Repository: kubernetes/website
Pull request #49919: Announce improved SELinux volume relabelling beta
Author: login: jsafrane
Labels: name: cncf-cla: yes
description: Indicates the PR's author has signed the CNCF CLA.
name: size/M
description: Denotes a PR that changes 30-99 lines, ignoring generated files.
name: lgtm
description: "Looks good to me", indicates that a PR is ready to be merged.
name: sig/docs
description: Categorizes an issue or PR as relevant to SIG Docs.
name: approved
description: Indicates a PR has been approved by an approver from all required OWNERS files.
name: language/en
description: Issues or PRs related to English language
Created: 2025-02-26T15:07:05Z | Merged: 2025-03-29T05:56:39Z

### Description

Document how SELinux feature gates (now beta) work together and potential actions needed before they graduate to GA.

Goals:

* Ensure non-SELinux users that nothing changes for them (= vast majority of users / cluster admins can just ignore all SELinux feature gates).
* Warn users / cluster admins / Kubernetes vendors that use SELinux about potentially breaking changes in a future release. Provide a clear way how to check if they're safe or they need to change anything. This is important to ensure smooth update.
    * OpenShift stats show that ~ 1.3% of all clusters would have at least one affected Pod, most of them with just handful of them. Some clusters (~0.3%) have more than 100 affected Pods and may need some work before the breaking upgrade when `SELinuxMount` goes GA + locked. Data taken on 2025-03-24.
* Emphasize that ephemeral volumes like `secrets` and `configMaps` can be still shared among pods with different SELinux labels.

Random notes:

* Removed note about ReadWriteOncePod feature gate, it's GA and locked.

### Issue

KEP: https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1710-selinux-relabeling
Enhancement issue: https://github.com/kubernetes/enhancements/issues/1710


Diff:
diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates/SELinuxChangePolicy.md b/content/en/docs/reference/command-line-tools-reference/feature-gates/SELinuxChangePolicy.md
index ed2e3d4e11cdc..e93272491fc65 100644
--- a/content/en/docs/reference/command-line-tools-reference/feature-gates/SELinuxChangePolicy.md
+++ b/content/en/docs/reference/command-line-tools-reference/feature-gates/SELinuxChangePolicy.md
@@ -9,6 +9,10 @@ stages:
   - stage: alpha
     defaultValue: false
     fromVersion: "1.32"
+    toVersion: "1.32"
+  - stage: beta
+    defaultValue: true
+    fromVersion: "1.33"
 ---
 Enables `spec.securityContext.seLinuxChangePolicy` field.
 This field can be used to opt-out from applying the SELinux label to the pod
diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates/SELinuxMount.md b/content/en/docs/reference/command-line-tools-reference/feature-gates/SELinuxMount.md
index 6e786d50d8a9c..45768ca14d66f 100644
--- a/content/en/docs/reference/command-line-tools-reference/feature-gates/SELinuxMount.md
+++ b/content/en/docs/reference/command-line-tools-reference/feature-gates/SELinuxMount.md
@@ -9,6 +9,11 @@ stages:
   - stage: alpha
     defaultValue: false
     fromVersion: "1.30"
+    toVersion: "1.32"
+  - stage: beta
+    defaultValue: false
+    fromVersion: "1.33"
+
 ---
 Speeds up container startup by allowing kubelet to mount volumes
 for a Pod directly with the correct SELinux label instead of changing each file on the volumes
diff --git a/content/en/docs/tasks/configure-pod-container/security-context.md b/content/en/docs/tasks/configure-pod-container/security-context.md
index 6b52e73f262e6..2b248c770732e 100644
--- a/content/en/docs/tasks/configure-pod-container/security-context.md
+++ b/content/en/docs/tasks/configure-pod-container/security-context.md
@@ -686,6 +686,8 @@ securityContext:
 
 {{< note >}}
 To assign SELinux labels, the SELinux security module must be loaded on the host operating system.
+On Windows and Linux worker nodes without SELinux support, this field and any SELinux feature gates described
+below have no effect.
 {{< /note >}}
 
 ### Efficient SELinux volume relabeling
@@ -696,24 +698,25 @@ To assign SELinux labels, the SELinux security module must be loaded on the host
 Kubernetes v1.27 introduced an early limited form of this behavior that was only applicable
 to volumes (and PersistentVolumeClaims) using the `ReadWriteOncePod` access mode.
 
