KEP-127: Mark as implementable (target phase I for 1.25) #3275

rata · 2022-04-07T15:48:57Z

With @giuseppe we created a PoC implementation for containerd and CRIO to validate this changes, all turned out to work just fine. Volume support is also working as expected.

This updates the KEP for 1.25 as discussed in SIG-node. Only PRR is missing to mark as implementable.

Signed-off-by: Rodrigo Campos rodrigoca@microsoft.com
Co-authored-by: Giuseppe Scrivano gscrivan@redhat.com
Signed-off-by: Giuseppe Scrivano gscrivan@redhat.com

cc @SergeyKanzhelev @mrunalp @thockin

One-line PR description: Add changes for userns support and switch to implementable

Issue link: Support User Namespaces in pods #127

Other comments:

rata · 2022-04-12T16:30:58Z

@mrunalp @SergeyKanzhelev @thockin friendly ping?

I'll be away until next week, but it will be great if you can have a look.

keps/sig-node/127-user-namespaces/README.md

marosset · 2022-04-26T17:09:01Z

/cc

giuseppe · 2022-05-03T07:13:31Z

@derekwaynecarr @SergeyKanzhelev @mrunalp @thockin PTAL

keps/sig-node/127-user-namespaces/README.md

giuseppe · 2022-05-05T07:41:21Z

@mrunalp could we get another review?

giuseppe · 2022-05-05T10:42:04Z

if I use Size, I get this error:

vendor/k8s.io/api/core/v1/generated.pb.go:21342:6: type IDMapping has both field and method named Size

I've reverted back to using Length

keps/sig-node/127-user-namespaces/README.md

fuweid · 2022-05-09T12:51:04Z

cc

marosset · 2022-05-09T21:31:50Z

I reviewed these changes from a Windows perspective and it would require some OS changes to be able to support something like this on Windows and even if those changes were in place things would work differently.
Let's keep the KEP/changes focused on linux for the time being.

rata · 2022-05-10T10:46:36Z

@marosset Perfect, thanks a lot!

For reviewers, please note that the CRI changes live all inside the linux-specific part. They are all inside the LinuxPodSandboxConfig field of the PodSandboxConfig message. (in particular PodSandboxConfig.linux.security_context.namespace_options)

keps/sig-node/127-user-namespaces/kep.yaml

SergeyKanzhelev

reapplying lgtm, changes looks good

/lgtm

keps/sig-node/127-user-namespaces/README.md

keps/prod-readiness/sig-node/3317.yaml

wojtek-t

@rata - couple follow ups from yesterday comments, but we're pretty close now.

keps/prod-readiness/sig-node/3317.yaml

keps/sig-node/127-user-namespaces/README.md

wojtek-t · 2022-06-08T07:25:46Z

keps/sig-node/127-user-namespaces/README.md

@@ -250,6 +312,56 @@ limit the number of pods using user namespaces to `min(maxPods, 1024)`. This
 leaves us plenty of host UID space free and this limits is probably never hit in
 practice. See UNRESOLVED for more some UNRESOLVED info we still have on this.

+##### pkg/volume changes for phase I


Comment to line 308 (follow up from your response to my comment):

The UID they choose is inside the user namespace, it doesn't affect the mapping picked on the host.

Since we are always allocating the same size, there is no fragmentation to worry about (in facts we just use a bitmap to store at runtime what ranges are allocated).

The picked range is stored in the file /var/lib/kubelet/pods/$POD/userns so the Kubelet can read all the allocated mappings if it restarts

Can you please add that information to the doc - I think it's actually a useful context for people who are not that familiar with details like me.

Yes, good call. Thanks!

I've kept this as a different commit, as I think it might be way simpler in this case to review as a separate commit. The commit title is: KEP-127: Clarify how IDs will be used and stored

keps/sig-node/127-user-namespaces/README.md

rata · 2022-06-08T10:57:12Z

@wojtek-t Thanks a lot for the quick and detailed review! I think I addressed all. PTAL (left some comments open that were either unresolved waiting for Sergey or thought it might make the re-review easier if those are more visible. Feel free to close them your self if you consider them solved).

keps/sig-node/127-user-namespaces/README.md

SergeyKanzhelev

/lgtm

wojtek-t · 2022-06-09T06:18:51Z

@rata - ok, I think it's good enough for Alpha (as I mentioned we will have more discussions for Beta, especially around monitoring and toubleshooting, but I think we're good for Alpha).

Please squash the commits and I will approve.

This adds the needed KEP metadata, CRI changes, etc. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com> Co-authored-by: Giuseppe Scrivano <gscrivan@redhat.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

rata · 2022-06-09T09:20:55Z

@wojtek-t squashed now, thanks!

btw, for the next time, I think you can add the label tide/merge-method-squash and approve. We avoid the forced push, that removes @SergeyKanzhelev lgtm label, so we have to do that dance once more now. (of course, nothing important :))

wojtek-t · 2022-06-09T09:27:52Z

/lgtm
/approve PRR

k8s-ci-robot · 2022-06-09T09:28:18Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dchen1107, mikebrow, rata, SergeyKanzhelev, wojtek-t

