From 992924664b5c2f05d39c26d1a901760817eb841a Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Tue, 6 May 2025 14:54:55 +0200 Subject: [PATCH 1/3] userns: Use len to handle empty non-nil slices When using an old runtime like containerd 1.7, this message is not implemented and what we get here is an empty non-nil slice. Let's check the len of the slice instead. While we are there, let's just return false and no error. In the following commits we will wrap the error and we didn't find any more info to add here. Signed-off-by: Rodrigo Campos --- pkg/kubelet/kubelet_getters.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/kubelet/kubelet_getters.go b/pkg/kubelet/kubelet_getters.go index 491ce594dd3..b51adf24174 100644 --- a/pkg/kubelet/kubelet_getters.go +++ b/pkg/kubelet/kubelet_getters.go @@ -120,8 +120,9 @@ func (kl *Kubelet) ListPodsFromDisk() ([]types.UID, error) { // user namespaces. func (kl *Kubelet) HandlerSupportsUserNamespaces(rtHandler string) (bool, error) { rtHandlers := kl.runtimeState.runtimeHandlers() - if rtHandlers == nil { - return false, fmt.Errorf("runtime handlers are not set") + if len(rtHandlers) == 0 { + // The slice is empty if the runtime is old and doesn't support this message. + return false, nil } for _, h := range rtHandlers { if h.Name == rtHandler { From 514da8a95a632fc029913adf2638ddf8910634ef Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Tue, 6 May 2025 14:58:32 +0200 Subject: [PATCH 2/3] userns: Improve error returned if userns is not supported This makes it clear the error comes due to a user namespace configuration. Otherwise the error returned looks too generic and is not clear. Before this PR, the error was: Warning FailedCreatePodSandBox 1s kubelet Failed to create pod sandbox: the handler "" is not known Now it is: Warning FailedCreatePodSandBox 1s kubelet Failed to create pod sandbox: runtime does not support user namespaces Signed-off-by: Rodrigo Campos --- pkg/kubelet/userns/userns_manager.go | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/pkg/kubelet/userns/userns_manager.go b/pkg/kubelet/userns/userns_manager.go index 57d38b972df..1a1c20b63fa 100644 --- a/pkg/kubelet/userns/userns_manager.go +++ b/pkg/kubelet/userns/userns_manager.go @@ -417,10 +417,15 @@ func (m *UsernsManager) GetOrCreateUserNamespaceMappings(pod *v1.Pod, runtimeHan // From here onwards, hostUsers=false and the feature gate is enabled. // if the pod requested a user namespace and the runtime doesn't support user namespaces then return an error. - if handlerSupportsUserns, err := m.kl.HandlerSupportsUserNamespaces(runtimeHandler); err != nil { - return nil, err - } else if !handlerSupportsUserns { - return nil, fmt.Errorf("RuntimeClass handler %q does not support user namespaces", runtimeHandler) + if handlerSupportsUserns, err := m.kl.HandlerSupportsUserNamespaces(runtimeHandler); err != nil || !handlerSupportsUserns { + msg := "can't set `spec.hostUsers: false`, runtime does not support user namespaces" + if runtimeHandler != "" { + msg = fmt.Sprintf("can't set `spec.hostUsers: false`, RuntimeClass handler %q does not support user namespaces", runtimeHandler) + } + if err != nil { + return nil, fmt.Errorf("%v: %w", msg, err) + } + return nil, fmt.Errorf("%v", msg) } m.lock.Lock() From 2628e18dabebbd557ec1e6dff1c86313ff05e122 Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Tue, 6 May 2025 15:01:32 +0200 Subject: [PATCH 3/3] userns: Wrap more errors Most errors where already wrapped, but these were missing. Signed-off-by: Rodrigo Campos --- pkg/kubelet/userns/userns_manager.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/kubelet/userns/userns_manager.go b/pkg/kubelet/userns/userns_manager.go index 1a1c20b63fa..728757b4f19 100644 --- a/pkg/kubelet/userns/userns_manager.go +++ b/pkg/kubelet/userns/userns_manager.go @@ -440,12 +440,12 @@ func (m *UsernsManager) GetOrCreateUserNamespaceMappings(pod *v1.Pod, runtimeHan if string(content) != "" { userNs, err = m.parseUserNsFileAndRecord(pod.UID, content) if err != nil { - return nil, err + return nil, fmt.Errorf("user namespace: %w", err) } } else { userNs, err = m.createUserNs(pod) if err != nil { - return nil, err + return nil, fmt.Errorf("create user namespace: %w", err) } } @@ -496,7 +496,7 @@ func (m *UsernsManager) CleanupOrphanedPodUsernsAllocations(pods []*v1.Pod, runn allFound := sets.New[string]() found, err := m.kl.ListPodsFromDisk() if err != nil { - return err + return fmt.Errorf("user namespace: read pods from disk: %w", err) } for _, podUID := range found {