Add enhancement for supporting user namespaces #1649

haircommander · 2024-06-25T19:24:05Z

related https://issues.redhat.com/browse/OCPNODE-2337
cc @rphillips @mrunalp

haircommander · 2024-06-25T19:24:26Z

/hold

@deads2k is on vacation and should review this. I'm opening it for preliminary review though

haircommander · 2024-06-28T17:20:46Z

SCC piece openshift/api#1939

haircommander · 2024-06-28T20:16:44Z

TPNU piece openshift/api#1940

haircommander · 2024-07-08T17:28:12Z

/hold cancel

I chatted with @deads2k on slack, he's okay with the piece I was waiting for his council on

enhancements/kubelet/user-namespaces-support.md

rphillips · 2024-07-15T20:26:59Z

/lgtm

openshift-ci · 2024-07-15T20:27:25Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rphillips

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [rphillips]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

haircommander · 2024-07-15T20:27:51Z

/hold

haircommander · 2024-07-15T20:28:09Z

for API and auth team reviews

ibihim

I am currently checking the impact on SCCs overall, but I added my first thoughts on reading it.

enhancements/kubelet/user-namespaces-support.md

haircommander · 2024-07-31T15:33:41Z

/hold cancel

enhancements/kubelet/user-namespaces-support.md

deads2k

some changes.

deads2k · 2024-08-15T20:45:34Z

enhancements/kubelet/user-namespaces-support.md

+       // NamespaceLevelEmpty will set to the default, which is currently "AllowHostLevel".
+       NamespaceLevelEmpty NamespaceLevelType = ""


This field is closer to user workloads than to configuration. This one we'll default to AllowHostLevel instead of leaving empty because we know the intent will never change

sorry I don't think I fully understand--do you want me to drop this or keep it?

Empty should not be allowed. We should default the value.

If we ever wanted to start enforcing this, would we not want to change the default? Is the expectation there that we create a new version of the SCC and folks move over to it? In which case, having an API default doesn't really matter as we will create the object with the new value we desire

I dropped empty.

Is the expectation there that we create a new version of the SCC and folks move over to it?

this is my understanding of the approach

enhancements/kubelet/user-namespaces-support.md

deads2k · 2024-08-15T20:57:15Z

enhancements/kubelet/user-namespaces-support.md

+The `MinimalKubeletVersion` feature is to fix this problem. If all apiservers support this field upon GA, then a cluster admin can set the field and ensure
+their kubelets are new enough to certainly support user namespaces. This frees the apiserver to relax validation and GA these SCC fields.
+
+This feature is not required for TechPreview, but is required for GA if we do not want to wait until 1.33/4.20 to GA this feature (the point where the oldest


FeatureGate is still not enabled for kubelets in 1.31/4.18, so if MinimalKubeletVersion is not developed, it looks like 4.22 is the earliest possible. If MinimalKubeletVersion is developed, the earliest is 4.18.

why 4.22?

Because as it currently stands 1.31/4.18 kubelets won't correctly honor the field. 4.19 becomes the first level where it might be properly honored and we have 4.19+3.

liouk

Adding some nits/typos I came across while reading this.

enhancements/kubelet/user-namespaces-support.md

haircommander · 2024-08-16T15:41:29Z

updated @deads2k @liouk ! thanks for your reviews, PTAL

liouk

Added a suggestion and a side-note for clarity.

enhancements/kubelet/user-namespaces-support.md

liouk · 2024-08-19T15:56:07Z

/lgtm

Holding for @deads2k to finish his review and approve.

/hold

enhancements/kubelet/user-namespaces-support.md

Signed-off-by: Peter Hunt <pehunt@redhat.com>

deads2k · 2024-08-19T18:57:47Z

/lgtm
/hold cancel

openshift-ci · 2024-08-19T19:13:07Z

@haircommander: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 25, 2024

openshift-ci bot requested review from jmguzik and joepvd June 25, 2024 19:35

haircommander force-pushed the scc-userns branch 2 times, most recently from 31705ee to 55032bf Compare June 25, 2024 20:11

haircommander force-pushed the scc-userns branch from 55032bf to 95cdfa8 Compare July 8, 2024 17:04

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 8, 2024

haircommander force-pushed the scc-userns branch from 95cdfa8 to 3605bb1 Compare July 15, 2024 20:06

rphillips suggested changes Jul 15, 2024

View reviewed changes

enhancements/kubelet/user-namespaces-support.md Outdated Show resolved Hide resolved

haircommander force-pushed the scc-userns branch from 3605bb1 to edb1513 Compare July 15, 2024 20:20

rphillips approved these changes Jul 15, 2024

View reviewed changes

openshift-ci bot assigned rphillips Jul 15, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jul 15, 2024

