Pod Certificates: Preliminary implementation of KEP-4317 #128010

ahmedtd · 2024-10-11T22:20:15Z

This PR implements KEP-4317 (Pod Certificates).

Define PodCertificateRequest and PodCertificate projected volume sources.
Enable support for these types on kube-apiserver (behind a feature gate).
Implement the projected volume support.
Implement a cleaner for PodCertificateRequests
Add an example signer implementation agnhost (to be used in e2e tests).
Run make update to do all the regeneration for the new types.

/kind feature
/kind api-change

Enable kube-apiserver support for PodCertificateRequest and PodCertificate projected volumes (behind the PodCertificateRequest feature gate).

- [KEP]: https://github.com/kubernetes/enhancements/tree/25777c1bba657eac76eb294c012acbbbd519299c/keps/sig-auth/4317-pod-certificates

ahmedtd · 2024-10-11T22:20:33Z

/sig auth

ahmedtd · 2024-10-11T22:21:08Z

/assign liggit
/assign enj

k8s-ci-robot · 2024-10-11T22:21:10Z

@ahmedtd: GitHub didn't allow me to assign the following users: liggit.

Note that only kubernetes members with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

/assign liggit
/assign enj

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-triage-robot · 2024-10-12T17:25:23Z

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

aramase · 2024-10-14T16:09:31Z

/triage accepted

deads2k · 2025-02-28T15:09:48Z

pkg/apis/certificates/types.go

+	// SignerName indicates the request signer.
+	SignerName string


Let's document the well-known signer.

deads2k · 2025-02-28T15:10:24Z

pkg/apis/certificates/types.go

+	// PodName is the name of the pod into which the certificate will be mounted.
+	PodName string
+	// PodUID is the UID of the pod into which the certificate will be mounted.
+	PodUID types.UID
+
+	// ServiceAccountname is the name of the service account the pod is running as.
+	ServiceAccountName string
+	// ServiceAccountUID is the UID of the service account the pod is running as.
+	ServiceAccountUID types.UID
+
+	// NodeName is the name of the node the pod is assigned to.
+	NodeName types.NodeName
+	// NodeUID is the UID of the node the pod is assigned to.
+	NodeUID types.UID


indicate these are all required. +required (currently)

deads2k · 2025-02-28T15:22:03Z

pkg/apis/certificates/types.go

+	// If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+	// will reject values shorter than 3600 (1 hour).


Defaulting can be done like this https://github.com/kubernetes/kubernetes/blob/master/pkg/apis/core/v1/defaults.go#L280-L285

defaulting for all will be 24hr. Custom signer users can specify this value if they need a non-default

Done. Though I'm wondering if it might be cleaner to not do any explicit defaulting, but instead treat the field being absent as meaning 24 hours. That way people who just use a JSON / yaml parser won't be confused by missing the magical behavior of the Kubernetes parsing defaulter.

Since we check the issued certificate against maxExpirationSeconds during status update validation, we can guarantee that third-party signer implementations have to be aware of the "missing means 24 hours" behavior.

deads2k · 2025-02-28T15:23:31Z

pkg/apis/certificates/types.go

+	// The PodCertificateMaxExpiration admission plugin, if enabled, will
+	// shorten the value to the maximum expiration configured for the requested
+	// signer.


Conditional defaulting has not aged well in the past. Let's not do mutating admission (or conditional mutating strategy).

Removed this.

I think I still see the original, did you push the changes?

deads2k · 2025-02-28T15:34:01Z

pkg/apis/certificates/types.go

+	// maxExpirationSeconds is the maximum lifetime permitted for the
+	// certificate.


Document maximum allowable range. the kubernetes ones will be 24hrs or less. not kube ones will be 91 days or less. shortest possible for all is 1hr.

deads2k · 2025-02-28T16:21:48Z

pkg/apis/certificates/validation/validation.go

+
+	var allErrors field.ErrorList
+	allErrors = append(allErrors, ValidatePodCertificateRequest(newReq, opts)...)
+	allErrors = append(allErrors, apivalidation.ValidateObjectMetaUpdate(&newReq.ObjectMeta, &oldReq.ObjectMeta, field.NewPath("metadata"))...)


