Document user namespace changes in v1.27 (KEP-127) #39860

rata · 2023-03-08T15:42:42Z

Placeholder PR to document the changes in Kubernetes v1.27 for user namespaces (KEP-127)

netlify · 2023-03-08T15:55:55Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`4986795`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/6408acf52334740007aecc98
😎 Deploy Preview	https://deploy-preview-39860--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

reylejano · 2023-03-08T17:50:04Z

Remember to change the base branch and target the dev-1.27 branch
/milestone 1.27
/cc @mickeyboxell

rata · 2023-03-14T10:26:36Z

@reylejano thanks, fixed that now!

mickeyboxell · 2023-03-21T03:30:25Z

Hi @rata 👋 please take a look at Documenting for a release - PR Ready for Review to get your PR ready for review as soon as possible. 01:00 UTC Wednesday 22nd March 2023 / 17:00 PDT Tuesday 21st March 2023 is the official deadline.

This PR will need a doc review by Tuesday 4th April 2023 to get this into the release. Please reach out to required SIGs to get their review. Thank you!

content/en/docs/concepts/workloads/pods/user-namespaces.md

rata · 2023-03-21T11:47:15Z

@mickeyboxell thanks, this should be ready for review now!

content/en/docs/concepts/workloads/pods/user-namespaces.md

content/en/docs/tasks/configure-pod-container/user-namespaces.md

rata · 2023-03-22T10:30:59Z

Pushed a new revision, PTAL

tengqm · 2023-03-22T13:12:38Z

/label tide/merge-method-squash
/lgtm

k8s-ci-robot · 2023-03-22T13:12:46Z

LGTM label has been added.

Git tree hash: 7b641c7f1ad38026c10fdaab06d84eb4583e7d30

rata · 2023-03-23T10:52:43Z

@tengqm Can you PTAL?

I've added a new commit duplicating a warning about versions. It seems it is better to be super clear about this and not have it only in some pages and not others.

I'm trying to err on the side of being very clear as a learning from another (not related to this) bug report where doc was the issue.

Did it as another commit, also, as you selected the squash merge method

tengqm · 2023-03-23T14:15:10Z

/approve

k8s-ci-robot · 2023-03-23T14:15:18Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tengqm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [tengqm]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rata · 2023-03-23T14:46:20Z

@tengqm thanks, now the lgtm is missing :-D

netlify · 2023-03-27T10:40:44Z

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	`a3c840e`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/6421a6aa069a0800073f8d8b

rata · 2023-03-27T10:41:46Z

Updated this PR to address similar comments that were raised in this other PR and also applied here: #40264

content/en/docs/concepts/workloads/pods/user-namespaces.md

sftim · 2023-03-27T11:28:36Z

content/en/docs/concepts/workloads/pods/user-namespaces.md

+
+* The filesystem you use for `/var/lib/kubelet/pods/`, or the custom directory
+  you configure for this, needs idmap mount support.
+* All the filesystems used in the pod need support for idmap mounts.


Suggested change

* All the filesystems used in the pod need support for idmap mounts.

* Every volume that is mounted into any container in the pod must support idmap mounts.

This smells slightly incorrect. What supports idmap mount is the filesystem, not the volume. It doesn't matter if it is an EBS volume, a local disk volume or what. The only thing that matters is that the filesystem used in that volume supports idmap mounts in the kernel running on the host.

So, what about this instead?

* All the filesystems used in the pod's volumes must support idmap mounts.

Changed it to that, let me know what you think

content/en/docs/concepts/workloads/pods/user-namespaces.md

content/en/docs/tasks/configure-pod-container/user-namespaces.md

rata · 2023-03-27T14:14:05Z

@sftim fixed all, thanks! PTAL

Also, with the new implementation, the fsGroup was dropped. So removed the mention to those limitations. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

tengqm · 2023-03-31T02:59:05Z

/lgtm
reapplied.

k8s-ci-robot · 2023-03-31T02:59:11Z

LGTM label has been added.

Git tree hash: 47c8f361630764ce0c0d919700424947b8306475

* content: Update user namespaces version requirements Also, with the new implementation, the fsGroup was dropped. So removed the mention to those limitations. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com> * content: Add reference to the userns task in the concepts page Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com> --------- Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Mar 8, 2023

k8s-ci-robot requested a review from bradtopol March 8, 2023 15:43

k8s-ci-robot added the language/en Issues or PRs related to English language label Mar 8, 2023

k8s-ci-robot requested a review from kbhawkey March 8, 2023 15:43

k8s-ci-robot added sig/docs Categorizes an issue or PR as relevant to SIG Docs. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 8, 2023

