KEP-2033: KubeletInUserNamespace: update the template; promote to beta #5388

AkihiroSuda · 2025-06-08T17:35:05Z

One-line PR description: Rootless Kubernetes

Issue link: sig-node: Kubelet-in-UserNS, aka Rootless mode #2033

Other comments: The first commit only updates the template. The actual content is updated in the second commit.

Only the template is updated in this commit. The actual content will be updated in follow-up commits. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

k8s-ci-robot · 2025-06-11T08:30:13Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: AkihiroSuda
Once this PR has been reviewed and has the lgtm label, please assign jpbetz, mrunalp for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

keps/prod-readiness/OWNERS
keps/sig-node/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

AkihiroSuda · 2025-06-11T08:34:42Z

keps/prod-readiness/sig-node/2033.yaml

@@ -1,3 +1,5 @@
 kep-number: 2033
 alpha:
  approver: "@ehashman"
+beta:
+  approver: "@ehashman"


cc @ehashman May I put your name here?

I think you'll need to find a new approver for this. I think ehashman has stepped down from PRR duties.

Use my name, I'll take this one over.

This still holds.

soltysh

There are multiple PRR questions not answered.

soltysh · 2025-06-17T11:08:41Z

keps/sig-node/2033-kubelet-in-userns-aka-rootless/kep.yaml

@@ -15,7 +15,7 @@ reviewers:
  - "@dims"
  - "@sftim"
 approvers:
-  - TBD
+  - "@ehashman"


Elena was approving the PRR section, so she's a separate entry in 2033.yaml. Here you'll need someone who actually approved this document. It seems last time it was Derek, not sure who will be approving it this time, but it has to be someone from sig-node.

soltysh · 2025-06-17T11:10:31Z

keps/sig-node/2033-kubelet-in-userns-aka-rootless/README.md

 - [ ] (R) Production readiness review completed
- [ ] Production readiness review approved
+- [ ] (R) Production readiness review approved


You're targeting a beta release, and thus this functionality will be on by default. I'd expect several of the above be ✔️

soltysh · 2025-06-17T11:15:25Z

keps/prod-readiness/sig-node/2033.yaml

@@ -1,3 +1,5 @@
 kep-number: 2033
 alpha:
  approver: "@ehashman"
+beta:
+  approver: "@ehashman"


This still holds.

soltysh · 2025-06-17T11:18:38Z

keps/sig-node/2033-kubelet-in-userns-aka-rootless/README.md

+extending the production code to implement this enhancement.
+-->
+
+N/A, as unit tests do not make sense here.


Since you're touching kubelet, at minimum I'd expect information about current unit coverage for the affected area.

soltysh · 2025-06-17T11:19:21Z

keps/sig-node/2033-kubelet-in-userns-aka-rootless/README.md

+```
+
+- Prow manifest: https://github.com/kubernetes/test-infra/blob/4b7824ff1cfe00c36062035ab6aea3bb6c2e6ba2/config/jobs/kubernetes/sig-testing/kubernetes-kind.yaml#L615-L678
+- Logs: https://prow.k8s.io/job-history/gs/kubernetes-ci-logs/logs/ci-kubernetes-e2e-kind-rootless


The lack of integration and/or e2e residing in k8s repository makes me worry about the stability of this functionality. How can we ensure this is working correctly, if there are no tests? This introduces a risk that if someone introduces a breaking change we won't notice it until somewhere else that test is being run.

soltysh · 2025-06-17T11:26:56Z

keps/sig-node/2033-kubelet-in-userns-aka-rootless/README.md

+implementation difficulties, etc.).
+-->
+
+N/A


As mentioned above, No - here is perfectly reasonable answer.

soltysh · 2025-06-17T11:27:51Z

keps/sig-node/2033-kubelet-in-userns-aka-rootless/README.md


 No.

-* **Will enabling / using this feature result in non-negligible increase of 
-resource usage (CPU, RAM, disk, IO, ...) in any components?**
+###### Will enabling / using this feature result in increasing time taken by any operations covered by existing SLIs/SLOs?


This is missing answer.

soltysh · 2025-06-17T11:28:04Z

keps/sig-node/2033-kubelet-in-userns-aka-rootless/README.md


 RootlessKit and slirp4netns may face high CPU and memory consumption.

+###### Can enabling / using this feature result in resource exhaustion of some node resources (PIDs, sockets, inodes, etc.)?


Also missing answer.

soltysh · 2025-06-17T11:28:33Z

keps/sig-node/2033-kubelet-in-userns-aka-rootless/README.md

@@ -804,6 +1161,7 @@ Major milestones might include:
 - 2019-11-19: @giuseppe submitted [cgroup v2 KEP](https://github.com/kubernetes/enhancements/pull/1370)
 - 2019-11-19: present KEP to SIG-node (cgroup v2 version)
 - 2020-07-07: the cgroup v2 support is in `implementable` status
+- 2021-08-04: Kubernetes v1.22 (Alpha)


You're missing current update here in the history as well.

soltysh · 2025-06-17T11:28:58Z

keps/sig-node/2033-kubelet-in-userns-aka-rootless/kep.yaml


 # The milestone at which this feature was, or is targeted to be, at each stage.
 milestone:
  alpha: "v1.22"
+  beta: "v1.34"


Below in the doc, you're missing metrics section, see template.

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jun 8, 2025

k8s-ci-robot requested a review from dchen1107 June 8, 2025 17:35

k8s-ci-robot added the kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory label Jun 8, 2025

k8s-ci-robot requested a review from derekwaynecarr June 8, 2025 17:35

k8s-ci-robot added sig/node Categorizes an issue or PR as relevant to SIG Node. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jun 8, 2025

AkihiroSuda mentioned this pull request Jun 8, 2025

sig-node: Kubelet-in-UserNS, aka Rootless mode #2033

Open

12 tasks

This comment was marked as resolved.

Sign in to view

AkihiroSuda added 2 commits June 11, 2025 17:28

KEP-2033: KubeletInUserNamespace: update the template

613bb69

Only the template is updated in this commit. The actual content will be updated in follow-up commits. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

KEP-2033: KubeletInUserNamespace: promote to beta

d078c6b

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

AkihiroSuda force-pushed the rootless2 branch from 0847db2 to d078c6b Compare June 11, 2025 08:30

AkihiroSuda commented Jun 11, 2025

View reviewed changes

soltysh reviewed Jun 17, 2025

View reviewed changes


		RootlessKit and slirp4netns may face high CPU and memory consumption.

		###### Can enabling / using this feature result in resource exhaustion of some node resources (PIDs, sockets, inodes, etc.)?

KEP-2033: KubeletInUserNamespace: update the template; promote to beta #5388

Are you sure you want to change the base?

KEP-2033: KubeletInUserNamespace: update the template; promote to beta #5388

Uh oh!

Conversation

AkihiroSuda commented Jun 8, 2025

Uh oh!

This comment was marked as resolved.

k8s-ci-robot commented Jun 11, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

soltysh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!