github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-23 11:50:44 +00:00
Code Issues Projects Releases Wiki Activity

Revert "Enforce the Minimum Kernel Version 6.3 for UserNamespacesSupport feature"

Browse Source 
This reverts commit 8597b343fa.

I wrote in the Kubernetes documentation:

	In practice this means you need at least Linux 6.3, as tmpfs started
	supporting idmap mounts in that version. This is usually needed as
	several Kubernetes features use tmpfs (the service account token that is
	mounted by default uses a tmpfs, Secrets use a tmpfs, etc.)

The check is wrong for several reasons:
	* Pods can use userns before 6.3, they will just need to be
	  careful to not use a tmpfs (like a serviceaccount). MOST users
	  will probably need 6.3, but it is possible to use earlier kernel
	  versions. 5.19 probably works fine and with improvements in
          the runtime 5.12 can probably be supported too.
	* Several distros backport changes and the recommended way is
	  usually to try the syscall instead of testing kernel versions.
	  I expect support for simple fs like tmpfs will be backported
	  in several distros, but with this check it can generate confusion.
	* Today a clear error is shown when the pod is created, so it's
	  unlikely a user will not understand why it fails.
	* Returning an error if utilkernel fails to understand what
	  kernel version is running is also too strict (as we are
	  logging a warning even if it is not the expected version)
	* We are switching to enabled by default, which will log a
	  warning on every user that runs on an older than 6.3 kernel,
	  adding noise to the logs.

For there reasons, let's just remove the hardcoded kernel version check.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
This commit is contained in:
Rodrigo Campos 2025-02-18 17:15:22 +01:00
parent c88aef2d63
commit 1e53e59c3a
2 changed files with 0 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/kubelet/kubelet_pods.go
View File

@ -41,7 +41,6 @@ import (
"k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/sets"
utilvalidation "k8s.io/apimachinery/pkg/util/validation"
"k8s.io/apimachinery/pkg/util/version"
utilfeature "k8s.io/apiserver/pkg/util/feature"
runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1"
"k8s.io/klog/v2"
@ -62,7 +61,6 @@ import (
"k8s.io/kubernetes/pkg/kubelet/status"
kubetypes "k8s.io/kubernetes/pkg/kubelet/types"
utilfs "k8s.io/kubernetes/pkg/util/filesystem"
utilkernel "k8s.io/kubernetes/pkg/util/kernel"
utilpod "k8s.io/kubernetes/pkg/util/pod"
volumeutil "k8s.io/kubernetes/pkg/volume/util"
"k8s.io/kubernetes/pkg/volume/util/hostutil"
@ -131,17 +129,6 @@ func (kl *Kubelet) getKubeletMappings() (uint32, uint32, error) {
if !utilfeature.DefaultFeatureGate.Enabled(features.UserNamespacesSupport) {
return defaultFirstID, defaultLen, nil
} else {
kernelVersion, err := utilkernel.GetVersion()
if err != nil {
return 0, 0, fmt.Errorf("failed to get kernel version, unable to determine if feature %s can be supported : %w",
features.UserNamespacesSupport, err)
}
if kernelVersion != nil && !kernelVersion.AtLeast(version.MustParseGeneric(utilkernel.UserNamespacesSupportKernelVersion)) {
return 0, 0, fmt.Errorf(
"the kernel version (%s) is incompatible with the %s feature gate, which needs %s as a minimum kernel version",
kernelVersion, features.UserNamespacesSupport, utilkernel.UserNamespacesSupportKernelVersion)
}
}
_, err := user.Lookup(kubeletUser)

4
pkg/util/kernel/constants.go
View File

@ -44,10 +44,6 @@ const TCPFinTimeoutNamespacedKernelVersion = "4.6"
// (ref: https://github.com/torvalds/linux/commit/35dfb013149f74c2be1ff9c78f14e6a3cd1539d1)
const IPVSConnReuseModeFixedKernelVersion = "5.9"
// UserNamespacesSupportKernelVersion is the kernel version where idmap for tmpfs support was added
// (ref: https://github.com/torvalds/linux/commit/05e6295f7b5e05f09e369a3eb2882ec5b40fff20)
const UserNamespacesSupportKernelVersion = "6.3"
const TmpfsNoswapSupportKernelVersion = "6.4"
// NFTablesKubeProxyKernelVersion is the lowest kernel version kube-proxy supports using