Pid Limiting

[derekwaynecarr]

Enhancement Description

• Ability to isolate pid resources pod-to-pod and node-to-pod

• Primary contact (assignee): @derekwaynecarr

• Responsible SIGs: sig-node

• Design proposal link (community repo): KEP Pid Limiting #755

• Link to e2e and/or unit tests: https://github.com/kubernetes/kubernetes/blob/master/test/e2e_node/pids_test.go

• KEP: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/757-pid-limiting

• Reviewer(s) - @dashpole @sjenning

• Approver (likely from SIG/area to which enhancement belongs): @dashpole @dchen1107

• Enhancement target (which target equals to which milestone):

  • Alpha 1.10
  • Beta 1.15
  • Stable release target 1.20

• Documentation PR: pid limiting documentation website#23929

[derekwaynecarr]

/sig node

[derekwaynecarr]

/assign @dashpole @dchen1107

[ameukam]

/kind feature

[ameukam]

Hello @derekwaynecarr, 1.14 enhancement shadow here. Code Freeze is March 7th and all PRs must be merged by then to your issue to make the 1.14 release. What open K/K PRs do you still have that need to merge? Thanks

[simplytunde]

Hey @derekwaynecarr. Just a friendly reminder we're looking for a PR against k/website (branch dev-1.14) due by Friday, March 1. It would be great if it's the start of the full documentation, but even a placeholder PR is acceptable. Let me know if you have any questions!

[sjenning]

kubernetes/kubernetes#73651 implements node-to-pid isolation for 1.14.
@RobertKrawitz could you open a PR against kubernetes/website for documenting this. Doesn't have to be the full thing yet. I think @simplytunde just needs the PR for release tracking atm.

[RobertKrawitz]

kubernetes/website#12932 is a placeholder.

[RobertKrawitz]

Above PR is complete and waiting for review/approval.

[derekwaynecarr]

kubernetes/website#13006 as well

[kacole2]

Hello @derekwaynecarr, I'm the Enhancement Lead for 1.15. Is this feature going to be graduating alpha/beta/stable stages in 1.15? Please let me know so it can be tracked properly and added to the spreadsheet.

/milestone clear
/tracked no

[derekwaynecarr]

we are graduating the node to pod pid isolation to beta for 1.15 per the kep.

/milestone 1.15

[k8s-ci-robot]

@derekwaynecarr: The provided milestone is not valid for this repository. Milestones in this repository: [keps-beta, keps-ga, v1.15, v1.16]

Use /milestone clear to clear the milestone.

In response to this:

we are graduating the node to pod pid isolation to beta for 1.15 per the kep.

/milestone 1.15

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[derekwaynecarr]

/milestone v1.15

[palnabarun]

/remove-lifecycle stale

[kikisdeliveryservice]

Hi @derekwaynecarr @RobertKrawitz

Enhancements Lead here. Are there any plans for this 1.20?

Thanks!
Kirsten

[sjenning]

This is going GA for 1.20 kubernetes/kubernetes#94140

[kikisdeliveryservice]

/milestone v1.20

[sftim]

As per #757 (reference) I also recommend documenting the feature.

[kikisdeliveryservice]

Documentation PR already open: kubernetes/website#23929

[MorrisLaw]

Hey @derekwaynecarr @RobertKrawitz - 1.20 Enhancements Shadow here 👋

Just a friendly reminder that the Enhancements Freeze deadline is October 6th.

[MorrisLaw]

Hi @derekwaynecarr,

Since your Enhancement is scheduled to be in 1.20, please keep in mind the important upcoming dates:
Friday, Nov 6th: Week 8 - Docs Placeholder PR deadline
Thursday, Nov 12th: Week 9 - Code Freeze

As a reminder, please link all of your k/k PR as well as docs PR to this issue so we can track them.

Regards,
Jeremy

[kikisdeliveryservice]

Hey @derekwaynecarr @sjenning

Is kubernetes/kubernetes#94140 the only k/k pr required to move this to GA? Is all work done? Code freeze is tomorrow.

Thanks
Kirsten

[kikisdeliveryservice]

Confirmed with both Derek and Seth that this is completed. 👍

[hh]

Just a quick check that in the process of promoting this feature to GA, was there any change to the API surface area?

Particularly swagger.json?

We have a process for detecting new GA API operations, but it currently looks primarily at the generated OpenAPI spec.

[hh]

it tests only GA, non-optional features or APIs (e.g., no alpha or beta endpoints, no feature flags required, no deprecated features)

^ From: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/conformance-tests.md#conformance-test-requirements

@dims Can I get your check-in on this? It doesn't seem to touch the OpenAPI spec, but if looks non-optional:

https://github.com/kubernetes/kubernetes/pull/94140/files#diff-71e3b98f9a6bbf5b8421e26a7ba0c079f397cd8d49abacdad943c66a4f44f03dR685-R686

+ SupportPodPidsLimit: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.21
+ SupportNodePidsLimit:{Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.21

[derekwaynecarr]

There is no end user api change in the promotion. The feature has been on by default via kubelet Config for multiple releases.

[hh]

Thanks @derekwaynecarr !

[SergeyKanzhelev]

@derekwaynecarr I wonder if the pid limit test should have been promoted to conformance as part of the GA process? It seems to be satisfying all requirements. I understand now there is a validation for the APIs to be conformance tested. I also see conformance tests for things like config maps. I wonder whether graduation criteria in general should include promoting a test to conformance whenever possible.

On KEP I see the graduation criteria that doesn't say anything about conformance tests:

GA

• assuming no negative user feedback, promote after 1 release at beta.

The only note on desire to increase coverage of conformance tests I found here:

NB: This should be viewed as a living document in a few key areas:

The desired set of conformant behaviors is not adequately expressed by the current set of e2e tests, as such this document is currently intended to guide us in the addition of new e2e tests than can fill this gap

[annajung]

Hi @SergeyKanzhelev @derekwaynecarr, 1.21 Enhancement Lead here.
Does this issue need to be kept open?

[SergeyKanzhelev]

This is GA'd. I don't see the reason to keep it open. @annajung can you please fix the link to KEP text in this issue description?

[annajung]

Great, it's been fixed.
With it being GA and KEP updated to implemented, I'm closing this issue.