KEP-4265keps/sig-node/4265-proc-mount

Add ProcMount option

implementablestablesig-nodelatest v1.36

KEP on GitHub kep.yaml Ask about this KEP

For Linux containers, the Kubelet instructs container runtimes to mask and set as read-only certain paths in /proc. This is to prevent data from being exposed into a container that should not be. However, there are certain use-cases where it is necessary to turn this off. This KEP proposes adding a field to the Pod security context to allow bypassing the usual restrictions. In 1.12, this was introduced as the ProcMountType feature gate, and has it has languished in alpha ever since. This KEP is a successor to (and heavily based on) https://github.com/kubernetes/community/pull/1934, updated for the modern era.

Facts

Authors: @haircommander
Approvers: @mrunalp @haircommander
Reviewers: none
PRR approvers: @jpbetzstable@deads2kalpha@deads2kbeta
Tracking issue: #4265(opens GitHub in a new tab) opensig/authsig/nodestage/stabletriage/accepted
Milestones: alpha v1.12beta v1.33stable v1.36
Participating SIGs: sig-auth
Feature gates: ProcMountType
Created / last updated: 2018-05-07 / none

Who decided each state, with the evidence.
Decided	Decision	Deciders	Evidence
2023-10-02 19:33 UTC	prr_approval deads2k gave the production readiness approval for KEP-4265 at alpha on 2023-10-02.	@deads2k prr_approver	Document 4265.yaml(opens GitHub in a new tab)
2023-10-02 19:33 UTC	prr_approval deads2k gave the production readiness approval for KEP-4265 at beta on 2023-10-02.	@deads2k prr_approver	Document 4265.yaml(opens GitHub in a new tab)
2024-02-08 19:34 UTC	stage_graduation KEP-4265 set milestone.alpha to v1.12 in PR #4266, approved by mrunalp, sergeykanzhelev, deads2k; merged by automation (k8s-ci-robot) on 2024-02-08.	@mrunalp approver @mrunalp lgtm @haircommander author @sergeykanzhelev approver @sergeykanzhelev lgtm @deads2k approve_command @k8s-ci-robot merger	Commit kubernetes/enhancements@bba9221bccdd8a9171ec120d797b2cc6004d900d(opens GitHub in a new tab) StatusChange milestone.alpha ∅ → v1.12 (2023-10-02)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#4266 Add restrospetive KEP for ProcMount and target at Beta
2024-02-08 19:34 UTC	stage_graduation KEP-4265 set milestone.beta to v1.30 in PR #4266, approved by mrunalp, sergeykanzhelev, deads2k; merged by automation (k8s-ci-robot) on 2024-02-08.	@mrunalp approver @mrunalp lgtm @haircommander author @sergeykanzhelev approver @sergeykanzhelev lgtm @deads2k approve_command @k8s-ci-robot merger	Commit kubernetes/enhancements@bba9221bccdd8a9171ec120d797b2cc6004d900d(opens GitHub in a new tab) StatusChange milestone.beta ∅ → v1.30 (2023-10-02)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#4266 Add restrospetive KEP for ProcMount and target at Beta
2024-02-08 19:34 UTC	stage_graduation KEP-4265 graduated to beta in PR #4266, approved by mrunalp, sergeykanzhelev, deads2k; merged by automation (k8s-ci-robot) on 2024-02-08.	@mrunalp approver @mrunalp lgtm @haircommander author @sergeykanzhelev approver @sergeykanzhelev lgtm @deads2k approve_command @k8s-ci-robot merger	Commit kubernetes/enhancements@bba9221bccdd8a9171ec120d797b2cc6004d900d(opens GitHub in a new tab) StatusChange stage ∅ → beta (2023-10-02)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#4266 Add restrospetive KEP for ProcMount and target at Beta
2024-02-08 19:34 UTC	status_transition KEP-4265 status set to implementable in PR #4266, approved by mrunalp, sergeykanzhelev, deads2k; merged by automation (k8s-ci-robot) on 2024-02-08.	@mrunalp approver @mrunalp lgtm @haircommander author @sergeykanzhelev approver @sergeykanzhelev lgtm @deads2k approve_command @k8s-ci-robot merger	Commit kubernetes/enhancements@bba9221bccdd8a9171ec120d797b2cc6004d900d(opens GitHub in a new tab) StatusChange status ∅ → implementable (2023-10-02)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#4266 Add restrospetive KEP for ProcMount and target at Beta
