Create task for alpha feature Share Process Namespace #7489

verb · 2018-02-22T20:28:58Z

Document a feature kubernetes/enhancements#495 for configuring sharing a process namespace between all containers in pod. This feature will be released as an alpha feature in 1.10.

This change is

k8sio-netlify-preview-bot · 2018-02-22T20:30:48Z

Deploy preview for kubernetes-io-vnext-staging ready!

Built with commit 9f8811e

https://deploy-preview-7489--kubernetes-io-vnext-staging.netlify.com

chenopis · 2018-02-22T21:35:02Z

@verb I forgot to mention, you will also need to add the new doc path to the Tasks table of contents (ToC), which is this file: https://github.com/kubernetes/website/blob/master/_data/tasks.yml. Otherwise, the Travis CI check will fail.

Bradamant3 · 2018-03-08T19:51:29Z

@verb what's your schedule for finishing up this doc? Deadline for merges to 1.10 branch for the release is tomorrow (3/9)/. Let me know if I can help in any way.

verb · 2018-03-08T23:00:12Z

@Bradamant3 apologies, I lost track of time. I've uploaded my first attempt. Feedback welcome.

Bradamant3

Waiting on tech review. Docs review is copyedits only, and all are optional at this point. If you don't need to make any technical corrections or clarifications, consider these all as suggestions only. They do clarify the language and comply better with the docs style guide, but the current content is clear enough, given especially where we are in the 1.10 release cycle.

Bradamant3 · 2018-03-09T14:01:18Z

docs/tasks/configure-pod-container/share-process-namespace.md

+
+This page shows how to configure process namespace sharing for a pod. When
+process namespace sharing is enabled, processes in a container will be visible
+to all other containers in that pod.


Optional (don't worry about it if you're not already in the file making other changes):
s/will be/are

Bradamant3 · 2018-03-09T14:03:42Z

docs/tasks/configure-pod-container/share-process-namespace.md

+
+This can be useful for cooperating containers, such as a log handler sidecar
+container, or troubleshooting container images that don't include debugging
+utilities like a shell.


I understand what you're saying here, but I had to read it a few times. Might be clearer (again, optional) with something like:
"You can use this feature to configure cooperating containers, such as " ...

Bradamant3 · 2018-03-09T14:04:27Z

docs/tasks/configure-pod-container/share-process-namespace.md

+{% include task-tutorial-prereqs.md %}
+
+A special **alpha** feature gate `PodShareProcessNamespace` has to be set to
+true across the system: `--feature-gates=PodShareProcessNamespace=true`.


"A special alpha feature gate, PodShareProcessNamespace, must be set to true ..."

Bradamant3 · 2018-03-09T14:08:04Z

docs/tasks/configure-pod-container/share-process-namespace.md

+
+1. It's possible to signal processes in other containers. Sending `SIGHUP` to
+   nginx causes it to restart the worker process (this requires the `SYS_PTRACE`
+   capability):


Remove numbering -- the procedure is over. Also:
"You can signal processes ..."
and
"Send SIGHUP to nginx to restart the worker process. This also requires the SYS_PTRACE capability."
(don't need colon)
Maybe add "For example," at the start of the second sentence, too?

Would providing the exact command here be useful?

Remove numbering -- the procedure is over.

Yeah, I was a little confused about to handle this sort of thing since the entire thing isn't really a procedure. It's more of an arbitrary example. I removed the numbering where you suggested.

Also:
"You can signal processes ..."
and
"Send SIGHUP to nginx to restart the worker process. This also requires the SYS_PTRACE capability."
(don't need colon)
Maybe add "For example," at the start of the second sentence, too?

Done

Would providing the exact command here be useful?