deads2k · 2025-02-28T16:22:02Z

pkg/apis/certificates/validation/validation.go

+func ValidatePodCertificateRequestUpdate(newReq, oldReq *certificates.PodCertificateRequest, optsIn ValidatePodCertificateRequestOptions) field.ErrorList {
+	opts := optsIn
+	if bytes.Equal(newReq.Spec.PKIXPublicKey, oldReq.Spec.PKIXPublicKey) && bytes.Equal(newReq.Spec.ProofOfPossession, oldReq.Spec.ProofOfPossession) && newReq.Status.CertificateChain == oldReq.Status.CertificateChain {
+		opts.SkipCryptoValidation = true


SkipCryptoValidation is no longer necessary

deads2k · 2025-02-28T16:22:33Z

pkg/apis/certificates/validation/validation.go

+	}
+
+	var allErrors field.ErrorList
+	allErrors = append(allErrors, ValidatePodCertificateRequest(newReq, opts)...)


This doesn't delegate because the update is immutable.

deads2k · 2025-02-28T16:23:12Z

pkg/apis/certificates/validation/validation.go

+	}
+
+	// Bail out if the certificate chain hasn't been set.
+	if req.Status.CertificateChain == "" {


.status updates need to be a different function. .status updates must never fail on invalid .spec values.

deads2k · 2025-02-28T16:23:59Z

pkg/apis/certificates/validation/validation.go

+	leafCert, err := x509.ParseCertificate(leafBlock.Bytes)
+	if err != nil {
+		allErrors = append(allErrors, field.Invalid(certChainPath, req.Status.CertificateChain, "leaf certificate does not parse as valid X.509"))
+		return allErrors
+	}


@enj can you be sure this does the validation we desire?

Actually, for the entire status bits. Be sure you're happy. Discussion suggests it's not as obvious as I might have thought.

tico88612 · 2025-03-05T08:40:52Z

Hi @ahmedtd,
We'd like to remind you of the code freeze time. If there's anything we can do, please let us know.
The code freeze is starting 02:00 UTC Friday 21st March 2025 (about 3 weeks from now). Please make sure the PR has both lgtm and approved labels before the code freeze. Thanks!

ahmedtd · 2025-03-16T03:59:32Z

/retest

tico88612 · 2025-03-17T06:21:48Z

Hello, @ahmedtd @deads2k
Appreciate all of your efforts with this PR! Is the plan still to resolve it for v1.33 release?
If so, a gentle reminder that the code freeze has started 02:00 UTC Friday 21st March 2025 . Please make sure any PRs have both lgtm and approved labels ASAP, and file an Exception if you haven't done it yet.
Thanks!

ahmedtd · 2025-03-17T18:00:03Z

@deads2k This is ready for another review pass. Apologies, it took a lot longer than I expected to convert the Kubelet code to be informer-based, but I think it has significantly improved it.

There's one change from the last time you reviewed that I should call out: I have locked down the allowable status conditions on PodCertificateRequest:

There can be only one condition entry.
It must be one of Issued, Denied, or Failed
The condition entry is immutable once it is set (similar to CSR).

This simplified a lot of the validation logic, and seems OK because

Only Kubelet is really consuming these conditions anyways.
We can relax the restrictions (for example, by permitting signers to add other informative conditions) in the future without compatibility concerns.

All other changes are just implementing review feedback.

stlaz · 2025-03-27T11:58:09Z

pkg/apis/certificates/types.go

+	// The PodCertificateMaxExpiration admission plugin, if enabled, will
+	// shorten the value to the maximum expiration configured for the requested
+	// signer.


I think I still see the original, did you push the changes?

stlaz · 2025-03-27T11:58:54Z

pkg/apis/certificates/types.go

+	//
+	// Signer implementations do not need to support all key types supported by
+	// kube-apiserver and kubelet.  If a signer does not support the key type
+	// used for a given PodCertificateRequest, it should deny the request, with


I still see "should", did you push the changes?

pkg/apis/certificates/types.go

pkg/controller/certificates/cleaner/pcrcleaner.go

stlaz · 2025-03-27T12:38:42Z

pkg/controller/certificates/cleaner/pcrcleaner.go

+	if pcr.ObjectMeta.CreationTimestamp.Time.After(time.Now().Add(-30 * time.Minute)) {
+		return nil
+	}


would it make sense to have different retention for PCRs with at least one condition (=> addressed) vs PCRs with none (ignored for some reason, maybe faulty signer implementation)?

