Default host user namespace via experimental flag #31169

pweil- · 2016-08-22T22:03:10Z

@vishh @ncdc @pmorie @smarterclayton @thockin

Initial thought on the implementation #30684 (comment) wasn't quite right. Since we need to dereference a PVC in some cases the defaulting code didn't fit nicely in the docker manager code (would've coupled it with a kube client and would've been messy). I think passing this in via the runtime config turned out cleaner. PTAL

This change is

smarterclayton · 2016-08-23T02:07:21Z

cmd/kubelet/app/options/options.go

@@ -211,4 +211,7 @@ func (s *KubeletServer) AddFlags(fs *pflag.FlagSet) {
 	fs.StringVar(&s.EvictionMinimumReclaim, "eviction-minimum-reclaim", s.EvictionMinimumReclaim, "A set of minimum reclaims (e.g. imagefs.available=2Gi) that describes the minimum amount of resource the kubelet will reclaim when performing a pod eviction if that resource is under pressure.")
 	fs.Int32Var(&s.PodsPerCore, "pods-per-core", s.PodsPerCore, "Number of Pods per core that can run on this Kubelet. The total number of Pods on this Kubelet cannot exceed max-pods, so max-pods will be used if this calculation results in a larger number of Pods allowed on the Kubelet. A value of 0 disables this limit.")
 	fs.BoolVar(&s.ProtectKernelDefaults, "protect-kernel-defaults", s.ProtectKernelDefaults, "Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than kubelet defaults.")
+
+	// experimental flags
+	fs.BoolVar(&s.ExperimentalHostUserNamespaceDefaulting, "experimental-host-user-namespace-defaulting", s.ExperimentalHostUserNamespaceDefaulting, "Default the value for UsernsMode for containers that are using other host namespaces, host mounts, or specific non-namespaced capabilities (MKNOD, SYS_MODULE, SYS_TIME). This should only be enabled is user namespace remapping is enabled in the docker daemon. [default=false]")


In the comment, explain what you are defaulting the value to. This description did not explain it.

pmorie · 2016-08-23T12:41:09Z

pkg/apis/componentconfig/types.go

@@ -415,6 +415,9 @@ type KubeletConfiguration struct {
 	// iptablesDropBit is the bit of the iptables fwmark space to use for dropping packets. Kubelet will ensure iptables mark and drop rules.
 	// Values must be within the range [0, 31]. Must be different from IPTablesMasqueradeBit
 	IPTablesDropBit int32 `json:"iptablesDropBit"`
+	// experimentalHostUserNamespaceDefaulting is an experimental flag to enable defaulting of the UsernsMode for
+	// a container.


Comment about this requiring remapping to be enabled in the daemon (or, ahem, container runtime?)

pmorie · 2016-08-23T12:59:28Z

pkg/kubelet/kubelet_pods.go

+limitations under the License.
+*/
+
+package kubelet


note to other reviewers: I asked @pweil- to name this file as such, going to put a ton of other stuff into it in a planned refactor.

pmorie · 2016-08-23T13:01:10Z

This LGTM, I'll give others a chance to chime in.

pmorie · 2016-08-23T13:05:27Z

@smarterclayton @thockin is this going to be 1.4?

k8s-ci-robot · 2016-11-07T16:30:30Z

Jenkins GCE e2e failed for commit bdbdcdfd660e80cdcdc503e725ef2c30e4364bc3. Full PR test history.

The magic incantation to run this job again is @k8s-bot cvm gce e2e test this. Please help us cut down flakes by linking to an open flake issue when you hit one in your PR.

pweil- · 2016-11-07T17:33:25Z

@k8s-bot cvm gce e2e test this

pweil- · 2016-11-07T19:10:03Z

rebased tests are green again, care to re-apply LGTM?

