Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add etcd-security@kubernetes.io group #6542

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add etcd-security@kubernetes.io group #6542

wants to merge 1 commit into from

Conversation

ahrtr
Copy link
Member

@ahrtr ahrtr commented Mar 7, 2024

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. area/access Define who has access to what via IAM bindings, role bindings, policy, etc. labels Mar 7, 2024
@k8s-ci-robot k8s-ci-robot added area/groups Google Groups management, code in groups/ sig/k8s-infra Categorizes an issue or PR as relevant to SIG K8s Infra. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Mar 7, 2024
@ahrtr ahrtr mentioned this pull request Mar 7, 2024
Open
@ahrtr
Add etcd-security@kubernetes.io group
f95201b 
Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>
MadhavJivrajani
MadhavJivrajani approved these changes Mar 7, 2024
View reviewed changes
Copy link
Contributor

@MadhavJivrajani MadhavJivrajani left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 7, 2024
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ahrtr, MadhavJivrajani
Once this PR has been reviewed and has the lgtm label, please assign dims for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@MadhavJivrajani
Copy link
Contributor

/assign @cblecker @nikhita

@upodroid
Copy link
Member

upodroid commented Mar 7, 2024

I have a better idea, why don't we add the etcd.io domain to the kubernetes.io Workspace as an alias domain and then recreate the same mailing list?

@ahrtr
Copy link
Member Author

ahrtr commented Mar 7, 2024

I have a better idea, why don't we add the etcd.io domain to the kubernetes.io Workspace as an alias domain and then recreate the same mailing list?

Sounds like a good idea, so we can continue to use security@etcd.io? cc @jmhbnz @serathius @spzala @wenjiaswe

Will it have any impact on https://etcd.io/?

@upodroid
Copy link
Member

upodroid commented Mar 7, 2024

No, there is a separate issue to recreate the etcd.io DNS zone in a Google Cloud DNS project that the community owns similar to https://github.com/kubernetes/k8s.io/tree/main/dns.

@ahrtr
Copy link
Member Author

ahrtr commented Mar 7, 2024 •
edited

Thanks for the feedback. Let's see others' feedback on we add the etcd.io domain to the kubernetes.io Workspace as an alias domain and then recreate the same mailing list.

Could you provide detailed guide on how to do it? Or can we add a task in #6102?

@upodroid
Copy link
Member

upodroid commented Mar 7, 2024

  1. Send the complete DNS zone for etcd.io to sig-k8s-infra via Slack
  2. We'll recreate the zone in GCP with zero modifications and give you a set of NS records to configure with your domain provider. I'm assuming the domain is owned by CNCF/LF. If not, I would probably fix that as well.
  3. Unlink etcd.io from the current Google Workspace subscription
  4. Someone from @kubernetes/steering-committee needs to add the domain to the kubernetes.io Google Workspace. They will receive a set of DNS records to verify ownership.
  5. We'll add the DNS records for verification and the domain is now available for use.
  6. Update this PR to use the previous email
  7. Merge this PR.

@spzala
Copy link
Member

spzala commented Mar 7, 2024

Thanks for the feedback. Let's see others' feedback on we add the etcd.io domain to the kubernetes.io Workspace as an alias domain and then recreate the same mailing list.

Could you provide detailed guide on how to do it? Or can we add a task in #6102?

Thanks @ahrtr @upodroid Also CC'ing @mrbobbytables @BenTheElder for their thoughts, thanks!

@mrbobbytables
Copy link
Member

I think it's a good move, theres been a separate thread on what to do with the etcd google workspace so this would wrap everything up nicely.

/cc

@spzala
Copy link
Member

spzala commented Mar 7, 2024 •
edited

I think it's a good move, theres been a separate thread on what to do with the etcd google workspace so this would wrap everything up nicely.

/cc

Sounds good, thanks so much @mrbobbytables !! @ahrtr thanks for driving this, I am looking at the next steps in this direction.

spzala
spzala reviewed Mar 7, 2024
View reviewed changes
Copy link
Member

@spzala spzala left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WIP - we will update the PR after working on the suggestions provided by @upodroid Thanks!

@cblecker
Copy link
Member

cblecker commented Mar 7, 2024

Another thing to consider: has sig-etcd spoken with the Kubernetes SRC about this? Now that etcd is a part of the Kubernetes project, I would expect that vulnerability reporting would flow through them now (it wasn't specifically called out in the charter as something that sig-etcd would do differently).

/hold
(adding as the consensus is this PR as is, isn't ready to merge)

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 7, 2024
@wenjiaswe
Copy link

@cblecker I don't know, probably not? Would you please kindly share the point of contact of k8s SRC please?

