add doc for new delete option ignoreStoreReadErrorWithClusterBreakingPotential #48463

tkashem · 2024-10-21T12:59:32Z

KEP: https://kep.k8s.io/3926
PR: kubernetes/kubernetes#127513

/sig api-machinery
/sig auth

netlify · 2024-10-21T12:59:49Z

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	`f7cce0d`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/6745e8b24a6dbc00097c23c5

netlify · 2024-10-21T13:08:30Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`f7cce0d`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/6745e8b2f736e200083be4b4
😎 Deploy Preview	https://deploy-preview-48463--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

spurin · 2024-11-01T12:44:57Z

Hello @tkashem 👋 please take a look at Documenting for a release - PR Ready for Review to get your PR ready for review before Tuesday November 19th 2024 18:00 PST. Thank you!

sftim · 2024-11-11T09:38:59Z

Also see kubernetes/kubernetes#127513 (comment)

spurin · 2024-11-11T16:57:36Z

Hello @tkashem 👋, 1.32 Docs Shadow here,

A quick reminder to get your PR ready for review before the deadline, Tuesday November 19th at 18:00 PDT. For additional information, refer to: Documenting for a release - PR Ready for Review.

Thank you!

tkashem · 2024-11-18T15:55:12Z

I have a couple of questions:

a) do i need to generate the updated api-reference?

b) from https://kubernetes.io/docs/contribute/new-content/new-features/#ready-for-review-feature-gates

With net new feature gates, a separate description of the feature gate is also required; create a new Markdown file inside content/en/docs/reference/command-line-tools-reference/feature-gates/ (use other files as a template).

I guess it is referring to the same markdown file at the beginning of the section, for a net new feature, i just need to create one markdown file, correct?

tkashem · 2024-11-18T16:04:14Z

/cc @stlaz @enj @dgrisonnet @deads2k

stlaz · 2024-11-18T17:29:27Z

/assign
per sig-auth triage

sftim · 2024-11-25T20:56:08Z

content/en/docs/reference/using-api/api-concepts.md


 Once the last finalizer is removed, the resource is actually removed from etcd.

+### Force deletion


(nit)

Suggested change

### Force deletion

### Forcible resource deletion {#forced-deletion}

should be {#force-deletion}, no d, to preserve existing links.

@tengqm this is new content (no existing links). Here I'm just recommending a way to make the eventual URL shorter.

content/en/docs/reference/using-api/api-concepts.md

sftim · 2024-11-25T20:58:51Z

content/en/docs/reference/using-api/api-concepts.md

+The user performing the force **delete** operation must have the
+`unsafe-delete-ignore-read-errors` permission on the resource.


(style nit)

Suggested change

The user performing the force **delete** operation must have the

`unsafe-delete-ignore-read-errors` permission on the resource.

The user performing the force **delete** operation must be permitted to perform

both the **delete** and **unsafe-delete-ignore-read-errors** verbs on that resource.

We write API verbs in non-monospaced bold. I assume that unsafe-delete-ignore-read-errors is a verb and that a SubjectAccessReview happens. Have I got that right?

Yes, unsafe-delete-ignore-read-errors is a right/verb. I was going through the existing doc (for example https://kubernetes.io/docs/concepts/security/rbac-good-practices/) and how they format RBAC rights. I used the same format ( verb ) in this doc. It seems the format delete is used to represent an API operation, thoughts?

If you're defining access through RBAC, you use monospace. But: outside of the RBAC docs, we avoid assuming that clusters use RBAC for authz. It's a common choice but not the only option.

I'm rewording here to avoid an RBAC-centric framing.

sftim

/lgtm

This is already alpha quality.

k8s-ci-robot · 2024-11-26T13:55:48Z

LGTM label has been added.

Git tree hash: 048f93145320f6d10ab034abf0ef3d2af6882320

tkashem · 2024-11-26T14:27:34Z

@sftim i dropped the and - #48463 (comment), ptal

sftim · 2024-11-26T14:30:38Z

content/en/docs/reference/using-api/api-concepts.md

+In addition to `delete` rights, the user performing the force **delete**
+operation must have `unsafe-delete-ignore-read-errors` rights on the given resource.


(style nit)

Suggested change

In addition to `delete` rights, the user performing the force **delete**

operation must have `unsafe-delete-ignore-read-errors` rights on the given resource.

The user performing the force **delete** operation must be permitted to perform

both the **delete** and **unsafe-delete-ignore-read-errors** verbs on that resource.

We write API verbs in non-monospaced bold. I assume that unsafe-delete-ignore-read-errors is a verb and that a SubjectAccessReview happens. Have I got that right?

Also, avoid implying that clusters always use Kubernetes RBAC. Many do but it's not mandatory to.

…Potential

sftim · 2024-11-26T15:29:56Z

I'm happy with the changes since #48463 (review)

/lgtm
/approve

k8s-ci-robot · 2024-11-26T15:30:02Z

LGTM label has been added.

