From c0eb9e34337c15f2fb58cb0646ca38457c7abdf0 Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Tue, 6 May 2025 14:58:32 +0200 Subject: [PATCH] userns: Improve error returned if userns is not supported This makes it clear the error comes due to a user namespace configuration. Otherwise the error returned looks too generic and is not clear. Before this PR, the error was: Warning FailedCreatePodSandBox 1s kubelet Failed to create pod sandbox: the handler "" is not known Now it is: Warning FailedCreatePodSandBox 1s kubelet Failed to create pod sandbox: runtime does not support user namespaces Signed-off-by: Rodrigo Campos --- pkg/kubelet/userns/userns_manager.go | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/pkg/kubelet/userns/userns_manager.go b/pkg/kubelet/userns/userns_manager.go index 73167783297..fe14ffc6e86 100644 --- a/pkg/kubelet/userns/userns_manager.go +++ b/pkg/kubelet/userns/userns_manager.go @@ -411,10 +411,15 @@ func (m *UsernsManager) GetOrCreateUserNamespaceMappings(pod *v1.Pod, runtimeHan // From here onwards, hostUsers=false and the feature gate is enabled. // if the pod requested a user namespace and the runtime doesn't support user namespaces then return an error. - if handlerSupportsUserns, err := m.kl.HandlerSupportsUserNamespaces(runtimeHandler); err != nil { - return nil, err - } else if !handlerSupportsUserns { - return nil, fmt.Errorf("RuntimeClass handler %q does not support user namespaces", runtimeHandler) + if handlerSupportsUserns, err := m.kl.HandlerSupportsUserNamespaces(runtimeHandler); err != nil || !handlerSupportsUserns { + msg := "can't set `spec.hostUsers: false`, runtime does not support user namespaces" + if runtimeHandler != "" { + msg = fmt.Sprintf("can't set `spec.hostUsers: false`, RuntimeClass handler %q does not support user namespaces", runtimeHandler) + } + if err != nil { + return nil, fmt.Errorf("%v: %w", msg, err) + } + return nil, fmt.Errorf("%v", msg) } m.lock.Lock()