docs and tests: update for user namespace modes #5476

haircommander · 2021-11-29T20:20:40Z

What type of PR is this?

/kind documentation
/kind ci

What this PR does / why we need it:

previously, the documentation and testing around user namespaces was pretty poor. Let's update both in one feld swoop, so we know we're testing the stuff we claim works in our docs

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

none

codecov · 2021-11-29T20:28:19Z

Codecov Report

Merging #5476 (da8f9a0) into main (fc844e4) will increase coverage by 0.00%.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #5476   +/-   ##
=======================================
  Coverage   43.27%   43.28%           
=======================================
  Files         120      120           
  Lines       11995    11995           
=======================================
+ Hits         5191     5192    +1     
+ Misses       6309     6308    -1     
  Partials      495      495

mrunalp · 2021-11-30T01:01:20Z

@giuseppe @nalind ptal

giuseppe

LGTM

TomSweeneyRedHat · 2021-12-01T01:16:14Z

tutorials/userns.md

+### CRI-O configuration
+To enable pods to be able to use the userns-mode annotation, the pod must be allowed to interpret the experimental annotation `io.kubernetes.cri-o.userns-mode`.
+#### 1.23.0 and beyond
+In CRI-O versions greater than 1.23.0, this can be done by creating a custom workload. This can be done by creating a file with the following contents in /etc/crio/crio.conf.d/01-userns-workload.conf


Suggested change

In CRI-O versions greater than 1.23.0, this can be done by creating a custom workload. This can be done by creating a file with the following contents in /etc/crio/crio.conf.d/01-userns-workload.conf

In CRI-O versions greater than 1.23.0, create a file with the following contents in /etc/crio/crio.conf.d/01-userns-workload.conf

"This can be done" got a little redundant.

TomSweeneyRedHat · 2021-12-01T01:18:54Z

tutorials/userns.md

+## Setup
+
+### /etc/sub{g,u}id
+To start, the host will have to have `/etc/subuid` and `/etc/subgid` files set correctly. By default, the [library CRI-O uses for container storage](https://github.com/containers/storage) assumes there will be entries in each of these files for the `containers` user. If one would like to have a different user's entries in `/etc/sub?id` files, then the field `remap-user` and `remap-group` can be configured in `/etc/containers/storage.conf` in the `[storage.options]` table.


I try to avoid pronouns on a man page. Suggest dropping "If one would like" at the start of the third sentence for instance. Etc throughout, YMMV.

TomSweeneyRedHat · 2021-12-01T01:19:56Z

tutorials/userns.md

+allowed_annotations = ["io.kubernetes.cri-o.userns-mode"]
+```
+
+This will allow any pod with the `io.kubernetes.cri-o.userns-mode` annotation to configure a user namespace. CRI-O opts for this approach to give admins the ability to toggle the behavior on their nodes, just in case an admin doesn't want their users to be able to create user namespace. An admin can also set a different `activation_annotation` if they'd like a different annotation to allow pods to configure user namespaces.


prefer "administrator" to "admin"

TomSweeneyRedHat · 2021-12-01T01:21:57Z

LGTM in general, just a couple Sweeney-tics to consider.

