127: Add KEP for user namespaces support

[rata]

Here is the high level work we discussed during Nov 2 SIG-node meeting.

Let me know if this KEP effectively reflects what we discussed and IIUC agreed. I'd like to know of any concerns or show-stoppers ASAP rather than last minute, after we already worked a lot of time on this.

If there are no concerns and this plan is agreed by all parties and this is merged, with @giuseppe we will start a PoC implementation to fill-in the rest of the details this KEP needs (CRI changes, etc.).

To the best of my knowledge, this incorporates all the feedback in the PR #2101 that @thockin @mtaufen and others gave (see basically that almost all is automatic and the room for improvements in phase 3, in particular the per-sa/per-ns strategies are in scope, with some others).

Please let us know what you think and thanks again for your time! :)

Tagging people that might want to get their eyes on this:
@giuseppe @mrunalp @derekwaynecarr @endocrimes @rhatdan @alban @mauriciovasquezbernal

I created this with @giuseppe, who has already reviewed this.

Bellow c&p from the commit msg (see the slides linked below for a quick overview, if you prefer that! :)).

---

This commit adds the high level overview I proposed in the SIG-node
meeting on Nov 2. The work divided in phases and intial support (phase 1
and 2) is disentangled from further improvements that community members
wanted to see (phase 3).

This incorporates the valuable feedback in the discussion at PR #2101,
making things as automatic as possible and adding a phase 3 for such
improvements, while it also leaves room for future improvements too.

Slides used in the Nov 2 SIG-node meeting are here:
https://docs.google.com/presentation/d/1z4oiZ7v4DjWpZQI2kbFbI8Q6botFaA07KJYaKA-vZpg/edit#slide=id.gc6f73a04f_0_0

Closes: #2101

Signed-off-by: Rodrigo Campos rodrigo@kinvolk.io

---

• One-line PR description: Add user namespaces KEP with its skeleton and phases

• Issue link:

• Other comments:

[rata]

I want to highlight this. I'd like the different pod.spec changes to graduate separate, so phase 1&2 can be in GA but phase 3 still in alpha/beta, as we gather more info and feedback (phase 3 will probably need quite a lot of feedback, I don't want that to block the progress of the rest of the features)

[mrunalp]

That will be through separate feature flags, right? Do we have proposed names? If we don't have one for later phases, we should call it out as a TBD.

[ddebroy]

A couple of thoughts to have a broader set of volume types - especially CSI plugin backed volumes - considered in Phase 1.

[rata]

@ehashman Can we move this to "Needs reviewer"? I've answered all the open comments and my understanding from the last SIG-node meeting is that I'm waiting on @mrunalp and @derekwaynecarr to take a closer look. And I will ping @thockin and @mtaufen too.

[rata]

Added @SergeyKanzhelev as reviewer now, as he asked me to do in the last sig-node meeting :)

[mtaufen]

Thanks @rata for writing this up. The overall breakdown looks good and I'm eager to see this work get started, so all the low level/behind the scenes groundwork can make progress as you mentioned.

It looks like there are maybe still some details to fill out in the KEP but this LGTM as a high level plan of how to approach the work.

[rata]

@mtaufen Thanks a lot for the review!

@ehashman can we move this to needs review? (as I mentioned here #3065 (comment)). A review from @mrunalp and @derekwaynecarr is pending. @thockin also told me on slack that he will review during this break, hopefully :)

[mrunalp]

This is looking fine to me overall for phase 1. I left a few nits.

[rata]

@SergeyKanzhelev @mrunalp thanks! We have addressed all the review comments. PTAL, let me know if anything is missing to merge this in with status provisional

[SergeyKanzhelev]

/lgtm

thank you. I think it has enough information to kick off the phase 1

[mrunalp]

/lgtm
I think we have enough for Phase 1. Thanks!

[giuseppe]

could we get /approve as well? :-)

/assign @derekwaynecarr

[mrunalp]

nit: Do you want to rename this back to UserNamespacesSupport as discussed in the thread before merge?

[rata]

Oh, sure. I didn't do it in case pushing will lose the LGTM (I'm not sure what is the config on this repo). Will push in a few minutes :)

[rata]

Yeap, we lost the lgtm label with the push :(

[rata]

@mrunalp pushed changing only the gate-feature name as you requested. Can you LGTM again? :)

[mrunalp]

/lgtm

[rata]

@derekwaynecarr ? :)

[derekwaynecarr]

Phase 1 looks great.

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: derekwaynecarr, rata, SergeyKanzhelev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• keps/sig-node/OWNERS [derekwaynecarr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment