Exception Request for Enhancement Freeze for KEP 6060

[Benjamin Petersen]

Hi Release Team,

I am requesting an exception for Enhancement Freeze for KEP #6060: API Server Authentication to Admission Webhooks.  Details: 

• Enhancement name: API Server Authentication to Admission Webhooks
• Enhancement status (alpha/beta/stable): Alpha
• SIG: SIG-Auth
• k/enhancements repo issue #:  https://github.com/kubernetes/enhancements/issues/6060
• PR #’s:  https://github.com/kubernetes/enhancements/pull/6156
• Additional time needed (in calendar days, due end of day AoE): 3 days (Friday, June 19th)
• Reason this enhancement is critical for this milestone:
• https://nvd.nist.gov/vuln/detail/CVE-2025-1974
• 9.8 critical, related to the Ingress-Nginx Controller
• This patch addresses an issue that was a component of this exploit
• Risks from adding code late: (to k8s stability, testing, etc.):
• low, this is an alpha api, disabled by default
• Risks from cutting enhancement: (partial implementation, critical customer usecase, etc.):
• Delaying this KEP simply means that a security gap regarding webhooks remains open for a longer period of time.  This gap may continue to invite bad actors to look for ways to utilize it to compromise clusters.

Thanks!

[Mo Khan]

+1 from me as this KEP is working to address a long standing security issue.

--
You received this message because you are subscribed to the Google Groups "kubernetes-sig-auth" group.
To unsubscribe from this group and stop receiving emails from it, send an email to kubernetes-sig-...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/kubernetes-sig-auth/CALCMx2Rje4uCsMXHqGX9UQqKFfyp0v5eYmQHybQggYfZavvjnw%40mail.gmail.com.

[Dipesh Rawat]

Hi all

After reviewing the request and the discussion in the referenced Slack thread [0], the Release Team is APPROVING this exception request.

The updated deadline for merging all Enhancement Freeze requirements for this KEP is Friday, 19 June 2026 (AoE) / Saturday, 20 June 2026, 12:00 UTC.

If you need any clarification, please feel free to reach out to us in the #sig-release Slack channel.

Thanks,
Dipesh Rawat
v1.37 Release Lead

[0]: https://kubernetes.slack.com/archives/C2C40FMNF/p1781677556916169