@smarterclayton @derekwaynecarr

pweil- · 2016-11-07T19:10:36Z

@vishh ^

pweil- · 2016-11-08T12:57:22Z

@vishh bump

pweil- · 2016-11-08T13:02:16Z

@saad-ali FYI this has had LGTM and has been in rebase cycles since (if you need to do any release czar maintenance)

saad-ali · 2016-11-08T20:27:35Z

@saad-ali FYI this has had LGTM and has been in rebase cycles since (if you need to do any release czar maintenance)

Ack. Thanks for the heads up. Are there any concerns about this PR in terms of risk to the 1.5 release? I see that the initial plan was to get it merged early in the 1.5 dev cycle to give it time to bake.

vishh · 2016-11-08T20:30:58Z

Saad, this PR is expected to be turned off by default. So from a risk
perspective, it should be low.

On Tue, Nov 8, 2016 at 12:27 PM, Saad Ali notifications@github.com wrote:

@saad-ali https://github.com/saad-ali FYI this has had LGTM and has
been in rebase cycles since (if you need to do any release czar maintenance)

Ack. Thanks for the heads up. Are there any concerns about this PR in
terms of risk to the 1.5 release? I see that the initial plan was to get it
merged early in the 1.5 dev cycle to give it time to bake.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#31169 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AGvIKEq31lgRSY-p5m22zJLbQlGEvFMIks5q8NtOgaJpZM4JqWln
.

pweil- · 2016-11-08T20:31:49Z

Saad, this PR is expected to be turned off by default. So from a risk
perspective, it should be low.

Agree, the feature is guarded by a feature gate and is turned off by default

saad-ali · 2016-11-08T21:55:11Z

Saad, this PR is expected to be turned off by default. So from a risk
perspective, it should be low.

Agree, the feature is guarded by a feature gate and is turned off by default

Great, thanks.

deads2k · 2016-11-09T13:39:42Z

Saad, this PR is expected to be turned off by default. So from a risk
perspective, it should be low.
Agree, the feature is guarded by a feature gate and is turned off by default
Great, thanks.

Looks like this has approval. Retagging.

k8s-ci-robot · 2016-11-09T14:30:25Z

Jenkins unit/integration failed for commit bdbdcdfd660e80cdcdc503e725ef2c30e4364bc3. Full PR test history.

The magic incantation to run this job again is @k8s-bot unit test this. Please help us cut down flakes by linking to an open flake issue when you hit one in your PR.

k8s-ci-robot · 2016-11-09T14:34:26Z

Jenkins GCE Node e2e failed for commit bdbdcdfd660e80cdcdc503e725ef2c30e4364bc3. Full PR test history.

The magic incantation to run this job again is @k8s-bot node e2e test this. Please help us cut down flakes by linking to an open flake issue when you hit one in your PR.

dims · 2016-11-14T17:38:17Z

@deads2k @saad-ali - looks like one of you have to reapply lgtm tag as the bot removed it

pweil- · 2016-11-14T17:45:45Z

@deads2k @saad-ali - looks like one of you have to reapply lgtm tag as the bot removed it

yes, please. PR needed rebase. Thanks!

k8s-github-robot · 2016-11-14T18:28:29Z

@k8s-bot test this [submit-queue is verifying that this PR is safe to merge]

k8s-github-robot · 2016-11-14T19:04:48Z

Automatic merge from submit-queue

googlebot added the cla: yes label Aug 22, 2016

pweil- mentioned this pull request Aug 22, 2016

Support host user namespace #30684

Closed

thockin assigned vishh Aug 22, 2016

k8s-github-robot added kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API size/L Denotes a PR that changes 100-499 lines, ignoring generated files. release-note-label-needed labels Aug 22, 2016

pweil- force-pushed the userns-experimental branch from 8a3a18b to 88ed698 Compare August 22, 2016 23:04

k8s-github-robot mentioned this pull request Aug 22, 2016

[k8s.io] ScheduledJob should not schedule new jobs when ForbidConcurrent {Kubernetes e2e suite} #30549

Closed

pweil- force-pushed the userns-experimental branch from 88ed698 to 5782fab Compare August 22, 2016 23:33

k8s-github-robot mentioned this pull request Aug 23, 2016

[k8s.io] Probing container should *not* be restarted with a /healthz http liveness probe [Conformance] {E2eNode Suite} #30714