2024-05-31 20:11 UTC	milestone_retarget KEP-4265 latest-milestone moved from v1.30 to v1.31 in PR #4679, approved by mrunalp; merged by automation (k8s-ci-robot) on 2024-05-31.	@mrunalp approver @mrunalp lgtm @sohankunkerkar author @k8s-ci-robot merger	Commit kubernetes/enhancements@fccc556e5e53f4fa91baf7ae86a23057ce259c2f(opens GitHub in a new tab) StatusChange latest_milestone v1.30 → v1.31 (2024-05-31)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#4679 KEP-4265: promote ProcMount option to beta(opens GitHub in a new tab) Review kubernetes/enhancements/pulls/reviews/2091633336
2024-05-31 20:11 UTC	milestone_retarget KEP-4265 milestone.beta moved from v1.30 to v1.31 in PR #4679, approved by mrunalp; merged by automation (k8s-ci-robot) on 2024-05-31.	@mrunalp approver @mrunalp lgtm @sohankunkerkar author @k8s-ci-robot merger	Commit kubernetes/enhancements@fccc556e5e53f4fa91baf7ae86a23057ce259c2f(opens GitHub in a new tab) StatusChange milestone.beta v1.30 → v1.31 (2024-05-31)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#4679 KEP-4265: promote ProcMount option to beta(opens GitHub in a new tab) Review kubernetes/enhancements/pulls/reviews/2091633336
2025-02-03 23:38 UTC	milestone_retarget KEP-4265 latest-milestone moved from v1.31 to v1.33 in PR #5120, approved by mrunalp; merged by automation (k8s-ci-robot) on 2025-02-03.	@kannon92 lgtm @mrunalp approver @mrunalp lgtm @haircommander author @k8s-ci-robot merger	Commit kubernetes/enhancements@cae99408c4f4c8cdcc53b9e99ec371595adeecad(opens GitHub in a new tab) StatusChange latest_milestone v1.31 → v1.33 (2025-01-31)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#5120 KEP-4265: move to on by default beta(opens GitHub in a new tab) Review kubernetes/enhancements/pulls/reviews/2591367102
2025-02-03 23:38 UTC	milestone_retarget KEP-4265 milestone.beta moved from v1.31 to v1.33 in PR #5120, approved by mrunalp; merged by automation (k8s-ci-robot) on 2025-02-03.	@kannon92 lgtm @mrunalp approver @mrunalp lgtm @haircommander author @k8s-ci-robot merger	Commit kubernetes/enhancements@cae99408c4f4c8cdcc53b9e99ec371595adeecad(opens GitHub in a new tab) StatusChange milestone.beta v1.31 → v1.33 (2025-01-31)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#5120 KEP-4265: move to on by default beta(opens GitHub in a new tab) Review kubernetes/enhancements/pulls/reviews/2591367102
2026-01-29 17:19 UTC	prr_approval jpbetz gave the production readiness approval for KEP-4265 at stable on 2026-01-29.	@jpbetz prr_approver	Document 4265.yaml(opens GitHub in a new tab)
2026-02-05 18:04 UTC	milestone_retarget KEP-4265 latest-milestone moved from v1.33 to v1.36 in PR #5853, approved by mrunalp, jpbetz; merged by automation (k8s-ci-robot) on 2026-02-05.	@mrunalp approver @mrunalp lgtm @haircommander author @jpbetz approve_command @k8s-ci-robot merger	Commit kubernetes/enhancements@8cb2aaf3c94b164e32c2c7f5c309d8dd323fcbcc(opens GitHub in a new tab) StatusChange latest_milestone v1.33 → v1.36 (2026-01-29)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#5853 KEP-4265: promote to stable(opens GitHub in a new tab) Review kubernetes/enhancements/pulls/reviews/3758582690
2026-02-05 18:04 UTC	stage_graduation KEP-4265 set milestone.stable to v1.36 in PR #5853, approved by mrunalp, jpbetz; merged by automation (k8s-ci-robot) on 2026-02-05.	@mrunalp approver @mrunalp lgtm @haircommander author @jpbetz approve_command @k8s-ci-robot merger	Commit kubernetes/enhancements@8cb2aaf3c94b164e32c2c7f5c309d8dd323fcbcc(opens GitHub in a new tab) StatusChange milestone.stable ∅ → v1.36 (2026-01-29)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#5853 KEP-4265: promote to stable(opens GitHub in a new tab) Review kubernetes/enhancements/pulls/reviews/3758582690
2026-02-05 18:04 UTC	stage_graduation KEP-4265 graduated to stable from beta in PR #5853, approved by mrunalp, jpbetz; merged by automation (k8s-ci-robot) on 2026-02-05.	@mrunalp approver @mrunalp lgtm @haircommander author @jpbetz approve_command @k8s-ci-robot merger	Commit kubernetes/enhancements@8cb2aaf3c94b164e32c2c7f5c309d8dd323fcbcc(opens GitHub in a new tab) StatusChange stage beta → stable (2026-01-29)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#5853 KEP-4265: promote to stable(opens GitHub in a new tab) Review kubernetes/enhancements/pulls/reviews/3758582690

