Support GMSA for Windows workloads

[ddebroy]

Enhancement Description

• One-line enhancement description (can be used as a release note): Enable support for Group Managed Service Account (gMSA) for Windows workloads on Kubernetes.
• Primary contact (assignee): @ddebroy
• Responsible SIGs: sig-windows, sig-auth, sig-node
• Design proposal link (community repo): https://github.com/kubernetes/enhancements/blob/master/keps/sig-windows/20181221-windows-group-managed-service-accounts-for-container-identity.md
  and
  https://github.com/kubernetes/enhancements/blob/master/keps/sig-windows/20190418-windows-security-context.md
• Link to e2e and/or unit tests: Coming soon
• Reviewer(s) - (for LGTM) recommend having 2+ reviewers (at least one from code-area OWNERS file) agreed to review. Reviewers from multiple companies preferred: @PatrickLang [Windows changes overall] @yujuhong [dockershim changes around Windows] @mikedanese, @liggitt [overall pod spec/container spec changes + authorization/security]
• Approver (likely from SIG/area to which enhancement belongs): @PatrickLang @yujuhong @liggitt @mikedanese
• Enhancement target (which target equals to which milestone):
  • Alpha release target (1.14)
  • Beta release target (1.16)
  • Stable release target (1.18)

Please to keep this description up to date. This will help the Enhancement Team track efficiently the evolution of the enhancement

[ddebroy]

/sig windows auth node

[claurence]

@ddebroy - Hi I'm the enhancements lead for 1.14 - it looks like this issue is targeting Alpha for 1.14. Just want to remind that enhancements freeze is 1/29

[ddebroy]

/milestone v1.14

[k8s-ci-robot]

@ddebroy: You must be a member of the kubernetes/kubernetes-milestone-maintainers github team to set the milestone.

In response to this:

/milestone v1.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[claurence]

/milestone v1.14

[k8s-ci-robot]

@claurence: You must be a member of the kubernetes/kubernetes-milestone-maintainers github team to set the milestone.

In response to this:

/milestone v1.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[claurence]

@ddebroy are there any open PRs that should be tracked for this issue for the 1.14 release?

[ddebroy]

@claurence we were trying to lock down the design and get to implementable state for the KEP this week (#694, #710 and #722).

We will have PRs for the alpha implementations out shortly.

[ddebroy]

With #710 merged, the feature should now be in approved/implementable state.

[liggitt]

I'll take API review on this (if there ends up being any for the alpha version) since I have context on the KEP

[ddebroy]

In-tree PR tracking the Alpha enhancements implemented through annotations and dockershim: https://github.com/kubernetes/kubernetes/pull/73726/files

[npentrel]

Hey @ddebroy 👋! I'm Naomi, a v1.14 docs release shadow.

Does this enhancement require any new docs (or modifications)?

Just a friendly reminder we're looking for a PR against k/website (branch dev-1.14) due by Friday, March 1. It would be great if it's the start of the full documentation, but even a placeholder PR is acceptable. Let me know if you have any questions!

[ddebroy]

Docs placeholder PR: kubernetes/website#19349
Feature Graduation PR: kubernetes/kubernetes#88654

[palnabarun]

Hi @ddebroy, this a reminder that we are just two days away from Code Freeze on 5th March.

By the Code Freeze, kubernetes/kubernetes#88654 should be merged else you would need to file an exception request.

[palnabarun]

Hi @ddebroy, since this enhancement graduated to Stable this release 🚀, the status can now be set to be Implemented.

Can you please update the status? After that, we will close this issue.

[ddebroy]

@palnabarun done at #1626

[palnabarun]

Thank you @ddebroy :)

[palnabarun]

/milestone clear

(removing this enhancement issue from the v1.18 milestone as the milestone is complete)

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[LorbusChris]

/remove-lifecycle rotten

[LorbusChris]

Looks like this has been implemented. Can this issue be closed now?

[marosset]

@LorbusChris - yes we can close this now. (sorry, just saw this issue)

[marosset]

/stage stable
/close

[k8s-ci-robot]

@marosset: Closing this issue.

In response to this:

/stage stable
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.