Skip to content

KEP-5883: Optional key in ConfigMapKeyRef and SecretKeyRef defaults to env var name#5955

Open
dap0am wants to merge 1 commit intokubernetes:masterfrom
dap0am:kep-5883-optional-env-key-defaulting
Open

KEP-5883: Optional key in ConfigMapKeyRef and SecretKeyRef defaults to env var name#5955
dap0am wants to merge 1 commit intokubernetes:masterfrom
dap0am:kep-5883-optional-env-key-defaulting

Conversation

@dap0am
Copy link

@dap0am dap0am commented Mar 10, 2026

Summary

Adds a provisional KEP for making the key field optional in configMapKeyRef
and secretKeyRef. When omitted and the EnvVarKeyDefaultsToName feature gate
is enabled, the kubelet defaults key to the enclosing env[*].name.

This eliminates boilerplate in the common case where the env var name and the
ConfigMap/Secret key are identical:

# Before
env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: my-secret
        key: DB_PASSWORD  # redundant

# After (with feature gate enabled)
env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: my-secret
        # key defaults to "DB_PASSWORD"

What this PR includes

  • keps/sig-node/5883-optional-env-key-defaulting/kep.yaml — KEP metadata
  • keps/sig-node/5883-optional-env-key-defaulting/README.md — full provisional KEP

Related

/sig node
/sig api-machinery
/kind feature

@dap0am
KEP-5883: Optional key in ConfigMapKeyRef and SecretKeyRef defaults t…
5d2e3d5 
…o env var name

Adds a provisional KEP for allowing the `key` field to be omitted from
`configMapKeyRef` and `secretKeyRef`, defaulting to the enclosing
`env[*].name` when the `EnvVarKeyDefaultsToName` feature gate is enabled.

Ref: kubernetes/kubernetes#132195
@k8s-ci-robot k8s-ci-robot added sig/node Categorizes an issue or PR as relevant to SIG Node. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. kind/feature Categorizes issue or PR as related to a new feature. kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory labels Mar 10, 2026
@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Mar 10, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dap0am
Once this PR has been reviewed and has the lgtm label, please assign mrunalp for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Mar 10, 2026

Welcome @dap0am!

It looks like this is your first PR to kubernetes/enhancements 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/enhancements has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Mar 10, 2026
@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Mar 10, 2026

Hi @dap0am. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 10, 2026
dap0am added a commit to dap0am/kubernetes that referenced this pull request Mar 13, 2026
@dap0am
feat: add EnvVarKeyDefaultsToName feature gate (KEP-5883)
9e7b4e0 
When the EnvVarKeyDefaultsToName feature gate is enabled, the `key` field
in `configMapKeyRef` and `secretKeyRef` may be omitted. The kubelet then
defaults the lookup key to the enclosing `env[*].name` at runtime.

Changes:
- Register EnvVarKeyDefaultsToName feature gate (alpha, v1.35, default off)
- Update validateConfigMapKeySelector/validateSecretKeySelector to allow
  an empty key when the gate is on, validating that env var name is also
  a valid ConfigMap/Secret key
- Update makeEnvironmentVariables() in kubelet to default an empty key to
  env var name when the gate is on
- Add unit tests for both the validation and kubelet resolution paths

Ref: kubernetes#132195
KEP: kubernetes/enhancements#5955
@dap0am dap0am mentioned this pull request Mar 13, 2026
Open
dap0am added a commit to dap0am/kubernetes that referenced this pull request Mar 13, 2026
@dap0am
feat: add EnvVarKeyDefaultsToName feature gate (KEP-5883)
e09f9a3 
When the EnvVarKeyDefaultsToName feature gate is enabled, the `key` field
in `configMapKeyRef` and `secretKeyRef` may be omitted. The kubelet then
defaults the lookup key to the enclosing `env[*].name` at runtime.

Changes:
- Register EnvVarKeyDefaultsToName feature gate (alpha, v1.35, default off)
- Update validateConfigMapKeySelector/validateSecretKeySelector to allow
  an empty key when the gate is on, validating that env var name is also
  a valid ConfigMap/Secret key
- Update makeEnvironmentVariables() in kubelet to default an empty key to
  env var name when the gate is on
- Add unit tests for both the validation and kubelet resolution paths

Ref: kubernetes#132195
KEP: kubernetes/enhancements#5955
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dchen1107 dchen1107 Awaiting requested review from dchen1107

@mrunalp mrunalp Awaiting requested review from mrunalp

Assignees

No one assigned

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/node Categorizes an issue or PR as relevant to SIG Node. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dap0am @k8s-ci-robot