If it's a persistent problem, then there is always going to be one you can query and look at with no conditions near the end of its life. If it isn't persistent, there's nothing to look at.

It could be interesting to have a metric count of PCRs deleted without any conditions on them. Maybe separated by the kube signer and everyone else.

pkg/kubelet/podcertificate/podcertificate_manager.go

stlaz · 2025-03-27T13:57:39Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+}
+
+func (m *IssuingManager) refreshOnePod(ctx context.Context, pod *corev1.Pod) error {
+	for _, v := range pod.Spec.Volumes {


maybe you could map pod -> slice[credRecord] or pod -> podCertProjectedVolume -> credRecord so that we don't have to loop through the volumes every time?

stlaz · 2025-03-27T13:59:03Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+			serviceAccount, err := m.kc.CoreV1().ServiceAccounts(pod.ObjectMeta.Namespace).Get(ctx, pod.Spec.ServiceAccountName, metav1.GetOptions{})
+			if err != nil {
+				return fmt.Errorf("while fetching service account: %w", err)
+			}


one live fetch should do for the whole pod

I suspect there is a reason we don't do cached SA lookups, right?

Moved to be one fetch for the pod.

Ehhh, I am not sure of the importance of having a live lookup here. It's probably fine to work from a cache if I can figure out where Kubelet is caching service accounts.

pkg/kubelet/podcertificate/podcertificate_manager.go

deads2k

so far. We start tomorrow with the kubelet

pkg/apis/certificates/validation/validation.go

deads2k · 2025-03-27T14:18:38Z

pkg/apis/certificates/validation/validation.go

+		return allErrors
+	}
+
+	if len(req.Status.Conditions) > 1 {


rather than this, make the three known conditions mutually exclusive. Keeping the "must be true" is fine. This will allow us to add other conditions without having a two release dance of loosening validation one release and adding the condition in a second release.

OK, I think I've done this. The three known conditions are now mutually exclusive, but other conditions may be set.

pkg/kubeapiserver/authorizer/config.go

deads2k · 2025-03-27T15:11:27Z

pkg/kubelet/kubelet.go

+			clock.RealClock{},
+		)
+		klet.podCertificateManager = pcm
+		kubeInformers.Start(wait.NeverStop)


should be able to use ctx.Done

deads2k · 2025-03-27T15:13:07Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+	"k8s.io/utils/clock"
+)
+
+// TODO(KEP-4317): Tests for IssuingManager


yeah, don't forget to add

Leaving a note for myself: This is probably easiest to test under the integration test framework, with a real kube-apiserver.

deads2k · 2025-03-27T15:14:24Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+	Namespace          string
+	PodName            string
+	PodUID             types.UID
+	ServiceAccountName string


weird to have the service account name as part of a pod identity.

I've removed PodIdentity --- it was vestigial after the IssuingManager refactor to be informer-driven

deads2k · 2025-03-27T15:18:13Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+)
+
+func (m *IssuingManager) Run(ctx context.Context) {
+	if !cache.WaitForCacheSync(ctx.Done(), m.pcrInformer.HasSynced) {


wait for the node lister to be synced

stlaz · 2025-03-28T11:06:12Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+			uniquePath := source.PodCertificate.CredentialBundlePath
+			if uniquePath == "" {
+				uniquePath = source.PodCertificate.KeyPath
+			}
+			if uniquePath == "" {
+				uniquePath = source.PodCertificate.CertificateChainPath
+			}


this is different from how uniquePath is calculated in TrackPod and ForgetPod

I've switched all this to be based on the volume name and the index of the projected volume source.

stlaz · 2025-03-28T11:12:32Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+				pod.ObjectMeta.Namespace,
+				pod.ObjectMeta.Name, pod.ObjectMeta.UID,
+				pod.Spec.ServiceAccountName, serviceAccount.ObjectMeta.UID,


nit: you could just pass both pod's and SA's objectMeta

I kind of like the current spelling.

stlaz · 2025-03-28T11:18:56Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+				volumeName: v.Name,
+				path:       uniquePath,
+			}
+			delete(m.validCredentials, key)


Are invalidCredentials ever cleaned up?
Should we also remove pendingCredentials? I see they get removed in handlePCRDelete() so I guess it might be fine to defer deletion till then.

