kubeadm: deprecate the RootlessControlPlane feature gate

[neolit123]

What type of PR is this?

/kind deprecation

What this PR does / why we need it:

The feature was left in alpha for a few releases, since k8s started planning on a broader feature UserNamespacesSupport, which is what kubeadm should integrate with.

UserNamespacesSupport graduated to beta in 1.30.
Once it graduates to GA kubeadm can start using it an remove RootlessControlPlane.

Which issue(s) this PR fixes:

xref kubernetes/kubeadm#2473 (comment)

Special notes for your reviewer:

Does this PR introduce a user-facing change?

kubeadm: deprecated the kubeadm `RootlessControlPlane` feature gate (previously alpha), given that the core K8s `UserNamespacesSupport` feature gate graduated to Beta in 1.30.
Once core Kubernetes support for user namespaces is generally available and kubeadm has started to support running the control plane in userns pods, the kubeadm `RootlessControlPlane` feature gate will be removed entirely.
Until kubeadm supports the userns functionality out of the box, users can continue using the deprecated  `RootlessControlPlane` feature gate, or  opt-in `UserNamespacesSupport` by using kubeadm patches on the static pod manifests.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[neolit123]

/triage accepted
/priority important-soon
/cc @pacoxu

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: neolit123

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/kubeadm/OWNERS [neolit123]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sftim]

Changelog suggestion

-kubeadm; deprecate the kubeadm RootlessControlPlane feature gate, as the core k8s UserNamespacesSupport feature gate graduated to Beta in 1.30. RootlessControlPlane will be removed once UserNamespacesSupport graduates to GA and kubeadm starts using it.
+kubeadm: deprecated the kubeadm `RootlessControlPlane` feature gate (previously alpha), given that the core K8s `UserNamespacesSupport` feature gate graduated to Beta in 1.30.
+Once core Kubernetes support for user namespaces is generally available and kubeadm has started to support running the control plane in userns pods, the kubeadm `RootlessControlPlane` feature gate will be removed entirely.

However, this implies that kubeadm doesn't support user namespaces yet, and people might also infer that having a control plane running as non-root is now deprecated.
Are we intending for people to run the control plane as a root user but inside a Pod using a user namespace? To me, the changelog entry isn't clear.

[neolit123]

Changelog suggestion

updated.

However, this implies that kubeadm doesn't support user namespaces yet, and people might also infer that having a control plane running as non-root is now deprecated.
Are we intending for people to run the control plane as a root user but inside a Pod using a user namespace? To me, the changelog entry isn't clear.

users can continue using the deprecated kubeadm feature RootlessControlPlane until it's removed.
alternatively, they can use kubeadm patches to opt-in userns with UserNamespacesSupport .

added one more sentance to clarify this in the release note:

Until kubeadm supports the userns functionality out of the box, users can continue using the deprecated RootlessControlPlane feature gate, or opt-in UserNamespacesSupport by using kubeadm patches on the static pod manifests.

[pacoxu]

+1 for this
/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: c8507d9fa6e283206b83ad29b8ecb422cbb73b34