From 8597b343fa49dcb491282eaa5e5887221a985905 Mon Sep 17 00:00:00 2001 From: Davanum Srinivas Date: Tue, 7 May 2024 15:57:47 -0400 Subject: [PATCH] Enforce the Minimum Kernel Version 6.3 for UserNamespacesSupport feature Signed-off-by: Davanum Srinivas --- pkg/kubelet/kubelet_pods.go | 13 +++++++++++++ pkg/util/kernel/constants.go | 4 ++++ 2 files changed, 17 insertions(+) diff --git a/pkg/kubelet/kubelet_pods.go b/pkg/kubelet/kubelet_pods.go index 58b28eb77e2..5a74ec44212 100644 --- a/pkg/kubelet/kubelet_pods.go +++ b/pkg/kubelet/kubelet_pods.go @@ -41,6 +41,7 @@ import ( "k8s.io/apimachinery/pkg/types" "k8s.io/apimachinery/pkg/util/sets" utilvalidation "k8s.io/apimachinery/pkg/util/validation" + "k8s.io/apimachinery/pkg/util/version" utilfeature "k8s.io/apiserver/pkg/util/feature" runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1" "k8s.io/klog/v2" @@ -62,6 +63,7 @@ import ( kubetypes "k8s.io/kubernetes/pkg/kubelet/types" "k8s.io/kubernetes/pkg/kubelet/util" utilfs "k8s.io/kubernetes/pkg/util/filesystem" + utilkernel "k8s.io/kubernetes/pkg/util/kernel" utilpod "k8s.io/kubernetes/pkg/util/pod" volumeutil "k8s.io/kubernetes/pkg/volume/util" "k8s.io/kubernetes/pkg/volume/util/hostutil" @@ -130,6 +132,17 @@ func (kl *Kubelet) getKubeletMappings() (uint32, uint32, error) { if !utilfeature.DefaultFeatureGate.Enabled(features.UserNamespacesSupport) { return defaultFirstID, defaultLen, nil + } else { + kernelVersion, err := utilkernel.GetVersion() + if err != nil { + return 0, 0, fmt.Errorf("failed to get kernel version, unable to determine if feature %s can be supported : %w", + features.UserNamespacesSupport, err) + } + if kernelVersion != nil && !kernelVersion.AtLeast(version.MustParseGeneric(utilkernel.UserNamespacesSupportKernelVersion)) { + return 0, 0, fmt.Errorf( + "the kernel version (%s) is incompatible with the %s feature gate, which needs %s as a minimum kernel version", + kernelVersion, features.UserNamespacesSupport, utilkernel.UserNamespacesSupportKernelVersion) + } } _, err := user.Lookup(kubeletUser) diff --git a/pkg/util/kernel/constants.go b/pkg/util/kernel/constants.go index da512ce3c71..86ba8f6106c 100644 --- a/pkg/util/kernel/constants.go +++ b/pkg/util/kernel/constants.go @@ -43,3 +43,7 @@ const TCPFinTimeoutNamespacedKernelVersion = "4.6" // IPVSConnReuseModeFixedKernelVersion is the kernel version in which net.ipv4.vs.conn_reuse_mode was fixed. // (ref: https://github.com/torvalds/linux/commit/35dfb013149f74c2be1ff9c78f14e6a3cd1539d1) const IPVSConnReuseModeFixedKernelVersion = "5.9" + +// UserNamespacesSupportKernelVersion is the kernel version where idmap for tmpfs support was added +// (ref: https://github.com/torvalds/linux/commit/05e6295f7b5e05f09e369a3eb2882ec5b40fff20) +const UserNamespacesSupportKernelVersion = "6.3"