Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support for Encrypted Images in Kubernetes #1067

Closed
harche opened this issue May 17, 2019 · 28 comments
Closed

Support for Encrypted Images in Kubernetes #1067

harche opened this issue May 17, 2019 · 28 comments
Labels
sig/architecture Categorizes an issue or PR as relevant to SIG Architecture. sig/node Categorizes an issue or PR as relevant to SIG Node. stage/alpha Denotes an issue tracking an enhancement targeted for Alpha status

Comments

@harche
Copy link
Contributor

harche commented May 17, 2019 •
edited
Loading

Enhancement Description

/sig node
/sig architecture
@k8s-ci-robot k8s-ci-robot added the needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. label May 17, 2019
@harche
Copy link
Contributor Author

harche commented May 17, 2019

/sig node
/sig architecture

@k8s-ci-robot k8s-ci-robot added sig/node Categorizes an issue or PR as relevant to SIG Node. sig/architecture Categorizes an issue or PR as relevant to SIG Architecture. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels May 17, 2019
This was referenced May 17, 2019
Closed
Closed
@harche harche mentioned this issue Jun 13, 2019
Closed
@harche
Copy link
Contributor Author

harche commented Jun 14, 2019

/cc @tallclair

@kacole2
Copy link

kacole2 commented Jul 9, 2019

/stage alpha
/milestone v1.16

Hi @@harche, I'm the 1.16 Enhancement Lead. I've added this to the 1.16 Tracking Spreadsheet.

Once coding begins or if it already has, please list all relevant k/k PRs in this issue so they can be tracked properly.

As a reminder, every enhancement requires a KEP in an implementable state with Graduation Criteria explaining each alpha/beta/stable stages requirements.

Milestone dates are Enhancement Freeze 7/30 and Code Freeze 8/29.

@k8s-ci-robot k8s-ci-robot added this to the v1.16 milestone Jul 9, 2019
@k8s-ci-robot k8s-ci-robot added the stage/alpha Denotes an issue tracking an enhancement targeted for Alpha status label Jul 9, 2019
@kacole2 kacole2 added the tracked/yes Denotes an enhancement issue is actively being tracked by the Release Team label Jul 9, 2019
@harche
Copy link
Contributor Author

harche commented Jul 10, 2019

Thanks @kacole2

@kacole2
Copy link

kacole2 commented Jul 29, 2019

@harche this is a reminder that Enhancement Freeze is tomorrow and this keep needs to be merged by EOD. Thanks

@harche
Copy link
Contributor Author

harche commented Jul 31, 2019

@kacole2 After the discussion in the sig-node call last Tuesday it was suggested that we should target 1.17 instead of 1.16 for this feature.

@kacole2
Copy link

kacole2 commented Jul 31, 2019

/milestone v1.17

@k8s-ci-robot k8s-ci-robot modified the milestones: v1.16, v1.17 Jul 31, 2019
@kacole2 kacole2 added tracked/no Denotes an enhancement issue is NOT actively being tracked by the Release Team and removed tracked/yes Denotes an enhancement issue is actively being tracked by the Release Team labels Jul 31, 2019
@mrbobbytables
Copy link
Member

Hey there @harche -- 1.17 Enhancements lead here. I wanted to check in and see if you think this Enhancement will be graduating to alpha in 1.17?

Just a reminder that for it to be accepted -- the KEP must be merged, in an implementable state and have both a test plan and graduation criteria defined before the Enhancement Freeze.

The current release schedule is:

Monday, September 23 - Release Cycle Begins
Tuesday, October 15, EOD PST - Enhancements Freeze
Thursday, November 14, EOD PST - Code Freeze
Tuesday, November 19 - Docs must be completed and reviewed
Monday, December 9 - Kubernetes 1.17.0 Released

If you do, once coding begins please list all relevant k/k PRs in this issue so they can be tracked properly. 👍

Thanks!

@jeremyrickard
Copy link
Contributor

👋 Hey @harche, enhancements team here! We wanted to check in again and see if you're still targeting 1.17 for this? The enhancements freeze is right around the corner (EOD PT, October 15th) and you''ll need to have your KEP merged by then. It looks like you're still waiting on some reviews?

@lumjjb
Copy link

lumjjb commented Oct 11, 2019

Yea - we are... unfortunately there seems to be some delay on getting the api review started :(. We have been trying to reach out the the reviewers on #1066. But no progress yet. Fingers crossed.

@mrbobbytables mrbobbytables added tracked/yes Denotes an enhancement issue is actively being tracked by the Release Team and removed tracked/no Denotes an enhancement issue is NOT actively being tracked by the Release Team labels Oct 14, 2019
@jeremyrickard
Copy link
Contributor

@lumjjb - Unfortunately the deadline for the 1.17 Enhancement freeze has passed and the KEP is still not merged. For now this is being removed from the milestone and 1.17 tracking sheet. If there is a need to get this in, please file an enhancement exception.