Let's clean them all

I believe all our map entries should be dropped once the pod or podcertificaterequest they correspond to has been dropped.

stlaz · 2025-03-28T11:23:08Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+	}
+	newPCR := new.(*certificatesv1alpha1.PodCertificateRequest)
+
+	klog.InfoS("Handling PodCertificateRequest update", "pcr", key)


The logs in this method seem a bit too verbose. Probably debug logs? Some of them might be useful at some debug level.

Changed to V(2)

stlaz · 2025-03-28T11:24:01Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+	reason := ""
+	message := ""
+	for _, cond := range newPCR.Status.Conditions {
+		// PCRs can have only one condition


no longer true after https://github.com/kubernetes/kubernetes/pull/128010/files#r2016806775 is implemented

I've updated this to properly handle other conditions.

stlaz · 2025-03-28T12:44:31Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+				v.Name, uniquePath,
+				source.PodCertificate.SignerName, source.PodCertificate.KeyType,
+			)
+			if err != nil {


should we try to optimistically create all PCRs and only log errors? And eventually reattempt the PCR creates that failed?

stlaz · 2025-03-28T12:53:44Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+
+// TrackPod visits all PodCertificate projected volume sources within the pod,
+// creating an initial PodCertificateRequest for each one.
+func (m *IssuingManager) TrackPod(ctx context.Context, pod *corev1.Pod) error {


I might be reading this wrong, but is this the case?

Conditions (either, or):

SA is not yet present in the NS

network blip during SA fetch/PCR create

What happens:

pendingCredentials is never populated, PCR create is never reattempted

GetPodCertificateCredentialBundle() will always fail in backoff when the kubelet tries to populate the volume with files

If that's the case, shouldn't we have a retry mechanism built into the manager?

stlaz · 2025-03-28T12:56:20Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+		// 2) Kubelet created this PCR, but then restarted.
+		//
+		// In both cases, just do nothing.
+		klog.InfoS("PodCertificateRequest update was for stray", "pcr", key)


Suggested change

klog.InfoS("PodCertificateRequest update was for stray", "pcr", key)

klog.InfoS("PodCertificateRequest isn't tracked for any known pods", "pcr", key)

stlaz · 2025-03-28T13:00:37Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+
+// On delete, clean up the pending credential record corresponding
+// to this PodCertificateRequest, if any exists.
+func (m *IssuingManager) handlePCRDelete(old any) {


If I understand it correctly, kubectl delete podcertificaterequest -A --all will make all pending pods requesting a cert never to come up. Is that ok?

stlaz · 2025-03-28T13:05:01Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+			serviceAccount, err := m.kc.CoreV1().ServiceAccounts(pod.ObjectMeta.Namespace).Get(ctx, pod.Spec.ServiceAccountName, metav1.GetOptions{})
+			if err != nil {
+				return fmt.Errorf("while fetching service account: %w", err)
+			}


I suspect there is a reason we don't do cached SA lookups, right?

deads2k · 2025-03-28T14:02:35Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+	}
+
+	// Add informer functions.  We don't follow the typical controller pattern
+	// where we use a workqueue, because we don't have to do any RPCs or state


this eliminates the de-duping capability of a workqueue.

deads2k

comments to be addressed before our next review session.

deads2k · 2025-03-28T14:03:39Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+	allPods := m.podManager.GetPods()
+	for _, pod := range allPods {
+		if err := m.refreshOnePod(ctx, pod); err != nil {
+			klog.ErrorS(err, "Error while refreshing pod", "namespace", pod.ObjectMeta.Namespace, "name", pod.ObjectMeta.Name)


Does kubelet not use utilruntime.HandleError

deads2k · 2025-03-28T14:11:32Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+			uniquePath := source.PodCertificate.CredentialBundlePath
+			if uniquePath == "" {
+				uniquePath = source.PodCertificate.KeyPath
+			}
+			if uniquePath == "" {
+				uniquePath = source.PodCertificate.CertificateChainPath
+			}


Let's use the index of the projected volume and the index projected volume source as the key.

deads2k · 2025-03-28T14:13:17Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+					// refresh.
+					return
+				}
+				if m.clock.Now().After(credRecord.beginRefreshAt) {


also be sure that beginRefreshAt is not zero value.

API validation places strong constraints on BefinRefreshAt --- it must be between NotBefore and NotAfter.