Closed

pweil- force-pushed the userns-experimental branch 2 times, most recently from 38887ff to 11725e4 Compare August 23, 2016 00:48

smarterclayton reviewed Aug 23, 2016
View reviewed changes

k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 23, 2016

pweil- force-pushed the userns-experimental branch from 11725e4 to 19a2293 Compare August 23, 2016 12:18

pmorie reviewed Aug 23, 2016
View reviewed changes

pweil- force-pushed the userns-experimental branch 3 times, most recently from c675e0d to 8dfdec5 Compare August 23, 2016 12:50

pmorie reviewed Aug 23, 2016
View reviewed changes

pmorie added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Aug 23, 2016

k8s-github-robot removed the release-note-label-needed label Aug 23, 2016

pweil- force-pushed the userns-experimental branch from 8dfdec5 to 6e31039 Compare August 23, 2016 13:09

pweil- force-pushed the userns-experimental branch from e95d29b to bdbdcdf Compare November 7, 2016 15:21

deads2k added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 9, 2016

k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 10, 2016

experimental host user ns defaulting

d0d78f4

pweil- force-pushed the userns-experimental branch from bdbdcdf to d0d78f4 Compare November 14, 2016 16:12

k8s-github-robot removed lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Nov 14, 2016

smarterclayton added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 14, 2016

k8s-github-robot merged commit c76fe8d into kubernetes:master Nov 14, 2016

chentao1596 mentioned this pull request Dec 5, 2016

WIP:kubelet: support multi-headers when getting pod from HTTP source #38089

Closed

piascikj mentioned this pull request Nov 3, 2017

https://github.com/kubernetes/kubernetes/pull/31169 provides experimental imdone/kubernetes#943

Open

Quentin-M mentioned this pull request Apr 12, 2018

Support User Namespaces in pods kubernetes/enhancements#127

Open

26 tasks

github-actions bot mentioned this pull request Dec 14, 2020

https://github.com/kubernetes/kubernetes/pull/31169 provides experimental pacoxu/kubernetes#344

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Default host user namespace via experimental flag #31169

Default host user namespace via experimental flag #31169

pweil- commented Aug 22, 2016 •

edited by k8s-oncall

smarterclayton Aug 23, 2016

pmorie Aug 23, 2016

pmorie Aug 23, 2016

pmorie commented Aug 23, 2016

pmorie commented Aug 23, 2016

k8s-ci-robot commented Nov 7, 2016

pweil- commented Nov 7, 2016

pweil- commented Nov 7, 2016

pweil- commented Nov 7, 2016

pweil- commented Nov 8, 2016

pweil- commented Nov 8, 2016

saad-ali commented Nov 8, 2016

vishh commented Nov 8, 2016

pweil- commented Nov 8, 2016

saad-ali commented Nov 8, 2016

deads2k commented Nov 9, 2016

k8s-ci-robot commented Nov 9, 2016

k8s-ci-robot commented Nov 9, 2016

dims commented Nov 14, 2016

pweil- commented Nov 14, 2016

k8s-github-robot commented Nov 14, 2016

k8s-github-robot commented Nov 14, 2016

Default host user namespace via experimental flag #31169

Default host user namespace via experimental flag #31169

Conversation

pweil- commented Aug 22, 2016 • edited by k8s-oncall

smarterclayton Aug 23, 2016

Choose a reason for hiding this comment

pmorie Aug 23, 2016

Choose a reason for hiding this comment

pmorie Aug 23, 2016

Choose a reason for hiding this comment

pmorie commented Aug 23, 2016

pmorie commented Aug 23, 2016

k8s-ci-robot commented Nov 7, 2016

pweil- commented Nov 7, 2016

pweil- commented Nov 7, 2016

pweil- commented Nov 7, 2016

pweil- commented Nov 8, 2016

pweil- commented Nov 8, 2016

saad-ali commented Nov 8, 2016

vishh commented Nov 8, 2016

pweil- commented Nov 8, 2016

saad-ali commented Nov 8, 2016

deads2k commented Nov 9, 2016

k8s-ci-robot commented Nov 9, 2016

k8s-ci-robot commented Nov 9, 2016

dims commented Nov 14, 2016

pweil- commented Nov 14, 2016

k8s-github-robot commented Nov 14, 2016

k8s-github-robot commented Nov 14, 2016

pweil- commented Aug 22, 2016 •

edited by k8s-oncall