Add deprecation warnings for enforce-mountable-secrets annotation #48771

ritazh · 2024-11-19T17:11:17Z

Description

Add warnings for deprecated kubernetes.io/enforce-mountable-secrets annotation. Encourage the use of separate namespaces when isolation is desired.

Issue

Closes: #

/sig auth
/cc @liggitt

netlify · 2024-11-19T17:11:33Z

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	`3b8c927`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/673ea26cbadbd20008d86558

netlify · 2024-11-19T17:20:27Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`3b8c927`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/673ea26c7e78e500087efdc9
😎 Deploy Preview	https://deploy-preview-48771--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

liggitt · 2024-11-19T17:28:33Z

/lgtm
for technical content

k8s-ci-robot · 2024-11-19T17:28:40Z

LGTM label has been added.

Git tree hash: 8b403a873f69216ce71d77033b385d7d24d13ce7

stmcginnis · 2024-11-19T21:23:46Z

/lgtm

sftim

Thanks for the PR, but:

please follow the style guide
- use note callouts, not warning
- small but important detail: don't deprecate the annotation except in the well-known list. Deprecate setting it.
- It'll have been deprecated "since Kubernetes v1.32", not "in v1.32+"
we should also remove or reword all places where we recommend setting the annotation

sftim · 2024-11-19T17:53:16Z

content/en/docs/reference/labels-annotations-taints/_index.md

+{{< warning >}}
+`kubernetes.io/enforce-mountable-secrets` is deprecated in v1.32+. Use separate namespaces to isolate access to mounted secrets.
+{{< /warning >}}


Move this to below the "Used on" line

sftim · 2024-11-19T17:53:17Z

content/en/docs/reference/labels-annotations-taints/_index.md

@@ -806,6 +806,10 @@ This annotation is used for describing specific behaviour of given object.

 ### kubernetes.io/enforce-mountable-secrets {#enforce-mountable-secrets}


Suggested change

### kubernetes.io/enforce-mountable-secrets {#enforce-mountable-secrets}

### kubernetes.io/enforce-mountable-secrets (deprecated) {#enforce-mountable-secrets}

sftim · 2024-11-19T17:53:36Z

content/en/docs/concepts/security/service-accounts.md

+{{< warning >}}
+`kubernetes.io/enforce-mountable-secrets` is deprecated in v1.32+. Use separate namespaces to isolate access to mounted secrets.
+{{< /warning >}}


I'd use a feature-state shortcode here.

sftim · 2024-11-19T17:54:42Z

content/en/docs/concepts/configuration/secret.md

@@ -674,6 +674,8 @@ For more information, you can refer to the [documentation about this annotation]
 {{< warning >}}
 Any containers that run with `privileged: true` on a node can access all
 Secrets used on that node.
+
+`kubernetes.io/enforce-mountable-secrets` is deprecated in v1.32+. Use separate namespaces to isolate access to mounted secrets.


Omit this, and reword or remove the earlier text:

To enhance the security measures around Secrets, Kubernetes provides a mechanism: you can
annotate a ServiceAccount as kubernetes.io/enforce-mountable-secrets: "true".

sftim · 2024-11-19T21:59:46Z

Because this PR adds warnings (as in: warning-level callouts), and we try to be really sparing with these, I suggest we don't merge this yet.

sftim · 2024-11-19T22:53:17Z

Oops. Wrong PR.

sftim

/lgtm

One nit; good to merge as is.

sftim · 2024-11-20T11:51:31Z

content/en/docs/concepts/security/secrets-good-practices.md

@@ -62,12 +62,16 @@ recommendations include:
 *  Implement audit rules that alert on specific events, such as concurrent
   reading of multiple Secrets by a single user

-#### Additional ServiceAccount annotations for Secret management
+#### Additional ServiceAccount annotations for Secret management (deprecated)


We can use a singular here.

Suggested change

#### Additional ServiceAccount annotations for Secret management (deprecated)

#### ServiceAccount annotation for Secret management (deprecated) {#additional-serviceaccount-annotations-for-secret-management}

The point of having a customized anchor ID is to make it easy to reference this section or subsection. In that spirit, I'd suggest we use a shorter ID which is
unique and clear enough in this page. For example, #additional-annotation.

I don't agree about the point. My intention here was for existing links to stay working.

k8s-ci-robot · 2024-11-20T11:52:20Z

LGTM label has been added.

Git tree hash: 6fc7f116f79f151c01bec30aadc3d6fcfcc12b1a

sftim · 2024-11-20T11:52:59Z

content/en/docs/concepts/security/secrets-good-practices.md

@@ -62,12 +62,16 @@ recommendations include:
 *  Implement audit rules that alert on specific events, such as concurrent
   reading of multiple Secrets by a single user

-#### Additional ServiceAccount annotations for Secret management


Actually, in a page about good practice, maybe we should simply be recommending using namespaces as trust boundaries?

Yes, IMO this section should be replaced with the following but I’m not sure how this impacts users who may have bookmarked the old section.

Restrict Access for Secrets

Use separate namespaces to isolate access to mounted secrets.

Signed-off-by: Rita Zhang <[email protected]>

sftim

/lgtm

k8s-ci-robot · 2024-11-25T00:10:50Z

LGTM label has been added.

