Promote RunAsGroup to Beta by krmayankk · Pull Request #73007 · kubernetes/kubernetes

krmayankk · 2019-01-17T05:52:59Z

What this PR does / why we need it:
promote this feature to beta for 1.14 kubernetes/enhancements#213

API is unchanged
Leave all feature gate checks
Enable it by default

The `RunAsGroup` feature has been promoted to beta and enabled by default. PodSpec and PodSecurityPolicy objects can be used to control the primary GID of containers on supported container runtimes.

/milestone v1.14

krmayankk · 2019-01-17T05:53:42Z

/assign @liggitt @tallclair

krmayankk · 2019-01-17T05:55:15Z

/kind feature

krmayankk · 2019-01-17T05:56:00Z

/sig auth

krmayankk · 2019-01-17T18:39:03Z

/test pull-kubernetes-bazel-test

krmayankk · 2019-01-17T18:39:11Z

/test pull-kubernetes-e2e-kops-aws

liggitt · 2019-01-17T20:08:43Z

are there tests that should be promoted as part of this (so they run in non-alpha CI suites)?
do we have information about which container runtimes support this (and at which versions)? that might be good to include in the release notes
would also be good to go ahead and open a doc PR against the dev-1.14 website branch with doc updates for this and link it here

krmayankk · 2019-01-18T22:16:25Z

@liggitt

are there tests that should be promoted as part of this (so they run in non-alpha CI suites)?

These are the e2e tests for this https://github.com/kubernetes/kubernetes/blob/master/test/e2e/node/security_context.go#L86 . I was told they always run for all CI suites. Trying to find the answer to this on testing

do we have information about which container runtimes support this (and at which versions)? that might be good to include in the release notes

Containerd and CRI-O support this there
Containerd: containerd/cri#710 (Available in v1.0.0-rc.1)
CRI-O: cri-o/cri-o#1601 (Available in v1.13.0)

would also be good to go ahead and open a doc PR against the dev-1.14 website branch with doc updates for this and link it here

kubernetes/website#12297

liggitt · 2019-01-22T15:05:25Z

/assign @tallclair
cc @kubernetes/sig-node-api-reviews for lgtm

These are the e2e tests for this https://github.com/kubernetes/kubernetes/blob/master/test/e2e/node/security_context.go#L86 . I was told they always run for all CI suites. Trying to find the answer to this on testing

The [Feature:RunAsGroup] tag means they do not run in all CI tests, only when explicitly included. If this is being enabled by default, I think the feature tag should be removed from that test.

krmayankk · 2019-01-24T05:36:36Z

Adding @BenTheElder for any insights . I am looking for direction in this area . Should I remove the feature flag from the e2e ?

BenTheElder · 2019-01-24T05:39:46Z

just echoing what @liggitt said, in presubmit for example we exclude [Feature:.*] for feature gated things, if this is no longer feature gated then we should remove that tag from the test

liggitt · 2019-02-22T04:52:19Z

progress! that made those tests actually run, which is good. looks like the selinux one ([k8s.io] [sig-node] Security Context should support volume SELinux relabeling) ~~does not work in the CI environment.~~ edit: it sometimes works, but flakes regularly.

~~@kubernetes/sig-node-pr-reviews do we need to add a [Feature:SELinux] tag to that test specifically, since it doesn't work in all environments?~~

krmayankk · 2019-02-23T18:43:26Z

/test pull-kubernetes-e2e-gce

krmayankk · 2019-02-23T22:25:11Z

@liggitt that seemed like a flake, everything is passing now including the selinux one

liggitt · 2019-02-24T21:01:00Z

/test pull-kubernetes-e2e-gce

BenTheElder · 2019-02-24T22:05:20Z

note: the SELinux one only passed in the last run due to our retry attempts which allows flaky tests to run again >.> https://gubernator.k8s.io/build/kubernetes-jenkins/pr-logs/pull/73007/pull-kubernetes-e2e-gce/69984/#k8sio-sig-node-security-context-should-support-volume-selinux-relabeling-when-using-hostpid

BenTheElder · 2019-02-24T22:06:22Z

and there were two failures from this in: https://gubernator.k8s.io/build/kubernetes-jenkins/pr-logs/pull/73007/pull-kubernetes-e2e-gce/69727/

liggitt · 2019-02-24T22:20:03Z

/test pull-kubernetes-e2e-gce

liggitt · 2019-02-24T22:20:41Z

seems like we should tag the selinux test as [flaky] and open an issue for sig-node or sig-storage to resolve. this seems good to go otherwise

krmayankk · 2019-02-25T02:41:40Z

Added #74482
How do i mark it as flaky, just add the [flaky] tag in the same way we add the feature flag tag ? (my grep didnt return anything in k/k

krmayankk · 2019-02-25T02:45:48Z

How do i mark it as flaky, just add the [flaky] tag in the same way we add the feature flag tag ? (my grep didnt return anything in k/k

ignore this found an example , adding

liggitt · 2019-02-25T08:04:43Z

test/e2e/node/security_context.go

most of these seem specific to Linux... do we need to add [LinuxOnly] to these as some other tests do? xref #73922

