cri: Throw an error if idmap mounts is requested

rata · rata · commit 7e6ab84884f3 · 2023-04-11T21:31:12.000+02:00
We need support in containerd and the OCI runtime to use idmap mounts.
Let's just throw an error for now if the kubelet requests some mounts
with mappings.

Signed-off-by: Rodrigo Campos &lt;rodrigoca@microsoft.com&gt;
diff --git a/pkg/cri/opts/spec_linux_opts.go b/pkg/cri/opts/spec_linux_opts.go
@@ -163,6 +163,10 @@ func WithMounts(osi osinterface.OS, config *runtime.ContainerConfig, extra []*ru
 					return fmt.Errorf("relabel %q with %q failed: %w", src, mountLabel, err)
 				}
 			}
+			if mount.UidMappings != nil || mount.GidMappings != nil {
+				return fmt.Errorf("idmap mounts not yet supported, but they were requested for: %q", src)
+			}
+
 			s.Mounts = append(s.Mounts, runtimespec.Mount{
 				Source:      src,
 				Destination: dst,

Original file line number	Diff line number	Diff line change
`@@ -163,6 +163,10 @@ func WithMounts(osi osinterface.OS, config runtime.ContainerConfig, extra []ru`
`163`	`163`	`return fmt.Errorf("relabel %q with %q failed: %w", src, mountLabel, err)`
`164`	`164`	`}`
`165`	`165`	`}`
	`166`	`+ if mount.UidMappings != nil \|\| mount.GidMappings != nil {`
	`167`	`+ return fmt.Errorf("idmap mounts not yet supported, but they were requested for: %q", src)`
	`168`	`+ }`
	`169`	`+`
`166`	`170`	`s.Mounts = append(s.Mounts, runtimespec.Mount{`
`167`	`171`	`Source: src,`
`168`	`172`	`Destination: dst,`