Handling undecryptable resources

[stlaz]

Handling undecryptable resources

• One-line enhancement description (can be used as a release note): Improve the identification of resources that won't decrypt. Make it possible to remove undecryptable resources by using the API.
• Kubernetes Enhancement Proposal: link
• Discussion Link: sig-auth meeting, 01.03.2023 - 40:41
• Primary contact (assignee): @stlaz
• Responsible SIGs: sig-auth, sig-api-machinery
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.32
  • Beta release target (x.y): 1.36
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s):
    • KEP-3926: handling undecryptable resources #3927
    • KEP-3926: update KEP latest milestone to v1.34 as implementable #5412
    • KEP-3926: update KEP beta milestone to v1.35 #5418
    • KEP-3926: keep in alpha for v1.35 #5658
  • Code (k/k) update PR(s):
    • 1.32:
      • KEP-3926: refactor: extract etcd3 store decode functions into an interface kubernetes#127982
      • KEP-3926: storage.InternalError should retain the inner error kubernetes#127984
      • KEP-3926: refactor: add delete options for Delete method in storage interface kubernetes#127777
      • KEP-3926: refactor: etcd store conditional delete kubernetes#127778
      • KEP-3926: unsafe deletion of corrupt objects kubernetes#127513
      • KEP-3926: add a new type to represent a corrupt object in storage error kubernetes#128056
      • KEP-3926: refactor: extend newTransformTest to enable RBAC kubernetes#128191
    • 1.33:
      • KEP-3926: skip admission validation for unsafe delete kubernetes#130595
    • 1.35:
      • KEP-3926: test the delete handler with unsafe deletion flow kubernetes#128726
      • KEP-3926: Add a test to verify list error aggregation kubernetes#129129
  • Docs (k/website) update PR(s):
    • add doc for new delete option ignoreStoreReadErrorWithClusterBreakingPotential website#48463
    • KEP-3926: Docs (Placeholder PR) website#52919
• Beta
  • KEP (k/enhancements) update PR(s):
    • 1.36:
      • KEP-3926: Add beta graduation criteria #5739
    • 1.37:
      • KEP-3926: Ensure corruption at latest revision for "unsafe delete" path. kubernetes#137582
  • Code (k/k) update PR(s):
    • kep-3926: add integration tests for CR and bit-flip corrupt object deletion kubernetes#137351
  • Docs (k/website) update(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[stlaz]

/sig auth
/sig api
/assign

[k8s-ci-robot]

@stlaz: The label(s) sig/api cannot be applied, because the repository doesn't have them.

Details

In response to this:

/sig auth
/sig api
/assign

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[stlaz]

/sig api-machinery

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[stlaz]

/remove-lifecycle stale