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 15, 2024

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 15, 2024

haircommander mentioned this pull request Jul 17, 2024

OCPNODE-2387: SCC: add UserNamespaceLevel field openshift/api#1939

Open

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Jul 18, 2024

haircommander force-pushed the scc-userns branch from 2dcdba1 to 4176f0e Compare July 23, 2024 17:40

ibihim reviewed Jul 29, 2024

View reviewed changes

haircommander force-pushed the scc-userns branch 2 times, most recently from b8fc9cb to afb1d1f Compare July 31, 2024 14:50

deads2k reviewed Aug 5, 2024

View reviewed changes

enhancements/kubelet/user-namespaces-support.md Outdated Show resolved Hide resolved

deads2k reviewed Aug 5, 2024

View reviewed changes

enhancements/kubelet/user-namespaces-support.md Outdated Show resolved Hide resolved

haircommander force-pushed the scc-userns branch 4 times, most recently from 79c3553 to ed340f4 Compare August 8, 2024 15:05

deads2k requested changes Aug 15, 2024

View reviewed changes

liouk suggested changes Aug 16, 2024

View reviewed changes

haircommander force-pushed the scc-userns branch from ed340f4 to 37a6e99 Compare August 16, 2024 15:41

liouk reviewed Aug 19, 2024

View reviewed changes

enhancements/kubelet/user-namespaces-support.md Outdated Show resolved Hide resolved

enhancements/kubelet/user-namespaces-support.md Show resolved Hide resolved

haircommander force-pushed the scc-userns branch 3 times, most recently from e819dc7 to 74c2cfe Compare August 19, 2024 15:37

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 19, 2024

openshift-ci bot assigned liouk Aug 19, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 19, 2024

deads2k reviewed Aug 19, 2024

View reviewed changes

enhancements/kubelet/user-namespaces-support.md Show resolved Hide resolved

deads2k reviewed Aug 19, 2024

View reviewed changes

enhancements/kubelet/user-namespaces-support.md Show resolved Hide resolved

haircommander force-pushed the scc-userns branch from 74c2cfe to a77d43a Compare August 19, 2024 16:37

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 19, 2024

Add enhancement for supporting user namespaces

b11957b

Signed-off-by: Peter Hunt <pehunt@redhat.com>

haircommander force-pushed the scc-userns branch from a77d43a to b11957b Compare August 19, 2024 18:56

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 19, 2024

openshift-ci bot assigned deads2k Aug 19, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 19, 2024

openshift-merge-bot bot merged commit ad5833d into openshift:master Aug 19, 2024
2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add enhancement for supporting user namespaces #1649

Add enhancement for supporting user namespaces #1649

haircommander commented Jun 25, 2024

haircommander commented Jun 25, 2024

haircommander commented Jun 28, 2024

haircommander commented Jun 28, 2024

haircommander commented Jul 8, 2024

rphillips commented Jul 15, 2024

openshift-ci bot commented Jul 15, 2024

haircommander commented Jul 15, 2024

haircommander commented Jul 15, 2024

ibihim left a comment

haircommander commented Jul 31, 2024

deads2k left a comment

deads2k Aug 15, 2024

haircommander Aug 16, 2024

deads2k Aug 19, 2024

JoelSpeed Aug 19, 2024

haircommander Aug 19, 2024

deads2k Aug 15, 2024

haircommander Aug 16, 2024

deads2k Aug 19, 2024

liouk left a comment

haircommander commented Aug 16, 2024

liouk left a comment

liouk commented Aug 19, 2024

deads2k commented Aug 19, 2024

openshift-ci bot commented Aug 19, 2024

		// NamespaceLevelEmpty will set to the default, which is currently "AllowHostLevel".
		NamespaceLevelEmpty NamespaceLevelType = ""

Add enhancement for supporting user namespaces #1649

Add enhancement for supporting user namespaces #1649

Conversation

haircommander commented Jun 25, 2024

haircommander commented Jun 25, 2024

haircommander commented Jun 28, 2024

haircommander commented Jun 28, 2024

haircommander commented Jul 8, 2024

rphillips commented Jul 15, 2024

openshift-ci bot commented Jul 15, 2024

haircommander commented Jul 15, 2024

haircommander commented Jul 15, 2024

ibihim left a comment

Choose a reason for hiding this comment

haircommander commented Jul 31, 2024

deads2k left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liouk left a comment

Choose a reason for hiding this comment

haircommander commented Aug 16, 2024

liouk left a comment

Choose a reason for hiding this comment

liouk commented Aug 19, 2024

deads2k commented Aug 19, 2024

openshift-ci bot commented Aug 19, 2024