Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for user namespaces phase 1 (KEP 127) #111090

Merged
merged 12 commits into from Aug 3, 2022
Merged

Add support for user namespaces phase 1 (KEP 127) #111090

merged 12 commits into from Aug 3, 2022
+2,763 −947

Commits on Aug 2, 2022

  1. volume: use the effective uid 

    Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
    @giuseppe
    giuseppe committed Aug 2, 2022
    Configuration menu
    Copy the full SHA
    eee5fa8 View commit details
    Browse the repository at this point in the history

  2. pkg/apis, staging: add HostUsers to pod spec 

    It is used to request that a pod runs in a unique user namespace.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
Co-authored-by: Rodrigo Campos <rodrigoca@microsoft.com>
    @giuseppe @rata
    giuseppe and rata committed Aug 2, 2022
    Configuration menu
    Copy the full SHA
    9e9b23f View commit details
    Browse the repository at this point in the history

Commits on Aug 3, 2022

  1. features: add UserNamespacesSupport feature 

    define a feature gate for the user namespaces support.  The feature is
not enabled by default.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
    @giuseppe @rata
    giuseppe authored and rata committed Aug 3, 2022
    Configuration menu
    Copy the full SHA
    482e76d View commit details
    Browse the repository at this point in the history

  2. apis: add validation for HostUsers 

    This commit just adds a validation according to KEP-127. We check that
only the supported volumes for phase 1 of the KEP are accepted.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
    @rata
    rata committed Aug 3, 2022
    Configuration menu
    Copy the full SHA
    cf8164b View commit details
    Browse the repository at this point in the history

  3. kubelet: add userns manager 

    it is used to allocate and keep track of the unique users ranges
assigned to each pod that runs in a user namespace.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
Co-authored-by: Rodrigo Campos <rodrigoca@microsoft.com>
    @giuseppe @rata
    giuseppe and rata committed Aug 3, 2022
    Configuration menu
    Copy the full SHA
    6346228 View commit details
    Browse the repository at this point in the history

  4. kubelet: add GetUserNamespaceMappings to RuntimeHelper 

    Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
    @giuseppe @rata
    giuseppe authored and rata committed Aug 3, 2022
    Configuration menu
    Copy the full SHA
    9b2fc63 View commit details
    Browse the repository at this point in the history

  5. kubelet: add GetHostIDsForPod() 

    In future commits we will need this to set the user/group of supported
volumes of KEP 127 - Phase 1.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
    @rata
    rata committed Aug 3, 2022
    Configuration menu
    Copy the full SHA
    d07c268 View commit details
    Browse the repository at this point in the history

  6. volume: use GetHostIDsForPod() 

    This commit only changes the UID/GID if user namespaces is enabled. When
it is enabled, it changes it so the hostUID and hostGID that are mapped
to the currently used UID/GID. This is needed so volumes are created
with the hostUID/hostGID and the user inside the container can read
them.

If user namespaces are disabled for this pod, this is a no-op: there is
no user namespace mapping, so the hostUID/hostGID are the same as inside
the container.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
    @rata
    rata committed Aug 3, 2022
    Configuration menu
    Copy the full SHA
    695b30e View commit details
    Browse the repository at this point in the history

  7. kubelet: propagate errors from namespacesForPod 

    it is a preparatory change for the next commit.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
    @giuseppe @rata
    giuseppe authored and rata committed Aug 3, 2022
    Configuration menu
    Copy the full SHA
    67b38ff View commit details
    Browse the repository at this point in the history

  8. kubelet: set user namespace options 

    Set the user namespace options to use for the pod.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
    @rata
    rata committed Aug 3, 2022
    Configuration menu
    Copy the full SHA
    138e808 View commit details
    Browse the repository at this point in the history

  9. tests: add e2e tests for userns 

    Co-authored-by: Rodrigo Campos <rodrigoca@microsoft.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
    @giuseppe @rata
    giuseppe and rata committed Aug 3, 2022
    Configuration menu
    Copy the full SHA
    b1eaf6a View commit details
    Browse the repository at this point in the history

  10. Update autogenerated files 

    Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
    @rata
    rata committed Aug 3, 2022
    Configuration menu
    Copy the full SHA
    8dc98c9 View commit details
    Browse the repository at this point in the history