-As an alpha feature, you can enable the `SELinuxMount` and `SELinuxChangePolicy`
-[feature gates](/docs/reference/command-line-tools-reference/feature-gates/) to widen that
-performance improvement to other kinds of PersistentVolumeClaims, as explained in detail
-below.
+Kubernetes v1.33 promotes `SELinuxChangePolicy` and `SELinuxMount`
+[feature gates](/docs/reference/command-line-tools-reference/feature-gates/)
+as beta to widen that performance improvement to other kinds of PersistentVolumeClaims,
+as explained in detail below. While in beta, `SELinuxMount` is still disabled by default.
 {{< /note >}}
 
-By default, the container runtime recursively assigns SELinux label to all
-files on all Pod volumes. To speed up this process, Kubernetes can change the
+With `SELinuxMount` feature gate disabled (the default in Kubernetes 1.33 and any previous release),
+the container runtime recursively assigns SELinux label to all
+files on all Pod volumes by default. To speed up this process, Kubernetes can change the
 SELinux label of a volume instantly by using a mount option
 `-o context=<label>`.
 
 To benefit from this speedup, all these conditions must be met:
 
-* The [feature gates](/docs/reference/command-line-tools-reference/feature-gates/) `ReadWriteOncePod`
-  and `SELinuxMountReadWriteOncePod` must be enabled.
+* The [feature gate](/docs/reference/command-line-tools-reference/feature-gates/)
+  `SELinuxMountReadWriteOncePod` must be enabled.
 * Pod must use PersistentVolumeClaim with applicable `accessModes` and [feature gates](/docs/reference/command-line-tools-reference/feature-gates/):
   * Either the volume has `accessModes: ["ReadWriteOncePod"]`, and feature gate `SELinuxMountReadWriteOncePod` is enabled.
-  * Or the volume can use any other access modes and both feature gates
+  * Or the volume can use any other access modes and all feature gates
     `SELinuxMountReadWriteOncePod`, `SELinuxChangePolicy` and `SELinuxMount` must be enabled
     and the Pod has `spec.securityContext.seLinuxChangePolicy` either nil (default) or `MountOption`. 
 * Pod (or all its Containers that use the PersistentVolumeClaim) must
@@ -724,9 +727,15 @@ To benefit from this speedup, all these conditions must be met:
     The CSI driver must announce that it supports mounting with `-o context` by setting
     `spec.seLinuxMount: true` in its CSIDriver instance.
 
-For any other volume types, SELinux relabelling happens another way: the container
+When any of these conditions is not met, SELinux relabelling happens another way: the container
 runtime  recursively changes the SELinux label for all inodes (files and directories)
-in the volume.
+in the volume. Calling out explicitly, this applies to Kubernetes ephemeral volumes like
+`secret`, `configMap` and `projected`, and all volumes whose CSIDriver instance does not
+explicitly announce mounting with `-o context`.
+
+When this speedup is used, all Pods that use the same applicable volume concurrently on the same node
+**must have the same SELinux label**. A Pod with a different SELinux label will fail to start and will be
+`ContainerCreating` until all Pods with other SELinux labels that use the volume are deleted.
 
 {{< feature-state feature_gate_name="SELinuxChangePolicy" >}}
 For Pods that want to opt-out from relabeling using mount options, they can set
@@ -758,6 +767,12 @@ with different SELinux labels:
 A cluster admin can use this information to identify pods affected by the planning change and
 proactively opt-out Pods from the optimization (i.e. set `spec.securityContext.seLinuxChangePolicy: Recursive`).
 