nee1esh · 2021-12-01T18:52:14Z

/retest-required

nee1esh · 2021-12-01T20:41:08Z

/retest-required

haircommander · 2021-12-02T14:41:18Z

not ok 219 userns annotation auto should succeed
# (in test file ./userns_annotation.bats, line 28)
#   `ctr_id=$(crictl run "$TESTDATA"/container_sleep.json "$sboxconfig")' failed
# time="2021-12-01T21:25:00Z" level=warning msg="Support for the 'registries' option has been dropped but it is referenced in \"/etc/crio/crio.conf.d/01-registries.conf\".  Please use containers-registries.conf(5) for configuring unqualified-search registries instead."
# time="2021-12-01 21:25:00.679796716Z" level=info msg="Starting CRI-O, version: 1.23.0, git: 6f2b52908ee579f4f2aceea367e3ca86525c243d(dirty)"
# level=info msg="Using default capabilities: CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FSETID, CAP_FOWNER, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_KILL"
# time="2021-12-01 21:25:00.973610374Z" level=info msg="Starting CRI-O, version: 1.23.0, git: 6f2b52908ee579f4f2aceea367e3ca86525c243d(dirty)"
# level=info msg="Using default capabilities: CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FSETID, CAP_FOWNER, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_KILL"
# time="2021-12-01T21:25:09Z" level=fatal msg="running container: run pod sandbox: rpc error: code = Unknown desc = failed to pin namespaces [0xc0007cb380 0xc0007cb3b0 0xc0007cb3e0 0xc0007cb410]: [pinns:e]: Failed to unshare namespaces: Invalid argument\n[pinns:e]: Failed to read from the sync pipe: Success\n exit status 1"
# # --- crio.log :: ---

link
@giuseppe I am guessing we're expected to not be able to configure user namespaces correctly on rhel 7?

haircommander · 2021-12-02T14:41:42Z

/retest-required

haircommander · 2021-12-07T14:29:10Z

/retest

haircommander · 2021-12-08T14:21:57Z

@cri-o/cri-o-maintainers PTAL

haircommander · 2021-12-08T16:17:54Z

/retest-required

saschagrunert

Just one nit, otherwise LGTM

saschagrunert · 2021-12-09T08:13:53Z

tutorials/userns.md

@@ -0,0 +1,65 @@
+# User namespaces and CRI-O


Let's link this tutorial from somewhere.

saschagrunert · 2021-12-09T08:16:17Z

/retest-required

nalind · 2021-12-09T15:41:22Z

@haircommander does the RHEL 7 node have the user.max_user_namespaces sysctl set to a non-zero value? IIRC it isn't set to a non-zero value by default there, while it is in later releases.

Signed-off-by: Peter Hunt <[email protected]>

haircommander · 2021-12-13T20:43:01Z

@haircommander does the RHEL 7 node have the user.max_user_namespaces sysctl set to a non-zero value? IIRC it isn't set to a non-zero value by default there, while it is in later releases.

I will try that!

Signed-off-by: Peter Hunt <[email protected]>

saschagrunert

LGTM

haircommander · 2021-12-14T19:01:14Z

/override ci/openshift-jenkins/integration_crun
/retest-required

openshift-ci · 2021-12-14T19:01:16Z

@haircommander: Overrode contexts on behalf of haircommander: ci/openshift-jenkins/integration_crun

Details

In response to this:

/override ci/openshift-jenkins/integration_crun
/retest-required

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

haircommander · 2021-12-15T18:07:50Z

/test integration_crun

saschagrunert

/lgtm

openshift-ci · 2021-12-16T15:21:28Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe, haircommander, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [giuseppe,haircommander,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2021-12-16T15:43:37Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-12-16T16:07:22Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-ci · 2021-12-16T16:32:07Z

@haircommander: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/openshift-jenkins/e2e_crun_cgroupv2	`da8f9a0`	link	false	`/test e2e_cgroupv2`
ci/openshift-jenkins/integration_crun_cgroupv2	`da8f9a0`	link	false	`/test integration_cgroupv2`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

haircommander · 2021-12-16T17:56:00Z

/override e2e-agnostic

openshift-ci · 2021-12-16T17:56:02Z

@haircommander: /override requires a failed status context or a job name to operate on.
The following unknown contexts were given:

e2e-agnostic

Only the following contexts were expected:

