Add PSP to the deprecation guide #26629

tallclair · 2021-02-19T20:20:05Z

See also #26581

tallclair · 2021-02-19T20:21:21Z

@reylejano missed your comment before pushing this - how do you want to handle it? This information seems relevant prior to v1.21 being released, so I'd vote to keep it on the main branch.

netlify · 2021-02-19T20:32:58Z

Deploy preview for kubernetes-io-master-staging ready!

Built with commit ce2e5f8

https://deploy-preview-26629--kubernetes-io-master-staging.netlify.app

reylejano · 2021-02-19T21:15:09Z

/assign
@cc @sftim @kbhawkey @jimangel @irvifa

@tallclair I've cc'd sig-docs leads to get their input

liggitt · 2021-02-19T21:26:21Z

content/en/docs/reference/using-api/deprecation-guide.md

@@ -49,6 +49,13 @@ RuntimeClass in the **node.k8s.io/v1beta1** API version will no longer be served
 * All existing persisted objects are accessible via the new API
 * No notable changes

+#### PodSecurityPolicy {#psp-v125}


my initial version kept this page limited to things with clear replacements. I was going to see what shook out for PSP this release, and if cronjob graduates to v1 as expected in 1.21, update this section for both of them after that.

also, PSP deprecation is getting released with 1.21, so I'd hold this at least until then

I'm OK with merging this into the live website before v1.21 released, provided that:

the deprecation in v1.21 is planned out, including how we communicate it

we are confident beyond any reasonable doubt of the deprecation timeline, we are committing ourselves to make exactly the changes we're documenting here

we make this update in tandem with the broader piece about communiction

See PR #27369, Add blog post describing PSP deprecation and next steps.

(now merged)

liggitt · 2021-02-19T21:26:51Z

content/en/docs/reference/using-api/deprecation-guide.md

+
+The **extensions/v1beta1** API version of PodSecurityPolicy is no longer served as of v1.16.
+
+* Migrate manifests and API client to use the **policy/v1beta1** API version, available since v1.10.


Suggested change

* Migrate manifests and API client to use the **policy/v1beta1** API version, available since v1.10.

* Migrate manifests and API clients to use the **policy/v1beta1** API version, available since v1.10.

liggitt · 2021-02-19T21:27:07Z

content/en/docs/reference/using-api/deprecation-guide.md

+The **extensions/v1beta1** API version of PodSecurityPolicy is no longer served as of v1.16.
+
+* Migrate manifests and API client to use the **policy/v1beta1** API version, available since v1.10.
+* Note that the **policy/v1beta1** API version of PodSecurityPolicy will be removed in v1.25.


Suggested change

* Note that the **policy/v1beta1** API version of PodSecurityPolicy will be removed in v1.25.

* Note that the **policy/v1beta1** API version of PodSecurityPolicy is also deprecated and will be removed in v1.25.

liggitt · 2021-02-19T21:28:03Z

content/en/docs/reference/using-api/deprecation-guide.md

@@ -49,6 +49,13 @@ RuntimeClass in the **node.k8s.io/v1beta1** API version will no longer be served
 * All existing persisted objects are accessible via the new API
 * No notable changes

+#### PodSecurityPolicy {#psp-v125}
+
+PodSecurityPolicy in the **policy/v1beta1** API version will no longer be served in v1.25, and the PodSecurityPolicy admission controller will be removed.


Suggested change

PodSecurityPolicy in the **policy/v1beta1** API version will no longer be served in v1.25, and the PodSecurityPolicy admission controller will be removed.

The **policy/v1beta1** API version of PodSecurityPolicy will no longer be served in v1.25, and the PodSecurityPolicy admission plugin will be removed.

