-promote-sysctl-annotations-to-fields.md

+
+Upstream issue: https://github.com/kubernetes/kubernetes/issues/61669
+
+### Gate the feature


Please just state what the feature gate flag is and the default behavior.

I have no problem with what @sjenning has started, but this document will be read in the future and linking out like that is painful for future readers.

derekwaynecarr · 2018-05-07T18:08:16Z

/cc @kubernetes/sig-node-proposals

this is the document that describes the promotion of sysctl to fields for beta support.

if folks have any comments, please provide them this week

sttts · 2018-05-08T06:21:33Z

Lgtm.

derekwaynecarr · 2018-05-14T23:11:56Z

Thank you for the updates @ingvagabund

/approve
/lgtm

k8s-ci-robot · 2018-05-14T23:12:02Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: derekwaynecarr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~keps/OWNERS~~ [derekwaynecarr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sttts · 2018-05-15T09:35:40Z

🎉

php-coder · 2018-05-30T16:42:12Z

After 2 weeks after merge, it became outdated. Do we care about making it up-to-date?

…-to-fields Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Promote sysctl annotations to fields # **What this PR does / why we need it**: Promoting experimental sysctl feature from annotations to API fields. **Special notes for your reviewer**: Following sysctl KEP: kubernetes/community#2093 **Release note**: ```release-note The Sysctls experimental feature has been promoted to beta (enabled by default via the `Sysctls` feature flag). PodSecurityPolicy and Pod objects now have fields for specifying and controlling sysctls. Alpha sysctl annotations will be ignored by 1.11+ kubelets. All alpha sysctl annotations in existing deployments must be converted to API fields to be effective. ``` **TODO**: * [x] - Promote sysctl annotation in Pod spec * [x] - Promote sysctl annotation in PodSecuritySpec spec * [x] - Feature gate the sysctl * [x] - Promote from alpha to beta * [x] - docs PR - kubernetes/website#8804

…-to-fields Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Promote sysctl annotations to fields # **What this PR does / why we need it**: Promoting experimental sysctl feature from annotations to API fields. **Special notes for your reviewer**: Following sysctl KEP: kubernetes/community#2093 **Release note**: ```release-note The Sysctls experimental feature has been promoted to beta (enabled by default via the `Sysctls` feature flag). PodSecurityPolicy and Pod objects now have fields for specifying and controlling sysctls. Alpha sysctl annotations will be ignored by 1.11+ kubelets. All alpha sysctl annotations in existing deployments must be converted to API fields to be effective. ``` **TODO**: * [x] - Promote sysctl annotation in Pod spec * [x] - Promote sysctl annotation in PodSecuritySpec spec * [x] - Feature gate the sysctl * [x] - Promote from alpha to beta * [x] - docs PR - kubernetes/website#8804 Kubernetes-commit: b6f75ac30e863531ac73cfd02a0edd57983cc5c0

thockin · 2018-06-25T19:20:59Z

keps/0008-20180430-promote-sysctl-annotations-to-fields.md

+      sysctls:
+      - name: kernel.shm_rmid_forced
+        value: 1
+      - name: net.ipv4.route.min_pmtu


Why are networking-related knobs in the security context? This seems like the wrong structure to me?

…notations-kep KEP: Promote sysctl annotations to fields

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Apr 30, 2018

k8s-ci-robot requested review from calebamiles and jbeda April 30, 2018 13:29

k8s-ci-robot added sig/architecture Categorizes an issue or PR as relevant to SIG Architecture. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 30, 2018

ingvagabund force-pushed the promote-sysctl-annotations-kep branch 6 times, most recently from 7df25db to 07982e8 Compare April 30, 2018 14:32

ingvagabund mentioned this pull request Apr 30, 2018

Add sysctl support kubernetes/enhancements#34

Closed

20 tasks

ingvagabund force-pushed the promote-sysctl-annotations-kep branch 5 times, most recently from 395afcf to a6f2178 Compare April 30, 2018 15:42

ingvagabund changed the title ~~WIP: Promote sysctl annotations to fields~~ KEP: Promote sysctl annotations to fields Apr 30, 2018