+{{< warning >}}
+We strongly recommend clusters that use SELinux to enable this controller and make sure that
+`selinux_warning_controller_selinux_volume_conflict` metric does not report any conflicts before enabling `SELinuxMount`
+feature gate or upgrading to a version where `SELinuxMount` is enabled by default.
+{{< /warning >}}
+
 #### Feature gates
 
 The following feature gates control the behavior of SELinux volume relabeling:
@@ -768,11 +783,11 @@ The following feature gates control the behavior of SELinux volume relabeling:
 * `SELinuxChangePolicy`: enables `spec.securityContext.seLinuxChangePolicy` field in Pod and related SELinuxWarningController
   in kube-controller-manager. This feature can be used before enabling `SELinuxMount` to check Pods running on a cluster,
   and to pro-actively opt-out Pods from the optimization.
-  This feature gate requires `SELinuxMountReadWriteOncePod` enabled. It is alpha and disabled by default in 1.32.
+  This feature gate requires `SELinuxMountReadWriteOncePod` enabled. It is beta and enabled by default in 1.33.
 * `SELinuxMount` enables the optimization for all eligible volumes. Since it can break existing workloads, we recommend
   enabling `SELinuxChangePolicy` feature gate + SELinuxWarningController first to check the impact of the change.
-  This feature gate requires `SELinuxMountReadWriteOncePod` and `SELinuxChangePolicy` enabled. It is alpha and disabled
-  by default in 1.32.
+  This feature gate requires `SELinuxMountReadWriteOncePod` and `SELinuxChangePolicy` enabled. It is beta, but disabled
+  by default in 1.33.
 
 ## Managing access to the `/proc` filesystem {#proc-access}
 


Reviews:
user: login: dipesh-rawat
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-02-27T00:13:44Z
user: login: jsafrane
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-25T14:14:11Z
user: login: tengqm
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-26T02:50:34Z
user: login: jsafrane
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-26T11:56:24Z
user: login: jsafrane
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-26T11:57:33Z
user: login: tengqm
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-26T23:20:16Z

Review comments:
diff_hunk: @@ -9,6 +9,9 @@ stages:
   - stage: alpha
     defaultValue: false
     fromVersion: "1.32"
+  - stage: beta
+    defaultValue: true
+    fromVersion: "1.32"
path: content/en/docs/reference/command-line-tools-reference/feature-gates/SELinuxChangePolicy.md
user: login: dipesh-rawat
body: Some early feedback: `toVersion` should be added to the previous stage. Also, looks like the beta version might need correction.

```suggestion
    toVersion: "1.32"
  - stage: beta
    defaultValue: true
    fromVersion: "1.33"
```
created_at: 2025-02-27T00:13:44Z
author_association: MEMBER
diff_hunk: @@ -9,6 +9,9 @@ stages:
   - stage: alpha
     defaultValue: false
     fromVersion: "1.32"
+  - stage: beta
+    defaultValue: true
+    fromVersion: "1.32"
path: content/en/docs/reference/command-line-tools-reference/feature-gates/SELinuxChangePolicy.md
user: login: jsafrane
body: Thanks for the suggestion, I applied + squashed it
created_at: 2025-03-25T14:14:11Z
author_association: MEMBER
diff_hunk: @@ -686,6 +686,8 @@ securityContext:
 
 {{< note >}}
 To assign SELinux labels, the SELinux security module must be loaded on the host operating system.
+On Windows and Linux workers without SELinux support, this field and any SELinux feature gates described
path: content/en/docs/tasks/configure-pod-container/security-context.md
user: login: tengqm
body: ```suggestion
On Windows and Linux worker nodes without SELinux support, this field and any SELinux feature gates described
```
created_at: 2025-03-26T02:42:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -696,24 +698,25 @@ To assign SELinux labels, the SELinux security module must be loaded on the host
 Kubernetes v1.27 introduced an early limited form of this behavior that was only applicable
 to volumes (and PersistentVolumeClaims) using the `ReadWriteOncePod` access mode.
 
-As an alpha feature, you can enable the `SELinuxMount` and `SELinuxChangePolicy`
-[feature gates](/docs/reference/command-line-tools-reference/feature-gates/) to widen that
-performance improvement to other kinds of PersistentVolumeClaims, as explained in detail
-below.
+Kubernetes v1.33 introduced `SELinuxChangePolicy` and `SELinuxMount`
path: content/en/docs/tasks/configure-pod-container/security-context.md
user: login: tengqm
body: ```suggestion
Kubernetes v1.33 promotes `SELinuxChangePolicy` and `SELinuxMount`
```
created_at: 2025-03-26T02:42:51Z
author_association: CONTRIBUTOR
diff_hunk: @@ -696,24 +698,25 @@ To assign SELinux labels, the SELinux security module must be loaded on the host
 Kubernetes v1.27 introduced an early limited form of this behavior that was only applicable
 to volumes (and PersistentVolumeClaims) using the `ReadWriteOncePod` access mode.
 
