Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AppArmor support #24

Open
13 of 19 tasks
timstclair opened this issue Jul 14, 2016 · 125 comments
Open
13 of 19 tasks

AppArmor support #24

timstclair opened this issue Jul 14, 2016 · 125 comments
Assignees
Labels
kind/feature Categorizes issue or PR as related to a new feature. lead-opted-in Denotes that an issue has been opted in to a release lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. priority/backlog Higher priority than priority/awaiting-more-evidence. sig/node Categorizes an issue or PR as relevant to SIG Node. stage/beta Denotes an issue tracking an enhancement targeted for Beta status
Milestone

Comments

@timstclair
Copy link

timstclair commented Jul 14, 2016

Description

Add AppArmor support to Kubernetes. Initial support should include the ability to specify an AppArmor profile for a container or pod in the API, and have that profile applied by the container runtime.

Progress Tracker

FEATURE_STATUS is used for feature tracking and to be updated by @kubernetes/feature-reviewers.
FEATURE_STATUS: BETA

More advice:

Design

  • Once you get LGTM from a @kubernetes/feature-reviewers member, you can check this checkbox, and the reviewer will apply the "design-complete" label.

Coding

  • Use as many PRs as you need. Write tests in the same or different PRs, as is convenient for you.
  • As each PR is merged, add a comment to this issue referencing the PRs. Code goes in the http://github.com/kubernetes/kubernetes repository,
    and sometimes http://github.com/kubernetes/contrib, or other repos.
  • When you are done with the code, apply the "code-complete" label.
  • When the feature has user docs, please add a comment mentioning @kubernetes/feature-reviewers and they will
    check that the code matches the proposed feature and design, and that everything is done, and that there is adequate
    testing. They won't do detailed code review: that already happened when your PRs were reviewed.
    When that is done, you can check this box and the reviewer will apply the "code-complete" label.

Docs

  • Write user docs and get them merged in.
  • User docs go into http://github.com/kubernetes/kubernetes.github.io.
  • When the feature has user docs, please add a comment mentioning @kubernetes/docs.
  • When you get LGTM, you can check this checkbox, and the reviewer will apply the "docs-complete" label.
@timstclair
Copy link
Author

Original issue here: kubernetes/kubernetes#22159

@idvoretskyi idvoretskyi modified the milestone: v1.4 Jul 18, 2016
k8s-github-robot pushed a commit to kubernetes/kubernetes that referenced this issue Jul 25, 2016
Automatic merge from submit-queue

AppArmor design proposal

For kubernetes/enhancements#24

/cc @kubernetes/sig-node @erictune @matchstick
@idvoretskyi idvoretskyi added the sig/node Categorizes an issue or PR as relevant to SIG Node. label Aug 4, 2016
@janetkuo
Copy link
Member

janetkuo commented Sep 2, 2016

@timstclair it looks like the docs PR number is outdated. Please update the PR number and check the docs box once it's done

@timstclair
Copy link
Author

Fixed. Thanks @janetkuo !

@timstclair
Copy link
Author

Docs kubernetes/website#1147 - @kubernetes/docs

@devin-donnelly
Copy link

Is there an issue? I merged this one in last week.

On Sep 21, 2016 1:30 PM, "Tim St. Clair" notifications@github.com wrote:

Docs kubernetes/website#1147
kubernetes/website#1147 -
@kubernetes/docs https://github.com/orgs/kubernetes/teams/docs


You are receiving this because you are on a team that was mentioned.
Reply to this email directly, view it on GitHub
#24 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/ARmNwOTArylXQHoAoz2lMTsKhg9luaTYks5qsZPlgaJpZM4JMBOR
.

@timstclair
Copy link
Author

No, I was just following the instructions at the bottom of the issue, which I hadn't done before...

@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 2, 2018
@fejta-bot
Copy link

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Feb 7, 2018
@fejta-bot
Copy link

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

@liggitt liggitt reopened this Mar 15, 2018
@liggitt
Copy link
Member

liggitt commented Mar 15, 2018

/remove-lifecycle rotten

@k8s-ci-robot k8s-ci-robot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Mar 15, 2018
@justaugustus
Copy link
Member

@tallclair @liggitt
Any plans for this in 1.11?

If so, can you please ensure the feature is up-to-date with the appropriate:

  • Description
  • Milestone
  • Assignee(s)
  • Labels:
    • stage/{alpha,beta,stable}
    • sig/*
    • kind/feature

cc @idvoretskyi

@tallclair tallclair removed the help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. label Feb 6, 2024
@SergeyKanzhelev
Copy link
Member

/lead-opted-in

@SergeyKanzhelev
Copy link
Member

/label lead-opted-in

@k8s-ci-robot k8s-ci-robot added the lead-opted-in Denotes that an issue has been opted in to a release label Feb 7, 2024
@tjons
Copy link

tjons commented Feb 8, 2024

hey @tallclair - sorry, I missed this KEP when scouring the boards earlier in this release cycle. Enhancements freeze is in just a few hours... https://github.com/kubernetes/enhancements/pull/4417/files needs to merge before we can track this towards the release. Do you think that will be possible?

