KEP-3926: updating the PRR questionnaire by ibihim · Pull Request #5645 · kubernetes/enhancements

ibihim · 2025-10-09T16:49:28Z

One-line PR description: Refining PRR questionnaire based on alpha implementation learnings

Issue link: Handling undecryptable resources #3926

Other comments:
- Updates Production Readiness Review sections with corrections from alpha implementation

enj · 2025-10-09T20:00:35Z

/approve
(as general update from SIG Auth)
/assign deads2k
(for PRR)

k8s-ci-robot · 2025-10-10T15:12:43Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: enj, ibihim
Once this PR has been reviewed and has the lgtm label, please ask for approval from deads2k. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

keps/prod-readiness/OWNERS
~~keps/sig-auth/OWNERS~~ [enj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

aramase · 2025-10-14T19:31:58Z

@deads2k could you take a look at this for PRR?

soltysh

There are some missing answers for beta requirement, but the biggest one is links to integration tests to ensure this new and risky functionality is working as expected.

soltysh · 2025-10-16T09:52:50Z

@@ -558,6 +559,11 @@ in back-to-back releases.
 - Error type is implemented


Above, missing links to integration tests, since you're not planning e2e at all, that's a major blocker for promotion.

If this is a major blocker promotion, we could do e2e tests.
I just thought it might be not necessary.

With links to integration tests, you mean links to the source code or to the PRs?

don't do e2e. They are not suited for that and brittle. Integrations are testing the real thing of apiserver and etcd.

integration = test server tests, we have one for kube-apiserver.

Nit, add a note in the e2e section, that you're only going with integration tests, b/c they are much better suited for the test scenarios you're excercising, where you need full control over kube-apiserver and etcd for the duration of the test.

I will then update this section: ##### e2e tests, right?

soltysh · 2025-10-16T09:53:58Z

 https://github.com/kubernetes/kubernetes/pull/97058/files#diff-7826f7adbc1996a05ab52e3f5f02429e94b68ce6bce0dc534d1be636154fded3R246-R282
 -->
-The implementation, including tests, is waiting for an approval of this enhancement.
+All tests verify feature enablement / disablement to ensure backwards


Again, links for the tests, or make sure they are included in the earlier sections.

This comment still holds.

soltysh · 2025-10-16T09:55:36Z

-If the average time of `apiserver_request_duration_seconds{verb="delete"}` of the kube-apiserver
-increases greatly, this feature might have caused a performance regression.
+If the average time of `apiserver_request_duration_seconds{verb="delete"}` or
+`apiserver_request_duration_seconds{verb="list"}` the amount of


Nit, can you make sure these metrics are mentioned at the end of kep.yaml in metrics section, please?

soltysh · 2025-10-16T09:55:52Z

 Longer term, we may want to require automated upgrade/rollback tests, but we
 are missing a bunch of machinery and tooling and can't do that now.
 -->
+No testing of upgrade->downgrade->upgrade necessary.


Can you explain why no such tests are necessary?

soltysh · 2025-10-16T09:57:36Z

 -->

+All corrupt object DELETEs complete, when feature is enabled, option is set and
+the user is authorized.


The question is about SLO, iow. what is the excpected time for delete completion? Check https://github.com/kubernetes/community/blob/master/sig-scalability/slos/slos.md for suggestions.

soltysh · 2025-10-16T09:59:40Z

      - Impact of its outage on the feature:
      - Impact of its degraded performance or high-error rates on the feature:
 -->
+- kube-apiserver


This is a question about external services to kubernetes. So in your case No is sufficient answer.

soltysh · 2025-10-16T10:04:07Z

-  approver: "@deads2k"
+  approver: "@deads2k"
+beta:
+  approver: "@deads2k"


You can put my name here, since I'm looking at this one.

k8s-triage-robot · 2026-01-14T10:18:44Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

soltysh

Left several comments.

soltysh · 2026-01-28T12:03:38Z

@@ -558,6 +559,11 @@ in back-to-back releases.
 - Error type is implemented


Nit, add a note in the e2e section, that you're only going with integration tests, b/c they are much better suited for the test scenarios you're excercising, where you need full control over kube-apiserver and etcd for the duration of the test.

soltysh · 2026-01-28T12:04:31Z

 https://github.com/kubernetes/kubernetes/pull/97058/files#diff-7826f7adbc1996a05ab52e3f5f02429e94b68ce6bce0dc534d1be636154fded3R246-R282
 -->
-The implementation, including tests, is waiting for an approval of this enhancement.
+All tests verify feature enablement / disablement to ensure backwards


