[release/1.7] Throw an error if the kubelet requests mounts with uid/gid mappings #8211

rata · 2023-03-06T12:42:03Z

This is a backport of #8376 to the 1.7 release branch (the only release with userns support, so the only one affected).

Please note I cherry-pick -x commit "cri: Throw an error if idmap mounts is requested", but manually did the vendor again (instead of cherry.picking) because there are other differences in the go modules.

k8s-ci-robot · 2023-03-06T12:42:13Z

Hi @rata. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rata · 2023-03-17T16:41:57Z

The k8s PR has been merged, so I've updated this to do the proper vendoring and mark it ready for review.

I've opened it against branch 1.7, as that is where we need this (see #8209 for more info). I'll open a draft PR that relies on runc 1.2 for the main branch, to properly handle idmap mounts.

cc @fuweid as you were active in the issue and userns support PRs.

dims · 2023-03-29T01:56:06Z

/ok-to-test

rata · 2023-04-03T14:05:43Z

Friendly ping?

estesp

LGTM

rata · 2023-04-11T10:51:10Z

ping?

@estesp thanks! Can you maybe get another maintainer to review this too? :)

fuweid · 2023-04-11T10:53:33Z

sorry for missing the mention. Did we have pr to main branch? @rata

rata · 2023-04-11T10:59:49Z

@fuweid no, for main I've just opened a PR handling idmap mounts for volumes (in draft as it depends on runc merging another PR, containerd PR is: #8287).

Shall I make another PR like this to main and then undo it when we merge #8287 ?

fuweid · 2023-04-11T14:28:30Z

@rata We usually don't apply patch to release branch directly. Hope you don't mind.

I think you can just file a similar pr X to main branch so that we can know that this pr 8211 is cherry-picked from X. So the steps are

merge X to main
cherry-pick X to [release/1.7] Throw an error if the kubelet requests mounts with uid/gid mappings #8211 and merge it to release/1.7
rebase main to Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27) #8287

Sounds good to you?

BTW, this patch looks good to me.

rata · 2023-04-11T15:18:53Z

Perfect, will do that then. Thanks!

rata · 2023-04-11T15:37:50Z

@fuweid created the PR to main: #8376 PTAL :)

rata · 2023-04-11T16:18:53Z

Switching to draft until the one in main is merged, then I'll cherry-pick -x if the merge method changes the hash and switch it to ready for review

We will use this in future commits to see if the kubelet requested idmap mounts for volumes, that we don't yet support. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

We need support in containerd and the OCI runtime to use idmap mounts. Let's just throw an error for now if the kubelet requests some mounts with mappings. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com> (cherry picked from commit 7e6ab84)

rata · 2023-04-13T09:03:22Z

@fuweid thanks! I updated this PR now with the cherry-pick, PTAL

fuweid

LGTM

rata · 2023-04-13T16:07:20Z

Two LGTM are enough? Or do we want to re-review as technically although the code hasn't changed, now the commit was cherr-picked?

fuweid · 2023-04-14T01:34:51Z

ping @AkihiroSuda @dmcgowan

fuweid · 2023-04-14T16:01:56Z

Hi @rata after change, it still needs two LGTMs.

ping @dims @mikebrow ~

AkihiroSuda · 2023-04-19T09:02:15Z

go.mod

@@ -77,7 +77,7 @@ require (
 	k8s.io/apiserver v0.26.2
 	k8s.io/client-go v0.26.2
 	k8s.io/component-base v0.26.2
-	k8s.io/cri-api v0.26.2
+	k8s.io/cri-api v0.27.0-beta.0


Non-beta might be preferable, but can be bumped up later

As requested by Akihiro Suda here: containerd#8211 (comment) This just bumps the tag name to the k8s final release. There are no changes other than the tag name, though. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

As requested by Akihiro Suda here: containerd#8211 (comment) This just bumps the tag name to the k8s final release. There are no changes other than the tag name, though. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com> (cherry picked from commit 92b93e3)

