KEP-5018: move to beta in 1.34 #5327

ritazh · 2025-05-21T15:49:32Z

One-line PR description: Update KEP to prepare for beta in 1.34

Issue link: DRA: AdminAccess for ResourceClaims and ResourceClaimTemplates #5018

Other comments: Some of the material is already covered in KEP-4381: DRA Structure Parameters, so that KEP is referenced in some places.

/wg device-management
/assign @liggitt for sig auth
/assign @pohly
/assign @soltysh for PRR

Signed-off-by: Rita Zhang <[email protected]>

k8s-ci-robot · 2025-05-21T15:49:36Z

@ritazh: GitHub didn't allow me to assign the following users: for, sig, auth, PRR.

Note that only kubernetes members with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

One-line PR description: Update KEP to prepare for beta in 1.34

Issue link: DRA: AdminAccess for ResourceClaims and ResourceClaimTemplates #5018

Other comments: Some of the material is already covered in KEP-4381: DRA Structure Parameters, so that KEP is referenced in some places.

/wg device-management
/assign @liggitt for sig auth
/assign @pohly
/assign @soltysh for PRR

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

liggitt

update lgtm, just had a couple questions

liggitt · 2025-05-21T15:54:53Z

keps/sig-auth/5018-dra-adminaccess/README.md

@@ -466,7 +466,7 @@ ResourceClaimTemplate and ResourceClaim for admin access

 - Gather feedback
 - Additional tests are in Testgrid and linked in KEP
- Implementations in the kubernetes-sigs/dra-example-driver
+- Implementations in the kubernetes-sigs/dra-example-driver: https://github.com/kubernetes-sigs/dra-example-driver/issues/97 and the NVIDIA dra driver: https://github.com/NVIDIA/k8s-dra-driver-gpu/issues/337


do those issues mean we will show those repos labeling namespaces as admin access and using devices as admin access before promoting the gate to beta?

Yes, Implementations in the kubernetes-sigs/dra-example-driver was part of the original beta criteria. I think we should be able to add an example there. I'm less certain about the exact timeline of the Nvidia one. I could remove that one for now and add it back AFTER it's done. wdyt?

let's not take dependencies on consumers we're not sure will be ready as a beta graduation criteria ... one example use seems sufficient

liggitt · 2025-05-21T15:57:11Z

keps/sig-auth/5018-dra-adminaccess/README.md

@@ -541,7 +541,12 @@ rollout. Similarly, consider large clusters and how enablement/disablement
 will rollout across nodes.
 -->

-Will be considered for beta.
+- kube-controller-manager: If the kube-controller-manager fails to create `ResourceClaim` objects from `ResourceClaimTemplate` due to misconfigurations or permission issues relating to `adminAccess`, then the associated Pods will remain in a pending state and won't be scheduled.
+- kube-scheduler: Bugs in the scheduler might lead to Pods not being scheduled even when resources are available or, scheduling Pods that shouldn't be scheduled due to unmet `adminAccess` requirements. If the `DRAAdminAccess` feature gate isn't enabled or is misconfigured, the scheduler might not recognize ResourceClaim requirements, leading to scheduling failures.


is this thinking of something more than generic scheduler backoff behavior when it encounters failed API requests?

No, this should be part of the generic scheduler backoff behavior.

ok, maybe clarify that... otherwise this line sounds scarier or more specific to this feature than it actually is

liggitt · 2025-05-21T15:58:11Z

keps/sig-auth/5018-dra-adminaccess/README.md

@@ -596,7 +603,9 @@ checking if there are objects with field X set) may be a last resort. Avoid
 logs or events for this purpose.
 -->

-Will be considered for beta.
+".status.allocation.devices.results[*].adminaccess" will be set to true for a claim using adminAccess when needed by a pod.


Suggested change

".status.allocation.devices.results[*].adminaccess" will be set to true for a claim using adminAccess when needed by a pod.

".status.allocation.devices.results[*].adminAccess" will be set to true for a claim using adminAccess when needed by a pod.

liggitt · 2025-05-21T15:58:50Z

keps/sig-auth/5018-dra-adminaccess/README.md

@@ -705,7 +717,8 @@ and creating new ones, as well as about cluster-level services (e.g. DNS):
      - Impact of its degraded performance or high-error rates on the feature:
 -->

-Will be considered for beta.
+- The DynamicResourceAllocation feature gate must be enabled to create ResourceClaim, ResourceClaimTemplate. More details at [KEP-4381 - DRA Structured Parameters](https://github.com/kubernetes/enhancements/issues/4381)
+- A third-party DRA driver is required for how the driver should interpret the AdminAcess field to get acess to device specific resources without allocating them.


Suggested change

- A third-party DRA driver is required for how the driver should interpret the AdminAcess field to get acess to device specific resources without allocating them.

- A third-party DRA driver is required for how the driver should interpret the AdminAcess field to get access to device specific resources without allocating them.

Signed-off-by: Rita Zhang <[email protected]>

liggitt · 2025-05-21T21:46:23Z

/lgtm
/approve

soltysh

Mostly the integration links are missing, otherwise it's good to go.

soltysh · 2025-05-22T14:30:54Z

keps/sig-auth/5018-dra-adminaccess/README.md

@@ -466,7 +466,7 @@ ResourceClaimTemplate and ResourceClaim for admin access

 - Gather feedback


Missing bits higher in the doc:

make sure to check appropriate boxes in Release Singoff Checklist

In Integration tests section, please make sure to link tests according to the template, especially the newly added that are called out there, since looking at the PRs submitted during alpha they did add new tests.

