add subprojects for sig-auth #2525

mikedanese · 2018-08-13T19:51:17Z

Transplanted from:

https://docs.google.com/document/d/1RJvnSPOJ3JC61gerCpCpaCtzQjRcsZ2tXkcyokr6sLY/edit

I talked about this with @spiffxp in slack. Our current subprojects are generally cross cutting. The TLs for these subprojects don't roll up to specific OWNERS files generally. However, the convetions for the SIG README seems to be that subproject owners should be URLs to OWNERS files. Is this an issue?

cc @liggitt @tallclair

Fixes #2505

spiffxp · 2018-08-13T21:03:30Z

/hold
Each subproject is supposed to be a collection of 1-N packages or repos of code, the owners which are designated by OWNERS files within those packages/repos

Where do packages like these fall within the subprojects? eg:

k8s.io/kubernetes/apis/authentication
k8s.io/kubernetes/apis/authorization
k8s.io/auth/authorizer
k8s.io/apiserver/pkg/apis/audit
etc.

@bgrant0607 how would you suggest proceeding here

sig-auth/README.md

tallclair · 2018-08-13T21:40:40Z

sig-auth/README.md

+  - Owners:
+    - Mike Danese
+    - Jordan Liggitt
+- **policy-management**


Worth calling out the the policy working group (now merged with SAFE)?

(meetings field?)

Is this project supposed to represent a topic, or actual maintenance and development on the below subtrees? How involved is SAFE in the later?

tallclair · 2018-08-13T21:41:45Z

sig-auth/README.md

+## Subprojects
+
+The following subprojects are owned by sig-auth:
+- **audit-logging**


I think we should probably give a description (including scope) for each of these.

mikedanese · 2018-08-13T21:53:31Z

@tallclair, I was working off this document:

https://docs.google.com/document/d/1RJvnSPOJ3JC61gerCpCpaCtzQjRcsZ2tXkcyokr6sLY/edit

I asked in #2505, if that was a good starting point. Perhaps we need to revisit and iterate on the document before moving subprojects to sig.yaml.

bgrant0607 · 2018-08-13T21:54:13Z

These subprojects aren't properly specified. Some of them are more activities right now than subprojects AFAIK.

We should ensure the scope in the charter is sufficient to cover them:
https://github.com/kubernetes/community/blob/master/sig-auth/charter.md

But I wouldn't list them as subprojects here unless there are specific code and/or doc artifacts.

Subprojects such as authentication, authorization, and audit logging should have specific OWNERS files. I realize they are spread out, but each subtree should be enumerated. Over time, we need to reorganize the code to be less sprawling.

Being spread out isn't the same as cross-cutting.

spiffxp · 2018-08-22T23:10:48Z

/approve
This looks way better, thanks. A description for these is possible if you want to go that route (eg: testing-commons). I leave the /lgtm and /hold removal to folks from the sig

k8s-ci-robot · 2018-08-22T23:10:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

mikedanese · 2018-08-28T15:29:24Z

Lot's of these OWNERS files don't exist yet. If we agree on the subprojects, I will backfill them.

/hold cancel

spiffxp · 2018-08-31T21:36:34Z

/committee steering
(now with correct command spelling) just to keep track of when this gets closed out

mikedanese · 2018-09-01T00:35:43Z

@liggitt @tallclair PTAL.

sig-auth/README.md

liggitt · 2018-10-04T14:28:44Z

maintaining these is going to be tough... most of these have already link-rotted and return 404s :-/

mikedanese · 2018-10-04T16:15:57Z

@liggitt These were broken when I sent the PR. My intention was to find the right subtrees to claim, then backfill the OWNERS files.

sig-auth/README.md

sigs.yaml

mikedanese · 2018-10-29T18:50:44Z

/assign @enj @tallclair @liggitt

tallclair · 2018-10-29T18:53:30Z

sig-auth/README.md

+    - https://raw.githubusercontent.com/kubernetes/kubernetes/master/staging/src/k8s.io/client-go/kubernetes/typed/authorization/OWNERS
+    - https://raw.githubusercontent.com/kubernetes/kubernetes/master/staging/src/k8s.io/client-go/listers/authorization/OWNERS
+- **certificates**
+  - Description: Certificates APIs and client infrastructure to support PKI.