As requested by Akihiro Suda here: containerd#8211 (comment) This just bumps the tag name to the k8s final release. There are no changes other than the tag name, though. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

k8s-ci-robot added the needs-ok-to-test label Mar 6, 2023

rata mentioned this pull request Mar 6, 2023

Pass uid/gid mappings to OCI runtime #8210

Closed

rata force-pushed the rata/userns-stateless-idmap-error branch from 9d5c3d2 to 1e4e9fe Compare March 6, 2023 15:33

rata force-pushed the rata/userns-stateless-idmap-error branch from 1e4e9fe to fb937d8 Compare March 17, 2023 15:02

rata changed the base branch from main to release/1.7 March 17, 2023 15:03

rata force-pushed the rata/userns-stateless-idmap-error branch from fb937d8 to a86c0e3 Compare March 17, 2023 16:34

rata marked this pull request as ready for review March 17, 2023 16:38

rata changed the title ~~Thow an error if the kubelet requests mounts with uid/gid mappings~~ [release/1.7] Thow an error if the kubelet requests mounts with uid/gid mappings Mar 20, 2023

estesp approved these changes Apr 3, 2023

View reviewed changes

rata mentioned this pull request Apr 11, 2023

Thow an error if the kubelet requests mounts with uid/gid mappings #8376

Merged

rata marked this pull request as draft April 11, 2023 16:18

rata added 2 commits April 13, 2023 10:58

cri: Vendor v0.27.0-beta.0 for mounts uid/gid mappings

75ac7e0

We will use this in future commits to see if the kubelet requested idmap mounts for volumes, that we don't yet support. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

rata force-pushed the rata/userns-stateless-idmap-error branch from a86c0e3 to 7de8629 Compare April 13, 2023 09:00

rata marked this pull request as ready for review April 13, 2023 09:03

fuweid changed the title ~~[release/1.7] Thow an error if the kubelet requests mounts with uid/gid mappings~~ [release/1.7] Throw an error if the kubelet requests mounts with uid/gid mappings Apr 13, 2023

fuweid approved these changes Apr 13, 2023

View reviewed changes

rata requested a review from estesp April 14, 2023 16:55

AkihiroSuda reviewed Apr 19, 2023

View reviewed changes

AkihiroSuda approved these changes Apr 19, 2023

View reviewed changes

AkihiroSuda merged commit 7dd7a09 into containerd:release/1.7 Apr 19, 2023
47 checks passed

rata deleted the rata/userns-stateless-idmap-error branch April 24, 2023 10:14

rata mentioned this pull request Apr 24, 2023

cri: Vendor v0.27.1 #8437

Merged

rata mentioned this pull request Apr 25, 2023

[release/1.7] cri: Vendor v0.27.1 #8444

Merged

kiashok mentioned this pull request May 5, 2023

[release/1.7] Prepare release notes for v1.7.1 #8479

Closed

dmcgowan mentioned this pull request May 9, 2023

[release/1.7] Prepare release notes for v1.7.1 #8501

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[release/1.7] Throw an error if the kubelet requests mounts with uid/gid mappings #8211

[release/1.7] Throw an error if the kubelet requests mounts with uid/gid mappings #8211

rata commented Mar 6, 2023 •

edited

k8s-ci-robot commented Mar 6, 2023

rata commented Mar 17, 2023

dims commented Mar 29, 2023

rata commented Apr 3, 2023

estesp left a comment

rata commented Apr 11, 2023 •

edited

fuweid commented Apr 11, 2023

rata commented Apr 11, 2023

fuweid commented Apr 11, 2023 •

edited

rata commented Apr 11, 2023

rata commented Apr 11, 2023

rata commented Apr 11, 2023

rata commented Apr 13, 2023

fuweid left a comment

rata commented Apr 13, 2023

fuweid commented Apr 14, 2023

fuweid commented Apr 14, 2023

AkihiroSuda Apr 19, 2023

[release/1.7] Throw an error if the kubelet requests mounts with uid/gid mappings #8211

[release/1.7] Throw an error if the kubelet requests mounts with uid/gid mappings #8211

Conversation

rata commented Mar 6, 2023 • edited

k8s-ci-robot commented Mar 6, 2023

rata commented Mar 17, 2023

dims commented Mar 29, 2023

rata commented Apr 3, 2023

estesp left a comment

Choose a reason for hiding this comment

rata commented Apr 11, 2023 • edited

fuweid commented Apr 11, 2023

rata commented Apr 11, 2023

fuweid commented Apr 11, 2023 • edited

rata commented Apr 11, 2023

rata commented Apr 11, 2023

rata commented Apr 11, 2023

rata commented Apr 13, 2023

fuweid left a comment

Choose a reason for hiding this comment

rata commented Apr 13, 2023

fuweid commented Apr 14, 2023

fuweid commented Apr 14, 2023

AkihiroSuda Apr 19, 2023

Choose a reason for hiding this comment

rata commented Mar 6, 2023 •

edited

rata commented Apr 11, 2023 •

edited

fuweid commented Apr 11, 2023 •

edited