KEP-4006: Synthetic RBAC create check for WebSocket request upgrade -- 1.35 #5524

seans3 · 2025-09-09T19:20:30Z

Adds requirement for new synthetic RBAC CREATE permission check for WebSocket upgrade request.
- Feature Gate for this functionality: AuthorizePodWebsocketUpgradeCreatePermission; enabled by default
- Beta in v1.35
Refactor GA/stable requirement for transitioning to streaming WebSockets from client to Kubelet (but NOT from Kubelet to container runtime).
Updates KEP to reflect graduating WebSockets functionality to GA in v1.36

Issue link: Transition from SPDY to WebSockets #4006

seans3 · 2025-09-09T19:39:15Z

aojea · 2025-09-09T19:54:07Z

keps/sig-api-machinery/4006-transition-spdy-to-websockets/README.md

 -->

 1. We will not make *any* changes to current WebSocket based browser/javascript clients.
+2. We will not extend the WebSockets communication leg from the API Server to Kubelet (in


I think is reasonable in order to avoid keeping this KEP and feature gate for longer, this has already an immediate positive impact by allowing the entire ecosystem to use websockets against the apiserver instead of a deprecated protocol like SPDY, with almost zero support for most of the load balancers causing a lot of friction.

aojea · 2025-09-09T19:54:30Z

/lgtm

liggitt · 2025-09-10T14:10:28Z

I do think we should resolve the user-visible permissions change related to kubectl exec / attach / portforward - see kubernetes/kubernetes#133515 (comment)

The permissions required by kubectl changed from create to get ... I think we should consider adding a second authz check for create permission specifically to exec / attach / portforward when entering via the GET path.

aojea · 2025-09-15T05:25:06Z

keps/sig-api-machinery/4006-transition-spdy-to-websockets/README.md


+- `kubectl` environment variables and API Server feature gates are locked to on by default.
+- Deprecate `kubectl` environment variables and API Server feature gates for future removal.
+- Address RBAC authorization for WebSocket upgrades. The mechanism must be compatible with existing authorization rules for subresources (e.g., `pods/exec`) that are typically enforced on POST requests.


@liggitt for your comment in kubernetes/kubernetes#133515 (comment) and your code there is unclear to me if you want to rollout this authoritzation compatibility as a separate gate or making this GA but not locked by default during one cycle.

I think we need a separate gate, but we can add a few sentences in this KEP about that gate and it's purpose, since it's sort of prompted by the kubectl switch to websockets.

I'd like to get that merged as a prereq for indicating work on this KEP is complete / GA

I have updated the KEP to indicate GA in 1.36.

I have added a separate feature gate ForceRBACCreateCheck for the additional CREATE authz check. This functionality is a prerequisite for GA.

Please let me know what you think.

liggitt · 2025-10-02T17:06:05Z

keps/sig-api-machinery/4006-transition-spdy-to-websockets/README.md

+- Deprecate `kubectl` environment variables and API Server feature gates for future removal.
+- Force synthetic RBAC `CREATE` authorization check for WebSocket upgrades on the following
+  subresources: `pods/exec`, `pods/attach`, and `pods/portforward`. This additional check
+  will be gated by the API Server `ForceRBACCreateCheck` feature flag, which defaults to


I'd name this as specifically as possible, to indicate what it does... maybe something like AuthorizePodWebsocketUpgradeCreatePermission

Maybe describe this in a paragraph in the design details section. We'll start defaulting to true but not lock to true for a release so people can disable as a mitigation if needed short-term.

1.35: default=true, state=beta 1.36: default=true, state=ga, locked=true

I believe I have addressed this. Please let me know what you think.

liggitt · 2025-10-02T17:23:40Z

keps/sig-api-machinery/4006-transition-spdy-to-websockets/README.md

 The upstream connection is the same SPDY connection to the container (through the
 Kubelet and CRI).

-### Pre-GA: Kubelet `StreamTranslatorProxy`


restore this paragraph, keep the kubelet StreamTranslatorProxy bits, drop out the container runtime websocket bits

then we need also to change https://github.com/kubernetes/enhancements/pull/5524/files#r2334624987

I believe I have addressed this. Please let me know what you think.

liggitt · 2025-10-02T17:29:29Z

/milestone v1.35
/label lead-opted-in

ardaguclu · 2025-10-07T06:36:40Z

keps/sig-api-machinery/4006-transition-spdy-to-websockets/README.md

+or pods/portforward subresources, the handler will perform an additional check to ensure
+the user also has the create verb permission for that specific subresource. This new
+authorization check will be controlled by a feature gate,
+`AuthorizePodWebsocketUpgradeCreatePermission`, which will be enabled by default to


Will this feature gate be removed at some point in the future?. Or we'll keep it for a long time?.

after a couple releases in enabled-by-default state, we'll transition it to locked on, then remove it ~3 releases after that

aojea · 2025-10-07T11:25:25Z

/lgtm

liggitt · 2025-10-07T16:24:48Z

keps/sig-api-machinery/4006-transition-spdy-to-websockets/README.md

+communication path from the client to the Kubelet. After the initial
+kubectl-to-API-Server leg is stable, this proposal outlines the next phase:
+transitioning the communication between the API Server and the Kubelet. This is
+achieved by moving the translation logic currently in the API Server—specifically


Suggested change

achieved by moving the translation logic currently in the API Server—specifically

achieved by replicating the translation logic currently in the API Server—specifically

