CSR Duration

[enj]

Enhancement Description

• One-line enhancement description (can be used as a release note): CSR Duration

• Kubernetes Enhancement Proposal: KEP

• Discussion Link:

  • CSR API: cluster signing duration is not flexible and has unsafe defaulting kubernetes#92678
  • SIG Auth 2021-03-17 Meeting
  • SIG Auth 2021-05-26 Meeting

• Primary contact (assignee): @enj

• Responsible SIGs: Auth

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): (skipped)
  • Beta release target (x.y): v1.22
  • Stable release target (x.y): v1.24

• Beta

  • KEP (k/enhancements) update PR(s):
    • CSR Duration KEP #2788
    • KEP-2784: Update CSR Duration KEP to match implementation #2820
  • Code (k/k) update PR(s):
    • csr: correctly handle backdating of short lived certs kubernetes#99412
    • csr: add expirationSeconds field to control cert lifetime kubernetes#99494
  • Docs (k/website) update(s): Update CSR docs with expirationSeconds field details website#28070

• Stable

  • KEP (k/enhancements) update PR(s):
    • KEP-2784: Update CSR Duration KEP with GA details #3197
    • KEP-2784: CSR Duration: address all GA items #3250
    • KEP-2784: CSR Duration: mark as implemented #3253
  • Code (k/k) update PR(s):
    • Promote CertificateSigningRequest's Spec.ExpirationSeconds field to GA kubernetes#108782
  • Docs (k/website) update(s):
    • Graduate CSRDuration to GA website#32405

[kikisdeliveryservice]

As this is being submitted well after the enhancments freeze author has submitted an exception request:
https://groups.google.com/g/kubernetes-sig-release/c/UZUQAIfizkY/m/0g3TxofwAwAJ

removing from milestone until it is evaluated.

[kikisdeliveryservice]

As per a comment here:
kubernetes/kubernetes#99412 (comment)

kubernetes/kubernetes#99412 is a bug fix (and prereq for this KEP) that will go into the 1.22 release regardless of whether or not this KEP (and other associate work) is included in the 1.22 release.

[kikisdeliveryservice]

The exception request to the enhancements freeze for this KEP has been approved: https://groups.google.com/g/kubernetes-sig-release/c/UZUQAIfizkY/m/PIyu2HBZBQAJ

@JamesLaverack can you please ensure the KEP is tracked?

Once the KEP is finished/merged, we can remove the holds from the implementation PRs.

[supriya-premkumar]

Thank you @kikisdeliveryservice! This is now being tracked.

[supriya-premkumar]

Hi @enj 👋🏽. This is Supriya, 1.22 Enhancements Shadow here.

Code Freeze is on July 8th, 2021 at EOD PST. After your KEP is approved and merged, all implementation PRs must be code complete and merged before the deadline. If PRs are not merged by code freeze, they will be removed from the 1.22 milestone.

Please keep us in the loop if anything changes. Thank you.

[supriya-premkumar]

Hi @enj, just a reminder that we are one week away from the code freeze(July 8th, 2021) and I see that the PR is yet to be merged, due to this the issue will still be marked as atRisk for 1.22 Release.

[enj]

Hi @enj, just a reminder that we are one week away from the code freeze(July 8th, 2021) and I see that the PR is yet to be merged, due to this the issue will still be marked as atRisk for 1.22 Release.

@supriya-premkumar kubernetes/kubernetes#99494 is merged now.

[supriya-premkumar]

That's awesome. Thank you @enj
This is now on track for the 1.22 code freeze 🎉

[enj]

All items for beta are complete.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[enj]

/remove-lifecycle stale
/milestone v1.24

[gracenng]

Hi @enj ! 1.24 Enhancements team here. Just checking in as we approach enhancements freeze on 18:00pm PT on Thursday Feb 3rd. This enhancements is targeting stable for 1.24
Here’s where this enhancement currently stands:

• Updated KEP file using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for this release with latest-milestone: 1.24
• KEP has a test plan section filled out.
• KEP has up to date graduation criteria.
• KEP has a production readiness review that has been completed and merged into k/enhancements.

The status of this enhancement is track as `at risk
Thanks!

[enj]

@gracenng I have opened #3197 to address the missing items for 1.24. Let me know if I need to do anything else.

[gracenng]

The status for 1.24 Enhancementsis now tracked 🥳

[chrisnegus]

Hi @enj 👋 1.24 Docs shadow here.

This enhancement is marked as 'Needs Docs' for the 1.24 release.

Please follow the steps detailed in the documentation to open a PR against the dev-1.24 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thu March 31, 11:59 PM PDT.

Also, if needed take a look at Documenting for a release to familiarize yourself with the docs requirement for the release.

Thanks!

[katcosgrove]

Hey there! Comms shadow here. Would y'all like to have this included in the deprecations and removal blog for 1.24? Here's what it looked like for 1.22: https://kubernetes.io/blog/2021/07/14/upcoming-changes-in-kubernetes-1-22/

[enj]

Hey there! Comms shadow here. Would y'all like to have this included in the deprecations and removal blog for 1.24? Here's what it looked like for 1.22: https://kubernetes.io/blog/2021/07/14/upcoming-changes-in-kubernetes-1-22/

We are not deprecating or removing anything from the CSR API with this KEP so I do not believe it needs to be included. Thanks!

[gracenng]

Hi @enj 1.24 Enhancements Team here,

With Code Freeze approaching on 18:00 PDT Tuesday March 29th 2022, the enhancement status is at risk as there is no linked k/k PR. Kindly list them in this issue. Thanks!

[katcosgrove]

Hey y'all! It's me again, comms shadow. We're approaching last call for feature blogs, as the freeze is Wednesday, March 23. If you would like to have a feature blog for this, please add it to the tracking sheet and reach out to me if you have any questions. Thank you!

[enj]

@gracenng @chrisnegus all code, docs, etc for this KEP are complete and it is marked as implemented. I believe we can close this tracking issue 🥳