Handling undecryptable resources

[stlaz]

Handling undecryptable resources

• One-line enhancement description (can be used as a release note): Improve the identification of resources that won't decrypt. Make it possible to remove undecryptable resources by using the API.
• Kubernetes Enhancement Proposal: link
• Discussion Link: sig-auth meeting, 01.03.2023 - 40:41
• Primary contact (assignee): @stlaz
• Responsible SIGs: sig-auth, sig-api-machinery
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.32
  • Beta release target (x.y):
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s): KEP-3926: handling undecryptable resources #3927
  • Code (k/k) update PR(s):
    • KEP-3926: refactor: extract etcd3 store decode functions into an interface kubernetes#127982
    • KEP-3926: storage.InternalError should retain the inner error kubernetes#127984
    • KEP-3926: refactor: add delete options for Delete method in storage interface kubernetes#127777
    • KEP-3926: refactor: etcd store conditional delete kubernetes#127778
    • KEP-3926: unsafe deletion of corrupt objects kubernetes#127513
    • KEP-3926: add a new type to represent a corrupt object in storage error kubernetes#128056
    • KEP-3926: refactor: extend newTransformTest to enable RBAC kubernetes#128191
  • Docs (k/website) update PR(s):
    • add doc for new delete option ignoreStoreReadErrorWithClusterBreakingPotential website#48463

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[stlaz]

/sig auth
/sig api
/assign

[k8s-ci-robot]

@stlaz: The label(s) sig/api cannot be applied, because the repository doesn't have them.

In response to this:

/sig auth
/sig api
/assign

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[stlaz]

/sig api-machinery

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[stlaz]

/remove-lifecycle stale

[sanchita-07]

Hello @stlaz 👋, 1.29 Enhancements team here!

Just checking in as we approach enhancements freeze on 01:00 UTC, Friday, 6th October, 2023.

This enhancement is targeting for stage alpha for 1.29 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.29. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

For this KEP, we would need to add/update the following:

• The status should be marked as implementable in the kep.yaml file.
• Ensure the KEP readme using the latest template has been merged into the k/enhancements repo
• Ensure that the PR including the production readiness review has been merged into k/enhancements.

The status of this enhancement is marked as at risk for enhancement freeze. Please keep the issue description up-to-date with appropriate stages as well.
Thank you!

[sanchita-07]

Hi @stlaz , checking in once more as we approach the 1.29 enhancement freeze deadline on 01:00 UTC, Friday, 6th October, 2023. The status of this enhancement is marked as at risk for enhancement freeze. It looks like #3927 will address the requirements. Let me know if I missed anything. Thanks!

[stlaz]

Hello 👋
Indeed, #3927 should indeed address the requirements. I'm trying to move it forward but it's not yet clear if it'll make it in time.

[npolshakova]

With KEP PR #3927 approved, the enhancement is ready for the enhancements freeze. The status is now marked as tracked for enhancement freeze for 1.29. 🚀 Thank you!

[katcosgrove]

Hey there @stlaz! 👋, v1.29 Docs Lead here.
Does this enhancement work planned for v1.29 require any new docs or modification to existing docs?
If so, please follows the steps here to open a PR against dev-1.29 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday, 19 October 2023.
Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.
Thank you!

[katcosgrove]

Hi again @stlaz ! The deadline to open a placeholder PR against k/website for required documentation is this Thursday, 19 October. Could you please update me on the status of docs for this enhancement? Thank you!

[stlaz]

Hello,
Sorry for late reply. Unfortunately, due to external circumstances, we won't be able to deliver the work for the 1.29 milestone 😞

[jenshu]

@stlaz @enj thanks for updating the kep.yaml, I've updated the status to tracked for enhancements freeze!

Can you also be sure to keep the issue description at the top updated with the correct release targets and such?

[spurin]

Hi @stlaz 👋, I'm James Spurin, a 1.32 Docs Shadow. Great to meet you again.

Does this enhancement work planned for 1.32 require any new docs or modifications to the existing docs?

If so, please follows the steps here to open a PR against dev-1.32 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday October 24th 2024 18:00 PDT.

Also, take a look at Documenting for a release to familiarise with the docs requirement for the release.

Thank you!

[mbianchidev]

Hey there @stlaz
👋 from the v1.32 Communications Team!

We'd love for you to consider writing a feature blog about your enhancement.
Some reasons why you might want to write a blog for this feature include (but are not limited to) if this introduces breaking changes, is important to our users, or has been in progress for a long time and it is graduating.