Git tree hash: bdd3173a87feaa1b76dcaa75278a71fd685898d5

dgrisonnet

/lgtm

k8s-ci-robot · 2024-11-26T15:30:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dgrisonnet, sftim

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/docs/OWNERS~~ [sftim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sftim · 2024-11-26T15:30:38Z

Also, please fix the changelog for the k/k PR; see kubernetes/kubernetes#127513 (comment)

k8s-ci-robot added this to the 1.32 milestone Oct 21, 2024

tkashem mentioned this pull request Oct 21, 2024

Handling undecryptable resources kubernetes/enhancements#3926

Open

8 tasks

tkashem force-pushed the kep-3926 branch from 3b431f4 to d943f81 Compare November 18, 2024 15:25

k8s-ci-robot added the language/en Issues or PRs related to English language label Nov 18, 2024

tkashem force-pushed the kep-3926 branch from d943f81 to a64db58 Compare November 18, 2024 15:43

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Nov 18, 2024

tkashem marked this pull request as ready for review November 18, 2024 15:48

k8s-ci-robot requested review from katcosgrove and salaxander November 18, 2024 15:48

tkashem changed the title ~~WIP: Placeholder for 1.32 KEP-3926 docs.~~ add doc for new delete option ignoreStoreReadErrorWithClusterBreakingPotential Nov 18, 2024

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 18, 2024

k8s-ci-robot requested review from deads2k, dgrisonnet, enj and stlaz November 18, 2024 16:04

tkashem force-pushed the kep-3926 branch from a64db58 to ed21583 Compare November 18, 2024 16:11

tkashem force-pushed the kep-3926 branch from b447585 to 024df30 Compare November 25, 2024 14:42

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 25, 2024

k8s-ci-robot requested review from dgrisonnet and stlaz November 25, 2024 14:42

tkashem force-pushed the kep-3926 branch 3 times, most recently from 393eabf to 5deea87 Compare November 25, 2024 19:15

sftim reviewed Nov 25, 2024

View reviewed changes

content/en/docs/reference/using-api/api-concepts.md Outdated Show resolved Hide resolved

sftim reviewed Nov 25, 2024

View reviewed changes

tkashem force-pushed the kep-3926 branch from 5deea87 to 8a68a8a Compare November 26, 2024 01:27

sftim reviewed Nov 26, 2024

View reviewed changes

k8s-ci-robot assigned sftim Nov 26, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 26, 2024

tkashem force-pushed the kep-3926 branch from 8a68a8a to d81f5b3 Compare November 26, 2024 14:26

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 26, 2024

k8s-ci-robot requested a review from sftim November 26, 2024 14:26

sftim reviewed Nov 26, 2024

View reviewed changes

add doc for new delete option ignoreStoreReadErrorWithClusterBreaking…

f7cce0d

…Potential

tkashem force-pushed the kep-3926 branch from d81f5b3 to f7cce0d Compare November 26, 2024 15:26

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 26, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 26, 2024

dgrisonnet approved these changes Nov 26, 2024

View reviewed changes

k8s-ci-robot merged commit f8f5eda into kubernetes:dev-1.32 Nov 26, 2024
6 checks passed


		Once the last finalizer is removed, the resource is actually removed from etcd.

		### Force deletion

	### Force deletion
	### Forcible resource deletion {#forced-deletion}

		The user performing the force delete operation must have the
		`unsafe-delete-ignore-read-errors` permission on the resource.

		In addition to `delete` rights, the user performing the force delete
		operation must have `unsafe-delete-ignore-read-errors` rights on the given resource.

add doc for new delete option ignoreStoreReadErrorWithClusterBreakingPotential #48463

add doc for new delete option ignoreStoreReadErrorWithClusterBreakingPotential #48463

Uh oh!

Conversation

tkashem commented Oct 21, 2024

Uh oh!

netlify bot commented Oct 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Uh oh!

netlify bot commented Oct 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Pull request preview available for checking

Uh oh!

spurin commented Nov 1, 2024

Uh oh!

sftim commented Nov 11, 2024

Uh oh!

spurin commented Nov 11, 2024

Uh oh!

tkashem commented Nov 18, 2024

Uh oh!

tkashem commented Nov 18, 2024

Uh oh!

stlaz commented Nov 18, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sftim left a comment

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Nov 26, 2024

Uh oh!

tkashem commented Nov 26, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sftim commented Nov 26, 2024

Uh oh!

k8s-ci-robot commented Nov 26, 2024

Uh oh!

dgrisonnet left a comment

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Nov 26, 2024

Uh oh!

sftim commented Nov 26, 2024

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

netlify bot commented Oct 21, 2024 •

edited

Loading

netlify bot commented Oct 21, 2024 •

edited

Loading