Graduate SeccompDefault feature to stable / GA

[saschagrunert]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Updating the required code and docs for SeccompDefault to go GA, which now means that we enable the feature per default.

Which issue(s) this PR fixes:

Refers to kubernetes/enhancements#2413

Special notes for your reviewer:

cc @kubernetes/sig-node-api-reviews

Does this PR introduce a user-facing change?

Graduated seccomp profile defaulting to GA.

Set the kubelet `--seccomp-default` flag or `seccompDefault` kubelet configuration field to `true` to make pods on that node default to using the `RuntimeDefault` seccomp profile.

Enabling seccomp for your workload can have a negative performance impact depending on the kernel and container runtime version in use.

Guidance for identifying and mitigating those issues is outlined in the Kubernetes [seccomp tutorial](https://k8s.io/docs/tutorials/security/seccomp).

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

KEP: https://github.com/kubernetes/enhancements/tree/05f81b8/keps/sig-node/2413-seccomp-by-default

[saschagrunert]

/priority important-soon

[k8s-triage-robot]

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

[saschagrunert]

/label api-review

[saschagrunert]

/test pull-kubernetes-e2e-gce

[bart0sh]

/triage accepted

[liggitt]

/approve
for kubelet config API changes

will leave lgtm to node review

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, saschagrunert, SergeyKanzhelev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/kubelet/OWNERS [liggitt]
• pkg/features/OWNERS [liggitt]
• pkg/generated/openapi/OWNERS [liggitt]
• staging/src/k8s.io/kubelet/config/OWNERS [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[saschagrunert]

/test pull-kubernetes-unit

[dims]

this PR by itself LGTM. folks have pointed out that the KEP text needs to match this PR. I am ok either to land this first and then update the KEP or the other way around.

[SergeyKanzhelev]

@saschagrunert would you please also address the todo comment that is relatively related:

kubernetes/pkg/kubelet/kuberuntime/kuberuntime_sandbox.go

Lines 171 to 174 in e55f2a9

	// TODO: Deprecated, remove after we switch to Seccomp field
	// Forcing sandbox to run as `runtime/default` allow users to
	// use least privileged seccomp profiles at pod level. Issue #84623
	SeccompProfilePath: v1.SeccompProfileRuntimeDefault,

this PR is lgtm

/lgtm
/hold

(hold if you will decide to address TODO as part of this PR, feel free to unhold any moment)

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: ba30bddf1e5c89c8d9af6ae22b4bba778159069f

[saschagrunert]

@SergeyKanzhelev I'm going to follow-up on the TODO, thank you for the hint!

/unhold

See #115898

[sftim]

My suggestion for a changelog entry (we can revise these after merge):

Graduated seccomp profile defaulting to GA.

Set the kubelet `--seccomp-default` flag or `seccompDefault` kubelet configuration field to `true` to make
pods on that node default to using the `RuntimeDefault` seccomp profile.

Enabling seccomp for your workload can have a negative performance impact depending on the kernel and
container runtime version in use.
Guidance for identifying and mitigating those issues is outlined in the Kubernetes
[seccomp tutorial](https://k8s.io/docs/tutorials/security/seccomp).

---

Should we also track work to update related docs, such as https://kubernetes.io/docs/concepts/security/security-checklist/?

[saschagrunert]

My suggestion for a changelog entry (we can revise these after merge):
…
Should we also track work to update related docs, such as https://kubernetes.io/docs/concepts/security/security-checklist/?

Thanks, changed the release notes as suggested 👍

Yes, docs updates will be part of the usual enhancement process and I'm following-up on them in the next weeks.