I have addressed this issue. Please have a look.

liggitt · 2025-10-07T16:25:22Z

keps/sig-api-machinery/4006-transition-spdy-to-websockets/README.md

 variable associated with the feature to **OFF**. Or the features can be turned off
 for all `kubectl` users communicating with a cluster by turning off the feature flags
-for the API Server.
+for the API Server. A cluster operator can disable the more stringent permissions for


Suggested change

for the API Server. A cluster operator can disable the more stringent permissions for

for the API Server. A cluster operator can temporarily disable the more stringent permissions for

I have addressed this language issue. Please have a look.

liggitt · 2025-10-07T16:26:36Z

a couple language nits, but lgtm overall

cc @enj @pmengelbert for kubernetes/kubernetes#133515 (comment) for the incorporation of the kubectl permission check into this KEP

liggitt · 2025-10-07T18:43:00Z

/lgtm
/approve

jpbetz · 2025-10-07T19:42:30Z

keps/sig-api-machinery/4006-transition-spdy-to-websockets/kep.yaml

  alpha: "v1.29"
  beta: "v1.31"
-  stable: "v1.32"
+  stable: "v1.36"


35? Or are we waiting till spring to go GA?

We'll wait until v1.36; we're implementing a new RBAC permissions check for WebSocket upgrades in this v1.35 release, and we'll wait one release before attempting GA.

jpbetz · 2025-10-07T19:43:41Z

/approve
For PRR

k8s-ci-robot · 2025-10-07T19:43:51Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jpbetz, liggitt, seans3

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~keps/prod-readiness/OWNERS~~ [jpbetz]
~~keps/sig-api-machinery/OWNERS~~ [jpbetz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Sep 9, 2025

k8s-ci-robot requested a review from jpbetz September 9, 2025 19:20

k8s-ci-robot added the kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory label Sep 9, 2025

k8s-ci-robot requested a review from sttts September 9, 2025 19:20

k8s-ci-robot added sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Sep 9, 2025

seans3 changed the title ~~Updated WebSockets KEP to move to GA in 1.35~~ KEP-4006: Updated KEP to move to GA in 1.35 Sep 9, 2025

seans3 force-pushed the kep-to-ga branch from 75a6272 to 95c7400 Compare September 9, 2025 19:32

seans3 mentioned this pull request Sep 9, 2025

Transition from SPDY to WebSockets #4006

Open

12 tasks

k8s-ci-robot assigned aojea and liggitt Sep 9, 2025

aojea reviewed Sep 9, 2025

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 9, 2025

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 15, 2025

aojea reviewed Sep 15, 2025

View reviewed changes

seans3 changed the title ~~KEP-4006: Updated KEP to move to GA in 1.35~~ KEP-4006: Updated KEP for 1.35 Sep 18, 2025

seans3 force-pushed the kep-to-ga branch from 35f360e to aefcf65 Compare September 25, 2025 17:07

liggitt reviewed Oct 2, 2025

View reviewed changes

k8s-ci-robot added this to the v1.35 milestone Oct 2, 2025

k8s-ci-robot added the lead-opted-in Denotes that an issue has been opted in to a release label Oct 2, 2025

seans3 force-pushed the kep-to-ga branch from aefcf65 to c564039 Compare October 6, 2025 23:41

ardaguclu reviewed Oct 7, 2025

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 7, 2025

liggitt reviewed Oct 7, 2025

View reviewed changes

liggitt mentioned this pull request Oct 7, 2025

Request method of kubectl exec changed from POST to GET now? kubernetes/kubernetes#133515

Open

Updated WebSockets KEP to move to GA in 1.35

f8d92d3

seans3 force-pushed the kep-to-ga branch from c564039 to f8d92d3 Compare October 7, 2025 18:40

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 7, 2025

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 7, 2025

jpbetz reviewed Oct 7, 2025

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 7, 2025

k8s-ci-robot merged commit 755a89a into kubernetes:master Oct 7, 2025
4 checks passed

seans3 changed the title ~~KEP-4006: Updated KEP for 1.35~~ KEP-4006: Synthetic RBAC create check for WebSocket request upgrade -- 1.35 Oct 10, 2025

seans3 mentioned this pull request Oct 22, 2025

[KEP-4006] Docs for AuthorizeWebsocketUpgradeCreatePermission (Beta) kubernetes/website#52896

Open

	achieved by moving the translation logic currently in the API Server—specifically
	achieved by replicating the translation logic currently in the API Server—specifically

	for the API Server. A cluster operator can disable the more stringent permissions for
	for the API Server. A cluster operator can temporarily disable the more stringent permissions for

KEP-4006: Synthetic RBAC create check for WebSocket request upgrade -- 1.35 #5524

KEP-4006: Synthetic RBAC create check for WebSocket request upgrade -- 1.35 #5524

Uh oh!

Conversation

seans3 commented Sep 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seans3 commented Sep 9, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aojea commented Sep 9, 2025

Uh oh!

liggitt commented Sep 10, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liggitt Sep 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liggitt Oct 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liggitt commented Oct 2, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aojea commented Oct 7, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

liggitt commented Oct 7, 2025

Uh oh!

liggitt commented Oct 7, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jpbetz commented Oct 7, 2025

Uh oh!

k8s-ci-robot commented Oct 7, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

seans3 commented Sep 9, 2025 •

edited

Loading

liggitt Sep 16, 2025 •

edited

Loading

liggitt Oct 2, 2025 •

edited

Loading