Would be good to add this, but I don't see it blocking a merge.

liggitt · 2021-02-19T21:28:36Z

content/en/docs/reference/using-api/deprecation-guide.md

+
+PodSecurityPolicy in the **policy/v1beta1** API version will no longer be served in v1.25, and the PodSecurityPolicy admission controller will be removed.
+
+PodSecurityPolicy replacements are still under discussion, but current use can be migrated to


I would avoid putting uncertain future-looking statements in this doc

Suggested change

PodSecurityPolicy replacements are still under discussion, but current use can be migrated to

Current use can be migrated to

We can link to the blog article from #27369, which I believe is due to merge and publish before the v1.21 release. Usually we don't link to blog articles for information about features but in this case I (confidently) think that's a good idea.

annajung · 2021-02-19T21:30:04Z

/hold until consensus on adding this to main vs dev-1.21 branch
feel free to remove hold when a decision has been reached

cc @palnabarun

kbhawkey · 2021-02-19T21:48:54Z

content/en/docs/reference/using-api/deprecation-guide.md

+
+PodSecurityPolicy in the **policy/v1beta1** API version will no longer be served in v1.25, and the PodSecurityPolicy admission controller will be removed.
+
+PodSecurityPolicy replacements are still under discussion, but current use can be migrated to


👋 @tallclair .
I'm a bit surprised that this page includes information about future feature deprecations (about 1 yr away?).

nit: PodSecurityPolicy replacements are still under discussion; however, you can migrate current PodSecurityPolicy resources to ...

the ones already included in the page in master are current deprecations (if you kubectl get those resources on a 1.20 API server, you get a message that they are deprecated, when they'll be removed, and what you should switch to using)

current deprecations

makes sense to me

We could merge this change at the same time as the deprecation announcement.

tengqm · 2021-02-20T02:06:40Z

SInce PSP deprecation is targeted 1.21, please consider submit this to the dev-1.21 branch.

reylejano · 2021-02-20T02:13:00Z

/milestone 1.21
/assign @tengqm
/sig auth

tengqm · 2021-03-18T01:04:35Z

@annajung I was suggesting this going into dev-1.21 branch because PSP is not deprecated in 1.20 yet. Considering that the target page already contains some future predicting contents, maybe we can lift the hold on this?

liggitt · 2021-03-18T01:43:56Z

Considering that the target page already contains some future predicting contents, maybe we can lift the hold on this?

I intentionally limited this page to items already announced as deprecated in a released version, which had an unequivocal "switch to use ____" call to action. Neither of those is yet true for PSP, so I wouldn't merge this to master yet.

reylejano · 2021-03-18T04:06:43Z

I intentionally limited this page to items already announced as deprecated in a released version, which had an unequivocal "switch to use ____" call to action. Neither of those is yet true for PSP, so I wouldn't merge this to master yet.

@liggitt @tallclair How about submitting this PR to the dev-1.21 branch so that it merges with master on the 1.21 release date (April 8). March 31 is the "ready to merge" deadline for the dev-1.21 and the PR can be modified until then.

sftim · 2021-04-06T21:19:44Z

We published https://blog.k8s.io/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/

sftim · 2021-04-06T21:20:35Z

/lgtm

k8s-ci-robot · 2021-04-06T21:20:46Z

LGTM label has been added.

Git tree hash: c6ccb356f9965f6eaf628f55cdd7b7d52af3b580

sftim · 2021-04-06T21:21:18Z

Not unholding, but I recommend that whoever approves this does also unhold it.

reylejano · 2021-04-07T15:45:45Z

Hi @tallclair , what do you think of the suggestion of replacing controller with plugin in L54. The PSP blog post is live now, what do you think of linking to the blog post. This PR can stay targeted to the master branch

sftim · 2021-04-07T16:10:57Z

I'm definitely happy to see this merge in even if there are nits. The commit in the PR right now could be polished, but is factually accurate enough to merge.

reylejano · 2021-04-08T19:16:02Z

/hold cancel
/approve

k8s-ci-robot · 2021-04-08T19:16:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: reylejano

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [reylejano]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Add PSP to the deprecation guide

ce2e5f8

k8s-ci-robot requested a review from deads2k February 19, 2021 20:20

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. labels Feb 19, 2021

k8s-ci-robot assigned reylejano Feb 19, 2021

liggitt reviewed Feb 19, 2021

View reviewed changes

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 19, 2021

kbhawkey reviewed Feb 19, 2021

View reviewed changes

k8s-ci-robot assigned tengqm Feb 20, 2021

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Feb 20, 2021

k8s-ci-robot added this to the 1.21 milestone Feb 20, 2021

liggitt mentioned this pull request Mar 23, 2021

generic ephemeral volumes: beta #26801

Merged

sftim mentioned this pull request Apr 3, 2021

Add blog post describing PSP deprecation and next steps. #27369

Merged

k8s-ci-robot assigned sftim Apr 6, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 6, 2021