cc @spiffxp

per https://kubernetes.slack.com/archives/C09QZ4DQB/p1551136840248100, let's add [LinuxOnly] to the individual tests that make use of linux-only function in the security context (which I think is all of these individual tests):

https://github.com/kubernetes/enhancements/blob/master/keps/sig-windows/20190103-windows-node-support.md#what-will-never-work:

uid (runasuser)

gid (fsgroup, runasgroup, supplementalgroup)

selinux

seccomp

added [LinuxOnly]

liggitt · 2019-03-01T04:57:02Z

/lgtm
/approve

k8s-ci-robot · 2019-03-01T04:57:26Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: krmayankk, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~pkg/features/OWNERS~~ [liggitt]
~~test/e2e/node/OWNERS~~ [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

fejta-bot · 2019-03-01T05:03:11Z

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

fejta-bot · 2019-03-01T08:37:43Z

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

k8s-ci-robot requested review from brendandburns and thockin January 17, 2019 05:53

k8s-ci-robot assigned liggitt and tallclair Jan 17, 2019

k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. and removed needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Jan 17, 2019

k8s-ci-robot added sig/auth Categorizes an issue or PR as relevant to SIG Auth. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Jan 17, 2019

krmayankk mentioned this pull request Jan 17, 2019

Provide RunAsGroup feature for Containers in a Pod kubernetes/enhancements#213

Closed

5 tasks

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 18, 2019

krmayankk force-pushed the runasgroup branch from d4eddce to 1185630 Compare January 18, 2019 21:54

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 18, 2019

k8s-ci-robot added sig/node Categorizes an issue or PR as relevant to SIG Node. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API labels Jan 22, 2019

krmayankk force-pushed the runasgroup branch from 465a358 to 9c300ff Compare February 22, 2019 02:36

krmayankk mentioned this pull request Feb 25, 2019

E2E Nodes tests for SELinux relabelling and SELinux relabelling when using hostPID are flaky #74482

Closed

krmayankk force-pushed the runasgroup branch from 9c300ff to c6fd62a Compare February 25, 2019 02:49

smarterclayton mentioned this pull request Feb 25, 2019

DO NOT MERGE: Re-enable a chunk of tests that should probably be working now openshift/origin#22143

Closed

krmayankk force-pushed the runasgroup branch from c6fd62a to 75e312e Compare February 25, 2019 03:51

liggitt reviewed Feb 25, 2019

View reviewed changes

krmayankk force-pushed the runasgroup branch from 75e312e to 1b12512 Compare March 1, 2019 01:24

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Mar 1, 2019

Promote RunAsGroup to Beta

1b12512

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 1, 2019

liggitt removed the api-review Categorizes an issue or PR as actively needing an API review. label Mar 1, 2019

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 1, 2019

k8s-ci-robot merged commit 8c95a07 into kubernetes:master Mar 1, 2019

pdecat mentioned this pull request Apr 25, 2019

Add run_as_group to container security contexts attributes hashicorp/terraform-provider-kubernetes#414

Merged

mikkeloscar mentioned this pull request Jul 16, 2019

Update to Kubernetes v1.14 zalando-incubator/kubernetes-on-aws#2175

Merged

15 tasks

Conversation

krmayankk commented Jan 17, 2019 • edited by tallclair Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

krmayankk commented Jan 17, 2019

Uh oh!

krmayankk commented Jan 17, 2019

Uh oh!

krmayankk commented Jan 17, 2019

Uh oh!

krmayankk commented Jan 17, 2019

Uh oh!

krmayankk commented Jan 17, 2019

Uh oh!

liggitt commented Jan 17, 2019

Uh oh!

krmayankk commented Jan 18, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

liggitt commented Jan 22, 2019

Uh oh!

krmayankk commented Jan 24, 2019

Uh oh!

BenTheElder commented Jan 24, 2019

Uh oh!

liggitt commented Feb 22, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

krmayankk commented Feb 23, 2019

Uh oh!

krmayankk commented Feb 23, 2019

Uh oh!

liggitt commented Feb 24, 2019

Uh oh!

BenTheElder commented Feb 24, 2019

Uh oh!

BenTheElder commented Feb 24, 2019

Uh oh!

liggitt commented Feb 24, 2019

Uh oh!

liggitt commented Feb 24, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

krmayankk commented Feb 25, 2019

Uh oh!

krmayankk commented Feb 25, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

liggitt Feb 25, 2019

Choose a reason for hiding this comment

Uh oh!

liggitt Feb 26, 2019

Choose a reason for hiding this comment

Uh oh!

krmayankk Mar 1, 2019

Choose a reason for hiding this comment

Uh oh!

liggitt commented Mar 1, 2019

Uh oh!

k8s-ci-robot commented Mar 1, 2019

Uh oh!

fejta-bot commented Mar 1, 2019

Uh oh!

fejta-bot commented Mar 1, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

krmayankk commented Jan 17, 2019 •

edited by tallclair

Loading

krmayankk commented Jan 18, 2019 •

edited

Loading

liggitt commented Feb 22, 2019 •

edited

Loading

liggitt commented Feb 24, 2019 •

edited

Loading

krmayankk commented Feb 25, 2019 •

edited

Loading