It's included. (It's kill -HUP 8)

Bradamant3 · 2018-03-09T14:10:36Z

docs/tasks/configure-pod-container/share-process-namespace.md

+containers, though, so it's important to understand these differences:
+
+1. **The container process no longer has PID 1.** Some container images refuse
+   to start without PID 1 (e.g. containers using `systemd`) or run commands like


s/e.g./for example,

Bradamant3 · 2018-03-09T14:11:06Z

docs/tasks/configure-pod-container/share-process-namespace.md

+
+1. **Processes are visible to other containers in the pod.** This includes all
+   information visible in `/proc`, such as passwords that were passed as arguments
+   or environment variables. These will be protected only by regular Unix


s/will be/are

verb · 2018-03-09T14:42:47Z

Oh, also FYI to @smarterclayton, whose concerns about surprising behavior I tried to address in the "Understanding Process Namespace Sharing" section.

Bradamant3 · 2018-03-09T17:26:44Z

@smarterclayton or any other tech reviewer @verb might add -- if you're good with the content, an /lgtm from you will get this PR merged.

/approve

verb · 2018-03-09T18:40:33Z

/assign @yujuhong

chenopis · 2018-03-09T21:50:07Z

docs/tasks/configure-pod-container/share-process-namespace.md

+title: Share Process Namespace between Containers in a Pod
+min-kubernetes-server-version: v1.10
+reviewer:
+- dawnchen


Is this the correct Dawn Chen? Should it bedchen1107?

I believe it should be @dchen1107 here :)

egad! thanks for that catch :P

tengqm

In general LGTM. Just one nit.

tengqm · 2018-03-10T02:51:24Z

docs/tasks/configure-pod-container/share-process-namespace.md

+{% include task-tutorial-prereqs.md %}
+
+A special **alpha** feature gate `PodShareProcessNamespace` must be set to true
+across the system: `--feature-gates=PodShareProcessNamespace=true`.


Please update docs/reference/feature-gates.md to make sure this feature gate is documented.

tengqm

/lgtm

k8s-ci-robot · 2018-03-10T08:49:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Bradamant3, tengqm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Bradamant3]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