-As an alpha feature, you can enable the `SELinuxMount` and `SELinuxChangePolicy`
-[feature gates](/docs/reference/command-line-tools-reference/feature-gates/) to widen that
-performance improvement to other kinds of PersistentVolumeClaims, as explained in detail
-below.
+Kubernetes v1.33 introduced `SELinuxChangePolicy` and `SELinuxMount`
+[feature gates](/docs/reference/command-line-tools-reference/feature-gates/)
+as beta to widen that performance improvement to other kinds of PersistentVolumeClaims,
+as explained in detail below. While beta, `SELinuxMount` is still disabled by default.
path: content/en/docs/tasks/configure-pod-container/security-context.md
user: login: tengqm
body: ```suggestion
as explained in detail below. While in beta, `SELinuxMount` is still disabled by default.
```
created_at: 2025-03-26T02:43:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -724,9 +727,15 @@ To benefit from this speedup, all these conditions must be met:
     The CSI driver must announce that it supports mounting with `-o context` by setting
     `spec.seLinuxMount: true` in its CSIDriver instance.
 
-For any other volume types, SELinux relabelling happens another way: the container
+When any of these conditions is not met, SELinux relabelling happens another way: the container
 runtime  recursively changes the SELinux label for all inodes (files and directories)
-in the volume.
+in the volume. Calling out explicitly, this applies to Kubernetes ephemeral volumes like
+`secrets`, `configMaps` and `projected`, and all volumes whose CSIDriver instance does not
path: content/en/docs/tasks/configure-pod-container/security-context.md
user: login: tengqm
body: ```suggestion
`secret`, `configMap` and `projected`, and all volumes whose CSIDriver instance does not
```
created_at: 2025-03-26T02:44:51Z
author_association: CONTRIBUTOR
diff_hunk: @@ -758,6 +767,12 @@ with different SELinux labels:
 A cluster admin can use this information to identify pods affected by the planning change and
 proactively opt-out Pods from the optimization (i.e. set `spec.securityContext.seLinuxChangePolicy: Recursive`).
 
+{{< warning >}}
+We strongly recommend clusters that use SELinux to enable this controller and make sure that
+`selinux_warning_controller_selinux_volume_conflict` metric does not report any conflicts before enabling `SELinuxMount`
path: content/en/docs/tasks/configure-pod-container/security-context.md
user: login: tengqm
body: are you sure that this metrics will report anything before `SELinuxMount` is enabled?
created_at: 2025-03-26T02:49:11Z
author_association: CONTRIBUTOR
diff_hunk: @@ -768,11 +783,11 @@ The following feature gates control the behavior of SELinux volume relabeling:
 * `SELinuxChangePolicy`: enables `spec.securityContext.seLinuxChangePolicy` field in Pod and related SELinuxWarningController
   in kube-controller-manager. This feature can be used before enabling `SELinuxMount` to check Pods running on a cluster,
   and to pro-actively opt-out Pods from the optimization.
-  This feature gate requires `SELinuxMountReadWriteOncePod` enabled. It is alpha and disabled by default in 1.32.
+  This feature gate requires `SELinuxMountReadWriteOncePod` enabled. It is beta and enabled by default in 1.33.
 * `SELinuxMount` enables the optimization for all eligible volumes. Since it can break existing workloads, we recommend
   enabling `SELinuxChangePolicy` feature gate + SELinuxWarningController first to check the impact of the change.
-  This feature gate requires `SELinuxMountReadWriteOncePod` and `SELinuxChangePolicy` enabled. It is alpha and disabled
-  by default in 1.32.
+  This feature gate requires `SELinuxMountReadWriteOncePod` and `SELinuxChangePolicy` enabled. It is beta, but disabled
path: content/en/docs/tasks/configure-pod-container/security-context.md
user: login: tengqm
body: Which gate is "It" referring to?
`SELinuxMountReadWriteOncePod` is enabled by default right?
created_at: 2025-03-26T02:50:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -758,6 +767,12 @@ with different SELinux labels:
 A cluster admin can use this information to identify pods affected by the planning change and
 proactively opt-out Pods from the optimization (i.e. set `spec.securityContext.seLinuxChangePolicy: Recursive`).
 