Metadata, label and milestone changes, oldest first.Showing 1–10 of 67Rows

Status history
At	Kind	Field	Change	Actor	Evidence
2023-10-02 18:57 UTC	label	needs-sig added	none → needs-sig	@k8s-ci-robot	source(opens GitHub in a new tab)
2023-10-02 18:57 UTC	label	sig/node added	none → sig/node	@k8s-ci-robot	source

Relationships as stored, Person → KEP, from kep.yaml(opens GitHub in a new tab)
Person	Relationship
@haircommander GitHub(opens GitHub in a new tab)	—AUTHORED→
@mrunalp GitHub(opens GitHub in a new tab)	—APPROVES→
@haircommander GitHub(opens GitHub in a new tab)	—APPROVES→
@jpbetz

How they connect

Shortest paths in the graph between this KEP and its SIG or one of its people, up to four hops.

Impact of change

Rows returned by the tool
Kep	Depth	Reached	By hop	Open pull requests	Hop	Feature gates	Sigs	People	Open issues
{ "label": "KEP", "key": "keps/sig-node/4265-proc-mount", "title": "Add ProcMount option", "url": "https://github.com/kubernetes/enhancements/tree/6ebe0a94771723b3f27cb4a757f0cc22f29e38a2/keps/sig-node/4265-proc-mount", "evidence_id": "pody54csr2f7", "number": 4265, "owning_sig": "sig-node", "status": "implementable", "stage": "stable", "latest_milestone": "v1.36", "milestone_alpha": "v1.12", "milestone_beta": "v1.33", "milestone_stable": "v1.36", "creation_date": "2018-05-07", "metadata_invalid": false }	2	5	{ "1": { "feature_gates": 1, "sigs": 1, "people": 2, "open_issues": 1 } }	not in graph (merged pull requests only)	none	none	none	none	none
none	none	none	none	none	1	[ { "label": "FeatureGate", "key": "ProcMountType", "title": "ProcMountType", "url": "https://github.com/kubernetes/enhancements/blob/6ebe0a94771723b3f27cb4a757f0cc22f29e38a2/keps/sig-node/4265-proc-mount/kep.yaml", "evidence_id": "czpbdb2wcels", "name": "ProcMountType" } ]	[ { "label": "SIG", "key": "sig-node", "title": "Node", "url": "https://github.com/kubernetes/community/tree/440e496d3a172234d81728df1bfe43849b589adf/sig-node", "evidence_id": "nrsuxu2xcxa7", "display_name": "Node", "sig_label": "node", "in_scope": true } ]	[ { "label": "Person", "key": "haircommander", "title": "haircommander", "url": "https://github.com/haircommander", "evidence_id": "so5ew2mhqcu2", "login": "haircommander", "is_bot": false }, { "label": "Person", "key": "mrunalp", "title": "mrunalp", "url": "https://github.com/mrunalp", "evidence_id": "oysq4hgp6yuk", "login": "mrunalp", "is_bot": false } ]	[ { "label": "Issue", "key": "kubernetes/enhancements#4265", "title": "add ProcMount option", "url": "https://github.com/kubernetes/enhancements/issues/4265", "evidence_id": "s5ntq2kvpur7", "number": 4265, "state": "open", "created_at_iso": "2023-10-02T18:57:03Z", "labels_current": [ "sig/auth", "sig/node", "stage/stable", "triage/accepted" ], "is_tracking_issue": true } ]

