Skip to content

[release/1.7] Throw an error if the kubelet requests mounts with uid/gid mappings#8211

Merged
AkihiroSuda merged 2 commits intocontainerd:release/1.7from
kinvolk:rata/userns-stateless-idmap-error
Apr 19, 2023
Merged

[release/1.7] Throw an error if the kubelet requests mounts with uid/gid mappings#8211
AkihiroSuda merged 2 commits intocontainerd:release/1.7from
kinvolk:rata/userns-stateless-idmap-error

Conversation

@rata
Copy link
Copy Markdown
Contributor

@rata rata commented Mar 6, 2023 •
edited
Loading

This is a backport of #8376 to the 1.7 release branch (the only release with userns support, so the only one affected).

Please note I cherry-pick -x commit "cri: Throw an error if idmap mounts is requested", but manually did the vendor again (instead of cherry.picking) because there are other differences in the go modules.

@k8s-ci-robot
Copy link
Copy Markdown

k8s-ci-robot commented Mar 6, 2023

Hi @rata. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@rata rata mentioned this pull request Mar 6, 2023
Closed
@rata rata force-pushed the rata/userns-stateless-idmap-error branch from 9d5c3d2 to 1e4e9fe Compare March 6, 2023 15:33
@rata rata force-pushed the rata/userns-stateless-idmap-error branch from 1e4e9fe to fb937d8 Compare March 17, 2023 15:02
@rata rata changed the base branch from main to release/1.7 March 17, 2023 15:03
@rata rata force-pushed the rata/userns-stateless-idmap-error branch from fb937d8 to a86c0e3 Compare March 17, 2023 16:34
@rata rata marked this pull request as ready for review March 17, 2023 16:38
@rata
Copy link
Copy Markdown
Contributor Author

rata commented Mar 17, 2023

The k8s PR has been merged, so I've updated this to do the proper vendoring and mark it ready for review.

I've opened it against branch 1.7, as that is where we need this (see #8209 for more info). I'll open a draft PR that relies on runc 1.2 for the main branch, to properly handle idmap mounts.

cc @fuweid as you were active in the issue and userns support PRs.

@rata rata changed the title Thow an error if the kubelet requests mounts with uid/gid mappings [release/1.7] Thow an error if the kubelet requests mounts with uid/gid mappings Mar 20, 2023
@dims
Copy link
Copy Markdown
Member

dims commented Mar 29, 2023

/ok-to-test

@rata
Copy link
Copy Markdown
Contributor Author

rata commented Apr 3, 2023

Friendly ping?

estesp
estesp approved these changes Apr 3, 2023
View reviewed changes
Copy link
Copy Markdown
Member

@estesp estesp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@rata
Copy link
Copy Markdown
Contributor Author

rata commented Apr 11, 2023 •
edited
Loading

ping?

@estesp thanks! Can you maybe get another maintainer to review this too? :)

@fuweid
Copy link
Copy Markdown
Member

fuweid commented Apr 11, 2023

sorry for missing the mention. Did we have pr to main branch? @rata

@rata
Copy link
Copy Markdown
Contributor Author

rata commented Apr 11, 2023

@fuweid no, for main I've just opened a PR handling idmap mounts for volumes (in draft as it depends on runc merging another PR, containerd PR is: #8287).

Shall I make another PR like this to main and then undo it when we merge #8287 ?

@fuweid
Copy link
Copy Markdown
Member

fuweid commented Apr 11, 2023 •
edited
Loading

@rata We usually don't apply patch to release branch directly. Hope you don't mind.

I think you can just file a similar pr X to main branch so that we can know that this pr 8211 is cherry-picked from X. So the steps are

  1. merge X to main
  2. cherry-pick X to [release/1.7] Throw an error if the kubelet requests mounts with uid/gid mappings #8211 and merge it to release/1.7
  3. rebase main to Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27) #8287

Sounds good to you?

BTW, this patch looks good to me.

@rata
Copy link
Copy Markdown
Contributor Author

rata commented Apr 11, 2023

Perfect, will do that then. Thanks!

@rata rata mentioned this pull request Apr 11, 2023
Merged
@rata
Copy link
Copy Markdown
Contributor Author

rata commented Apr 11, 2023

@fuweid created the PR to main: #8376 PTAL :)

@rata rata marked this pull request as draft April 11, 2023 16:18
@rata
Copy link
Copy Markdown
Contributor Author

rata commented Apr 11, 2023

Switching to draft until the one in main is merged, then I'll cherry-pick -x if the merge method changes the hash and switch it to ready for review

rata added 2 commits April 13, 2023 10:58
@rata
cri: Vendor v0.27.0-beta.0 for mounts uid/gid mappings
75ac7e0 
We will use this in future commits to see if the kubelet requested idmap
mounts for volumes, that we don't yet support.

Signed-off-by: Rodrigo Campos <[email protected]>
@rata
cri: Throw an error if idmap mounts is requested
7de8629 
We need support in containerd and the OCI runtime to use idmap mounts.
Let's just throw an error for now if the kubelet requests some mounts
with mappings.