What would a zero check guard against here?

deads2k · 2025-03-28T14:17:04Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+				continue
+			}
+
+			serviceAccount, err := m.kc.CoreV1().ServiceAccounts(pod.ObjectMeta.Namespace).Get(ctx, pod.Spec.ServiceAccountName, metav1.GetOptions{})


Must document why this is done. Add beta criteria to the KEP to consider the alternative of single-item list/watch as we do for secrets and configmaps. We have another one of these in projected service account tokens for image pulls.

pkg/kubelet/podcertificate/podcertificate_manager.go

deads2k · 2025-03-28T14:42:36Z

pkg/volume/projected/projected.go

+			path := source.PodCertificate.CredentialBundlePath
+			if path == "" {
+				path = source.PodCertificate.KeyPath
+			}
+			if path == "" {
+				path = source.PodCertificate.CredentialBundlePath
+			}


change to use indexes.

deads2k · 2025-03-28T14:45:20Z

pkg/volume/projected/projected.go

+				Namespace:          s.pod.ObjectMeta.Namespace,
+				PodName:            s.pod.ObjectMeta.Name,
+				PodUID:             s.pod.ObjectMeta.UID,
+				ServiceAccountName: s.pod.Spec.ServiceAccountName,


there are two possible choices

SA name is enough, but if this is true, then it doesn' tmatter because SA name cannot change

SA name is not enough and we need a UID, and we must collect the correct UID.

deads2k · 2025-03-28T14:51:41Z

pkg/volume/projected/projected.go

blocker for merge

There must be static pod integration tests. We want static pods with pod certificate projected volumes to

kubelet rejects the pod and does X to report this to someone

kubelet runs the pod and doesn't create the projected volume

we do NOT want a state where the kubelet runs the pod and cannot write the pod to the API.

Information to make the choice, what do we do with static pods with service accounts.

deads2k · 2025-03-28T14:57:55Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+				volumeName: v.Name,
+				path:       uniquePath,
+			}
+			delete(m.validCredentials, key)


Let's clean them all

deads2k · 2025-03-28T15:01:57Z

pkg/kubelet/podcertificate/podcertificate_manager.go

+		return fmt.Errorf("while PEM-encoding private key: %w", err)
+	}
+
+	req := &certificatesv1alpha1.PodCertificateRequest{


Add owner reference to the pod so we clean up automatically. And test with the OwnerReferencesPermissionEnforcement admission plugin. You may have to add the deletion powers back, but that seems worth the tradeoff. This prevents build up of podcertificaterequests when pods are short lived.

* Define feature gate * Define and serve PodCertificateRequest * Implement Kubelet projected volume source * kube-controller-manager GCs PodCertificateRequests * Add agnhost subcommand that implements a toy signer for testing Change-Id: Id7ed030d449806410a4fa28aab0f2ce4e01d3b10

Change-Id: I9edc0f3d7080330b164f6be78bb8f16350869ffa

k8s-ci-robot · 2025-06-14T05:01:49Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ahmedtd
Once this PR has been reviewed and has the lgtm label, please assign liggitt for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

api/OWNERS
cmd/kube-controller-manager/OWNERS
pkg/api/OWNERS
pkg/apis/OWNERS
pkg/controller/certificates/OWNERS
pkg/controlplane/OWNERS
pkg/features/OWNERS
pkg/generated/openapi/OWNERS
pkg/kubeapiserver/OWNERS
pkg/kubelet/OWNERS
pkg/printers/OWNERS
pkg/registry/certificates/OWNERS
pkg/volume/OWNERS
plugin/pkg/admission/certificates/OWNERS
plugin/pkg/admission/noderestriction/OWNERS
plugin/pkg/auth/authorizer/OWNERS
staging/src/k8s.io/api/OWNERS
staging/src/k8s.io/apiserver/OWNERS
staging/src/k8s.io/client-go/OWNERS
test/OWNERS
test/compatibility_lifecycle/reference/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2025-06-14T06:06:05Z