Can we be a bit more specific here? E.g. does kubernetes/kubernetes#63732 fall under this subproject?

I suspect that the linked issue would fit better under the service-accounts subproject.

tallclair · 2018-10-29T18:54:33Z

sig-auth/README.md

+    - https://raw.githubusercontent.com/kubernetes/kubernetes/master/staging/src/k8s.io/apiserver/pkg/authentication/request/x509/OWNERS
+    - https://raw.githubusercontent.com/kubernetes/kubernetes/master/staging/src/k8s.io/client-go/util/cert/OWNERS
+    - https://raw.githubusercontent.com/kubernetes/kubernetes/master/staging/src/k8s.io/client-go/util/certificate/OWNERS
+- **encryption-at-rest**


Can we expand this subproject to be "secrets management"? E.g. I think the vault integration might fall under this subproject?

The current implementation of encryption is orthogonal to resource kind even though the motivating usecase was secrets. Which vault integration are you thinking of? The KMS plugin? There's also a valut integration based on service accounts.

sig-auth/README.md

so block descriptions look the same as inline descriptions.

liggitt · 2018-11-02T22:00:34Z

created approvers and reviewers owners aliases for each subproject, and linked them in owners files in the referenced packages in kubernetes/kubernetes#70600

liggitt · 2018-11-07T04:46:40Z

sig-auth/README.md

+  - Description: Node identity management (co-owned with sig-lifecycle), and authorization restrictions for isolating workloads on separate nodes (co-owned with sig-node).
+  - Owners:
+    - https://raw.githubusercontent.com/kubernetes/kubernetes/master/pkg/controller/certificates/approver/OWNERS
+    - https://raw.githubusercontent.com/kubernetes/kubernetes/master/pkg/kubelet/certificate/OWNERS


the first two seem more like the certificates subproject (and pkg/controller/certificates is already under the certificates subproject)

pkg/kubelet/certificate belongs under certificate infra over node identity? And the approvers in pkg/controller/certificates/approver are only good for approving node certificates. These both seem more appropriately positioned here.

ok, I can buy that. can you follow up with a PR against k/k to populate/fixup those two OWNERS files to point to the right subproject?

liggitt · 2018-11-07T14:03:36Z

with the switch of the certificates bits under the certificates subproject, this lgtm as a first step

the referenced owners files have been added in kubernetes/kubernetes#70600

liggitt · 2018-11-08T04:12:13Z

/lgtm

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. sig/auth Categorizes an issue or PR as relevant to SIG Auth. labels Aug 13, 2018

k8s-ci-robot requested review from idvoretskyi and tallclair August 13, 2018 19:51

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 13, 2018

tallclair reviewed Aug 13, 2018

View reviewed changes

mikedanese force-pushed the auth-subprojects branch 2 times, most recently from 1808585 to 700340c Compare August 22, 2018 17:27

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Aug 22, 2018

mikedanese force-pushed the auth-subprojects branch from 700340c to 8634d5c Compare August 22, 2018 18:03

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 22, 2018

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 28, 2018

jdumars mentioned this pull request Aug 29, 2018

Charters Meta-issue kubernetes/steering#31

Closed

k8s-ci-robot added the committee/steering Denotes an issue or PR intended to be handled by the steering committee. label Aug 31, 2018

liggitt reviewed Sep 2, 2018

View reviewed changes

sig-auth/README.md Show resolved Hide resolved

mikedanese force-pushed the auth-subprojects branch from 8634d5c to 07f27f9 Compare October 4, 2018 16:11

mikedanese force-pushed the auth-subprojects branch from 07f27f9 to 8dfc700 Compare October 4, 2018 18:04

