From 4ed3768dc95c77810ac18f60591a8400c028d82c Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Tue, 6 May 2025 14:54:55 +0200 Subject: [PATCH 1/3] userns: Use len to handle empty non-nil slices When using an old runtime like containerd 1.7, this message is not implemented and what we get here is an empty non-nil slice. Let's check the len of the slice instead. While we are there, let's just return false and no error. In the following commits we will wrap the error and we didn't find any more info to add here. Signed-off-by: Rodrigo Campos --- pkg/kubelet/kubelet_getters.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/kubelet/kubelet_getters.go b/pkg/kubelet/kubelet_getters.go index 2928673b6c3..d63c76df689 100644 --- a/pkg/kubelet/kubelet_getters.go +++ b/pkg/kubelet/kubelet_getters.go @@ -120,8 +120,9 @@ func (kl *Kubelet) ListPodsFromDisk() ([]types.UID, error) { // user namespaces. func (kl *Kubelet) HandlerSupportsUserNamespaces(rtHandler string) (bool, error) { rtHandlers := kl.runtimeState.runtimeHandlers() - if rtHandlers == nil { - return false, fmt.Errorf("runtime handlers are not set") + if len(rtHandlers) == 0 { + // The slice is empty if the runtime is old and doesn't support this message. + return false, nil } for _, h := range rtHandlers { if h.Name == rtHandler { From 43f61e80de3cf84142274b43b8062ab6d55578c6 Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Tue, 6 May 2025 14:58:32 +0200 Subject: [PATCH 2/3] userns: Improve error returned if userns is not supported This makes it clear the error comes due to a user namespace configuration. Otherwise the error returned looks too generic and is not clear. Before this PR, the error was: Warning FailedCreatePodSandBox 1s kubelet Failed to create pod sandbox: the handler "" is not known Now it is: Warning FailedCreatePodSandBox 1s kubelet Failed to create pod sandbox: runtime does not support user namespaces Signed-off-by: Rodrigo Campos --- pkg/kubelet/userns/userns_manager.go | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/pkg/kubelet/userns/userns_manager.go b/pkg/kubelet/userns/userns_manager.go index 57d38b972df..1a1c20b63fa 100644 --- a/pkg/kubelet/userns/userns_manager.go +++ b/pkg/kubelet/userns/userns_manager.go @@ -417,10 +417,15 @@ func (m *UsernsManager) GetOrCreateUserNamespaceMappings(pod *v1.Pod, runtimeHan // From here onwards, hostUsers=false and the feature gate is enabled. // if the pod requested a user namespace and the runtime doesn't support user namespaces then return an error. - if handlerSupportsUserns, err := m.kl.HandlerSupportsUserNamespaces(runtimeHandler); err != nil { - return nil, err - } else if !handlerSupportsUserns { - return nil, fmt.Errorf("RuntimeClass handler %q does not support user namespaces", runtimeHandler) + if handlerSupportsUserns, err := m.kl.HandlerSupportsUserNamespaces(runtimeHandler); err != nil || !handlerSupportsUserns { + msg := "can't set `spec.hostUsers: false`, runtime does not support user namespaces" + if runtimeHandler != "" { + msg = fmt.Sprintf("can't set `spec.hostUsers: false`, RuntimeClass handler %q does not support user namespaces", runtimeHandler) + } + if err != nil { + return nil, fmt.Errorf("%v: %w", msg, err) + } + return nil, fmt.Errorf("%v", msg) } m.lock.Lock() From 441dd305150d2a6dabb33f0f640421f0ee6637fb Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Tue, 6 May 2025 15:01:32 +0200 Subject: [PATCH 3/3] userns: Wrap more errors Most errors where already wrapped, but these were missing. Signed-off-by: Rodrigo Campos --- pkg/kubelet/userns/userns_manager.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/kubelet/userns/userns_manager.go b/pkg/kubelet/userns/userns_manager.go index 1a1c20b63fa..728757b4f19 100644 --- a/pkg/kubelet/userns/userns_manager.go +++ b/pkg/kubelet/userns/userns_manager.go @@ -440,12 +440,12 @@ func (m *UsernsManager) GetOrCreateUserNamespaceMappings(pod *v1.Pod, runtimeHan if string(content) != "" { userNs, err = m.parseUserNsFileAndRecord(pod.UID, content) if err != nil { - return nil, err + return nil, fmt.Errorf("user namespace: %w", err) } } else { userNs, err = m.createUserNs(pod) if err != nil { - return nil, err + return nil, fmt.Errorf("create user namespace: %w", err) } } @@ -496,7 +496,7 @@ func (m *UsernsManager) CleanupOrphanedPodUsernsAllocations(pods []*v1.Pod, runn allFound := sets.New[string]() found, err := m.kl.ListPodsFromDisk() if err != nil { - return err + return fmt.Errorf("user namespace: read pods from disk: %w", err) } for _, podUID := range found {