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 30, 2018

k8s-ci-robot added the sig/node Categorizes an issue or PR as relevant to SIG Node. label Apr 30, 2018

php-coder reviewed Apr 30, 2018

View reviewed changes

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Apr 30, 2018

ingvagabund force-pushed the promote-sysctl-annotations-kep branch 3 times, most recently from 94b9345 to b90d346 Compare May 2, 2018 13:10

derekwaynecarr suggested changes May 7, 2018

View reviewed changes

k8s-ci-robot added the kind/design Categorizes issue or PR as related to design. label May 7, 2018

ingvagabund force-pushed the promote-sysctl-annotations-kep branch 2 times, most recently from afdcc25 to ce422be Compare May 10, 2018 12:01

KEP: Promote sysctl annotations to fields

6d6bfda

ingvagabund force-pushed the promote-sysctl-annotations-kep branch from ce422be to 6d6bfda Compare May 10, 2018 12:49

ingvagabund mentioned this pull request May 14, 2018

Promote sysctl annotations to fields kubernetes/kubernetes#63717

Merged

5 tasks

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 14, 2018

derekwaynecarr approved these changes May 14, 2018

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 14, 2018

k8s-ci-robot merged commit 5f826e3 into kubernetes:master May 14, 2018

ingvagabund deleted the promote-sysctl-annotations-kep branch May 18, 2018 07:59

ingvagabund mentioned this pull request May 24, 2018

WIP: Promote sysctl annotations to fields (pointer to array variant) kubernetes/kubernetes#64264

Closed

4 tasks

thockin reviewed Jun 25, 2018

View reviewed changes

jdumars mentioned this pull request Jul 12, 2018

KEP #8(dup): Promote sysctl annotations to fields kubernetes-retired/architecture-tracking#33

Closed

calebamiles pushed a commit to calebamiles/community that referenced this pull request Sep 5, 2018

Merge pull request kubernetes#2093 from ingvagabund/promote-sysctl-an…

ee5958a

…notations-kep KEP: Promote sysctl annotations to fields

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

KEP: Promote sysctl annotations to fields #2093

KEP: Promote sysctl annotations to fields #2093

ingvagabund commented Apr 30, 2018 •

edited

Loading

ingvagabund commented Apr 30, 2018

sjenning commented Apr 30, 2018

php-coder Apr 30, 2018

php-coder Apr 30, 2018

php-coder commented Apr 30, 2018

php-coder commented Apr 30, 2018

derekwaynecarr commented May 1, 2018

derekwaynecarr commented May 1, 2018

ingvagabund commented May 2, 2018

derekwaynecarr left a comment

derekwaynecarr May 7, 2018

ingvagabund May 10, 2018

derekwaynecarr commented May 7, 2018

sttts commented May 8, 2018

derekwaynecarr commented May 14, 2018

k8s-ci-robot commented May 14, 2018

sttts commented May 15, 2018

php-coder commented May 30, 2018

thockin Jun 25, 2018


		Upstream issue: https://github.com/kubernetes/kubernetes/issues/61669

		### Gate the feature

KEP: Promote sysctl annotations to fields #2093

KEP: Promote sysctl annotations to fields #2093

Conversation

ingvagabund commented Apr 30, 2018 • edited Loading

ingvagabund commented Apr 30, 2018

sjenning commented Apr 30, 2018

php-coder Apr 30, 2018

Choose a reason for hiding this comment

php-coder Apr 30, 2018

Choose a reason for hiding this comment

php-coder commented Apr 30, 2018

php-coder commented Apr 30, 2018

derekwaynecarr commented May 1, 2018

derekwaynecarr commented May 1, 2018

ingvagabund commented May 2, 2018

derekwaynecarr left a comment

Choose a reason for hiding this comment

derekwaynecarr May 7, 2018

Choose a reason for hiding this comment

ingvagabund May 10, 2018

Choose a reason for hiding this comment

derekwaynecarr commented May 7, 2018

sttts commented May 8, 2018

derekwaynecarr commented May 14, 2018

k8s-ci-robot commented May 14, 2018

sttts commented May 15, 2018

php-coder commented May 30, 2018

thockin Jun 25, 2018

Choose a reason for hiding this comment

ingvagabund commented Apr 30, 2018 •

edited

Loading