Enhancement Description

• One-line enhancement description (can be used as a release note): Ensure secure image access with IfNotPresent image pull policy
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2535-ensure-secret-pulled-images
• Discussion Link: https://docs.google.com/document/d/1Ne57gvidMEWXR70OxxnRkYquAoMpt56o75oZtg-OeBg/edit#heading=h.4oysqary051o
  Kubelet should enforce access to images after they've already been pulled to a node kubernetes#18787
• Primary contact (assignee): @stlaz @mikebrow @haircommander @pacoxu
• Responsible SIGs: Node
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.33
  • Beta release target (x.y): 1.35
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s):
    • v1.29 #2535:ensure secret pulled images - move kep targets; add persist #3532. (ensure secret pulled images #1608 merged)
    • v1.30 kep-2535: not persist on disk and add PullImageSecretRecheckDuration flag to define different behaviors #4431 (update based on sig-node meeting discussion and PR comments)
    • v1.31 KEP-2535: retarget alpha in 1.31 and update to readd the disk check  #4693
    • v1.32 KEP-2535: update the KEP with on-by-default strategy #4789
    • v1.33 KEP-2535: bump ensure secret images alpha/latest-milestone to 1.33 #5026
  • Code (k/k) update PR(s):
    • Multi-tenancy in accessing node images via Pod API kubernetes#128152
    • first try Ensure secret pulled images kubernetes#94899
    • kubelet: ensure secret pulled image kubernetes#114847
    • Implement KEP-2535 - Ensure secret pulled images feature kubernetes#125817
  • Docs (k/website) update PR(s):
    • KEP 2535: Ensure Secret Pulled Images website#49886
    • KEP-2535 (Ensure secret pulled secrets) docs placeholder website#48491
    • [WIP] Document KubeletEnsureSecretPulledImages feature website#43454
    • blog: ensure secret pulled images website#45293
    • Blog on "Ensure secret pulled images" feature website#47053
• Beta 1.35
  • KEP (k/enhancements) update PR(s):
    • 1.34 and PRR review: KEP-2535: (Ensure Secret Pulled Images): add metrics, bump to beta in 1.34 #5371
    • KEP-2535: update beta/latest milestones to 1.35 #5586
  • Code (k/k) update PR(s):
    • kubelet: add metrics for EnsureImageExists kubernetes#132644
    • [x ] KEP-2535: move objects to beta, add storage version migration to filesystem cache kubernetes#132579
    • Mark KubeletEnsureSecretPulledImages feature gate as beta kubernetes#135228
    • Enable image pull credential verification with service account–based credential providers kubernetes#132771
    • kubelet: add metrics related to image pull records kubernetes#132812
    • In-memory caching for node image access multitenancy kubernetes#131882
    • Benchmarks for node image access multitenancy kubernetes#131864
    • 1.37: Ensure secret-pulled images - preloaded images kubernetes#139156
  • Docs (k/website) update(s):
    • [ ]。Add docs for Ensure secret pulled images beta website#52915

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

/sig node