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~keps/prod-readiness/OWNERS~~ [wojtek-t]
~~keps/sig-node/OWNERS~~ [dchen1107]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Apr 7, 2022

k8s-ci-robot requested a review from dchen1107 April 7, 2022 15:49

k8s-ci-robot added the kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory label Apr 7, 2022

k8s-ci-robot requested a review from derekwaynecarr April 7, 2022 15:49

k8s-ci-robot added the sig/node Categorizes an issue or PR as relevant to SIG Node. label Apr 7, 2022

rata force-pushed the rata/userns branch from 1ad3d26 to b0526dc Compare April 7, 2022 15:51

rphillips reviewed Apr 19, 2022

View reviewed changes

keps/sig-node/127-user-namespaces/README.md Show resolved Hide resolved

k8s-ci-robot requested a review from marosset April 26, 2022 17:09

mrunalp reviewed May 3, 2022

View reviewed changes

keps/sig-node/127-user-namespaces/README.md Show resolved Hide resolved

giuseppe force-pushed the rata/userns branch from b0526dc to 21db1ed Compare May 4, 2022 09:30

giuseppe force-pushed the rata/userns branch from 21db1ed to b0526dc Compare May 5, 2022 10:41

mrunalp reviewed May 6, 2022

View reviewed changes

keps/sig-node/127-user-namespaces/README.md Outdated Show resolved Hide resolved

jiangliu mentioned this pull request May 8, 2022

Enhance CRI workflow to support pod level user namespace containerd/containerd#6908

Closed

rata mentioned this pull request May 23, 2022

Add support for user namespaces #3317

Closed

4 tasks

rata changed the title ~~KEP-127: Add CRI changes for userns support~~ KEP-3317: Mark KEP as implementable for 1.25 May 23, 2022

rata force-pushed the rata/userns branch from b0526dc to 3a82762 Compare May 23, 2022 14:27

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 23, 2022

rata force-pushed the rata/userns branch 2 times, most recently from 6f047d6 to fa47967 Compare May 23, 2022 15:03

SergeyKanzhelev reviewed Jun 7, 2022

View reviewed changes

keps/sig-node/127-user-namespaces/kep.yaml Outdated Show resolved Hide resolved

SergeyKanzhelev reviewed Jun 7, 2022

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 7, 2022

SergeyKanzhelev reviewed Jun 7, 2022

View reviewed changes

keps/sig-node/127-user-namespaces/README.md Outdated Show resolved Hide resolved

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 7, 2022

SergeyKanzhelev reviewed Jun 7, 2022

View reviewed changes

keps/prod-readiness/sig-node/3317.yaml Outdated Show resolved Hide resolved

wojtek-t reviewed Jun 8, 2022

View reviewed changes

rata force-pushed the rata/userns branch from 042b5db to f121566 Compare June 8, 2022 10:53

rata changed the title ~~KEP-3317: Changes tracked for 1.25~~ KEP-3317: Mark as implementable (target phase I for 1.25) Jun 8, 2022

rata force-pushed the rata/userns branch from f121566 to acd8035 Compare June 8, 2022 11:12

rata changed the title ~~KEP-3317: Mark as implementable (target phase I for 1.25)~~ KEP-127: Mark as implementable (target phase I for 1.25) Jun 8, 2022

rata commented Jun 8, 2022

View reviewed changes

keps/sig-node/127-user-namespaces/README.md Show resolved Hide resolved

SergeyKanzhelev approved these changes Jun 8, 2022

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 8, 2022

KEP-127: Changes for alpha and mark implementable

41b93bc

This adds the needed KEP metadata, CRI changes, etc. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com> Co-authored-by: Giuseppe Scrivano <gscrivan@redhat.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

rata force-pushed the rata/userns branch from acd8035 to 41b93bc Compare June 9, 2022 09:17

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 9, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 9, 2022

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 9, 2022

k8s-ci-robot merged commit 6c7accb into kubernetes:master Jun 9, 2022

k8s-ci-robot added this to the v1.25 milestone Jun 9, 2022

rata deleted the rata/userns branch June 9, 2022 10:13

Priyankasaggu11929 mentioned this pull request Jun 9, 2022

Support User Namespaces in pods #127

Open

26 tasks

SergeyKanzhelev mentioned this pull request Feb 17, 2023

Refactored kubelet's kuberuntime_sandbox kubernetes/kubernetes#114185

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

KEP-127: Mark as implementable (target phase I for 1.25) #3275

KEP-127: Mark as implementable (target phase I for 1.25) #3275

rata commented Apr 7, 2022 •

edited

Loading

rata commented Apr 12, 2022

marosset commented Apr 26, 2022

giuseppe commented May 3, 2022

giuseppe commented May 5, 2022

giuseppe commented May 5, 2022

fuweid commented May 9, 2022

marosset commented May 9, 2022

rata commented May 10, 2022

SergeyKanzhelev left a comment

wojtek-t left a comment

wojtek-t Jun 8, 2022

rata Jun 8, 2022

rata commented Jun 8, 2022

SergeyKanzhelev left a comment

wojtek-t commented Jun 9, 2022

rata commented Jun 9, 2022

wojtek-t commented Jun 9, 2022

k8s-ci-robot commented Jun 9, 2022

KEP-127: Mark as implementable (target phase I for 1.25) #3275

KEP-127: Mark as implementable (target phase I for 1.25) #3275

Conversation

rata commented Apr 7, 2022 • edited Loading

rata commented Apr 12, 2022

marosset commented Apr 26, 2022

giuseppe commented May 3, 2022

giuseppe commented May 5, 2022

giuseppe commented May 5, 2022

fuweid commented May 9, 2022

marosset commented May 9, 2022

rata commented May 10, 2022

SergeyKanzhelev left a comment

Choose a reason for hiding this comment

wojtek-t left a comment

Choose a reason for hiding this comment

wojtek-t Jun 8, 2022

Choose a reason for hiding this comment

rata Jun 8, 2022

Choose a reason for hiding this comment

rata commented Jun 8, 2022

SergeyKanzhelev left a comment

Choose a reason for hiding this comment

wojtek-t commented Jun 9, 2022

rata commented Jun 9, 2022

wojtek-t commented Jun 9, 2022

k8s-ci-robot commented Jun 9, 2022

rata commented Apr 7, 2022 •

edited

Loading