Kubernetes system components logs sanitization

[44past4]

Enhancement Description

• One-line enhancement description: Introduce a logging filter which could be applied to all Kubernetes system components logs to prevent various types of sensitive information from leaking via logs
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-instrumentation/1753-logs-sanitization
• Primary contact (assignee): @44past4
• Responsible SIGs: sig-instrumentation
• Enhancement target (which target equals to which milestone):
  • Alpha release target (1.20)
  • Beta release target (N/A)
  • Stable release target (N/A)
  • Deprecation target (1.24)

[44past4]

/sig intrumentation

[k8s-ci-robot]

@44past4: The label(s) sig/intrumentation cannot be applied, because the repository doesn't have them

In response to this:

/sig intrumentation

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[44past4]

/sig instrumentation

[44past4]

/kind kep
/kind feature

[palnabarun]

Hey there @44past4 -- 1.19 Enhancements Lead here. I wanted to check in and see if you think this Enhancement will be graduating to Alpha in 1.19?

In order to have this part of the release:

1. The KEP PR must be merged in an implementable state
2. The KEP must have test plans
3. The KEP must have graduation criteria.

As an additional note, #1620 merged recently, adding production readiness review questions to the KEP template. We are not making it mandatory for the 1.19 release cycle, but it would be great if the PRR questionnaire is filled since the KEP PR is in flight.

If you do, I'll add it to the 1.19 tracking sheet (http://bit.ly/k8s-1-19-enhancements). Once coding begins please list all relevant k/k PRs in this issue so they can be tracked properly. 👍

Thanks! 🙂

---

The current release schedule is:

• Monday, April 13: Week 1 - Release cycle begins
• Tuesday, May 19: Week 6 - Enhancements Freeze
• Thursday, June 25: Week 11 - Code Freeze
• Thursday, July 9: Week 14 - Docs must be completed and reviewed
• Tuesday, August 4: Week 17 - Kubernetes v1.19.0 released

[palnabarun]

Hi @44past4 ,

Tomorrow, Tuesday May 19 EOD Pacific Time is Enhancements Freeze

Will this enhancement be part of the 1.19 release cycle?

[palnabarun]

@44past4 -- Unfortunately, the deadline for the 1.19 Enhancement freeze has passed. For now, this is being removed from the milestone and 1.19 tracking sheet. If there is a need to get this in, please file an enhancement exception.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[palnabarun]

/remove-lifecycle stale

[kikisdeliveryservice]

Hi @44past4

Enhancements Lead here. Any plans for this in 1.20?

Thanks!
Kirsten

[44past4]

Yes, we plan to work on this in 1.20.

[ehashman]

/milestone v1.20

[kikisdeliveryservice]

Thanks @44past4

Also, as a reminder to be included in a release:

• The KEP must be merged in an implementable state <- yours is currently provisional see: https://github.com/kubernetes/enhancements/blob/master/keps/sig-instrumentation/1753-logs-sanitization/kep.yaml
• The KEP must have test plans
• The KEP must have graduation criteria.

I've also updated the description to link directly to the merged KEP.

Best,
Kirsten

[ehashman]

/wg security-audit

[MorrisLaw]

Hey @44past4 - 1.20 Enhancements Shadow here 👋

Just a friendly reminder, Enhancements Freeze is October 6th and if this KEP is intended for the 1.20 release, it still needs the following:

• The KEP must be merged in an implementable state <- yours is currently provisional. Please update this: https://github.com/kubernetes/enhancements/blob/master/keps/sig-instrumentation/1753-logs-sanitization/kep.yaml#L8
• The KEP must have test plans <- this section is currently empty. Please update this: https://github.com/kubernetes/enhancements/blame/master/keps/sig-instrumentation/1753-logs-sanitization/README.md#L199-L200

[ehashman]

@44past4 please ensure you have opened a PR to address the above so this can be reviewed and merged by the enhancements freeze deadline, Oct. 6.

[ehashman]

/assign
for deprecation

[ehashman]

/kind deprecation
/remove-kind kep feature
/milestone v1.24

[Priyankasaggu11929]

Hello @44past4 👋, 1.24 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00pm PT on Thursday Feb 3rd, 2022. This enhancement is targeting for deprecation for 1.24, is this correct?

