This commit introduces enum-based validation for the `AllocationConfigSource` field.
The following changes are included:
- The `AllocationConfigSource` type is now marked with `+k8s:enum`.
- The `Source` field in `DeviceAllocationConfiguration` is marked as required.
- Generated validation files are updated to enforce the enum constraint.
- A declarative validation test is added for the `AllocationConfigSource` field.
Golang allows to call methods on a nil object, as long as the methods
don't dereference the nil object. This is what we do here.
This makes all the userns configurations (idsPerPod or mapping configs
in /etc/subuid or /etc/subgid) to be ignored if the feature is off.
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
The first UID used for userns mappings needs to be at least the
idsPerPod. When idsPerPod is extended to be 65536*2, for example, then
the default UID of 65536 doesn't work.
While this can be configured by the user, let's just improve the default
first UID to be the same as idsPerPod. This makes the default first UID
work out of the box if the user just wants to tune that.
This also simplifies testing, as we don't need to create a system user
and /etc/subuid and /etc/subgid files to test the idsPerPod setting.
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
The idsPerPod where completely ignored since they were introduced in PR:
https://github.com/kubernetes/kubernetes/pull/130028
The problem was the following:
1. The userns manager (as well as all managers) is created
before the config is copied to the kubelet object[1]
2. The userns manager on creation is calling the kubelet_getter
GetUserNamespacesIDsPerPod to get the idsPerPod
3. The getter checks the configuration stored in the kubelet
object, which hasn't been set at that point.
4. As the config is nil (unset), it returns the default value.
Therefore, the value was ignored.
To solve this, let's just pass the idsPerPod as a parameter to
MakeUserNsManager(). This is the common pattern already used in the
kubelet initialization.
[1]: 461ba83084/pkg/kubelet/kubelet.go (L1078-L1087)
[2]: 461ba83084/pkg/kubelet/kubelet_getters.go (L145)
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
unit tests for the policy options add test options to the
global state without proper cleanup; this is done only in tests
so it has limited room for doing damage, but still weakens
the test signal. Let's avoid that adding proper cleanup.
Signed-off-by: Francesco Romani <fromani@redhat.com>
This commit migrates the validation for the DeviceAllocationResult.Config field to declarative validation by adding the +k8s:maxItems=64 annotation.
The change is applied to the following API versions:
- resource/v1
- resource/v1beta1
- resource/v1beta2
