diff --git a/pkg/kubelet/kuberuntime/helpers.go b/pkg/kubelet/kuberuntime/helpers.go index 214549bdadb..e66440447aa 100644 --- a/pkg/kubelet/kuberuntime/helpers.go +++ b/pkg/kubelet/kuberuntime/helpers.go @@ -25,7 +25,9 @@ import ( "github.com/golang/glog" "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/types" + utilfeature "k8s.io/apiserver/pkg/util/feature" v1helper "k8s.io/kubernetes/pkg/apis/core/v1/helper" + "k8s.io/kubernetes/pkg/features" runtimeapi "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2" kubecontainer "k8s.io/kubernetes/pkg/kubelet/container" ) @@ -303,7 +305,9 @@ func pidNamespaceForPod(pod *v1.Pod) runtimeapi.NamespaceMode { if pod.Spec.HostPID { return runtimeapi.NamespaceMode_NODE } - // TODO(verb): set NamespaceMode_POD based on ShareProcessNamespace after #58716 is merged + if utilfeature.DefaultFeatureGate.Enabled(features.PodShareProcessNamespace) && pod.Spec.ShareProcessNamespace != nil && *pod.Spec.ShareProcessNamespace { + return runtimeapi.NamespaceMode_POD + } } // Note that PID does not default to the zero value for v1.Pod return runtimeapi.NamespaceMode_CONTAINER diff --git a/pkg/kubelet/kuberuntime/helpers_test.go b/pkg/kubelet/kuberuntime/helpers_test.go index 7eaf377dee0..47379620022 100644 --- a/pkg/kubelet/kuberuntime/helpers_test.go +++ b/pkg/kubelet/kuberuntime/helpers_test.go @@ -346,7 +346,75 @@ func TestNamespacesForPod(t *testing.T) { Pid: runtimeapi.NamespaceMode_NODE, }, }, - // TODO(verb): add test cases for ShareProcessNamespace true (after #58716 is merged) + "Shared Process Namespace (feature enabled)": { + &v1.Pod{ + Spec: v1.PodSpec{ + ShareProcessNamespace: &[]bool{true}[0], + }, + }, + &runtimeapi.NamespaceOption{ + Ipc: runtimeapi.NamespaceMode_POD, + Network: runtimeapi.NamespaceMode_POD, + Pid: runtimeapi.NamespaceMode_POD, + }, + }, + "Shared Process Namespace, redundant flag (feature enabled)": { + &v1.Pod{ + Spec: v1.PodSpec{ + ShareProcessNamespace: &[]bool{false}[0], + }, + }, + &runtimeapi.NamespaceOption{ + Ipc: runtimeapi.NamespaceMode_POD, + Network: runtimeapi.NamespaceMode_POD, + Pid: runtimeapi.NamespaceMode_CONTAINER, + }, + }, + } { + t.Logf("TestCase: %s", desc) + actual := namespacesForPod(test.input) + assert.Equal(t, test.expected, actual) + } + + // Test ShareProcessNamespace feature disabled, feature gate restored by previous defer + utilfeaturetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.PodShareProcessNamespace, false) + + for desc, test := range map[string]struct { + input *v1.Pod + expected *runtimeapi.NamespaceOption + }{ + "v1.Pod default namespaces": { + &v1.Pod{}, + &runtimeapi.NamespaceOption{ + Ipc: runtimeapi.NamespaceMode_POD, + Network: runtimeapi.NamespaceMode_POD, + Pid: runtimeapi.NamespaceMode_CONTAINER, + }, + }, + "Shared Process Namespace (feature disabled)": { + &v1.Pod{ + Spec: v1.PodSpec{ + ShareProcessNamespace: &[]bool{true}[0], + }, + }, + &runtimeapi.NamespaceOption{ + Ipc: runtimeapi.NamespaceMode_POD, + Network: runtimeapi.NamespaceMode_POD, + Pid: runtimeapi.NamespaceMode_CONTAINER, + }, + }, + "Shared Process Namespace, redundant flag (feature disabled)": { + &v1.Pod{ + Spec: v1.PodSpec{ + ShareProcessNamespace: &[]bool{false}[0], + }, + }, + &runtimeapi.NamespaceOption{ + Ipc: runtimeapi.NamespaceMode_POD, + Network: runtimeapi.NamespaceMode_POD, + Pid: runtimeapi.NamespaceMode_CONTAINER, + }, + }, } { t.Logf("TestCase: %s", desc) actual := namespacesForPod(test.input)