These comments still hold.

soltysh · 2025-05-22T14:37:17Z

keps/sig-auth/5018-dra-adminaccess/README.md

+    and ResourceClaim.
+
+  - Mitigations: When ResourceClaims or ResourceClaimTemplates the `AdminAccess`
+field don't get created, debugging should focus on the namespace labels. The kube-controller-manager logs should have more information.


Suggested change

field don't get created, debugging should focus on the namespace labels. The kube-controller-manager logs should have more information.

field doesn't get created, debugging should focus on the namespace labels. The kube-controller-manager logs should have more information.

keps/sig-auth/5018-dra-adminaccess/README.md

Signed-off-by: Rita Zhang <[email protected]>

liggitt · 2025-05-22T20:24:21Z

/lgtm
/approve

k8s-ci-robot · 2025-05-22T20:24:29Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: liggitt, ritazh
Once this PR has been reviewed and has the lgtm label, please ask for approval from soltysh. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

keps/prod-readiness/OWNERS
~~keps/sig-auth/OWNERS~~ [liggitt,ritazh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

liggitt · 2025-05-22T21:31:30Z

/hold cancel

soltysh · 2025-05-23T17:07:34Z

keps/sig-auth/5018-dra-adminaccess/README.md

   ```

+   Note: This label has been updated from `resource.k8s.io/admin-access` while the feature was in alpha in v1.33.


This is not quite accurate, b/c 1.33 is still using resource.k8s.io/admin-access: "true", so maybe

Suggested change

Note: This label has been updated from `resource.k8s.io/admin-access` while the feature was in alpha in v1.33.

Note: This label has been updated from `resource.k8s.io/admin-access` before the beta promotion.

or

Suggested change

Note: This label has been updated from `resource.k8s.io/admin-access` while the feature was in alpha in v1.33.

Note: This label has been updated from `resource.k8s.io/admin-access` while the feature was in alpha.

Ideally I'd say open a PR doing so asap.

soltysh · 2025-05-23T17:09:24Z

keps/sig-auth/5018-dra-adminaccess/README.md

@@ -466,7 +466,7 @@ ResourceClaimTemplate and ResourceClaim for admin access

 - Gather feedback


These comments still hold.

5018-update beta

49db474

Signed-off-by: Rita Zhang <[email protected]>

k8s-ci-robot assigned liggitt, pohly and soltysh May 21, 2025

k8s-ci-robot added the wg/device-management Categorizes an issue or PR as relevant to WG Device Management. label May 21, 2025

github-project-automation bot added this to Dynamic Resource Allocation May 21, 2025

k8s-ci-robot added the kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory label May 21, 2025

github-project-automation bot moved this to 🆕 New in Dynamic Resource Allocation May 21, 2025

k8s-ci-robot requested a review from kikisdeliveryservice May 21, 2025 15:49

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label May 21, 2025

k8s-ci-robot requested a review from micahhausler May 21, 2025 15:49

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 21, 2025

liggitt mentioned this pull request May 21, 2025

DRA: AdminAccess for ResourceClaims and ResourceClaimTemplates #5018

Open

8 tasks

liggitt reviewed May 21, 2025

View reviewed changes

address comments

420ef20

Signed-off-by: Rita Zhang <[email protected]>

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 21, 2025

enj added this to SIG Auth May 22, 2025

enj moved this to Needs Triage in SIG Auth May 22, 2025

soltysh reviewed May 22, 2025

View reviewed changes

liggitt reviewed May 22, 2025

View reviewed changes

keps/sig-auth/5018-dra-adminaccess/README.md Show resolved Hide resolved

k8s-ci-robot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. labels May 22, 2025

update label

4d27a7d

Signed-off-by: Rita Zhang <[email protected]>

ritazh force-pushed the kep-5018-beta branch from 9afca23 to 4d27a7d Compare May 22, 2025 20:14

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 22, 2025

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 22, 2025

soltysh reviewed May 23, 2025

View reviewed changes

pohly moved this from 🆕 New to 👀 In review in Dynamic Resource Allocation May 25, 2025

	".status.allocation.devices.results[*].adminaccess" will be set to true for a claim using adminAccess when needed by a pod.
	".status.allocation.devices.results[*].adminAccess" will be set to true for a claim using adminAccess when needed by a pod.

	- A third-party DRA driver is required for how the driver should interpret the AdminAcess field to get acess to device specific resources without allocating them.
	- A third-party DRA driver is required for how the driver should interpret the AdminAcess field to get access to device specific resources without allocating them.

		@@ -466,7 +466,7 @@ ResourceClaimTemplate and ResourceClaim for admin access

		- Gather feedback

	field don't get created, debugging should focus on the namespace labels. The kube-controller-manager logs should have more information.
	field doesn't get created, debugging should focus on the namespace labels. The kube-controller-manager logs should have more information.

		```

		Note: This label has been updated from `resource.k8s.io/admin-access` while the feature was in alpha in v1.33.

KEP-5018: move to beta in 1.34 #5327

Are you sure you want to change the base?

KEP-5018: move to beta in 1.34 #5327

Conversation

ritazh commented May 21, 2025

Uh oh!

k8s-ci-robot commented May 21, 2025

Uh oh!

liggitt left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liggitt commented May 21, 2025

Uh oh!

soltysh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

liggitt commented May 22, 2025

Uh oh!

k8s-ci-robot commented May 22, 2025

Uh oh!

liggitt commented May 22, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!