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 8, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 8, 2021

k8s-ci-robot merged commit 5fe92f2 into kubernetes:master Apr 8, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add PSP to the deprecation guide #26629

Add PSP to the deprecation guide #26629

tallclair commented Feb 19, 2021

tallclair commented Feb 19, 2021

netlify bot commented Feb 19, 2021

reylejano commented Feb 19, 2021

liggitt Feb 19, 2021

liggitt Feb 19, 2021

sftim Feb 20, 2021

sftim Apr 3, 2021

sftim Apr 7, 2021

liggitt Feb 19, 2021

liggitt Feb 19, 2021

liggitt Feb 19, 2021

sftim Apr 3, 2021

liggitt Feb 19, 2021

sftim Apr 3, 2021

annajung commented Feb 19, 2021

kbhawkey Feb 19, 2021

liggitt Feb 19, 2021 •

edited

Loading

sftim Apr 3, 2021

tengqm commented Feb 20, 2021

reylejano commented Feb 20, 2021

tengqm commented Mar 18, 2021

liggitt commented Mar 18, 2021

reylejano commented Mar 18, 2021

sftim commented Apr 6, 2021

sftim commented Apr 6, 2021

k8s-ci-robot commented Apr 6, 2021

sftim commented Apr 6, 2021

reylejano commented Apr 7, 2021 •

edited

Loading

sftim commented Apr 7, 2021

reylejano commented Apr 8, 2021

k8s-ci-robot commented Apr 8, 2021


		The extensions/v1beta1 API version of PodSecurityPolicy is no longer served as of v1.16.

		* Migrate manifests and API client to use the policy/v1beta1 API version, available since v1.10.

	* Migrate manifests and API client to use the policy/v1beta1 API version, available since v1.10.
	* Migrate manifests and API clients to use the policy/v1beta1 API version, available since v1.10.

	* Note that the policy/v1beta1 API version of PodSecurityPolicy will be removed in v1.25.
	* Note that the policy/v1beta1 API version of PodSecurityPolicy is also deprecated and will be removed in v1.25.

	PodSecurityPolicy in the policy/v1beta1 API version will no longer be served in v1.25, and the PodSecurityPolicy admission controller will be removed.
	The policy/v1beta1 API version of PodSecurityPolicy will no longer be served in v1.25, and the PodSecurityPolicy admission plugin will be removed.


		PodSecurityPolicy in the policy/v1beta1 API version will no longer be served in v1.25, and the PodSecurityPolicy admission controller will be removed.

		PodSecurityPolicy replacements are still under discussion, but current use can be migrated to

	PodSecurityPolicy replacements are still under discussion, but current use can be migrated to
	Current use can be migrated to

Add PSP to the deprecation guide #26629

Add PSP to the deprecation guide #26629

Conversation

tallclair commented Feb 19, 2021

tallclair commented Feb 19, 2021

netlify bot commented Feb 19, 2021

reylejano commented Feb 19, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

annajung commented Feb 19, 2021

Choose a reason for hiding this comment

liggitt Feb 19, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tengqm commented Feb 20, 2021

reylejano commented Feb 20, 2021

tengqm commented Mar 18, 2021

liggitt commented Mar 18, 2021

reylejano commented Mar 18, 2021

sftim commented Apr 6, 2021

sftim commented Apr 6, 2021

k8s-ci-robot commented Apr 6, 2021

sftim commented Apr 6, 2021

reylejano commented Apr 7, 2021 • edited Loading

sftim commented Apr 7, 2021

reylejano commented Apr 8, 2021

k8s-ci-robot commented Apr 8, 2021

liggitt Feb 19, 2021 •

edited

Loading

reylejano commented Apr 7, 2021 •

edited

Loading