ClusterTrustBundles (previously Trust Anchor Sets)

[ahmedtd]

Enhancement Description

• One-line enhancement description (can be used as a release note): Define ClusterTrustBundle, a resource for holding X.509 trust anchors
• Kubernetes Enhancement Proposal: link
• Discussion Link: Draft doc w/ comments SIG Auth Meeting
• Primary contact (assignee): @ahmedtd
• Responsible SIGs: sig-auth
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.27 (API), 1.28 (Kubelet)
  • Beta release target (x.y): 1.33
  • Stable release target (x.y): ??
• 1.27 - Alpha
  • KEP (k/enhancements) update PR(s):
    • KEP-3257: Trust Anchor Sets #3258
    • kep-3257: Update target milestone, record reviewers / approvers #3826
  • Code (k/k) update PR(s):
    • Add certificates.k8s.io/v1alpha1 ClusterTrustBundle kubernetes#113218
  • Docs (k/website) update PR(s):
    • ClusterTrustBundles: Add section to certificates page website#40065
• 1.28 - Alpha
  • KEP (k/enhancements) update PR(s):
  • Code (k/k) update PR(s):
    • Implement ClusterTrustBundlePEM projected volume kubernetes#113374
  • Docs (k/website) update PR(s):
• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP-3257: cluster trust bundles: add a new in-tree signer and its CTB #4791
    • KEP-3257: bump CTB beta/latest-milestone to 1.33 #5025
  • Code (k/k) update PR(s):
    • trustbundles: add a new kube-apiserver-serving signer kubernetes#127326
    • ClusterTrustBundles - move to beta kubernetes#128499
  • Docs (k/website) update(s): Label kubernetes.io/cluster-trust-bundle-version not documented website#41481

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[ahmedtd]

/sig auth

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[ritazh]

/remove-lifecycle rotten