@tjons
Copy link

tjons commented Feb 9, 2024

Hello 👋, 1.30 Enhancements team here.

Unfortunately, this enhancement did not meet requirements for enhancements freeze.

This question under scalability is now required in the KEP: https://github.com/kubernetes/enhancements/tree/master/keps/NNNN-kep-template#can-enabling--using-this-feature-result-in-resource-exhaustion-of-some-node-resources-pids-sockets-inodes-etc

If you still wish to progress this enhancement in 1.30, please file an exception request. Thanks!

@salehsedghpour
Copy link
Contributor

/milestone clear

@k8s-ci-robot k8s-ci-robot removed this from the v1.30 milestone Feb 9, 2024
@tallclair
Copy link
Member

@tjons Sorry, I missed your comment on this issue. The KEP in question actually did merge in time for enhancements freeze, unless I mixed up the dates. Does this still need an exception request?

/milestone v1.30

@k8s-ci-robot k8s-ci-robot added this to the v1.30 milestone Feb 13, 2024
@tallclair tallclair changed the title Add AppArmor support AppArmor support Feb 14, 2024
@drewhagen
Copy link
Member

Hello @tallclair 👋, 1.30 Docs Lead here.

Does this enhancement work planned for 1.30 require any new docs or modification to existing docs?
If so, please follows the steps here to open a PR against dev-1.30 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday February 22nd 2024 18:00 PDT.

Also, take a look at Documenting for a release to get yourself familiarize with the docs requirement for the release.
Thank you!

@tallclair
Copy link
Member

The AppArmor docs definitely need a refresh. Most of these changes can be made against the main branch though. There will also be some API updates needed on the 1.30 branch though.

@tallclair
Copy link
Member

Docs placeholder: kubernetes/website#45176

@a-mccarthy
Copy link

Hi @tallclair, 👋 from the v1.30 Communications Team! Are you planning to write a blog for this?

We encourage blogs for features including, but not limited to: breaking changes, features and changes important to our users, and features that have been in progress for a long time and are graduating.

To opt in, you need to open a Feature Blog placeholder PR against the website repository.
The placeholder PR deadline is 27th February, 2024.
Here's the 1.30 Release Calendar

@tjons
Copy link

tjons commented Feb 25, 2024

Hey again @tallclair 👋 Enhancements team here,

Just checking in as we approach code freeze at 02:00 UTC Wednesday 6th March 2024 .

Here's where this enhancement currently stands:

  • All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
  • All PR/s are ready to be merged (they have approved and lgtm labels applied) by the code freeze deadline. This includes tests.

For this enhancement, it looks like the following PR is open and needs to be merged before code freeze:

Could you please add the above PR to the issue description?

Also, please let me know if there are other PRs in k/k we should be tracking for this KEP.
As always, we are here to help if any questions come up. Thanks!

@tallclair
Copy link
Member

Updated the issue description with a link to kubernetes/kubernetes#123435. This is currently in the API review queue, scheduled for Thursday.

@salehsedghpour
Copy link
Contributor

With the exception request being approved, this can now be marked as tracked for code freeze.

@tjons
Copy link

tjons commented Mar 21, 2024

Hey @tallclair - Enhancements team here. Now that this has merged and is on track to be stable in 1.30, would you kindly mark the feature as status: implemented in the associated KEP?

Thank you!

@tallclair tallclair added stage/beta Denotes an issue tracking an enhancement targeted for Beta status and removed stage/stable Denotes an issue tracking an enhancement targeted for Stable/GA status labels Apr 3, 2024
@tallclair
Copy link
Member

To clarify, we implemented all the planned changes, but decided to hold the feature in beta for another release. Should I still mark it as implemented, or wait for GA?

@tjons
Copy link

tjons commented Apr 8, 2024

Ah I understand. In that case wait for GA, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature Categorizes issue or PR as related to a new feature. lead-opted-in Denotes that an issue has been opted in to a release lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. priority/backlog Higher priority than priority/awaiting-more-evidence. sig/node Categorizes an issue or PR as relevant to SIG Node. stage/beta Denotes an issue tracking an enhancement targeted for Beta status
Projects
Status: Removed From Milestone
Status: Tracked for Doc Freeze
Development

No branches or pull requests