Signed-off-by: Rodrigo Campos <[email protected]>
(cherry picked from commit 7e6ab84)
@rata rata force-pushed the rata/userns-stateless-idmap-error branch from a86c0e3 to 7de8629 Compare April 13, 2023 09:00
@rata rata marked this pull request as ready for review April 13, 2023 09:03
@rata
Copy link
Copy Markdown
Contributor Author

rata commented Apr 13, 2023

@fuweid thanks! I updated this PR now with the cherry-pick, PTAL

@fuweid fuweid changed the title [release/1.7] Thow an error if the kubelet requests mounts with uid/gid mappings [release/1.7] Throw an error if the kubelet requests mounts with uid/gid mappings Apr 13, 2023
fuweid
fuweid approved these changes Apr 13, 2023
View reviewed changes
Copy link
Copy Markdown
Member

@fuweid fuweid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@rata
Copy link
Copy Markdown
Contributor Author

rata commented Apr 13, 2023

Two LGTM are enough? Or do we want to re-review as technically although the code hasn't changed, now the commit was cherr-picked?

@fuweid
Copy link
Copy Markdown
Member

fuweid commented Apr 14, 2023

ping @AkihiroSuda @dmcgowan

@fuweid
Copy link
Copy Markdown
Member

fuweid commented Apr 14, 2023

Hi @rata after change, it still needs two LGTMs.

ping @dims @mikebrow ~

@rata rata requested a review from estesp April 14, 2023 16:55
AkihiroSuda
AkihiroSuda reviewed Apr 19, 2023
View reviewed changes
Comment thread go.mod
k8s.io/client-go v0.26.2
k8s.io/component-base v0.26.2
k8s.io/cri-api v0.26.2
k8s.io/cri-api v0.27.0-beta.0
Copy link
Copy Markdown
Member

@AkihiroSuda AkihiroSuda Apr 19, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non-beta might be preferable, but can be bumped up later

@AkihiroSuda AkihiroSuda merged commit 7dd7a09 into containerd:release/1.7 Apr 19, 2023
@rata rata deleted the rata/userns-stateless-idmap-error branch April 24, 2023 10:14
rata added a commit to kinvolk/containerd that referenced this pull request Apr 24, 2023
@rata
cri: Vendor v0.27.1
c060257 
As requested by Akihiro Suda here:
	containerd#8211 (comment)

This just bumps the tag name to the k8s final release. There are no
changes other than the tag name, though.

Signed-off-by: Rodrigo Campos <[email protected]>
@rata rata mentioned this pull request Apr 24, 2023
Merged
rata added a commit to kinvolk/containerd that referenced this pull request Apr 24, 2023
@rata
cri: Vendor v0.27.1
4755683 
As requested by Akihiro Suda here:
	containerd#8211 (comment)

This just bumps the tag name to the k8s final release. There are no
changes other than the tag name, though.

Signed-off-by: Rodrigo Campos <[email protected]>
rata added a commit to kinvolk/containerd that referenced this pull request Apr 24, 2023
@rata
cri: Vendor v0.27.1
92b93e3 
As requested by Akihiro Suda here:
	containerd#8211 (comment)

This just bumps the tag name to the k8s final release. There are no
changes other than the tag name, though.

Signed-off-by: Rodrigo Campos <[email protected]>
rata added a commit to kinvolk/containerd that referenced this pull request Apr 25, 2023
@rata
cri: Vendor v0.27.1
571715a 
As requested by Akihiro Suda here:
	containerd#8211 (comment)

This just bumps the tag name to the k8s final release. There are no
changes other than the tag name, though.

Signed-off-by: Rodrigo Campos <[email protected]>
(cherry picked from commit 92b93e3)
@rata rata mentioned this pull request Apr 25, 2023
Merged
@kiashok kiashok mentioned this pull request May 5, 2023
Closed
@dmcgowan dmcgowan mentioned this pull request May 9, 2023
Merged
jsturtevant pushed a commit to jsturtevant/containerd that referenced this pull request Sep 21, 2023
@rata @jsturtevant
cri: Vendor v0.27.1
2dcff05 
As requested by Akihiro Suda here:
	containerd#8211 (comment)

This just bumps the tag name to the k8s final release. There are no
changes other than the tag name, though.

Signed-off-by: Rodrigo Campos <[email protected]>
juliusl pushed a commit to juliusl/containerd that referenced this pull request Jan 26, 2024
@rata @juliusl
cri: Vendor v0.27.1
a8b7846 
As requested by Akihiro Suda here:
	containerd#8211 (comment)

This just bumps the tag name to the k8s final release. There are no
changes other than the tag name, though.

Signed-off-by: Rodrigo Campos <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AkihiroSuda AkihiroSuda AkihiroSuda approved these changes

@fuweid fuweid fuweid approved these changes

@estesp estesp Awaiting requested review from estesp

Assignees

No one assigned

Labels

needs-ok-to-test

Projects

Pull Request Review
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@rata @k8s-ci-robot @dims @fuweid @estesp @AkihiroSuda