KEP 4447: Promote PolicyReport API to Kubernetes SIG API #4448

anusha94 · 2024-01-27T10:09:34Z

One-line PR description: Adding a new KEP-4447 to promote PolicyReport API to a Kubernetes SIG API

Issue link: Promote PolicyReport API to a Kubernetes SIG API #4447

Other comments: None

/sig auth
/wg policy

k8s-ci-robot · 2024-01-27T10:09:42Z

Welcome @anusha94!

It looks like this is your first PR to kubernetes/enhancements 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/enhancements has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2024-01-27T10:09:43Z

Hi @anusha94. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

keps/sig-auth/4447-promote-policyreport-sig-api/README.md

sftim · 2024-01-28T14:00:57Z

keps/sig-auth/4447-promote-policyreport-sig-api/README.md

+Based on the producer and usage, it is possible to create lots of report objects. 
+For example, if a policy engine has 20 policy rules and a namespace has 1000 pods, 
+an implementation may produce 20,000 reports. This can overwhelm etcd.


Suggested change

Based on the producer and usage, it is possible to create lots of report objects.

For example, if a policy engine has 20 policy rules and a namespace has 1000 pods,

an implementation may produce 20,000 reports. This can overwhelm etcd.

Based on the producer and usage, it is possible to create lots of report objects.

For example, if a policy engine has 20 policy rules and a namespace has 1000 pods,

an implementation may produce 20,000 reports. If a cluster operator deploys PolicyReport

into their cluster, using this APU can overwhelm etcd.

(is this a risk? We already let people deploy any CRD they like.)

It has definitely been reported as an issue for users of the API. Whether that constitutes a risk or not is a good question, but this should be highlighted somewhere

We have 2 projects we can link to and reference - perhaps in the docs?

https://github.com/kyverno/reports-server

https://github.com/open-cluster-management-io/enhancements/tree/main/enhancements/sig-policy/98-long-term-compliance-history

This is my core concern with the concept of reporting findings via the API server.

I think events are another example of a high-volume object? One salient difference between this and events is that events are understood to be subject to throttling/sampling. Security reports may not have the same luxury.

I like the idea of reports-server, but IMO it would need to be an expectation that all clusters have a similar scalable backend solution before reports could be reliably enabled without risking cluster stability.

I should also add that there is a difference between "users can deploy any CRD they like" and "K8s accepts using KRM/the API server this way as a valid practice", the second statement has much stronger implications around supportability.

@JimBugwadia can you comment on the cluster reliability and performance concerns brought up here?

Hi @ritazh - can you please help clarify what exactly is expected?

The proposal is for a uniform API for reporting, and reliability or performance will depend heavily on implementations. For example, the API as a contract between consumers and producers can be used as a bounded log for the last N results.

We can help document best practices, but seems like a number of those may be applicable to any other API as well. For example, the standard size limits would apply, and resource limits can be configured.

Is there any prior work, done to test performance and reliability impacts of other APIs, that we can reference?

If there are specific tests or measurements that are recommended, happy to help capture the data.

sftim · 2024-01-28T14:01:21Z

keps/sig-auth/4447-promote-policyreport-sig-api/README.md

+We need approvals from the following stakeholders:
+[TBD]


Will we target this API at a release?

No, its decoupled from Kubernetes releases.

sftim · 2024-01-28T14:02:39Z

keps/sig-auth/4447-promote-policyreport-sig-api/README.md

+
+- Add `policy-report-api` as a new project under kubernetes-sigs i.e `github.com/kubernetes-sigs/policy-report-api`
+- Provide guidance on building consumers and producers
+


Do we want to publish official artefacts for the API?

YAML manifest?

OCI image of Helm chart?

something else?

Here's what I suggest:

Golang client set to reuse in producers and consumers

Generated YAMLs

API spec

Docs

keps/sig-auth/4447-promote-policyreport-sig-api/README.md

sudermanjr · 2024-01-31T16:34:03Z

keps/sig-auth/4447-promote-policyreport-sig-api/README.md

+Based on the producer and usage, it is possible to create lots of report objects. 
+For example, if a policy engine has 20 policy rules and a namespace has 1000 pods, 
+an implementation may produce 20,000 reports. This can overwhelm etcd.