To opt-in, let us know by opening a Feature Blog placeholder PR against the website repository by 30th Oct 2024. For more information about writing a blog see the blog contribution guidelines.

Note: In your placeholder PR, use XX characters for the blog date in the front matter and file name. We will work with you on updating the PR with the publication date once we finalize the blog schedule.

[spurin]

Hi @stlaz 👋,

Just a reminder to open a placeholder PR against dev-1.32 branch in the k/website repo for this (steps available here) for this KEP if it requires new or modifications to existing docs.

The deadline for this is Thursday Oct 24 at 18:00 PDT.

Thanks

James Spurin

[tkashem]

draft doc PR: kubernetes/website#48463

[jenshu]

Hey again @stlaz 👋, v1.32 Enhancements team here.

Just checking in as we approach code freeze at 02:00 UTC Friday 8th November 2024 / 19:00 PDT Thursday 7th November 2024.

Here's where this enhancement currently stands:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PR/s are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

For this enhancement, it looks like the following PRs need to be merged before code freeze (and we need to update the Issue description to include all the related PRs of this KEP):

• KEP-3926: unsafe deletion of corrupt objects kubernetes#127513
• KEP-3926: add a new type to represent a corrupt object in storage error kubernetes#128056
• KEP-3926: refactor: extend newTransformTest to enable RBAC kubernetes#128191

If you anticipate missing code freeze, you can file an exception request in advance.

Also, please let me know if there are other PRs in k/k we should be tracking for this KEP.
As always, we are here to help if any questions come up. Thanks!

[tkashem]

/assign

[tkashem]

other refactor PRs that have already merged:

• KEP-3926: refactor: extract etcd3 store decode functions into an interface kubernetes#127982
• KEP-3926: storage.InternalError should retain the inner error kubernetes#127984
• KEP-3926: refactor: add delete options for Delete method in storage interface kubernetes#127777
• KEP-3926: refactor: etcd store conditional delete kubernetes#127778

[tjons]

Hello @stlaz 👋 Enhancements team here,

Unfortunately, the implementation (code related) PR(s) associated with this enhancement is not in the merge-ready state by code-freeze and hence this enhancement is now removed from the 1.32 milestone.

If you still wish to progress this enhancement in 1.32, please file an exception request as soon as possible, within three days. If you have any questions, you can reach out in the #release-enhancements channel on Slack and we'll be happy to help. Thanks!

/milestone clear

[tkashem]

@tjons the implementation pr kubernetes/kubernetes#127513 merged in time.

kubernetes/kubernetes#128056 and kubernetes/kubernetes#128191 were closed since they were included in #127513

[pacoxu]

/milestone v1.32

[spurin]

Based on the thread, I’ve moved this back to "Tracked for Code Freeze" in the tracker. However, I’m uncertain if this aligns with the intended approach for this task. cc: @tjons

[tkashem]

the doc PR: kubernetes/website#48463 is ready for review

[tkashem]

Adding more tests:

• KEP-3926: Add a test to verify list error aggregation kubernetes#129129
• KEP-3926: Add tests to verify that delete handlers work with unsafe delete kubernetes#128726

[dipesh-rawat]

Hello 👋, 1.33 Enhancements Lead here.

I’m closing milestone 1.32 now. If you'd like to work on this enhancement in v1.33, please have the SIG lead opt-in by adding the lead-opted-in label, which ensures it gets added to the tracking board. Also, please set the milestone to v1.33 using /milestone v1.33.
Thanks!

/remove-label lead-opted-in
/milestone clear

[lzung]

Hello @stlaz @tkashem 👋, v1.33 Enhancements team here.

Just checking in as we approach enhancements freeze on 02:00 UTC Friday 14th February 2025 / 19:00 PDT Thursday 13th February 2025.

This enhancement is targeting stage alpha for v1.33 (correct me, if otherwise)
/stage alpha

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: v1.33.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here). If your production readiness review is not completed yet, please make sure to fill the production readiness questionnaire in your KEP by the PRR Freeze deadline on Thursday 6th February 2025 so that the PRR team has enough time to review your KEP.

For this KEP, we would just need to update the following:

• Please update KEP status for milestone v1.33

The status of this enhancement is marked as At risk for enhancements freeze. Please keep the issue description up-to-date with appropriate stages as well.

If you anticipate missing enhancements freeze, you can file an exception request in advance. Thank you!