Skip to content

Commit

Permalink
content: Userns now supports stateful pods
Browse files Browse the repository at this point in the history
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
  • Loading branch information
rata committed Jul 17, 2023
1 parent a358d7a commit f88a2a1
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 18 deletions.
15 changes: 3 additions & 12 deletions content/en/docs/concepts/workloads/pods/user-namespaces.md
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ ext4, xfs, fat, tmpfs, overlayfs.

In addition, support is needed in the
{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}
to use this feature with Kubernetes stateless pods:
to use this feature with Kubernetes pods:

* CRI-O: version 1.25 (and later) supports user namespaces for containers.

Expand All @@ -75,7 +75,7 @@ A pod can opt-in to use user namespaces by setting the `pod.spec.hostUsers` fiel
to `false`.

The kubelet will pick host UIDs/GIDs a pod is mapped to, and will do so in a way
to guarantee that no two stateless pods on the same node use the same mapping.
to guarantee that no two pods on the same node use the same mapping.

The `runAsUser`, `runAsGroup`, `fsGroup`, etc. fields in the `pod.spec` always
refer to the user inside the container.
Expand All @@ -92,7 +92,7 @@ Most applications that need to run as root but don't access other host
namespaces or resources, should continue to run fine without any changes needed
if user namespaces is activated.

## Understanding user namespaces for stateless pods
## Understanding user namespaces for pods

Several container runtimes with their default configuration (like Docker Engine,
containerd, CRI-O) use Linux namespaces for isolation. Other technologies exist
Expand Down Expand Up @@ -162,15 +162,6 @@ allowed to set any of:
* `hostIPC: true`
* `hostPID: true`

The pod is allowed to use no volumes at all or, if using volumes, only these
volume types are allowed:

* configmap
* secret
* projected
* downwardAPI
* emptyDir

## {{% heading "whatsnext" %}}

* Take a look at [Use a User Namespace With a Pod](/docs/tasks/configure-pod-container/user-namespaces/)
15 changes: 9 additions & 6 deletions content/en/docs/tasks/configure-pod-container/user-namespaces.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,8 @@ min-kubernetes-server-version: v1.25
<!-- overview -->
{{< feature-state for_k8s_version="v1.25" state="alpha" >}}

This page shows how to configure a user namespace for stateless pods. This
allows to isolate the user running inside the container from the one in the
host.
This page shows how to configure a user namespace for pods. This allows to
isolate the user running inside the container from the one in the host.

A process running as root in a container can run as a different (non-root) user
in the host; in other words, the process has full privileges for operations
Expand Down Expand Up @@ -41,7 +40,11 @@ this is true when user namespaces are used.
* The node OS needs to be Linux
* You need to exec commands in the host
* You need to be able to exec into pods
* Feature gate `UserNamespacesStatelessPodsSupport` need to be enabled.
* Feature gate `UserNamespacesSupport` need to be enabled

Note that the feature gate was previously named
`UserNamespacesStatelessPodsSupport` when only stateless pods were supported.
This feature gate is not recognized anymore.

The cluster that you're using **must** include at least one node that meets the
[requirements](/docs/concepts/workloads/pods/user-namespaces/#before-you-begin)
Expand All @@ -59,8 +62,8 @@ created without user namespaces.**

## Run a Pod that uses a user namespace {#create-pod}

A user namespace for a stateless pod is enabled setting the `hostUsers` field of
`.spec` to `false`. For example:
A user namespace for a pod is enabled setting the `hostUsers` field of `.spec`
to `false`. For example:

{{< codenew file="pods/user-namespaces-stateless.yaml" >}}

Expand Down

0 comments on commit f88a2a1

Please sign in to comment.