KEP-213keps/sig-node/213-run-as-group

RunAsGroup support in PodSpec and PodSecurityPolicy

implementedstablesig-nodelatest v1.21

KEP on GitHub kep.yaml Ask about this KEP

- https://github.com/kubernetes/kubernetes/pull/52077 - https://github.com/kubernetes/kubernetes/pull/67802 - https://github.com/kubernetes/kubernetes/pull/61030 - https://github.com/kubernetes/kubernetes/pull/72230 - https://github.com/kubernetes/kubernetes/pull/70465 - https://github.com/kubernetes/website/pull/12297 - https://github.com/kubernetes/kuberne… Full summary

Facts

Authors: @krmayankk
Approvers: @liggitt @derekwaynecarr
Reviewers: @mrunalp @tallclair
PRR approvers: @johnbelamaricstable
Tracking issue: #213(opens GitHub in a new tab) closedcompletedclosed 2022-01-08 17:26 UTCmilestone v1.21sig/nodestage/stablekind/featurelifecycle/rottenkind/api-change
Milestones: alpha v1.10beta v1.14stable v1.21
Participating SIGs: sig-auth
Feature gates: none
Created / last updated: 2017-06-21 / 2021-04-08

Who decided each state, with the evidence.
Decided	Decision	Deciders	Evidence
2020-09-09 07:59 UTC	prr_approval johnbelamaric gave the production readiness approval for KEP-213 at stable on 2020-09-09.	@johnbelamaric prr_approver	Document 213.yaml(opens GitHub in a new tab)
2020-12-17 17:41 UTC	status_transition KEP-213 status set to implementable in PR #2193, approved by johnbelamaric; merged by automation (k8s-ci-robot) on 2020-12-17.	@wojtek-t author @johnbelamaric approve_command @johnbelamaric lgtm @k8s-ci-robot merger	Commit kubernetes/enhancements@7eef794bb549a50c6b08c457556ff0eac98a4c6b(opens GitHub in a new tab) StatusChange status ∅ → implementable (2020-12-17)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#2193 Migrate some node KEPs to new template(opens GitHub in a new tab) Review kubernetes/enhancements/pulls/reviews/554835705(opens GitHub in a new tab)
2021-02-10 04:58 UTC	stage_graduation KEP-213 set milestone.alpha to v1.10 in PR #1974, approved by derekwaynecarr, johnbelamaric; merged by automation (k8s-ci-robot) on 2021-02-10.	@johnbelamaric approve_command @johnbelamaric lgtm @derekwaynecarr approve_command @derekwaynecarr lgtm @krmayankk author @k8s-ci-robot merger	Commit kubernetes/enhancements@5a02adf28bd6c899366945067438d4e7eef09075(opens GitHub in a new tab) StatusChange milestone.alpha ∅ → v1.10 (2020-09-09)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#1974 Promote RunAsGroup to GA
2021-02-10 04:58 UTC	stage_graduation KEP-213 set milestone.beta to v1.14 in PR #1974, approved by derekwaynecarr, johnbelamaric; merged by automation (k8s-ci-robot) on 2021-02-10.	@johnbelamaric approve_command @johnbelamaric lgtm @derekwaynecarr approve_command @derekwaynecarr lgtm @krmayankk author @k8s-ci-robot merger	Commit kubernetes/enhancements@5a02adf28bd6c899366945067438d4e7eef09075(opens GitHub in a new tab) StatusChange milestone.beta ∅ → v1.14 (2020-09-09)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#1974 Promote RunAsGroup to GA
2021-02-10 04:58 UTC	stage_graduation KEP-213 set milestone.stable to v1.21 in PR #1974, approved by derekwaynecarr, johnbelamaric; merged by automation (k8s-ci-robot) on 2021-02-10.	@johnbelamaric approve_command @johnbelamaric lgtm @derekwaynecarr approve_command @derekwaynecarr lgtm @krmayankk author @k8s-ci-robot merger	Commit kubernetes/enhancements@5a02adf28bd6c899366945067438d4e7eef09075(opens GitHub in a new tab) StatusChange milestone.stable ∅ → v1.21 (2020-09-09)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#1974 Promote RunAsGroup to GA
2021-02-10 04:58 UTC	stage_graduation KEP-213 graduated to stable in PR #1974, approved by derekwaynecarr, johnbelamaric; merged by automation (k8s-ci-robot) on 2021-02-10.	@johnbelamaric approve_command @johnbelamaric lgtm @derekwaynecarr approve_command @derekwaynecarr lgtm @krmayankk author @k8s-ci-robot merger	Commit kubernetes/enhancements@5a02adf28bd6c899366945067438d4e7eef09075(opens GitHub in a new tab) StatusChange stage ∅ → stable (2020-09-09)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#1974 Promote RunAsGroup to GA(opens GitHub in a new tab)
2022-01-11 16:44 UTC	status_transition KEP-213 status changed from implementable to implemented in PR #2614, approved by mrunalp, derekwaynecarr; merged by automation (k8s-ci-robot) on 2022-01-11.	@mrunalp approver @ehashman author @derekwaynecarr approve_command @derekwaynecarr lgtm @annajung lgtm @k8s-ci-robot merger	Commit kubernetes/enhancements@657ebd7679d0afaff84e66e2dbbeb6395af81f34(opens GitHub in a new tab) StatusChange status implementable → implemented (2021-04-08)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#2614 Mark RunAsGroup as GA(opens GitHub in a new tab)

