Add FileEnvSource and FileKeySelector to add environment generated on the fly

[QuentinN42]

Enhancement Description

• One-line enhancement description (can be used as a release note): Add FileEnvSource and FileKeySelector to add environment generated on the fly.
• Kubernetes Enhancement Proposal: No PR now.
• Discussion Link: Add FileEnvSource and FileKeySelector to add environment generated on the fly kubernetes#114674
• Primary contact (assignee): @QuentinN42 @HirazawaUi
• Responsible SIGs: sig-node
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.34
  • Beta release target (x.y):
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s): KEP-3721: Support for env files. #5384
  • Code (k/k) update PR(s): KEP-3721: Support for env files kubernetes#132626
  • Docs (k/website) update PR(s): [WIP] Add documentation for the EnvFiles feature gate website#51415

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[QuentinN42]

/sig node

[QuentinN42]

Some questions still needs to be discuss :

• [ERRORS] How do we handle errors ? (if the file is not an env file / if there is some errors in it)
• [ORDER] Sourcing from some file inside container might be not feaseable if env is generated before container is created.
• [NRI] Investigate NRI hook to do it ? (I have no idea what it is, need to read the docs)
• [SECU] Sourcing from arbitrary path may have security concerns, validate files trough security context ?
• [SCOPE] The root path may be too large scope. Would limiting this to empty dir files be enough ?

[QuentinN42]

Some uses for an emptyDir are:

• scratch space, such as for a disk-based merge sort
• checkpointing a long computation for recovery from crashes
• holding files that a content-manager container fetches while a webserver container serves the data
  K8s volumes docs

This is exactly a checkpointing for env var so I think using emptydir is totally ok, but the 3rd party init container can export it's data not in an emptydir ...

[QuentinN42]

So maybe to solve [ORDER], [SECU] and [SCOPE] at once, we can reference a file path of a volume like in the VolumeMount.

• [ORDER] It can be done before the ct is created so no order problems.
• [SECU] / [SCOPE] This will only allow the operator to read files that he can already mount in an alpine container and read it.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[SergeyKanzhelev]

/remove-lifecycle stale

[SergeyKanzhelev]

xlink: kubernetes/kubernetes#116993

[SergeyKanzhelev]

@QuentinN42 do you want to work on this for 1.28 milestone?

[QuentinN42]

Yes !
I'm still not sure in which sig this goes, it will probably use volumes from empty dir so need I go to the sig storage meetings or it's a sig apps feature only ?

[SergeyKanzhelev]

It is likely a sig node meeting as sig node will need to read and set those variables. Sig storage may help with feedback on storage types we should support. SIG Apps can help with more scenarios where this feature will be useful.