* 1.10 update (#7151) * Fix partition value expected behaviour explanation (#7123) Fixes issue #7057 * Correct "On-Premise" to "On-Premises" * Updates the Calico installation page (#7094) * All files for Haufe Groups case study (#7051) * Fix typo (#7127) * fix typo of device-plugins.md (#7106) * fix broken links (#7136) * Updated configure-service-account (#7147) Error from server resolved by escaping kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "myregistrykey"}]}' JSON string by '\' * Remove docs related to 'require-kubeconfig' (#7138) With kubernetes/kubernetes#58367 merged, v1.10 will not use the "require-kubeconfig" flag. The flag has become a no-op solely to ensure existing deployments won't break. * Added Verification Scenario for a Pod that Uses a PVC in Terminating State (#7164) The below PR: kubernetes/kubernetes#55873 modified scheduler in such a way that scheduling of a pod that uses a PVC in Terminating state fails. That's why verification of such scenario was added to documentation. * fix LimitPodHardAntiAffinityTopology name (#7221) * Document the removal of the KubeletConfigFile feature gate (#7140) With kubernetes/kubernetes#58978 merged, the said feature gate is removed. This PR removes texts related to the gate and revises the Feature Gates reference to reflect this change. * deprecate three admission controller (#7363) * Document the removal of Accelerators feature gate (#7389) The `Accelerators` feature gate will be removed in 1.11. 1.10 will be its last mile. References: kubernetes/kubernetes#57384 * Update local storage docs for beta (#7473) * Document that HugePages feature gate is Beta (#7387) The `HugePages` feature gate has graduated to Beta in v1.10. This PR documents this fact. * Add HyperVContainer feature gates (#7502) * Remove the beta reference from Taints and Tolerations doc (#7493) * Kms provider doc (#7479) * Kms provider doc * issue# 7399, Create KMS-provider.md and update encrypt-data.md * address review comments * Document that Device Plugin feature is Beta (1.10) (#7512) * Add docs for CRD features for 1.10 (#7439) * Add docs for CRD features for 1.10 * Add CustomResourcesSubresources to list of feature gates * Add latest changes to custom resources doc * Add crds as abbreviated alias (#7437) * Bring PVC Protection Feature to Beta (#7165) * Bring PVC Protection Feature to Beta The PR: kubernetes/kubernetes#59052 brought PVC Protection feature to beta. That's why the documentation is updated accordingly. * The PVC Protection feature was renamed to Storage Protection. That's why the documentation is updated. * promote PodNodeSelector to stable; document detailed behavior (#7134) * promote PodNodeSelector to stable; document detailed behavior * respond to feedback * Update CPU manager feature enabling (#7390) With `CPUManager` feature graduating to beta. No explicit enabling is required starting v1.10. References: kubernetes/kubernetes#55977 * Adding block volumeMode documentation for local volumes. (#7531) Code review comments. Changed property to field. Address tech review comment. * remove description kubectl --show-all (#7574) --show-all has been deprecated and set to true by default. kubernetes/kubernetes#60210 * fix description about contribute style guide (#7592) * fix description about KUBECONFIG (#7589) s/envrionment/environment * fix description about cni (#7588) s/simultanously/simultaneously/ * fix description about MutatingAdmissionWebhook and ValidatingAdmissionWebhook (#7587) * fix description about persistent volume binding (#7590) s/slighty/slightly/ * Doc change for configurable pod resolv.conf Beta (#7611) * fix description about out of resource handling (#7597) s/threshhold/threshold * fix description about zookeeper (#7598) s/achive/achieve * fix description about kubeadm (#7594) s/compatability/compatibility/ * fix description about kubeadm (#7593) * fix description about kubeadm implementation details (#7595) * fix description about api concepts (#7596) * Storage Protection was renamed to Storage Object in Use Protection (#7576) * Storage Protection was renamed to Storage Object in Use Protection The K8s PR: kubernetes/kubernetes#59901 renamed Storage Protection to Storage Object in Use Protection. That's why the same is also renamed in the documentation. * Moved Storage Object in Use Protection admission plugin description down according to alphabetic order. * Use PSP from policy API group. (#7562) * update kubeletconfig docs for v1.10, beta (#7561) * Update port-forwarding docs (#7575) * add pv protection description (#7620) * fix description about client library (#7634) * Add docs on configuring NodePort IP (#7631) * Document that LocalStorageCapacityIsolation is beta (#7635) A follow-up to the kubernetes/kubernetes#60159 change which has promoted the `LocalStorageCapacityIsolation` feature gate to Beta. * Update CoreDNS docs for