Metadata, label and milestone changes, oldest first.Showing 1–10 of 79Rows

Status history
At	Kind	Field	Change	Actor	Evidence
2017-03-20 12:59 UTC	milestone	milestone milestoned	none → next-milestone	@idvoretskyi	source(opens GitHub in a new tab)
2018-01-08 11:19 UTC	label	lifecycle/stale added	none → lifecycle/stale	@k8s-ci-robot	source

Relationships as stored, Person → KEP, from kep.yaml(opens GitHub in a new tab)
Person	Relationship
@krmayankk GitHub(opens GitHub in a new tab)	—AUTHORED→
@mrunalp GitHub(opens GitHub in a new tab)	—REVIEWS→
@tallclair GitHub(opens GitHub in a new tab)	—REVIEWS→
@liggitt GitHub

How they connect

Shortest paths in the graph between this KEP and its SIG or one of its people, up to four hops.

Impact of change

Rows returned by the tool
Kep	Depth	Reached	By hop	Open pull requests	Hop	Sigs	People
{ "label": "KEP", "key": "keps/sig-node/213-run-as-group", "title": "RunAsGroup support in PodSpec and PodSecurityPolicy", "url": "https://github.com/kubernetes/enhancements/tree/5b503a75369bdfdd494a2c2c72107a41bf6dd1a8/keps/sig-node/213-run-as-group", "evidence_id": "unqaikpzvjgh", "number": 213, "owning_sig": "sig-node", "status": "implemented", "stage": "stable", "latest_milestone": "v1.21", "milestone_alpha": "v1.10", "milestone_beta": "v1.14", "milestone_stable": "v1.21", "creation_date": "2017-06-21", "last_updated": "2021-04-08", "metadata_invalid": false }	2	4	{ "1": { "sigs": 1, "people": 3 } }	not in graph (merged pull requests only)	none	none	none
none	none	none	none	none	1	[ { "label": "SIG", "key": "sig-node", "title": "Node", "url": "https://github.com/kubernetes/community/tree/440e496d3a172234d81728df1bfe43849b589adf/sig-node", "evidence_id": "nrsuxu2xcxa7", "display_name": "Node", "sig_label": "node", "in_scope": true } ]	[ { "label": "Person", "key": "krmayankk", "title": "krmayankk", "url": "https://github.com/krmayankk", "evidence_id": "4zfp2d5552d5", "login": "krmayankk", "is_bot": false }, { "label": "Person", "key": "liggitt", "title": "liggitt", "url": "https://github.com/liggitt", "evidence_id": "mjccccaftaj3", "login": "liggitt", "is_bot": false }, { "label": "Person", "key": "derekwaynecarr", "title": "derekwaynecarr", "url": "https://github.com/derekwaynecarr", "evidence_id": "wpnbg5qnq5fl", "login": "derekwaynecarr", "is_bot": false } ]

Rows returned by the tool
Kep	Depth	Reached	By hop	Open pull requests	Hop	Sigs	People
{ "label": "KEP", "key": "keps/sig-node/213-run-as-group", "title": "RunAsGroup support in PodSpec and PodSecurityPolicy", "url": "https://github.com/kubernetes/enhancements/tree/5b503a75369bdfdd494a2c2c72107a41bf6dd1a8/keps/sig-node/213-run-as-group", "evidence_id": "unqaikpzvjgh", "number": 213, "owning_sig": "sig-node", "status": "implemented", "stage": "stable", "latest_milestone": "v1.21", "milestone_alpha": "v1.10", "milestone_beta": "v1.14", "milestone_stable": "v1.21", "creation_date": "2017-06-21", "last_updated": "2021-04-08", "metadata_invalid": false }	2	4	{ "1": { "sigs": 1, "people": 3 } }	not in graph (merged pull requests only)	none	none	none
none	none	none	none	none	1	[ { "label": "SIG", "key": "sig-node", "title": "Node", "url": "https://github.com/kubernetes/community/tree/440e496d3a172234d81728df1bfe43849b589adf/sig-node", "evidence_id": "nrsuxu2xcxa7", "display_name": "Node", "sig_label": "node", "in_scope": true } ]	[ { "label": "Person", "key": "krmayankk", "title": "krmayankk", "url": "https://github.com/krmayankk", "evidence_id": "4zfp2d5552d5", "login": "krmayankk", "is_bot": false }, { "label": "Person", "key": "liggitt", "title": "liggitt", "url": "https://github.com/liggitt", "evidence_id": "mjccccaftaj3", "login": "liggitt", "is_bot": false }, { "label": "Person", "key": "derekwaynecarr", "title": "derekwaynecarr", "url": "https://github.com/derekwaynecarr", "evidence_id": "wpnbg5qnq5fl", "login": "derekwaynecarr", "is_bot": false } ]