+{{< warning >}}
+We strongly recommend clusters that use SELinux to enable this controller and make sure that
+`selinux_warning_controller_selinux_volume_conflict` metric does not report any conflicts before enabling `SELinuxMount`
path: content/en/docs/tasks/configure-pod-container/security-context.md
user: login: jsafrane
body: Yes. That's why the whole new controller is introduced. Just to expose metrics + events for Pods that would break *before* `SELinuxMount` is enabled.
created_at: 2025-03-26T11:56:24Z
author_association: MEMBER
diff_hunk: @@ -768,11 +783,11 @@ The following feature gates control the behavior of SELinux volume relabeling:
 * `SELinuxChangePolicy`: enables `spec.securityContext.seLinuxChangePolicy` field in Pod and related SELinuxWarningController
   in kube-controller-manager. This feature can be used before enabling `SELinuxMount` to check Pods running on a cluster,
   and to pro-actively opt-out Pods from the optimization.
-  This feature gate requires `SELinuxMountReadWriteOncePod` enabled. It is alpha and disabled by default in 1.32.
+  This feature gate requires `SELinuxMountReadWriteOncePod` enabled. It is beta and enabled by default in 1.33.
 * `SELinuxMount` enables the optimization for all eligible volumes. Since it can break existing workloads, we recommend
   enabling `SELinuxChangePolicy` feature gate + SELinuxWarningController first to check the impact of the change.
-  This feature gate requires `SELinuxMountReadWriteOncePod` and `SELinuxChangePolicy` enabled. It is alpha and disabled
-  by default in 1.32.
+  This feature gate requires `SELinuxMountReadWriteOncePod` and `SELinuxChangePolicy` enabled. It is beta, but disabled
path: content/en/docs/tasks/configure-pod-container/security-context.md
user: login: jsafrane
body: "It" refers to SELinuxMount. 
created_at: 2025-03-26T11:57:33Z
author_association: MEMBER
diff_hunk: @@ -758,6 +767,12 @@ with different SELinux labels:
 A cluster admin can use this information to identify pods affected by the planning change and
 proactively opt-out Pods from the optimization (i.e. set `spec.securityContext.seLinuxChangePolicy: Recursive`).
 
+{{< warning >}}
+We strongly recommend clusters that use SELinux to enable this controller and make sure that
+`selinux_warning_controller_selinux_volume_conflict` metric does not report any conflicts before enabling `SELinuxMount`
path: content/en/docs/tasks/configure-pod-container/security-context.md
user: login: tengqm
body: Got it. Thanks.
created_at: 2025-03-26T23:20:16Z
author_association: CONTRIBUTOR

PR comments:
user: login: netlify[bot]
created_at: 2025-02-26T15:07:28Z
body: ### <span aria-hidden="true">👷</span> Deploy Preview for *kubernetes-io-vnext-staging* processing.


|  Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 5d6fb08b15f8da587fc3cfc5eb653e0be08a0b7a |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/67e3ebdfb9036b0008e3a80e |
author_association: NONE
user: login: netlify[bot]
created_at: 2025-02-26T15:16:43Z
body: ### <span aria-hidden="true">✅</span> Pull request preview available for checking
Built [without sensitive environment variables](https://docs.netlify.com/configure-builds/environment-variables/#sensitive-variable-policy)

|  Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | c8a7cac3335590e5f9ab4a85b7b4b4973eb733f4 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/67bf2e1c0dbeae0008c522ab |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-49919--kubernetes-io-main-staging.netlify.app](https://deploy-preview-49919--kubernetes-io-main-staging.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br />![QR Code](https://app.netlify.com/qr-code/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczovL2RlcGxveS1wcmV2aWV3LTQ5OTE5LS1rdWJlcm5ldGVzLWlvLW1haW4tc3RhZ2luZy5uZXRsaWZ5LmFwcCJ9.Q98jFrizvFeOWdIRW9Vy4hGnN4GCAwBZg4RexMA2aF4)<br /><br />_Use your smartphone camera to open QR code link._</details> |
---
<!-- [kubernetes-io-main-staging Preview](https://deploy-preview-49919--kubernetes-io-main-staging.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify site configuration](https://app.netlify.com/sites/kubernetes-io-main-staging/configuration/notifications#deploy-webhooks)._
author_association: NONE
user: login: netlify[bot]
created_at: 2025-02-26T15:25:23Z
body: ### <span aria-hidden="true">✅</span> Pull request preview available for checking
Built [without sensitive environment variables](https://docs.netlify.com/configure-builds/environment-variables/#sensitive-variable-policy)