@BenTheElder
Copy link
Member

Good point, maybe we should alias (#6542 (comment)) security@etcd.io to SRC?

@wenjiaswe:
https://github.com/kubernetes/committee-security-response#contacting-the-src
https://kubernetes.io/security

@spzala
Copy link
Member

spzala commented Mar 13, 2024

As etcd is used as stand-alone, we want to make sure users of etcd don't feel restricted to using it with only k8s. If we can use security@etcd.io alias then using k8s SRC that should be good, IMHO. This will keep things simpler from any maintenance perspective and will keep SRC in aware of any etcd security issues. However, that means, we may want etcd maintainer representation in the SRC or SRC can simply forward issues to the maintainers group (I guess either should work). I can reach out to SRC if using SRC sounds good to you @ahrtr @wenjiaswe @serathius @jmhbnz cc @cblecker @BenTheElder Thanks!

@spzala
Copy link
Member

spzala commented Mar 15, 2024

As etcd is used as stand-alone, we want to make sure users of etcd don't feel restricted to using it with only k8s. If we can use security@etcd.io alias then using k8s SRC that should be good, IMHO. This will keep things simpler from any maintenance perspective and will keep SRC in aware of any etcd security issues. However, that means, we may want etcd maintainer representation in the SRC or SRC can simply forward issues to the maintainers group (I guess either should work). I can reach out to SRC if using SRC sounds good to you @ahrtr @wenjiaswe @serathius @jmhbnz cc @cblecker @BenTheElder Thanks!

I have reached out to SRC but haven't yet heard back I guess because of KubeCon travel next week. I will follow up, but it will be good if you get an opportunity to discuss this in person with any SRC member(s) at the KubeCon @ahrtr @wenjiaswe Thanks!

spzala added a commit to spzala/etcd that referenced this pull request Mar 16, 2024
@spzala
Use etcd maintainers ML for security related discussion
8a49779 
Temporary move to using etcd maintainers mailing list
from security@etcd.io.

Related,
kubernetes/community#7739 and
kubernetes/k8s.io#6542

Signed-off-by: Sahdev Zala <spzala@us.ibm.com>
@spzala spzala mentioned this pull request Mar 16, 2024
Merged
@upodroid
Copy link
Member

I met James in person.

We need to migrate all the GCP projects in the etcd.io GCP org before we decommission the gsuite org and move the domain to kubernetes.io Google Workspace.

I'll work with James & other SIG K8s Infra leads on migrating those projects to our org.

@mrbobbytables
Copy link
Member

I tried to add etcd.io as an alias domain to the kubernetes workspace, but it will not let me proceed because its currently associated with another workspace. -_-

@ahrtr
Copy link
Member Author

ahrtr commented Mar 27, 2024

but it will not let me proceed because its currently associated with another workspace. -_-

cc @idvoretskyi

@cblecker
Copy link
Member

We need to cut some other things over first. This is currently pending on me (and I'm in turn waiting for something from CNCF staff).

/assign
/hold

@jmhbnz jmhbnz mentioned this pull request Mar 28, 2024
Closed
@idvoretskyi
Copy link
Member

A quick check here on a current state of things, @cblecker :)

@BenTheElder
Copy link
Member

What happened with this? Please let us know in #sig-k8s-infra at slack.k8s.io if there's anything blocked on us.

@jmhbnz
Copy link
Member

jmhbnz commented May 23, 2024 •
edited

What happened with this? Please let us know in #sig-k8s-infra at slack.k8s.io if there's anything blocked on us.

Hey Team - @upodroid and I met a couple weeks ago to continue stepping through the migration of gcp projects. We got stuck on permissions and needed to reach out to the Linux Foundation listed org admin for the etcd-development gcp project.

I did that on Kubernetes slack but checking back we haven't had a reply so I have just followed up with an email.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@spzala spzala spzala left review comments

@MadhavJivrajani MadhavJivrajani MadhavJivrajani approved these changes

@thockin thockin Awaiting requested review from thockin

@mrbobbytables mrbobbytables Awaiting requested review from mrbobbytables

Assignees

@cblecker cblecker

@MadhavJivrajani MadhavJivrajani

@nikhita nikhita

Labels
area/access Define who has access to what via IAM bindings, role bindings, policy, etc. area/groups Google Groups management, code in groups/ cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. lgtm "Looks good to me", indicates that a PR is ready to be merged. sig/k8s-infra Categorizes an issue or PR as relevant to SIG K8s Infra. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Create etcd-security@kubernetes.io group