KEP-3659: ApplySet: kubectl apply --prune redesign and graduation str…

…ategy (#3661)

* Initial KEP for improving pruning in kubectl apply

* Add design details

Co-authored-by: Katrina Verey <katrina.verey@shopify.com>

* Add another open question

* Links, clarifications, ownerRef and GKNN explanations

* Follow-on to initial feedback, address some unresolved blocks

* Fix lint errors

* Add more detail about reference implementation (#2)

* Apply prune jan25 (#3)

* More clearly delineate specification vs kubectl details

* Move design details of spec to Design Details section

* Updates from synchronous conversation

* Remove leftover paragraph (#5)

Not an alternative rejected any more, given applyset.k8s.io/inventory

* Justin has always been coauthor

* KEP-3659: production readiness etc (#4)

Fill in the testing/ PRR sections.

* Fix test failures

* Prune: document confused deputy attack and mitigations

Likely pushes us to GKNN-derived IDs.

* Constrain applyset id

We just choose the constrained applyset id to prevent "applyset ID
impersonation".

* Update KEP and PRR metadata

* Enhance testing description

* ID vs name fixes

* Fixes from soltysh's review

---------

Co-authored-by: Justin Santa Barbara <justinsb@google.com>

keps/prod-readiness/sig-cli/3659.yaml

@@ -0,0 +1,3 @@
+kep-number: 3659
+alpha:
+  approver: "@johnbelamaric"