Kep

Depth

Reached

By hop

Open pull requests

Hop

Sigs

People

{
  "label": "KEP",
  "key": "keps/sig-node/213-run-as-group",
  "title": "RunAsGroup support in PodSpec and PodSecurityPolicy",
  "url": "https://github.com/kubernetes/enhancements/tree/5b503a75369bdfdd494a2c2c72107a41bf6dd1a8/keps/sig-node/213-run-as-group",
  "evidence_id": "unqaikpzvjgh",
  "number": 213,
  "owning_sig": "sig-node",
  "status": "implemented",
  "stage": "stable",
  "latest_milestone": "v1.21",
  "milestone_alpha": "v1.10",
  "milestone_beta": "v1.14",
  "milestone_stable": "v1.21",
  "creation_date": "2017-06-21",
  "last_updated": "2021-04-08",
  "metadata_invalid": false
}

{
  "1": {
    "sigs": 1,
    "people": 3
  }
}

not in graph (merged pull requests only)

[
  {
    "label": "SIG",
    "key": "sig-node",
    "title": "Node",
    "url": "https://github.com/kubernetes/community/tree/440e496d3a172234d81728df1bfe43849b589adf/sig-node",
    "evidence_id": "nrsuxu2xcxa7",
    "display_name": "Node",
    "sig_label": "node",
    "in_scope": true
  }
]

[
  {
    "label": "Person",
    "key": "krmayankk",
    "title": "krmayankk",
    "url": "https://github.com/krmayankk",
    "evidence_id": "4zfp2d5552d5",
    "login": "krmayankk",
    "is_bot": false
  },
  {
    "label": "Person",
    "key": "liggitt",
    "title": "liggitt",
    "url": "https://github.com/liggitt",
    "evidence_id": "mjccccaftaj3",
    "login": "liggitt",
    "is_bot": false
  },
  {
    "label": "Person",
    "key": "derekwaynecarr",
    "title": "derekwaynecarr",
    "url": "https://github.com/derekwaynecarr",
    "evidence_id": "wpnbg5qnq5fl",
    "login": "derekwaynecarr",
    "is_bot": false
  }
]

MATCH (k:KEP {key: $key}) RETURN k LIMIT 1 ; MATCH (k:KEP {key: $key}) MATCH path = (k)-[:REPLACES|SUPERSEDED_BY|SEE_ALSO|GATED_BY*1..2]-(n) WHERE n <> k AND (n:KEP OR n:FeatureGate) AND all(x IN nodes(path)[1..-1] WHERE x <> k AND (x:KEP OR (x:FeatureGate AND NOT x.key IN $placeholders))) WITH n, path ORDER BY length(path), [x IN nodes(path) | x.key] WITH n, collect(path)[0] AS path RETURN n AS node, length(path) AS hop, path ORDER BY hop, n.key LIMIT 150 ; UNWIND $keys AS kk MATCH (k:KEP {key: kk}) RETURN k.key AS kep, [(k)-[r_0:OWNED_BY]->(s_0:SIG) WHERE coalesce(r_0.valid_to, $open) = $open | s_0] AS sigs, [(p_1:Person)-[r_1:AUTHORED]->(k) WHERE coalesce(r_1.valid_to, $open) = $open AND coalesce(p_1.is_bot, false) = false | p_1] AS authors, [(p_2:Person)-[r_2:APPROVES]->(k) WHERE coalesce(r_2.valid_to, $open) = $open AND coalesce(p_2.is_bot, false) = false | p_2] AS approvers, [(k)-[r_3:TRACKED_BY]->(i_3:Issue) WHERE coalesce(r_3.valid_to, $open) = $open AND i_3.state = 'open' | i_3] AS open_issues LIMIT 200

RunAsGroup support in PodSpec and PodSecurityPolicy

Facts

How they connect

Impact of change

Keyboard shortcuts

Everywhere

Go to a page

Ask

Search lists

KEP page

Findings table

How they connect

Impact of change

Hop 1

Impact of change

Impact of change

Hop 1