@jeremyrickard
Copy link
Contributor

/milestone clear

@k8s-ci-robot k8s-ci-robot removed this from the v1.17 milestone Oct 16, 2019
@jeremyrickard jeremyrickard removed the tracked/yes Denotes an enhancement issue is actively being tracked by the Release Team label Oct 16, 2019
@jeremyrickard jeremyrickard added the tracked/no Denotes an enhancement issue is NOT actively being tracked by the Release Team label Oct 16, 2019
@lumjjb
Copy link

lumjjb commented Oct 16, 2019

Thanks @jeremyrickard for the followup! Should hopefully meet the deadline for 1.18!

@kikisdeliveryservice
Copy link
Member

Hey there @lumjjb @harche -- 1.18 Enhancements shadow here. I wanted to check in and see if you think this Enhancement will be graduating to alpha|beta|stable in 1.18?
The current release schedule is:
Monday, January 6th - Release Cycle Begins
Tuesday, January 28th EOD PST - Enhancements Freeze
Thursday, March 5th, EOD PST - Code Freeze
Monday, March 16th - Docs must be completed and reviewed
Tuesday, March 24th - Kubernetes 1.18.0 Released
To be included in the release, this enhancement must have a merged KEP in the implementable status. The KEP must also have graduation criteria and a Test Plan defined.
If you would like to include this enhancement, once coding begins please list all relevant k/k PRs in this issue so they can be tracked properly. 👍
We'll be tracking enhancements here: http://bit.ly/k8s-1-18-enhancements
Thanks!

@harche
Copy link
Contributor Author

harche commented Jan 14, 2020

@kikisdeliveryservice this enhancement will not be graduating in 1.18.

@kikisdeliveryservice
Copy link
Member

thanks @harche !

@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 13, 2020
@palnabarun
Copy link
Member

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 13, 2020
@kikisdeliveryservice
Copy link
Member

Hi @harche @lumjjb !

1.19 Enhancements shadow here. I wanted to check in and see if you think this Enhancement will be graduating in 1.19?

In order to have this part of the release:

The KEP PR must be merged in an implementable state
The KEP must have test plans
The KEP must have graduation criteria.

The current release schedule is:

Monday, April 13: Week 1 - Release cycle begins
Tuesday, May 19: Week 6 - Enhancements Freeze
Thursday, June 25: Week 11 - Code Freeze
Thursday, July 9: Week 14 - Docs must be completed and reviewed
Tuesday, August 4: Week 17 - Kubernetes v1.19.0 released

Please let me know and I'll add it to the 1.19 tracking sheet (http://bit.ly/k8s-1-19-enhancements). Once coding begins please list all relevant k/k PRs in this issue so they can be tracked properly. 👍

Thanks!

@harche
Copy link
Contributor Author

harche commented May 4, 2020

@kikisdeliveryservice We aren't targeting 1.19 at for this enhancement.

@kikisdeliveryservice
Copy link
Member

thanks for the update @harche !

@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 2, 2020
@palnabarun
Copy link
Member

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Sep 1, 2020
@kikisdeliveryservice
Copy link
Member

Hi @harche

Enhancements Lead here. Any plans for this in 1.20?

Thanks!
Kirsten

@harche
Copy link
Contributor Author

harche commented Sep 14, 2020

@kikisdeliveryservice thanks for reaching out. We aren't planning this for 1.20.

@harche
Copy link
Contributor Author

harche commented Sep 14, 2020

I am going to close this for now. If we ever decide to revive this in future, I will reopen this issue.

@harche harche closed this as completed Sep 14, 2020
@kikisdeliveryservice kikisdeliveryservice removed the tracked/no Denotes an enhancement issue is NOT actively being tracked by the Release Team label Sep 14, 2020
@danmx
Copy link

danmx commented Mar 8, 2021

Hi, what's the status and do you need any help?

@lumjjb
Copy link

lumjjb commented Mar 8, 2021

Hi @danmx ! Currently, the enablement of the feature in crio/containerd is via an operator: https://github.com/IBM/k8s-enc-image-operator

This is a talk we did at kubecon a while back: https://kccnceu20.sched.com/event/Zepc, has a demo and some more info.

There is definitely potential for more native support and per service account/namespace decryption, but there hasn't been an ask for it yet.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
sig/architecture Categorizes an issue or PR as relevant to SIG Architecture. sig/node Categorizes an issue or PR as relevant to SIG Node. stage/alpha Denotes an issue tracking an enhancement targeted for Alpha status
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[WIP] Adding support for encrypted container images harche/kubernetes
10 participants
@lumjjb @kacole2 @kikisdeliveryservice @mrbobbytables @palnabarun @danmx @harche @k8s-ci-robot @fejta-bot @jeremyrickard