Skip to content

annual-report-2025.md

Latest commit

 

History

History
118 lines (95 loc) · 11.6 KB

annual-report-2025.md

File metadata and controls

118 lines (95 loc) · 11.6 KB

2025 Annual Report: SIG Auth

Current initiatives and Project Health

  1. What work did the SIG do this year that should be highlighted?
  • Leadership change: Mike Danese (@mikedanese) offboarded; Anish Ramasekar (@aramase) and Micah Hausler (@micahhausler) onboarded as SIG Auth chairs (#8390).
  • ClusterTrustBundles (KEP-3257) graduated to beta in v1.33, providing a cluster-scoped resource for holding X.509 trust anchors (root certificates). This API makes it easier for in-cluster certificate signers to publish and communicate X.509 trust anchors to cluster workloads.
  • Projected ServiceAccount tokens for kubelet image credential providers (KEP-4412) was introduced as alpha in v1.33 and graduated to beta in v1.34. The kubelet can now request short-lived, audience-bound ServiceAccount tokens for authenticating to container registries, eliminating the need for long-lived image pull secrets.
  • Structured Authentication Configuration (KEP-3331) graduated to stable in v1.34. The AuthenticationConfiguration type in --authentication-config files was promoted to apiserver.config.k8s.io/v1, supporting multiple JWT authenticators, CEL expression validation, and dynamic reloading.
  • Authorize with Selectors (KEP-4601) graduated to stable in v1.34. Authorization decisions can now leverage field and label selectors to restrict list, watch, and deletecollection operations. The AuthorizeWithSelectors and AuthorizeNodeWithSelectors feature gates were promoted to stable and locked on.
  • Anonymous auth configurable endpoints (KEP-4633) graduated to stable in v1.34. Anonymous access can now be limited to an explicit allowlist of endpoints such as /healthz, /readyz, /livez, reducing the blast radius of RBAC misconfigurations.
  • Pod Security Admission baseline and restricted levels now block setting .host field in ProbeHandler and LifecycleHandler (KEP-4940) graduated to stable in v1.34.
  • Support for external signing of service account tokens (KEP-740) graduated to beta in v1.34.
  • DRA Admin Access (KEP-5018) was introduced as alpha in v1.33 and graduated to beta in v1.34.
  • Pod Certificates (KEP-4317) was introduced as alpha in v1.34 and graduated to beta in v1.35. This enables native workload identity with automated certificate rotation, where the kubelet generates keys and requests certificates via PodCertificateRequest, writing credential bundles directly to the Pod's filesystem.
  • Constrained Impersonation (KEP-5284) was introduced as alpha in v1.35, implementing a framework to prevent impersonating users from performing unauthorized actions.
  • Added ability to specify controlplane or cluster egress selectors in JWT authenticators via the issuer.egressSelectorType field in v1.34, gated by the StructuredAuthenticationConfigurationEgressSelector beta feature gate.
  • Kube-apiserver now supports disabling caching of authorization webhook decisions in the --authorization-config file in v1.34 using cacheAuthorizedRequests and cacheUnauthorizedRequests fields.
  • The NodeRestriction admission controller now disallows nodes from changing their ownerReferences in v1.33, preventing nodes from deleting themselves by patching OwnerReferences.
  • Made pods/exec, pods/attach, and pods/portforward subresources require create permission for both SPDY and Websocket requests in v1.35, gated by AuthorizePodWebsocketUpgradeCreatePermission (enabled by default).
  • Cross-SIG work (SIG Auth participating):
    • Ensure Secret Pulled Images (KEP-2535, sig-node) was introduced as alpha in v1.33 and graduated to beta in v1.35. Provides authorization to container image pulls for images already present on the node, ensuring image pull credentials are re-verified even for cached images.
    • Fine grained Kubelet API authorization (KEP-2862, sig-node) graduated to beta in v1.33. Adds fine-grained authorization controls to the kubelet's API endpoints.
    • Credential plugin policy and allowlist in kuberc (KEP-3104, sig-cli) graduated to beta in v1.35. The credPluginPolicy and credPluginAllowlist fields were added to the kuberc configuration file, giving users control over which exec credential plugins kubectl is allowed to execute.
    • CSI driver opt-in for service account tokens via secrets field (KEP-5538, sig-storage) graduated to beta in v1.35. CSI drivers can now opt in to receive service account tokens via the secrets field instead of volume context, separating credentials from metadata to prevent accidental leakage.
  • Important initiatives that aren't tracked via KEPs:
    • Once a week issue/PR triage meetings.
    • Retired the hierarchical-namespace-controller subproject and the policy working group #5484.
  1. Are there any areas and/or subprojects that your group needs help with (e.g. fewer than 2 active OWNERS)?
  1. Did you have community-wide updates in 2025 (e.g. KubeCon talks)?
  1. KEP work in 2025 (v1.33, v1.34, v1.35):

Subprojects

Retired in 2025:

  • hierarchical-namespace-controller

Continuing:

  • audit-logging
  • authenticators
  • authorizers
  • certificates
  • encryption-at-rest
  • node-identity-and-isolation
  • policy-management
  • secrets-store-csi-driver
  • secrets-store-sync-controller
  • service-accounts
  • sig-auth-tools

Working groups

New in 2025:

  • AI Integration
  • Checkpoint Restore

Retired in 2025:

  • Policy

Operational

Operational tasks in sig-governance.md:

  • README.md reviewed for accuracy and updated if needed
  • CONTRIBUTING.md reviewed for accuracy and updated if needed
  • Other contributing docs (e.g. in devel dir or contributor guide) reviewed for accuracy and updated if needed
  • Subprojects list and linked OWNERS files in sigs.yaml reviewed for accuracy and updated if needed
  • SIG leaders (chairs, tech leads, and subproject leads) in sigs.yaml are accurate and active, and updated if needed
  • Meeting notes and recordings for 2025 are linked from README.md and updated/uploaded if needed