It has definitely been reported as an issue for users of the API. Whether that constitutes a risk or not is a good question, but this should be highlighted somewhere

nilekhc · 2024-02-12T17:17:05Z

/assign @ritazh

k8s-triage-robot · 2024-06-02T22:29:42Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot · 2024-07-02T23:03:33Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle rotten
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

JimBugwadia · 2024-07-02T23:09:39Z

/remove-lifecycle rotten

Co-authored-by: Andy Suderman <andy@suderman.dev>

k8s-ci-robot · 2024-08-26T12:42:54Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: anusha94
Once this PR has been reviewed and has the lgtm label, please ask for approval from ritazh. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

keps/sig-auth/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-triage-robot · 2024-11-24T13:23:09Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

JimBugwadia · 2024-11-24T17:45:34Z

/remove-lifecycle stale

PolicyReport KEP initial commit

27b73b3

k8s-ci-robot added sig/auth Categorizes an issue or PR as relevant to SIG Auth. wg/policy Categorizes an issue or PR as relevant to WG Policy. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jan 27, 2024

k8s-ci-robot requested a review from deads2k January 27, 2024 10:09

k8s-ci-robot added the kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory label Jan 27, 2024

k8s-ci-robot requested a review from mikedanese January 27, 2024 10:09

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jan 27, 2024

k8s-ci-robot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Jan 27, 2024

sftim reviewed Jan 28, 2024

View reviewed changes

anusha94 added 2 commits January 29, 2024 20:26

Change Policy Report to PolicyReport

668faf1

Update PolicyReport occurrences

8068934

sudermanjr reviewed Jan 31, 2024

View reviewed changes

k8s-ci-robot assigned ritazh Feb 12, 2024

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 2, 2024

k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Jul 2, 2024

k8s-ci-robot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Jul 2, 2024

Update keps/sig-auth/4447-promote-policyreport-sig-api/README.md

055c7d0

Co-authored-by: Andy Suderman <andy@suderman.dev>

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 24, 2024

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 24, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

KEP 4447: Promote PolicyReport API to Kubernetes SIG API #4448

KEP 4447: Promote PolicyReport API to Kubernetes SIG API #4448

anusha94 commented Jan 27, 2024

k8s-ci-robot commented Jan 27, 2024

k8s-ci-robot commented Jan 27, 2024

sftim Jan 28, 2024

sudermanjr Jan 31, 2024 •

edited

Loading

JimBugwadia Feb 28, 2024

maxsmythe Mar 4, 2024 •

edited

Loading

maxsmythe Mar 4, 2024

ritazh Aug 14, 2024 •

edited

Loading

JimBugwadia Aug 26, 2024

sftim Jan 28, 2024

JimBugwadia Feb 28, 2024

sftim Jan 28, 2024

JimBugwadia Feb 28, 2024

sudermanjr Jan 31, 2024 •

edited

Loading

nilekhc commented Feb 12, 2024

k8s-triage-robot commented Jun 2, 2024

k8s-triage-robot commented Jul 2, 2024

JimBugwadia commented Jul 2, 2024

k8s-ci-robot commented Aug 26, 2024

k8s-triage-robot commented Nov 24, 2024

JimBugwadia commented Nov 24, 2024


		- Add `policy-report-api` as a new project under kubernetes-sigs i.e `github.com/kubernetes-sigs/policy-report-api`
		- Provide guidance on building consumers and producers

KEP 4447: Promote PolicyReport API to Kubernetes SIG API #4448

Are you sure you want to change the base?

KEP 4447: Promote PolicyReport API to Kubernetes SIG API #4448

Conversation

anusha94 commented Jan 27, 2024

k8s-ci-robot commented Jan 27, 2024

k8s-ci-robot commented Jan 27, 2024

Choose a reason for hiding this comment

sudermanjr Jan 31, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maxsmythe Mar 4, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ritazh Aug 14, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sudermanjr Jan 31, 2024 • edited Loading

Choose a reason for hiding this comment

nilekhc commented Feb 12, 2024

k8s-triage-robot commented Jun 2, 2024

k8s-triage-robot commented Jul 2, 2024

JimBugwadia commented Jul 2, 2024

k8s-ci-robot commented Aug 26, 2024

k8s-triage-robot commented Nov 24, 2024

JimBugwadia commented Nov 24, 2024

sudermanjr Jan 31, 2024 •

edited

Loading

maxsmythe Mar 4, 2024 •

edited

Loading

ritazh Aug 14, 2024 •

edited

Loading

sudermanjr Jan 31, 2024 •

edited

Loading