Repository navigation
Support User Namespaces in pods #127
Description
Enhancement Description
-
One-line enhancement description (can be used as a release note): Add support for user namespaces in pods
-
Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/127-user-namespaces/README.md
-
Discussion Link: This was discussed in several sig-node meetings, most notable Nov 2 2021 and in this PR, that feedback was incorporated already by this KEP is taking: keps/127: Support User Namespaces #2101.
-
Responsible SIGs: sig-node
-
Enhancement target (which target equals to which milestone):
- Alpha release target (x.y): 1.25
- Beta1 release target (x.y): 1.30
- Beta2 release target (x.y): 1.33
- Stable release target (x.y): 1.36
-
Alpha
- KEP (
k/enhancements) update PR(s):- v1.24 127: Add KEP for user namespaces support #3065
- v1.25 KEP-127: Mark as implementable (target phase I for 1.25) #3275
- v1.27 KEP-127: Support userns in stateless pods with idmap mounts #3811
- v1.28 [KEP-127] Add Pod Security Standards to User Namespaces KEP #4044
- v1.28 KEP-127: add support for stateful pods #4084
- v1.28 KEP-127: Fix user namespaces feature gate name #4107
- v1.28 KEP-127: Update feature gate name and update last-milestone for 1.29 #4147
- Code (
k/k) update PR(s): - Docs (
k/website) update PR(s):
- KEP (
-
Beta 1 （default off）
- KEP (
k/enhancements) update PR(s): - Code (
k/k) update PR(s): - Docs (
k/website) update(s):
- KEP (
-
Beta 2 （default on）
- KEP (
k/enhancements) update PR(s):-
KEP-127: Update userns KEP template to latest and and answer more sections #5141
-
KEP 127: add a metric, describe an error kubelet will return, and target one more beta #5413
-
features: Enable user namespaces by default kubernetes#130138
-
kubelet: config: add userNamespaces.idsPerPod kubernetes#130028
-
userns: Don't special-case windows for the kubelet userns mappings kubernetes#130820.
-
KEP-127: retarget beta to 1.35 and include PSA updates there #5603
- KEP (
-
Code PRs for 1.34:
-
Doc PR for 1.33:
-
1.35 updates (still beta):
-
Stable
- KEP (
k/enhancements) update PR(s): github.com/KEP-127: Let's go GA in 1.36! #5847 - Code (
k/k) update PR(s): feature: Migrate UserNamespacesSupport to GA kubernetes#136792 - Docs (
k/website) update(s): userns: Doc PR for 1.36 website#54371
- KEP (
Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.
Activity
derekwaynecarr commentedon Oct 10, 2016
This work is being done by @pweil- and is reviewed by @derekwaynecarr, it is sponsored by @kubernetes/sig-node
mdshuai commentedon Oct 26, 2016
@derekwaynecarr Could you help create a user story card for this feature?
idvoretskyi commentedon Nov 15, 2016
@derekwaynecarr can you confirm that this feature targets alpha for 1.5?
pweil- commentedon Nov 16, 2016
Yes, this feature is experimental only so it would be considered alpha.
idvoretskyi commentedon Dec 13, 2016
@derekwaynecarr @pweil- can you confirm that this item targets beta in 1.6?
adelton commentedon Nov 14, 2017
@derekwaynecarr, the proposal kubernetes/kubernetes#34569 was closed by bot due to inactivity.
@pweil-, in kubernetes/kubernetes#34569 (comment) you've proposed the approach pweil-/kubernetes@16f29eb which changes the group of
/var/lib/kubelet/podsto the remapped root group. Do I understand it correctly that this is currently not tracked in any pull request?adelton commentedon Nov 14, 2017
@pweil-, I also wonder if similar to docker's
/var/lib/docker/<uid>.<gid>approach when--userns-remapis used, it might make sense to use/var/lib/kubelet/pods-<uid>.<gid>and just chown/chgroup everything in those subdirectories to the remapped<uid>.<gid>. Why did you opt for just the chgrp and not the full chown?576 remaining items
jmickey commentedon May 16, 2026
Hi @rata @giuseppe 👋, v1.36 Enhancements Lead here,
Just doing some end of release cleanup. Given that this KEP has graduated to
stableand the status inkep.yamlhas been updated toimplemented, I will close the issue./remove-label lead-opted-in
/remove-label tracked/yes
/close
k8s-ci-robot commentedon May 16, 2026
@jmickey: Closing this issue.
Details
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.
chore(usernamespaces): drop UserNamespacesSupport feature gate
chore(usernamespaces): drop UserNamespacesSupport feature gate
rata commentedon May 21, 2026
We will completely remove the feature gate in upcoming releases, though. I guess it should still be close? @jmickey
adelton commentedon May 21, 2026
@rata Do you have the
UserNamespacesSupportfeature gate in mind? Is the removal tracked anywhere where folks could watch / follow it?rata commentedon May 21, 2026
Yes and another e2e gate. I'll post the things here, watch here :)
jmickey commentedon May 22, 2026
Hi @rata, once stable the feature gate removal doesn't require tracking by the release team. It becomes the responsibility of the owning SIG to track the 3 release cooldown and eventually removal.
rata commentedon May 22, 2026
Thanks!
agusdallalba commentedon Sep 17, 2026
What happened to this section of the KEP?
PR kubernetes/kubernetes#125198 implemented this behaviour but was closed.
Would it be possible to add a small set of extra allowed capabilities to the baseline + not hostUsers case?
In particular:
SYS_PTRACEto allow users to debug and profile their workloads in the production environment without also giving them full access to the host node.NET_ADMINto allow the cluster operator to debug the network or configure VPNs without giving himself fullprivilegedPod permissions.rata commentedon Sep 18, 2026
@agusdallalba no, the feature is GA. You can propose a new KEP and a new feature gate if you want and drive that.
However, we decided to not allow more capabilities in the PSS with userns. This is because even though is much safer than allowing them on the host,it is still not safer that not allowing them (you could potentially trigger use after free bugs and gain more privs, etc.). Sig auth was concerned with that. This way, also, userns is a net win (it's always safer than without).