robscott reviewed Oct 17, 2018

View reviewed changes

sig-auth/README.md Outdated Show resolved Hide resolved

robscott reviewed Oct 17, 2018

View reviewed changes

sigs.yaml Outdated Show resolved Hide resolved

mikedanese force-pushed the auth-subprojects branch from 8dfc700 to 089fbe1 Compare October 29, 2018 18:37

k8s-ci-robot assigned enj, liggitt and tallclair Oct 29, 2018

tallclair reviewed Oct 29, 2018

View reviewed changes

enj reviewed Oct 29, 2018

View reviewed changes

sig-auth/README.md Show resolved Hide resolved

liggitt reviewed Nov 2, 2018

View reviewed changes

sig-auth/README.md Show resolved Hide resolved

mikedanese force-pushed the auth-subprojects branch from a1ac21b to 157cbc7 Compare November 2, 2018 18:33

k8s-ci-robot added sig/contributor-experience Categorizes an issue or PR as relevant to SIG Contributor Experience. sig/testing Categorizes an issue or PR as relevant to SIG Testing. labels Nov 2, 2018

mikedanese force-pushed the auth-subprojects branch from 157cbc7 to 8dfd31a Compare November 2, 2018 18:36

mikedanese added 2 commits November 2, 2018 11:37

trim whitespace around sub-project descriptions

0ec20e7

so block descriptions look the same as inline descriptions.

add subprojects for sig-auth

fa386fb

mikedanese force-pushed the auth-subprojects branch from 8dfd31a to fa386fb Compare November 2, 2018 18:37

liggitt mentioned this pull request Nov 2, 2018

Add owners/approvers aliases for sig-auth subprojects kubernetes/kubernetes#70600

Merged

liggitt reviewed Nov 7, 2018

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 8, 2018

k8s-ci-robot merged commit d5e1a9b into kubernetes:master Nov 8, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add subprojects for sig-auth #2525

add subprojects for sig-auth #2525

mikedanese commented Aug 13, 2018

spiffxp commented Aug 13, 2018

tallclair Aug 13, 2018

tallclair Aug 13, 2018

mikedanese Oct 4, 2018

tallclair Aug 13, 2018

liggitt Sep 2, 2018

mikedanese commented Aug 13, 2018 •

edited

Loading

bgrant0607 commented Aug 13, 2018

spiffxp commented Aug 22, 2018

k8s-ci-robot commented Aug 22, 2018

mikedanese commented Aug 28, 2018 •

edited

Loading

spiffxp commented Aug 31, 2018

mikedanese commented Sep 1, 2018

liggitt commented Oct 4, 2018

mikedanese commented Oct 4, 2018

mikedanese commented Oct 29, 2018

tallclair Oct 29, 2018

mikedanese Nov 2, 2018

tallclair Oct 29, 2018

mikedanese Nov 2, 2018

liggitt commented Nov 2, 2018

liggitt Nov 7, 2018 •

edited

Loading

mikedanese Nov 8, 2018 •

edited

Loading

liggitt Nov 8, 2018

liggitt commented Nov 7, 2018

liggitt commented Nov 8, 2018

add subprojects for sig-auth #2525

add subprojects for sig-auth #2525

Conversation

mikedanese commented Aug 13, 2018

spiffxp commented Aug 13, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mikedanese commented Aug 13, 2018 • edited Loading

bgrant0607 commented Aug 13, 2018

spiffxp commented Aug 22, 2018

k8s-ci-robot commented Aug 22, 2018

mikedanese commented Aug 28, 2018 • edited Loading

spiffxp commented Aug 31, 2018

mikedanese commented Sep 1, 2018

liggitt commented Oct 4, 2018

mikedanese commented Oct 4, 2018

mikedanese commented Oct 29, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt commented Nov 2, 2018

liggitt Nov 7, 2018 • edited Loading

Choose a reason for hiding this comment

mikedanese Nov 8, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt commented Nov 7, 2018

liggitt commented Nov 8, 2018

mikedanese commented Aug 13, 2018 •

edited

Loading

mikedanese commented Aug 28, 2018 •

edited

Loading

liggitt Nov 7, 2018 •

edited

Loading

mikedanese Nov 8, 2018 •

edited

Loading