k8s-ci-robot requested a review from mickeyboxell March 8, 2023 17:50

k8s-ci-robot added this to the 1.27 milestone Mar 8, 2023

rata changed the base branch from main to dev-1.27 March 14, 2023 10:24

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Mar 14, 2023

rata force-pushed the rata/userns branch from 4986795 to 4dce62c Compare March 14, 2023 10:26

k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Mar 14, 2023

rata mentioned this pull request Mar 14, 2023

Support User Namespaces in pods kubernetes/enhancements#127

Open

26 tasks

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Mar 21, 2023

rata force-pushed the rata/userns branch 2 times, most recently from c0bd517 to cb8701e Compare March 21, 2023 11:43

rata commented Mar 21, 2023

View reviewed changes

content/en/docs/concepts/workloads/pods/user-namespaces.md Outdated Show resolved Hide resolved

rata marked this pull request as ready for review March 21, 2023 11:46

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 21, 2023

k8s-ci-robot requested review from mehabhalodiya and reylejano March 21, 2023 11:46

tengqm reviewed Mar 22, 2023

View reviewed changes

rata force-pushed the rata/userns branch from cb8701e to 5ef6702 Compare March 22, 2023 10:30

k8s-ci-robot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Mar 22, 2023

k8s-ci-robot assigned tengqm Mar 22, 2023

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 22, 2023

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 23, 2023

k8s-ci-robot requested a review from tengqm March 23, 2023 10:50

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 23, 2023

rata force-pushed the rata/userns branch from 356b27b to bb27fcc Compare March 27, 2023 10:40

rata mentioned this pull request Mar 27, 2023

content: Mention containerd 1.7 supports user namespaces #40264

Merged

rata force-pushed the rata/userns branch from bb27fcc to 3cbc601 Compare March 27, 2023 10:59

sftim reviewed Mar 27, 2023

View reviewed changes

rata added 2 commits March 27, 2023 16:20

content: Update user namespaces version requirements

4514e6e

Also, with the new implementation, the fsGroup was dropped. So removed the mention to those limitations. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

content: Add reference to the userns task in the concepts page

a3c840e

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

rata force-pushed the rata/userns branch from 3cbc601 to a3c840e Compare March 27, 2023 14:22

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 31, 2023

k8s-ci-robot merged commit 2ffb037 into kubernetes:dev-1.27 Mar 31, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Document user namespace changes in v1.27 (KEP-127) #39860

Document user namespace changes in v1.27 (KEP-127) #39860

rata commented Mar 8, 2023

netlify bot commented Mar 8, 2023

reylejano commented Mar 8, 2023

rata commented Mar 14, 2023

mickeyboxell commented Mar 21, 2023

rata commented Mar 21, 2023

rata commented Mar 22, 2023

tengqm commented Mar 22, 2023

k8s-ci-robot commented Mar 22, 2023

rata commented Mar 23, 2023 •

edited

Loading

tengqm commented Mar 23, 2023

k8s-ci-robot commented Mar 23, 2023

rata commented Mar 23, 2023

netlify bot commented Mar 27, 2023 •

edited

Loading

rata commented Mar 27, 2023

sftim Mar 27, 2023

rata Mar 27, 2023 •

edited

Loading

rata Mar 27, 2023

rata commented Mar 27, 2023

tengqm commented Mar 31, 2023

k8s-ci-robot commented Mar 31, 2023

	* All the filesystems used in the pod need support for idmap mounts.
	* Every volume that is mounted into any container in the pod must support idmap mounts.

Document user namespace changes in v1.27 (KEP-127) #39860

Document user namespace changes in v1.27 (KEP-127) #39860

Conversation

rata commented Mar 8, 2023

netlify bot commented Mar 8, 2023

✅ Pull request preview available for checking

reylejano commented Mar 8, 2023

rata commented Mar 14, 2023

mickeyboxell commented Mar 21, 2023

rata commented Mar 21, 2023

rata commented Mar 22, 2023

tengqm commented Mar 22, 2023

k8s-ci-robot commented Mar 22, 2023

rata commented Mar 23, 2023 • edited Loading

tengqm commented Mar 23, 2023

k8s-ci-robot commented Mar 23, 2023

rata commented Mar 23, 2023

netlify bot commented Mar 27, 2023 • edited Loading

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

rata commented Mar 27, 2023

sftim Mar 27, 2023

Choose a reason for hiding this comment

rata Mar 27, 2023 • edited Loading

Choose a reason for hiding this comment

rata Mar 27, 2023

Choose a reason for hiding this comment

rata commented Mar 27, 2023

tengqm commented Mar 31, 2023

k8s-ci-robot commented Mar 31, 2023

rata commented Mar 23, 2023 •

edited

Loading

netlify bot commented Mar 27, 2023 •

edited

Loading

rata Mar 27, 2023 •

edited

Loading