beta (#7638) * Update CoreDNS docs for beta * Review comments * Fix typo (#7640) * Update feature gates move to beta (#7662) * Added the inability to use colon ':' character as environment variable names and described workaround (#7657) * merge master to 1.10, with fixes (#7682) * Flag names changed (s/admission-control/enable-admission-plugins); disable-admissions-plugin entry added; removed reference to admission controller/plugins requiring set order (for v1.10), redundant example enabling specific plugin, and redundant version-specific info (#7449) * Documentation for MountPropagation beta (#7655) * Remove job's scale-related operations (#7684) * authentication: document client-go exec plugins (#7648) * authentication: document client-go exec plugins * Update authentication.md * Update local ephemeral storage feature to beta (#7685) Update local ephemeral storage feature to beta * Update docs for windows container resources (#7653) * add server-side print docs (#7671) * Create a task describing Pod process namespace sharing (#7489) * Add external metrics to HPA docs (#7664) * Add external metrics to HPA docs * Update horizontal-pod-autoscale-walkthrough.md * Apply review comments to HPA walkthrough * remove description about "scale jobs" (#7712) * CSI Docs for K8s v1.10 (#7698) * Add a warning about increased memory consumption for audit logging feature. (#7725) Signed-off-by: Mik Vyatskov <vmik@google.com> * Update Audit Logging documentation for 1.10 (#7679) Signed-off-by: Mik Vyatskov <vmik@google.com> * Fix stage names in audit logging documentation (#7746) Signed-off-by: Mik Vyatskov <vmik@google.com> * Feature gate update for release 1.10 (#7742) * State in the docs that the value of default Node labels are not reliable. (#7794) * Kill the reference to --admission-control option (#7755) The `--admission-control` option has been replaced by two new options in v1.10. This PR kills the last appearance of the old option in the doc. * Pvcprotection toc (#7807) * Refreshing installation instructions (#7495) * Refreshing installation instructions Added conjure-up. Updated displays and juju versions to current versions. * Updated anchors * Fixed image value version typo (#7768) Was inconsistent with other values * Update flocker reference to the github repo (#7784) * Fix typo in federation document (#7779) * an user -> a user (#7778) * Events are namespaced (#7767) * fix 'monitoring' link lose efficacy problem' (#7764) * docs/concepts/policy/pod-security-policy.md: minor fix. (#7659) * Update downward-api-volume-expose-pod-information.md (#7771) * Update downward-api-volume-expose-pod-information.md The pod spec puts the downward api files into /etc/podinfo, not directly in /etc. Updated docs to reflect this fact. * Update downward-api-volume-expose-pod-information.md One more spot needed fixing. * Update downward-api-volume-expose-pod-information.md Yet another fix, in the container example. * Add Amadeus Case Study (#7783) * Add Amadeus Case Study * add Amadeus logo * Fixed Cyrillic с in 'kube-proxy-cm' (#7787) There was a typo (wrong character) in kube-proxy-cm.yaml - Cyrillic с (UTF-8 0x0441) was used instead of Latin c. * install-kubectl: choose one installation method (#7705) The previous text layout suggested that all installations had to be done, one after another. * Update install-kubeadm.md (#7781) Add note to kubeadm install instruction to help install in other arch i.e. aarch64, ppc64le etc. * repair failure link (#7788) * repair failure link * repair failure link * do change as required * Update k8s201.md (#7777) * Update k8s201.md Change instructions to download yams files directly from the website (as used in other pages.) Added instructions to delete labeled pod to avoid warnings in the subsequent deployment step. * Update k8s201.md Added example of using the exposed host from the a node running Kubernetes. (This works on AWS with Weave; not able to test it on other variations...) * Gramatical fix to kompose introduction (#7792) The original wording didn't through very well. As much of the original sentence has been preserved as possible, primarily to ensure the kompose web address is see both in text and as a href link. * update amadeus.html (#7800) * Fix a missing word in endpoint reconciler section (#7804) * add toc entry for pvcprotection downgrade issue doc * Pvcprotection toc (#7809) * Refreshing installation instructions (#7495) * Refreshing installation instructions Added conjure-up. Updated displays and juju versions to current versions. * Updated anchors * Fixed image value version typo (#7768) Was inconsistent with other values * Update flocker reference to the github repo (#7784) * Fix typo in federation document (#7779) * an user -> a user (#7778) * Events are namespaced (#7767) * fix 'monitoring' link lose efficacy problem' (#7764) * docs/concepts/policy/pod-security-policy.md: