Change:
Look, here is the thing, this is only useful IF you are only exposing the kube api to the end user. AND even then if you do not prevent mounting the host into containers via a PodSecurityPolicy then you could just exec in by combining the file descriptors.... Like this window dressing of a feature is kinda un-useful and people are enabling it under circumstances where it is just plain stupid.... there is literally no point to this feature if you do not also have a pod security policy in place preventing people from mounting shit in to literally exec. Or if users have access to the nodes in the first place it makes literally no sense.
/sig auth
/sig node cc
Agreed. I would much prefer to see this done with a combination of RBAC, namespaces, and PodSecurityPolicy. For example: Allow privileged pods in the "privileged" namespace (PodSecurityPolicy), do not allow exec in that namespace (RBAC) Forbid privileged pods in the "unprivileged" namespace (PSP), allow exec in that namespace PSP actually covers enough ground to properly prevent escalating exec (privileged, capabilities, host paths, etc.).
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
Stale issues rot after 30d of inactivity. Mark the issue as fresh with . Rotten issues close after an additional 30d of inactivity. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle rotten
/remove-lifecycle rotten
opened to mark as deprecated
Thanks

Discussion:
"//staging/src/k8s.io/apiserver/pkg/admission:go_default_library", "//staging/src/k8s.io/apiserver/pkg/admission/initializer:go_default_library", "//staging/src/k8s.io/client-go/kubernetes:go_default_library", <ins> "//vendor/k8s.io/klog:go_default_library", </ins> ], )

"k8s.io/apiserver/pkg/admission" genericadmissioninitializer "k8s.io/apiserver/pkg/admission/initializer" "k8s.io/client-go/kubernetes" <ins> "k8s.io/klog" </ins> ) const ( // DenyEscalatingExec indicates name of admission plugin. <ins> // Deprecated, will be removed in v1.18. // Use of PodSecurityPolicy or a custom admission plugin to limit creation of pods is recommended instead. </ins> DenyEscalatingExec = "DenyEscalatingExec" // DenyExecOnPrivileged indicates name of admission plugin. <del> // Deprecated, should use DenyEscalatingExec instead. </del> <ins> // Deprecated, will be removed in v1.18. // Use of PodSecurityPolicy or a custom admission plugin to limit creation of pods is recommended instead. </ins> DenyExecOnPrivileged = "DenyExecOnPrivileged" ) // Register registers a plugin func Register(plugins *admission.Plugins) { plugins.Register(DenyEscalatingExec, func(config io.Reader) (admission.Interface, error) { <ins> klog.Warningf("the %s admission plugin is deprecated and will be removed in v1.18", DenyEscalatingExec) klog.Warningf("use of PodSecurityPolicy or a custom admission plugin to limit creation of pods is recommended instead") </ins> return NewDenyEscalatingExec(), nil }) // This is for legacy support of the DenyExecOnPrivileged admission controller.  Most // of the time DenyEscalatingExec should be preferred. plugins.Register(DenyExecOnPrivileged, func(config io.Reader) (admission.Interface, error) { <ins> klog.Warningf("the %s admission plugin is deprecated and will be removed in v1.18", DenyExecOnPrivileged) klog.Warningf("use of PodSecurityPolicy or a custom admission plugin to limit creation of pods is recommended instead") </ins> return NewDenyExecOnPrivileged(), nil }) }