Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

BUILD-596: set HostUsers=false for unprivileged build pods + UserNamespaces #245

Closed
wants to merge 1 commit into from
Closed

BUILD-596: set HostUsers=false for unprivileged build pods + UserNamespaces #245

wants to merge 1 commit into from

Conversation

nalind
Copy link
Member

@nalind nalind commented Oct 11, 2022

If the UserNamespacesStatelessPodsSupport feature is enabled (known in 1.25 and later, since kubernetes/kubernetes#111090), set HostUsers=false for unprivileged build pod specs, in addition to continuing to set the non-standardized annotation that older versions of CRI-O could be configured to accept instead.

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 11, 2022
@nalind nalind force-pushed the hostusers branch 2 times, most recently from 5dd0aaa to 4bcc5bb Compare October 21, 2022 14:39
@nalind
Copy link
Member Author

nalind commented Oct 21, 2022

/test e2e-aws-ovn-upgrade

@nalind nalind changed the title WIP: HostUsers=false for unprivileged build pods + UserNamespaces Set HostUsers=false for unprivileged build pods + UserNamespaces Oct 21, 2022
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 21, 2022
@nalind
Copy link
Member Author

nalind commented Oct 21, 2022

/retest-required

@openshift-bot
Copy link
Contributor

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 20, 2023
@nalind
Copy link
Member Author

nalind commented Jan 20, 2023

/remove-lifecycle stale

@openshift-ci openshift-ci bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 20, 2023
@openshift-bot
Copy link
Contributor

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 21, 2023
@nalind
Copy link
Member Author

nalind commented Apr 24, 2023

/remove-lifecycle stale

@openshift-ci openshift-ci bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 24, 2023
@coreydaley
Copy link
Member

@nalind Is this ready for review?

@nalind
Copy link
Member Author

nalind commented Apr 24, 2023

Yep, holler if it needs a rebase.

@coreydaley
Copy link
Member

/assign @coreydaley
for lgtm

@coreydaley
Copy link
Member

/approve
/lgtm

@openshift-ci openshift-ci bot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Apr 24, 2023
@coreydaley
Copy link
Member

/label px-approved
/label docs-approved
/label qe-approved

@openshift-ci openshift-ci bot added px-approved Signifies that Product Support has signed off on this PR docs-approved Signifies that Docs has signed off on this PR labels Apr 27, 2023
@coreydaley
Copy link
Member

@nalind It looks like you need to setup a bug in JIRA for this to be merged (and possibly backported?)

@openshift-ci openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Apr 27, 2023
@nalind nalind changed the title Set HostUsers=false for unprivileged build pods + UserNamespaces BUILD-596: set HostUsers=false for unprivileged build pods + UserNamespaces Apr 27, 2023
@openshift-ci openshift-ci bot removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 8, 2023
@nalind nalind force-pushed the hostusers branch 2 times, most recently from 95db506 to ce3c97b Compare August 9, 2023 15:43
@nalind
Copy link
Member Author

nalind commented Aug 9, 2023

Renamed a number of fields to be clear when we're talking about setting a field to false.

@nalind
Set HostUsers=false for unprivileged build pods + UserNamespaces
12da032 
If the UserNamespacesStatelessPodsSupport feature is enabled, set
HostUsers=false for unprivileged build pods, in addition to the
non-standardized annotation that older versions of CRI-O could be
configured to accept instead.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Aug 31, 2023 •
edited

@nalind: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-gcp-builds 78180de link true /test e2e-gcp-builds
ci/prow/e2e-aws-proxy 78180de link false /test e2e-aws-proxy
ci/prow/openshift-e2e-aws-builds-techpreview 78180de link false /test openshift-e2e-aws-builds-techpreview
ci/prow/e2e-aws-upgrade 78180de link true /test e2e-aws-upgrade

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@nalind
Copy link
Member Author

nalind commented Aug 31, 2023

/test e2e-aws-ovn-proxy

@nalind
Copy link
Member Author

nalind commented Aug 31, 2023

/retest

@nalind
Copy link
Member Author

nalind commented Aug 31, 2023

@coreydaley PTAL

@coreydaley
Copy link
Member

/approve
/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 6, 2023
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Sep 6, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: coreydaley, nalind

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 6, 2023
@nalind
Copy link
Member Author

nalind commented Sep 13, 2023

Holding because https://kubernetes.io/blog/2023/09/13/userns-alpha/ notes that the feature gate is being renamed in 1.28, and I don't think this is getting merged until 4.15 at least.
/hold

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 13, 2023
@openshift-bot
Copy link
Contributor

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 13, 2023
@openshift-bot
Copy link
Contributor

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

@openshift-ci openshift-ci bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Jan 12, 2024
@coreydaley
Copy link
Member

/unassign
/assign @sayan-biswas

@openshift-ci openshift-ci bot assigned sayan-biswas and unassigned coreydaley Feb 4, 2024
@openshift-bot
Copy link
Contributor

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 5, 2024
@openshift-merge-robot
Copy link
Contributor

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot closed this Mar 5, 2024
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Mar 5, 2024

@openshift-bot: Closed this PR.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@coreydaley coreydaley coreydaley requested changes

@adambkaplan adambkaplan Awaiting requested review from adambkaplan

Assignees

@sayan-biswas sayan-biswas

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. docs-approved Signifies that Docs has signed off on this PR jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. px-approved Signifies that Product Support has signed off on this PR qe-approved Signifies that QE has signed off on this PR
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@nalind @openshift-bot @coreydaley @openshift-ci-robot @openshift-merge-robot @sayan-biswas