minor fix. (#7659) * Update downward-api-volume-expose-pod-information.md (#7771) * Update downward-api-volume-expose-pod-information.md The pod spec puts the downward api files into /etc/podinfo, not directly in /etc. Updated docs to reflect this fact. * Update downward-api-volume-expose-pod-information.md One more spot needed fixing. * Update downward-api-volume-expose-pod-information.md Yet another fix, in the container example. * Add Amadeus Case Study (#7783) * Add Amadeus Case Study * add Amadeus logo * Fixed Cyrillic с in 'kube-proxy-cm' (#7787) There was a typo (wrong character) in kube-proxy-cm.yaml - Cyrillic с (UTF-8 0x0441) was used instead of Latin c. * install-kubectl: choose one installation method (#7705) The previous text layout suggested that all installations had to be done, one after another. * Update install-kubeadm.md (#7781) Add note to kubeadm install instruction to help install in other arch i.e. aarch64, ppc64le etc. * repair failure link (#7788) * repair failure link * repair failure link * do change as required * Update k8s201.md (#7777) * Update k8s201.md Change instructions to download yams files directly from the website (as used in other pages.) Added instructions to delete labeled pod to avoid warnings in the subsequent deployment step. * Update k8s201.md Added example of using the exposed host from the a node running Kubernetes. (This works on AWS with Weave; not able to test it on other variations...) * Gramatical fix to kompose introduction (#7792) The original wording didn't through very well. As much of the original sentence has been preserved as possible, primarily to ensure the kompose web address is see both in text and as a href link. * update amadeus.html (#7800) * Fix a missing word in endpoint reconciler section (#7804) * add toc entry for pvcprotection downgrade issue doc * revert TOC change * Release 1.10 (#7818) * Refreshing installation instructions (#7495) * Refreshing installation instructions Added conjure-up. Updated displays and juju versions to current versions. * Updated anchors * Fixed image value version typo (#7768) Was inconsistent with other values * Update flocker reference to the github repo (#7784) * Fix typo in federation document (#7779) * an user -> a user (#7778) * Events are namespaced (#7767) * fix 'monitoring' link lose efficacy problem' (#7764) * docs/concepts/policy/pod-security-policy.md: minor fix. (#7659) * Update downward-api-volume-expose-pod-information.md (#7771) * Update downward-api-volume-expose-pod-information.md The pod spec puts the downward api files into /etc/podinfo, not directly in /etc. Updated docs to reflect this fact. * Update downward-api-volume-expose-pod-information.md One more spot needed fixing. * Update downward-api-volume-expose-pod-information.md Yet another fix, in the container example. * Add Amadeus Case Study (#7783) * Add Amadeus Case Study * add Amadeus logo * Fixed Cyrillic с in 'kube-proxy-cm' (#7787) There was a typo (wrong character) in kube-proxy-cm.yaml - Cyrillic с (UTF-8 0x0441) was used instead of Latin c. * install-kubectl: choose one installation method (#7705) The previous text layout suggested that all installations had to be done, one after another. * Update install-kubeadm.md (#7781) Add note to kubeadm install instruction to help install in other arch i.e. aarch64, ppc64le etc. * repair failure link (#7788) * repair failure link * repair failure link * do change as required * Update k8s201.md (#7777) * Update k8s201.md Change instructions to download yams files directly from the website (as used in other pages.) Added instructions to delete labeled pod to avoid warnings in the subsequent deployment step. * Update k8s201.md Added example of using the exposed host from the a node running Kubernetes. (This works on AWS with Weave; not able to test it on other variations...) * Gramatical fix to kompose introduction (#7792) The original wording didn't through very well. As much of the original sentence has been preserved as possible, primarily to ensure the kompose web address is see both in text and as a href link. * update amadeus.html (#7800) * Fix a missing word in endpoint reconciler section (#7804) * Partners page updates (#7802) * Partners page updates * Update to ZTE link * Make using sysctls a task instead of a concept (#6808) Closes: #4505 * add a note when mount a configmap to pod (#7745) * adjust a note format (#7812) * Update docker-cli-to-kubectl.md (#7748) * Update docker-cli-to-kubectl.md Edited the document for adherence to the style guide and word usage. * Update docker-cli-to-kubectl.md * Incorporated the changes suggested. * Mount propagation update to include docker config (#7854) * update overridden config for 1.10 (#7847) * update overridden config for 1.10 * fix config file per comments * Update Extended Resource doc wrt cluster-level resources (#7759)