Here’s where this enhancement currently stands:

• Updated KEP file using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for this release
  • For record: KEP is already implemented at stage alpha & now marked for deprecation.
• KEP has a test plan section filled out.
• KEP has up to date graduation criteria.
• KEP has a production readiness review that has been completed and merged into k/enhancements.

Looks like for this one, we would just need to update the following:

• update https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/1753-logs-sanitization#implementation-history (kep implementation history) to reflect the latest deprecation timeline (if required?)
• add a production readiness review (PRR) section for this enhancement
  • Actually, I want to confirm whether a PRR approval is required for deprecation phase or not? (@ehashman could you please confirm on this? Thank you so much!)

At the moment, the status of this enhancement is track as at risk. Please keep the issue description updated. Thank you!

[ehashman]

Hi @Priyankasaggu11929,

No PRR questionnaire is required for deprecations. I will update the KEP at some point with the implementation history.

The PR removing the feature kubernetes/kubernetes#107207 is now merged.

[Priyankasaggu11929]

@ehashman, Thanks so much for the clarification on PRR bit above ^ .

No PRR questionnaire is required for deprecations. I will update the KEP at some point with the implementation history.

With this, I will update the status of this enhancement to Tracked in the tracking sheet. It is all good for the upcoming 1.24 enhancements freeze. 🚀

[ehashman]

The only thing remaining for this is to update the website documentation to remove references to this feature.

[chrisnegus]

Hi @44past4 👋 1.24 Docs shadow here.

This enhancement is marked as 'Needs Docs' for the 1.24 release.

Please follow the steps detailed in the documentation to open a PR against the dev-1.24 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thu March 31, 11:59 PM PDT.

Also, if needed take a look at Documenting for a release to familiarize yourself with the docs requirement for the release.

Thanks!

[chrisnegus]

@ehashman @Priyankasaggu11929 Are either of you expecting to do the documentation updates to remove this feature. I would be happy to work on doing the actual removal of this feature from the docs if you like.

[ehashman]

@husky-parul is going to do the documentation work for this. She'll update the website docs with the deprecation/removal.

[Priyankasaggu11929]

Hello @44past4 @husky-parul 👋

I'm just checking in once more as we approach the 1.24 Code Freeze on 18:00 PDT, Tuesday, March 29th 2022

Please ensure the following items are completed:

• All PRs to the Kubernetes repo that are related to your enhancement are merged by the code freeze deadline.
  • Deprecate dynamic log sanitization kubernetes#107207
• Have a documentation placeholder PR open by 18:00 PDT, Thursday, March 31, 2022.

For note, the status of this enhancement is currently marked as tracked.

Kindly please let me know if I'm missing any open PRs other than the ones I linked above. Thank you so much!

[chrisnegus]

@husky-parul is going to do the documentation work for this. She'll update the website docs with the deprecation/removal.

Thanks @ehashman !

[husky-parul]

Apologies for the delayed response. I am on PTO until March 22. I will get this done soon after that. Thanks

…

Sent from my iPhone

On Mar 19, 2022, at 8:22 PM, Chris Negus ***@***.***> wrote:  @husky-parul is going to do the documentation work for this. She'll update the website docs with the deprecation/removal. Thanks @ehashman ! — Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android. You are receiving this because you were mentioned.

[valaparthvi]

Hi @ehashman 👋 1.24 Release Comms team here.

We have an opt-in process for the feature blog delivery. If you would like to publish a feature blog for this issue in this cycle, then please opt in on this tracking sheet.

The deadline for submissions and the feature blog freeze is scheduled for 01:00 UTC Wednesday 23rd March 2022 / 18:00 PDT Tuesday 22nd March 2022. Other important dates for delivery and review are listed here: https://github.com/kubernetes/sig-release/tree/master/releases/release-1.24#timeline.

For reference, here is the blog for 1.23.

Please feel free to reach out any time to me or on the #release-comms channel with questions or comments.

Thanks!

[chrisnegus]

Apologies for the delayed response. I am on PTO until March 22. I will get this done soon after that. Thanks

Thanks @husky-parul! There is still time before the March 31 deadline to open a placeholder PR. Let me know if you have any questions.

[chrisnegus]

@husky-parul Thanks for filing the draft PR!

[ehashman]

As the KEP stage was already updated and all associated PRs have closed, this issue can now be closed!

/close

[k8s-ci-robot]

@ehashman: Closing this issue.

In response to this:

As the KEP stage was already updated and all associated PRs have closed, this issue can now be closed!

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.