From ef132adf02f9670f8eeef673a8993b77ecc17d57 Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Tue, 6 May 2025 14:54:55 +0200 Subject: [PATCH 1/3] userns: Use len to handle empty non-nil slices When using an old runtime like containerd 1.7, this message is not implemented and what we get here is an empty non-nil slice. Let's check the len of the slice instead. While we are there, let's just return false and no error. In the following commits we will wrap the error and we didn't find any more info to add here. Signed-off-by: Rodrigo Campos --- pkg/kubelet/kubelet_getters.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/kubelet/kubelet_getters.go b/pkg/kubelet/kubelet_getters.go index a32f197143f..918ce9006d7 100644 --- a/pkg/kubelet/kubelet_getters.go +++ b/pkg/kubelet/kubelet_getters.go @@ -120,8 +120,9 @@ func (kl *Kubelet) ListPodsFromDisk() ([]types.UID, error) { // user namespaces. func (kl *Kubelet) HandlerSupportsUserNamespaces(rtHandler string) (bool, error) { rtHandlers := kl.runtimeState.runtimeHandlers() - if rtHandlers == nil { - return false, fmt.Errorf("runtime handlers are not set") + if len(rtHandlers) == 0 { + // The slice is empty if the runtime is old and doesn't support this message. + return false, nil } for _, h := range rtHandlers { if h.Name == rtHandler { From 80aa6d0b1ea67c211fdc147c52febe453a12e33c Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Tue, 6 May 2025 14:58:32 +0200 Subject: [PATCH 2/3] userns: Improve error returned if userns is not supported This makes it clear the error comes due to a user namespace configuration. Otherwise the error returned looks too generic and is not clear. Before this PR, the error was: Warning FailedCreatePodSandBox 1s kubelet Failed to create pod sandbox: the handler "" is not known Now it is: Warning FailedCreatePodSandBox 1s kubelet Failed to create pod sandbox: runtime does not support user namespaces Signed-off-by: Rodrigo Campos --- pkg/kubelet/userns/userns_manager.go | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/pkg/kubelet/userns/userns_manager.go b/pkg/kubelet/userns/userns_manager.go index c431e0511af..2440538f98b 100644 --- a/pkg/kubelet/userns/userns_manager.go +++ b/pkg/kubelet/userns/userns_manager.go @@ -409,10 +409,15 @@ func (m *UsernsManager) GetOrCreateUserNamespaceMappings(pod *v1.Pod, runtimeHan // From here onwards, hostUsers=false and the feature gate is enabled. // if the pod requested a user namespace and the runtime doesn't support user namespaces then return an error. - if handlerSupportsUserns, err := m.kl.HandlerSupportsUserNamespaces(runtimeHandler); err != nil { - return nil, err - } else if !handlerSupportsUserns { - return nil, fmt.Errorf("RuntimeClass handler %q does not support user namespaces", runtimeHandler) + if handlerSupportsUserns, err := m.kl.HandlerSupportsUserNamespaces(runtimeHandler); err != nil || !handlerSupportsUserns { + msg := "can't set `spec.hostUsers: false`, runtime does not support user namespaces" + if runtimeHandler != "" { + msg = fmt.Sprintf("can't set `spec.hostUsers: false`, RuntimeClass handler %q does not support user namespaces", runtimeHandler) + } + if err != nil { + return nil, fmt.Errorf("%v: %w", msg, err) + } + return nil, fmt.Errorf("%v", msg) } m.lock.Lock() From d222ec14265b7720cf8c89b527de763ac6ce5d6f Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Tue, 6 May 2025 15:01:32 +0200 Subject: [PATCH 3/3] userns: Wrap more errors Most errors where already wrapped, but these were missing. Signed-off-by: Rodrigo Campos --- pkg/kubelet/userns/userns_manager.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/kubelet/userns/userns_manager.go b/pkg/kubelet/userns/userns_manager.go index 2440538f98b..9243a38d289 100644 --- a/pkg/kubelet/userns/userns_manager.go +++ b/pkg/kubelet/userns/userns_manager.go @@ -432,12 +432,12 @@ func (m *UsernsManager) GetOrCreateUserNamespaceMappings(pod *v1.Pod, runtimeHan if string(content) != "" { userNs, err = m.parseUserNsFileAndRecord(pod.UID, content) if err != nil { - return nil, err + return nil, fmt.Errorf("user namespace: %w", err) } } else { userNs, err = m.createUserNs(pod) if err != nil { - return nil, err + return nil, fmt.Errorf("create user namespace: %w", err) } } @@ -488,7 +488,7 @@ func (m *UsernsManager) CleanupOrphanedPodUsernsAllocations(pods []*v1.Pod, runn allFound := sets.NewString() found, err := m.kl.ListPodsFromDisk() if err != nil { - return err + return fmt.Errorf("user namespace: read pods from disk: %w", err) } for _, podUID := range found {