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Feb 22, 2018

k8s-ci-robot requested review from xiangpengzhao and zhangxiaoyu-zidif February 22, 2018 20:29

k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Feb 22, 2018

chenopis added this to the 1.10 milestone Feb 22, 2018

chenopis assigned Bradamant3 Feb 22, 2018

chenopis self-assigned this Feb 22, 2018

verb force-pushed the pid-task branch from bc1b4f6 to 12f51b0 Compare March 8, 2018 22:09

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 8, 2018

verb changed the title ~~WIP: Create task for alpha feature Share Process Namespace~~ Create task for alpha feature Share Process Namespace Mar 8, 2018

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 8, 2018

verb force-pushed the pid-task branch 4 times, most recently from 50eb91f to 3b87b2b Compare March 8, 2018 22:55

chenopis added Needs Tech Review labels Mar 8, 2018

verb force-pushed the pid-task branch from 3b87b2b to 57ae276 Compare March 8, 2018 22:57

Bradamant3 reviewed Mar 9, 2018

View reviewed changes

Bradamant3 removed the Needs Docs Review label Mar 9, 2018

verb force-pushed the pid-task branch 2 times, most recently from cb1c477 to 145ce66 Compare March 9, 2018 14:39

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 9, 2018

k8s-ci-robot assigned yujuhong Mar 9, 2018

chenopis requested a review from dchen1107 March 9, 2018 21:48

chenopis reviewed Mar 9, 2018

View reviewed changes

tengqm requested changes Mar 10, 2018

View reviewed changes

Create a task describing Pod process namespace sharing

9f8811e

verb force-pushed the pid-task branch from 6f702de to 9f8811e Compare March 10, 2018 07:47

k8s-ci-robot assigned tengqm Mar 10, 2018

tengqm approved these changes Mar 10, 2018

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 10, 2018

k8s-ci-robot merged commit 700209b into kubernetes:release-1.10 Mar 10, 2018

zacharysarah pushed a commit that referenced this pull request Apr 16, 2018

Create a task describing Pod process namespace sharing (#7489)

678ede6

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create task for alpha feature Share Process Namespace #7489

Create task for alpha feature Share Process Namespace #7489

verb commented Feb 22, 2018 •

edited

Loading

k8sio-netlify-preview-bot commented Feb 22, 2018 •

edited

Loading

chenopis commented Feb 22, 2018

Bradamant3 commented Mar 8, 2018

verb commented Mar 8, 2018

Bradamant3 left a comment •

edited

Loading

Bradamant3 Mar 9, 2018

verb Mar 9, 2018

Bradamant3 Mar 9, 2018

verb Mar 9, 2018

Bradamant3 Mar 9, 2018

verb Mar 9, 2018

Bradamant3 Mar 9, 2018

verb Mar 9, 2018

Bradamant3 Mar 9, 2018

verb Mar 9, 2018

Bradamant3 Mar 9, 2018

verb Mar 9, 2018

verb commented Mar 9, 2018

Bradamant3 commented Mar 9, 2018

verb commented Mar 9, 2018

chenopis Mar 9, 2018

xiangpengzhao Mar 10, 2018

verb Mar 10, 2018

tengqm left a comment

tengqm Mar 10, 2018

verb Mar 10, 2018

tengqm left a comment

k8s-ci-robot commented Mar 10, 2018

Create task for alpha feature Share Process Namespace #7489

Create task for alpha feature Share Process Namespace #7489

Conversation

verb commented Feb 22, 2018 • edited Loading

k8sio-netlify-preview-bot commented Feb 22, 2018 • edited Loading

chenopis commented Feb 22, 2018

Bradamant3 commented Mar 8, 2018

verb commented Mar 8, 2018

Bradamant3 left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

verb commented Mar 9, 2018

Bradamant3 commented Mar 9, 2018

verb commented Mar 9, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tengqm left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tengqm left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Mar 10, 2018

verb commented Feb 22, 2018 •

edited

Loading

k8sio-netlify-preview-bot commented Feb 22, 2018 •

edited

Loading

Bradamant3 left a comment •

edited

Loading