@ahmedtd: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-kubernetes-apidiff-client-go	`4a9326a`	link	false	`/test pull-kubernetes-apidiff-client-go`
pull-kubernetes-unit	`4a9326a`	link	true	`/test pull-kubernetes-unit`
pull-kubernetes-linter-hints	`4a9326a`	link	false	`/test pull-kubernetes-linter-hints`
pull-kubernetes-unit-windows-master	`4a9326a`	link	false	`/test pull-kubernetes-unit-windows-master`
pull-kubernetes-integration	`4a9326a`	link	true	`/test pull-kubernetes-integration`
pull-kubernetes-verify	`4a9326a`	link	true	`/test pull-kubernetes-verify`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Oct 11, 2024

k8s-ci-robot requested review from aojea and ardaguclu October 11, 2024 22:20

k8s-ci-robot assigned enj Oct 11, 2024

ahmedtd mentioned this pull request Oct 11, 2024

[WIP] Pod Certificates #127251

Closed

ahmedtd force-pushed the pod-certificates-types branch 2 times, most recently from 6027570 to bda6204 Compare October 12, 2024 00:25

k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Oct 14, 2024

enj mentioned this pull request Oct 31, 2024

Pod Certificates kubernetes/enhancements#4317

Open

5 tasks

ahmedtd force-pushed the pod-certificates-types branch from bda6204 to 6f72603 Compare November 1, 2024 19:33

k8s-ci-robot added the area/kubelet label Nov 1, 2024

ahmedtd force-pushed the pod-certificates-types branch 2 times, most recently from 9e39f17 to 035990e Compare February 28, 2025 06:46

deads2k requested changes Feb 28, 2025

View reviewed changes

tico88612 moved this to Tracked in [sig-release] Bug Triage Mar 5, 2025

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 8, 2025

ahmedtd force-pushed the pod-certificates-types branch from 035990e to 694bcad Compare March 16, 2025 02:24

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 16, 2025

ahmedtd force-pushed the pod-certificates-types branch from 694bcad to b889242 Compare March 16, 2025 03:48

ahmedtd force-pushed the pod-certificates-types branch from b889242 to 085e872 Compare March 16, 2025 04:12

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 18, 2025

stlaz reviewed Mar 27, 2025

View reviewed changes

deads2k requested changes Mar 27, 2025

View reviewed changes

stlaz reviewed Mar 28, 2025

View reviewed changes

deads2k reviewed Mar 28, 2025

View reviewed changes

deads2k requested changes Mar 28, 2025

View reviewed changes

liggitt modified the milestones: v1.33, v1.34 Apr 9, 2025

Rajalakshmi-Girish moved this from Tracked to Pending inclusion in [sig-release] Bug Triage May 21, 2025

ahmedtd added 2 commits June 14, 2025 04:37

make update

4a9326a

Change-Id: I9edc0f3d7080330b164f6be78bb8f16350869ffa

ahmedtd force-pushed the pod-certificates-types branch from 085e872 to 4a9326a Compare June 14, 2025 05:01

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 14, 2025

github-project-automation bot added this to SIG Node: code and documentation PRs Jun 14, 2025

github-project-automation bot moved this to Triage in SIG Node: code and documentation PRs Jun 14, 2025

		// SignerName indicates the request signer.
		SignerName string

		// If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
		// will reject values shorter than 3600 (1 hour).

		// maxExpirationSeconds is the maximum lifetime permitted for the
		// certificate.

	klog.InfoS("PodCertificateRequest update was for stray", "pcr", key)
	klog.InfoS("PodCertificateRequest isn't tracked for any known pods", "pcr", key)

Pod Certificates: Preliminary implementation of KEP-4317 #128010

Are you sure you want to change the base?

Pod Certificates: Preliminary implementation of KEP-4317 #128010

Uh oh!

Conversation

ahmedtd commented Oct 11, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ahmedtd commented Oct 11, 2024

Uh oh!

ahmedtd commented Oct 11, 2024

Uh oh!

k8s-ci-robot commented Oct 11, 2024

Uh oh!

k8s-triage-robot commented Oct 12, 2024

Uh oh!

aramase commented Oct 14, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ahmedtd Mar 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tico88612 commented Mar 5, 2025

Uh oh!

ahmedtd commented Mar 16, 2025

Uh oh!

tico88612 commented Mar 17, 2025

Uh oh!

ahmedtd commented Mar 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

ahmedtd commented Oct 11, 2024 •

edited

Loading

ahmedtd Mar 4, 2025 •

edited

Loading

ahmedtd commented Mar 17, 2025 •

edited

Loading

stlaz Mar 27, 2025 •

edited

Loading