Rows returned by the tool
Kep	Depth	Reached	By hop	Open pull requests	Hop	Feature gates	Sigs	People	Open issues
{ "label": "KEP", "key": "keps/sig-node/4265-proc-mount", "title": "Add ProcMount option", "url": "https://github.com/kubernetes/enhancements/tree/6ebe0a94771723b3f27cb4a757f0cc22f29e38a2/keps/sig-node/4265-proc-mount", "evidence_id": "pody54csr2f7", "number": 4265, "owning_sig": "sig-node", "status": "implementable", "stage": "stable", "latest_milestone": "v1.36", "milestone_alpha": "v1.12", "milestone_beta": "v1.33", "milestone_stable": "v1.36", "creation_date": "2018-05-07", "metadata_invalid": false }	2	5	{ "1": { "feature_gates": 1, "sigs": 1, "people": 2, "open_issues": 1 } }	not in graph (merged pull requests only)	none	none	none	none	none
none	none	none	none	none	1	[ { "label": "FeatureGate", "key": "ProcMountType", "title": "ProcMountType", "url": "https://github.com/kubernetes/enhancements/blob/6ebe0a94771723b3f27cb4a757f0cc22f29e38a2/keps/sig-node/4265-proc-mount/kep.yaml", "evidence_id": "czpbdb2wcels", "name": "ProcMountType" } ]	[ { "label": "SIG", "key": "sig-node", "title": "Node", "url": "https://github.com/kubernetes/community/tree/440e496d3a172234d81728df1bfe43849b589adf/sig-node", "evidence_id": "nrsuxu2xcxa7", "display_name": "Node", "sig_label": "node", "in_scope": true } ]	[ { "label": "Person", "key": "haircommander", "title": "haircommander", "url": "https://github.com/haircommander", "evidence_id": "so5ew2mhqcu2", "login": "haircommander", "is_bot": false }, { "label": "Person", "key": "mrunalp", "title": "mrunalp", "url": "https://github.com/mrunalp", "evidence_id": "oysq4hgp6yuk", "login": "mrunalp", "is_bot": false } ]	[ { "label": "Issue", "key": "kubernetes/enhancements#4265", "title": "add ProcMount option", "url": "https://github.com/kubernetes/enhancements/issues/4265", "evidence_id": "s5ntq2kvpur7", "number": 4265, "state": "open", "created_at_iso": "2023-10-02T18:57:03Z", "labels_current": [ "sig/auth", "sig/node", "stage/stable", "triage/accepted" ], "is_tracking_issue": true } ]

Kep

Depth

Reached

By hop

Open pull requests

Hop

Feature gates

Sigs

People

Open issues

{
  "label": "KEP",
  "key": "keps/sig-node/4265-proc-mount",
  "title": "Add ProcMount option",
  "url": "https://github.com/kubernetes/enhancements/tree/6ebe0a94771723b3f27cb4a757f0cc22f29e38a2/keps/sig-node/4265-proc-mount",
  "evidence_id": "pody54csr2f7",
  "number": 4265,
  "owning_sig": "sig-node",
  "status": "implementable",
  "stage": "stable",
  "latest_milestone": "v1.36",
  "milestone_alpha": "v1.12",
  "milestone_beta": "v1.33",
  "milestone_stable": "v1.36",
  "creation_date": "2018-05-07",
  "metadata_invalid": false
}

