add ProcMount option

[haircommander]

Enhancement Description

• One-line enhancement description (can be used as a release note):
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/4265-proc-mount
• Discussion Link:
• Primary contact (assignee): @sohankunkerkar @haircommander
• Responsible SIGs: node
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.12
  • Beta release target (x.y): 1.31(off by default); 1.33(on by default)
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s):
    • add ProcMount option community#1934
    • Add restrospetive KEP for ProcMount and target at Beta #4266
  • Code (k/k) update PR(s):
    • Add a ProcMount option to the SecurityContext & AllowedProcMountTypes to PodSecurityPolicy kubernetes#64283
    • KEP-4265: Update Unmasked ProcMountType to fail validation without a pod level user namespace kubernetes#123520
  • Docs (k/website) update PR(s):
    • ProcMount 1.30 update website#45152
• Beta
  • KEP (k/enhancements) update PR(s):
    • 1.31 KEP-4265: promote ProcMount option to beta #4679
    • 1.33 KEP-4265: move to on by default beta #5120
  • Code (k/k) update PR(s):
    • 1.31 KEP-4265: add e2e tests for ProcMountType kubernetes#123303
    • 1.31 [KEP-4265] promote ProcMountType feature gate to beta kubernetes#125259
    • 1.33 [KEP-4265]: features: bump proc mount to on by default beta kubernetes#130798
  • Docs (k/website) update(s):
    • draft 4265 update website#49894

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[haircommander]

replaces kubernetes/community#1934
/sig node
/sig auth

[mrunalp]

/label lead-opted-in

[AnaMMedina21]

Hola @haircommander 👋, v1.29 Enhancements team here.

I am just checking in as we approach enhancements freeze on 18:00 PDT on Thursday 6th October 2023..

This enhancement is targeting stage beta for v1.29 (correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: { v1.29}. KEPs targeting stable will need to be marked as implemented after code PRs are merged and the feature gates are removed.
• KEP readme has up-to-date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements. (For more information on the PRR process, check here).

For this KEP, we would just need to update the following:

• For this PR to be approved: Add restrospetive KEP for ProcMount and target at Beta #4266

The status of this enhancement is marked as Tracked for Enhancements Freeze. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[npolshakova]

Sorry for the confusion @haircommander, this is actually currently At Risk for Enhancement Freeze until #4266 is approved. We'll update the status once the PR goes in. Let me know if you have any questions- Thanks!