|  Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 5d6fb08b15f8da587fc3cfc5eb653e0be08a0b7a |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/67e3ebdf93c1ce0008bb6874 |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-49919--kubernetes-io-main-staging.netlify.app](https://deploy-preview-49919--kubernetes-io-main-staging.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br />![QR Code](https://app.netlify.com/qr-code/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczovL2RlcGxveS1wcmV2aWV3LTQ5OTE5LS1rdWJlcm5ldGVzLWlvLW1haW4tc3RhZ2luZy5uZXRsaWZ5LmFwcCJ9.Q98jFrizvFeOWdIRW9Vy4hGnN4GCAwBZg4RexMA2aF4)<br /><br />_Use your smartphone camera to open QR code link._</details> |
---
<!-- [kubernetes-io-main-staging Preview](https://deploy-preview-49919--kubernetes-io-main-staging.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify site configuration](https://app.netlify.com/sites/kubernetes-io-main-staging/configuration/notifications#deploy-webhooks)._
author_association: NONE
user: login: dipesh-rawat
created_at: 2025-02-27T00:12:36Z
body: /remove-area localization
/remove-language zh 
author_association: MEMBER
user: login: sftim
created_at: 2025-03-04T20:25:11Z
body: Placeholders should be marked as work in progress, so:

/retitle [WIP] Announce improved SELinux volume relabelling


author_association: CONTRIBUTOR
user: login: rayandas
created_at: 2025-03-25T05:55:22Z
body: Hello @jsafrane :wave: please take a look at [Documenting for a release - PR Ready for Review](https://kubernetes.io/docs/contribute/new-content/new-features/#pr-ready-for-review) to get your PR ready for review before Tuesday 25th March 2025 18:00 PDT. Thank you!
author_association: MEMBER
user: login: jsafrane
created_at: 2025-03-25T15:27:07Z
body: I updated the PR with a real content, now it's ready for review.
author_association: MEMBER
user: login: tengqm
created_at: 2025-03-26T23:23:05Z
body: /approve
/hold
Doc looks good. Holding for upstream change to be merged.
Feel free to unhold when that happens.
author_association: CONTRIBUTOR
user: login: jsafrane
created_at: 2025-03-28T13:32:46Z
body: @tengqm pardon my ignorance, what "upstream change" should be merged first?
author_association: MEMBER
user: login: tengqm
created_at: 2025-03-28T13:42:18Z
body: > @tengqm pardon my ignorance, what "upstream change" should be merged first?

The upstream change means the PR that promotes the gate in kubernetes/kubernetes.

author_association: CONTRIBUTOR
user: login: jsafrane
created_at: 2025-03-28T16:41:43Z
body: I think that has merged: https://github.com/kubernetes/kubernetes/pull/130544
author_association: MEMBER
user: login: tengqm
created_at: 2025-03-29T05:55:02Z
body: > I think that has merged: [kubernetes/kubernetes#130544](https://github.com/kubernetes/kubernetes/pull/130544)

Thanks.
/approve

author_association: CONTRIBUTOR
user: login: k8s-ci-robot
created_at: 2025-03-29T05:55:20Z
body: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes/website/pull/49919#issuecomment-2763126377" title="Approved">tengqm</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes%2Fwebsite).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[content/en/docs/OWNERS](https://github.com/kubernetes/website/blob/dev-1.33/content/en/docs/OWNERS)~~ [tengqm]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
author_association: CONTRIBUTOR
user: login: tengqm
created_at: 2025-03-29T05:55:25Z
body: /hold cancel
/lgtm

author_association: CONTRIBUTOR
user: login: k8s-ci-robot
created_at: 2025-03-29T05:55:32Z
body: LGTM label has been added.  <details>Git tree hash: 59d7f63c2f2113faa10e532bf09757a7ddc62651</details>
author_association: CONTRIBUTOR