{
  "1": {
    "feature_gates": 1,
    "sigs": 1,
    "people": 2,
    "open_issues": 1
  }
}

not in graph (merged pull requests only)

[
  {
    "label": "FeatureGate",
    "key": "ProcMountType",
    "title": "ProcMountType",
    "url": "https://github.com/kubernetes/enhancements/blob/6ebe0a94771723b3f27cb4a757f0cc22f29e38a2/keps/sig-node/4265-proc-mount/kep.yaml",
    "evidence_id": "czpbdb2wcels",
    "name": "ProcMountType"
  }
]

[
  {
    "label": "SIG",
    "key": "sig-node",
    "title": "Node",
    "url": "https://github.com/kubernetes/community/tree/440e496d3a172234d81728df1bfe43849b589adf/sig-node",
    "evidence_id": "nrsuxu2xcxa7",
    "display_name": "Node",
    "sig_label": "node",
    "in_scope": true
  }
]

[
  {
    "label": "Person",
    "key": "haircommander",
    "title": "haircommander",
    "url": "https://github.com/haircommander",
    "evidence_id": "so5ew2mhqcu2",
    "login": "haircommander",
    "is_bot": false
  },
  {
    "label": "Person",
    "key": "mrunalp",
    "title": "mrunalp",
    "url": "https://github.com/mrunalp",
    "evidence_id": "oysq4hgp6yuk",
    "login": "mrunalp",
    "is_bot": false
  }
]

[
  {
    "label": "Issue",
    "key": "kubernetes/enhancements#4265",
    "title": "add ProcMount option",
    "url": "https://github.com/kubernetes/enhancements/issues/4265",
    "evidence_id": "s5ntq2kvpur7",
    "number": 4265,
    "state": "open",
    "created_at_iso": "2023-10-02T18:57:03Z",
    "labels_current": [
      "sig/auth",
      "sig/node",
      "stage/stable",
      "triage/accepted"
    ],
    "is_tracking_issue": true
  }
]

MATCH (k:KEP {key: $key}) RETURN k LIMIT 1 ; MATCH (k:KEP {key: $key}) MATCH path = (k)-[:REPLACES|SUPERSEDED_BY|SEE_ALSO|GATED_BY*1..2]-(n) WHERE n <> k AND (n:KEP OR n:FeatureGate) AND all(x IN nodes(path)[1..-1] WHERE x <> k AND (x:KEP OR (x:FeatureGate AND NOT x.key IN $placeholders))) WITH n, path ORDER BY length(path), [x IN nodes(path) | x.key] WITH n, collect(path)[0] AS path RETURN n AS node, length(path) AS hop, path ORDER BY hop, n.key LIMIT 150 ; UNWIND $keys AS kk MATCH (k:KEP {key: kk}) RETURN k.key AS kep, [(k)-[r_0:OWNED_BY]->(s_0:SIG) WHERE coalesce(r_0.valid_to, $open) = $open | s_0] AS sigs, [(p_1:Person)-[r_1:AUTHORED]->(k) WHERE coalesce(r_1.valid_to, $open) = $open AND coalesce(p_1.is_bot, false) = false | p_1] AS authors, [(p_2:Person)-[r_2:APPROVES]->(k) WHERE coalesce(r_2.valid_to, $open) = $open AND coalesce(p_2.is_bot, false) = false | p_2] AS approvers, [(k)-[r_3:TRACKED_BY]->(i_3:Issue) WHERE coalesce(r_3.valid_to, $open) = $open AND i_3.state = 'open' | i_3] AS open_issues LIMIT 200

Add ProcMount option

Facts

How they connect

Impact of change

Keyboard shortcuts

Everywhere

Go to a page

Ask

Search lists

KEP page

Findings table

How they connect

Impact of change

Hop 1

Impact of change

Impact of change

Hop 1