From c88aef2d63a6b1dfb44f47eab6acb0475c951c70 Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Tue, 18 Feb 2025 17:10:56 +0100 Subject: [PATCH 1/2] Revert "Switch hard error to a WARNING for kernel version check" This reverts commit fd06dcd604102ef3b06b71501e8e12fb51c11fab. The revert is not to make it a hard error again, this revert is needed to revert cleanly the commit that added this as an error in the first place. Signed-off-by: Rodrigo Campos --- pkg/kubelet/kubelet_pods.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/kubelet/kubelet_pods.go b/pkg/kubelet/kubelet_pods.go index 7d24a90b0e7..b44e0576f83 100644 --- a/pkg/kubelet/kubelet_pods.go +++ b/pkg/kubelet/kubelet_pods.go @@ -138,8 +138,9 @@ func (kl *Kubelet) getKubeletMappings() (uint32, uint32, error) { features.UserNamespacesSupport, err) } if kernelVersion != nil && !kernelVersion.AtLeast(version.MustParseGeneric(utilkernel.UserNamespacesSupportKernelVersion)) { - klog.InfoS("WARNING: the kernel version is incompatible with the feature gate, which needs as a minimum kernel version", - "kernelVersion", kernelVersion, "feature", features.UserNamespacesSupport, "minKernelVersion", utilkernel.UserNamespacesSupportKernelVersion) + return 0, 0, fmt.Errorf( + "the kernel version (%s) is incompatible with the %s feature gate, which needs %s as a minimum kernel version", + kernelVersion, features.UserNamespacesSupport, utilkernel.UserNamespacesSupportKernelVersion) } } From 1e53e59c3ab1aaab9a924448593e2c064c50c588 Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Tue, 18 Feb 2025 17:15:22 +0100 Subject: [PATCH 2/2] Revert "Enforce the Minimum Kernel Version 6.3 for UserNamespacesSupport feature" This reverts commit 8597b343fa49dcb491282eaa5e5887221a985905. I wrote in the Kubernetes documentation: In practice this means you need at least Linux 6.3, as tmpfs started supporting idmap mounts in that version. This is usually needed as several Kubernetes features use tmpfs (the service account token that is mounted by default uses a tmpfs, Secrets use a tmpfs, etc.) The check is wrong for several reasons: * Pods can use userns before 6.3, they will just need to be careful to not use a tmpfs (like a serviceaccount). MOST users will probably need 6.3, but it is possible to use earlier kernel versions. 5.19 probably works fine and with improvements in the runtime 5.12 can probably be supported too. * Several distros backport changes and the recommended way is usually to try the syscall instead of testing kernel versions. I expect support for simple fs like tmpfs will be backported in several distros, but with this check it can generate confusion. * Today a clear error is shown when the pod is created, so it's unlikely a user will not understand why it fails. * Returning an error if utilkernel fails to understand what kernel version is running is also too strict (as we are logging a warning even if it is not the expected version) * We are switching to enabled by default, which will log a warning on every user that runs on an older than 6.3 kernel, adding noise to the logs. For there reasons, let's just remove the hardcoded kernel version check. Signed-off-by: Rodrigo Campos --- pkg/kubelet/kubelet_pods.go | 13 ------------- pkg/util/kernel/constants.go | 4 ---- 2 files changed, 17 deletions(-) diff --git a/pkg/kubelet/kubelet_pods.go b/pkg/kubelet/kubelet_pods.go index b44e0576f83..f4cbfe0177a 100644 --- a/pkg/kubelet/kubelet_pods.go +++ b/pkg/kubelet/kubelet_pods.go @@ -41,7 +41,6 @@ import ( "k8s.io/apimachinery/pkg/types" "k8s.io/apimachinery/pkg/util/sets" utilvalidation "k8s.io/apimachinery/pkg/util/validation" - "k8s.io/apimachinery/pkg/util/version" utilfeature "k8s.io/apiserver/pkg/util/feature" runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1" "k8s.io/klog/v2" @@ -62,7 +61,6 @@ import ( "k8s.io/kubernetes/pkg/kubelet/status" kubetypes "k8s.io/kubernetes/pkg/kubelet/types" utilfs "k8s.io/kubernetes/pkg/util/filesystem" - utilkernel "k8s.io/kubernetes/pkg/util/kernel" utilpod "k8s.io/kubernetes/pkg/util/pod" volumeutil "k8s.io/kubernetes/pkg/volume/util" "k8s.io/kubernetes/pkg/volume/util/hostutil" @@ -131,17 +129,6 @@ func (kl *Kubelet) getKubeletMappings() (uint32, uint32, error) { if !utilfeature.DefaultFeatureGate.Enabled(features.UserNamespacesSupport) { return defaultFirstID, defaultLen, nil - } else { - kernelVersion, err := utilkernel.GetVersion() - if err != nil { - return 0, 0, fmt.Errorf("failed to get kernel version, unable to determine if feature %s can be supported : %w", - features.UserNamespacesSupport, err) - } - if kernelVersion != nil && !kernelVersion.AtLeast(version.MustParseGeneric(utilkernel.UserNamespacesSupportKernelVersion)) { - return 0, 0, fmt.Errorf( - "the kernel version (%s) is incompatible with the %s feature gate, which needs %s as a minimum kernel version", - kernelVersion, features.UserNamespacesSupport, utilkernel.UserNamespacesSupportKernelVersion) - } } _, err := user.Lookup(kubeletUser) diff --git a/pkg/util/kernel/constants.go b/pkg/util/kernel/constants.go index 6775027e7a0..99c60a44bed 100644 --- a/pkg/util/kernel/constants.go +++ b/pkg/util/kernel/constants.go @@ -44,10 +44,6 @@ const TCPFinTimeoutNamespacedKernelVersion = "4.6" // (ref: https://github.com/torvalds/linux/commit/35dfb013149f74c2be1ff9c78f14e6a3cd1539d1) const IPVSConnReuseModeFixedKernelVersion = "5.9" -// UserNamespacesSupportKernelVersion is the kernel version where idmap for tmpfs support was added -// (ref: https://github.com/torvalds/linux/commit/05e6295f7b5e05f09e369a3eb2882ec5b40fff20) -const UserNamespacesSupportKernelVersion = "6.3" - const TmpfsNoswapSupportKernelVersion = "6.4" // NFTablesKubeProxyKernelVersion is the lowest kernel version kube-proxy supports using