This comment still holds.

soltysh · 2026-01-28T12:06:18Z

+- Extended testing is available
+- Dry-Run is implemented
+
 ### Upgrade / Downgrade Strategy


Both this section and version skew strategy is required to be filled in. Although you have pretty straightforward answers to provide, since your change is only within kube-apiserver, so for both I don't expect any specific strategy required. But please make sure to write it down explicitly.

soltysh · 2026-01-28T12:10:16Z

 rollout. Similarly, consider large clusters and how enablement/disablement
 will rollout across nodes.
 -->
+No impact on rollout or rollback.


Explain why, which will be similar to one of previous sections. Basically, the change is contained within kube-apiserver only, so you're not expecting any problems during rollout/rollback.

soltysh · 2026-01-28T12:14:43Z


+No.
+
 ### Troubleshooting


This entire section is missing answers. Similarly implementation history, drawbacks and alternatives.

Adds Production Readiness Review responses for beta promotion: - Feature enablement/rollback documentation - Monitoring requirements with metrics - Scalability considerations - Troubleshooting guidance - Test plan with integration test references

- Explain why integration tests are used instead of e2e - Add test links with feature gate toggle line numbers - Fill Upgrade/Downgrade Strategy section - Fill Version Skew Strategy section - Expand rollout/rollback failure explanation - Answer Troubleshooting section questions - Add Implementation History with alpha/beta milestones - Add Drawbacks section - Add Alternatives section"

soltysh · 2026-01-29T19:33:40Z

It seems all the changes to PRR were copied over to #5739 so I'm going to close this as a duplicate of the other.

/close

k8s-ci-robot · 2026-01-29T19:33:47Z

@soltysh: Closed this PR.

Details

In response to this:

It seems all the changes to PRR were copied over to #5739 so I'm going to close this as a duplicate of the other.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Oct 9, 2025

k8s-ci-robot requested review from liggitt and ritazh October 9, 2025 16:49

k8s-ci-robot added kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory sig/auth Categorizes an issue or PR as relevant to SIG Auth. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Oct 9, 2025

ibihim force-pushed the enhancements-ibihim-3926-prr-1.35 branch from 6dec232 to a893ad0 Compare October 9, 2025 17:06

k8s-ci-robot assigned deads2k Oct 9, 2025

aibarbetta mentioned this pull request Oct 10, 2025

Handling undecryptable resources #3926

Open

13 tasks

enj added this to SIG Auth Oct 10, 2025

enj moved this to Needs Triage in SIG Auth Oct 10, 2025

soltysh reviewed Oct 16, 2025

View reviewed changes

k8s-ci-robot added lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 14, 2026

ibihim force-pushed the enhancements-ibihim-3926-prr-1.35 branch from 76939f8 to b368ea9 Compare January 15, 2026 22:38

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 15, 2026

ibihim force-pushed the enhancements-ibihim-3926-prr-1.35 branch 3 times, most recently from 475f8ce to 1e88573 Compare January 22, 2026 14:47

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 22, 2026

soltysh mentioned this pull request Jan 28, 2026

KEP-3926: Add beta graduation criteria #5739

Merged

soltysh reviewed Jan 28, 2026

View reviewed changes

ibihim added 2 commits January 29, 2026 15:00

ibihim force-pushed the enhancements-ibihim-3926-prr-1.35 branch from 58fb12b to 677c572 Compare January 29, 2026 14:02

k8s-ci-robot closed this Jan 29, 2026

github-project-automation Bot moved this from Needs Triage to Closed / Done in SIG Auth Jan 29, 2026

		@@ -558,6 +559,11 @@ in back-to-back releases.
		- Error type is implemented

Conversation

ibihim commented Oct 9, 2025

Uh oh!

enj commented Oct 9, 2025

Uh oh!

k8s-ci-robot commented Oct 10, 2025

Uh oh!

aramase commented Oct 14, 2025

Uh oh!

soltysh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ibihim Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ibihim Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k8s-triage-robot commented Jan 14, 2026

Uh oh!

soltysh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

soltysh commented Jan 29, 2026

Uh oh!

k8s-ci-robot commented Jan 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

ibihim Jan 15, 2026 •

edited

Loading

ibihim Jan 29, 2026 •

edited

Loading