Git tree hash: 64eea8928728bca18e633e168d9dea3133387ca2

ritazh · 2024-11-26T03:10:26Z

Anything else needed to get this merged?

reylejano · 2024-11-26T17:11:25Z

/approve

k8s-ci-robot · 2024-11-26T17:11:36Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: reylejano

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/docs/OWNERS~~ [reylejano]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Add deprecation warnings for enforce-mountable-secrets annotation

926db12

k8s-ci-robot requested a review from liggitt November 19, 2024 17:11

k8s-ci-robot added this to the 1.32 milestone Nov 19, 2024

k8s-ci-robot requested a review from palnabarun November 19, 2024 17:11

k8s-ci-robot added sig/auth Categorizes an issue or PR as relevant to SIG Auth. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. language/en Issues or PRs related to English language labels Nov 19, 2024

k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Nov 19, 2024

ritazh changed the title ~~Add deprecation warnings for enforce-mountable-secrets annotation~~ Add docs for deprecated annotation Nov 19, 2024

ritazh changed the title ~~Add docs for deprecated annotation~~ Add deprecation warnings for enforce-mountable-secrets annotation Nov 19, 2024

k8s-ci-robot assigned liggitt Nov 19, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 19, 2024

k8s-ci-robot assigned stmcginnis Nov 19, 2024

sftim reviewed Nov 19, 2024

View reviewed changes

This comment was marked as outdated.

Sign in to view

k8s-ci-robot assigned sftim Nov 19, 2024

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 20, 2024

k8s-ci-robot requested review from sftim and stmcginnis November 20, 2024 06:53

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Nov 20, 2024

ritazh force-pushed the deprecate-EnforceMountableSecretsAnnotation branch from b91bcec to 1fb2c74 Compare November 20, 2024 06:56

sftim reviewed Nov 20, 2024

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 20, 2024

sftim reviewed Nov 20, 2024

View reviewed changes

Address comments

3b8c927

Signed-off-by: Rita Zhang <[email protected]>

ritazh force-pushed the deprecate-EnforceMountableSecretsAnnotation branch from 1fb2c74 to 3b8c927 Compare November 21, 2024 03:00

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 21, 2024

k8s-ci-robot requested a review from sftim November 21, 2024 03:01

sftim reviewed Nov 25, 2024

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 25, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 26, 2024

k8s-ci-robot merged commit 01eccc6 into kubernetes:dev-1.32 Nov 26, 2024
6 checks passed

ritazh deleted the deprecate-EnforceMountableSecretsAnnotation branch November 26, 2024 18:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add deprecation warnings for enforce-mountable-secrets annotation #48771

Add deprecation warnings for enforce-mountable-secrets annotation #48771

ritazh commented Nov 19, 2024 •

edited

Loading

netlify bot commented Nov 19, 2024 •

edited

Loading

netlify bot commented Nov 19, 2024 •

edited

Loading

liggitt commented Nov 19, 2024

k8s-ci-robot commented Nov 19, 2024

stmcginnis commented Nov 19, 2024

sftim left a comment

sftim Nov 19, 2024

sftim Nov 19, 2024

sftim Nov 19, 2024

sftim Nov 19, 2024

sftim commented Nov 19, 2024

This comment was marked as outdated.

sftim commented Nov 19, 2024

sftim left a comment

sftim Nov 20, 2024

tengqm Nov 20, 2024

sftim Nov 20, 2024

k8s-ci-robot commented Nov 20, 2024

sftim Nov 20, 2024

ritazh Nov 20, 2024

ritazh Nov 21, 2024

sftim left a comment

k8s-ci-robot commented Nov 25, 2024

ritazh commented Nov 26, 2024

reylejano commented Nov 26, 2024

k8s-ci-robot commented Nov 26, 2024

		@@ -806,6 +806,10 @@ This annotation is used for describing specific behaviour of given object.

		### kubernetes.io/enforce-mountable-secrets {#enforce-mountable-secrets}

	#### Additional ServiceAccount annotations for Secret management (deprecated)
	#### ServiceAccount annotation for Secret management (deprecated) {#additional-serviceaccount-annotations-for-secret-management}

Add deprecation warnings for enforce-mountable-secrets annotation #48771

Add deprecation warnings for enforce-mountable-secrets annotation #48771

Conversation

ritazh commented Nov 19, 2024 • edited Loading

Description

Issue

netlify bot commented Nov 19, 2024 • edited Loading

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

netlify bot commented Nov 19, 2024 • edited Loading

✅ Pull request preview available for checking

liggitt commented Nov 19, 2024

k8s-ci-robot commented Nov 19, 2024

stmcginnis commented Nov 19, 2024

sftim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sftim commented Nov 19, 2024

This comment was marked as outdated.

sftim commented Nov 19, 2024

sftim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Nov 20, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Restrict Access for Secrets

Choose a reason for hiding this comment

sftim left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Nov 25, 2024

ritazh commented Nov 26, 2024

reylejano commented Nov 26, 2024

k8s-ci-robot commented Nov 26, 2024

ritazh commented Nov 19, 2024 •

edited

Loading

netlify bot commented Nov 19, 2024 •

edited

Loading

netlify bot commented Nov 19, 2024 •

edited

Loading