ci/kata-jenkins
ci/openshift-jenkins/critest_fedora
ci/openshift-jenkins/critest_rhel
ci/openshift-jenkins/e2e_crun
ci/openshift-jenkins/e2e_crun_cgroupv2
ci/openshift-jenkins/e2e_features_fedora
ci/openshift-jenkins/e2e_features_rhel
ci/openshift-jenkins/e2e_fedora
ci/openshift-jenkins/e2e_rhel
ci/openshift-jenkins/integration_crun
ci/openshift-jenkins/integration_crun_cgroupv2
ci/openshift-jenkins/integration_fedora
ci/openshift-jenkins/integration_rhel
ci/prow/e2e-agnostic
ci/prow/e2e-gcp
ci/prow/images
dco
kata-containers-2-crio-PR
lift
pull-ci-cri-o-cri-o-main-e2e-agnostic
pull-ci-cri-o-cri-o-main-e2e-gcp
pull-ci-cri-o-cri-o-main-images
test_pull_request_crio_critest_fedora
test_pull_request_crio_critest_rhel
test_pull_request_crio_e2e_crun_fedora
test_pull_request_crio_e2e_crun_fedora_cgroupv2
test_pull_request_crio_e2e_features_fedora
test_pull_request_crio_e2e_features_rhel
test_pull_request_crio_e2e_fedora
test_pull_request_crio_e2e_rhel
test_pull_request_crio_integration_crun_fedora
test_pull_request_crio_integration_crun_fedora_cgroupv2
test_pull_request_crio_integration_fedora
test_pull_request_crio_integration_rhel
tide

Details

In response to this:

/override e2e-agnostic

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

haircommander · 2021-12-16T17:56:17Z

/override ci/prow/e2e-agnostic

openshift-ci · 2021-12-16T17:56:20Z

@haircommander: Overrode contexts on behalf of haircommander: ci/prow/e2e-agnostic

Details

In response to this:

/override ci/prow/e2e-agnostic

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

haircommander requested review from mrunalp and runcom as code owners November 29, 2021 20:20

openshift-ci bot requested review from umohnani8 and vrothberg November 29, 2021 20:20

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 29, 2021

haircommander force-pushed the userns-test-and-docs branch from 21eb366 to 0769d8c Compare November 29, 2021 20:25

haircommander force-pushed the userns-test-and-docs branch 2 times, most recently from a5cd9d6 to 45ff227 Compare November 29, 2021 22:33

giuseppe approved these changes Nov 30, 2021

View reviewed changes

TomSweeneyRedHat reviewed Dec 1, 2021

View reviewed changes

haircommander force-pushed the userns-test-and-docs branch from 45ff227 to 6f2b529 Compare December 1, 2021 20:51

haircommander added this to the 1.23 milestone Dec 2, 2021

haircommander force-pushed the userns-test-and-docs branch 2 times, most recently from 7b607ea to d98f78f Compare December 6, 2021 21:31

haircommander force-pushed the userns-test-and-docs branch from d98f78f to 45fa8e7 Compare December 8, 2021 14:07

saschagrunert approved these changes Dec 9, 2021

View reviewed changes

haircommander added 2 commits December 13, 2021 15:42

test: move workload creation function to helpers

ce36999

Signed-off-by: Peter Hunt <[email protected]>

test: add tests for user namespace annotations

231a358

Signed-off-by: Peter Hunt <[email protected]>

haircommander force-pushed the userns-test-and-docs branch from 45fa8e7 to 6e3dfa2 Compare December 13, 2021 20:42

haircommander added 4 commits December 13, 2021 17:04

docs: add tutorial for setting up user namespaces

0675511

Signed-off-by: Peter Hunt <[email protected]>

gh-actions/contrib: setup sub{g,u}id

0864aed

Signed-off-by: Peter Hunt <[email protected]>

lint: bump cyclo complexity

b8a7662

Signed-off-by: Peter Hunt <[email protected]>

set user.max_user_namespaces in case it's not

da8f9a0

Signed-off-by: Peter Hunt <[email protected]>

haircommander force-pushed the userns-test-and-docs branch from 6e3dfa2 to da8f9a0 Compare December 13, 2021 22:04

saschagrunert approved these changes Dec 14, 2021

View reviewed changes

saschagrunert approved these changes Dec 16, 2021

View reviewed changes

openshift-ci bot assigned saschagrunert Dec 16, 2021

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 16, 2021

openshift-merge-robot merged commit cbcc270 into cri-o:main Dec 16, 2021

	In CRI-O versions greater than 1.23.0, this can be done by creating a custom workload. This can be done by creating a file with the following contents in /etc/crio/crio.conf.d/01-userns-workload.conf
	In CRI-O versions greater than 1.23.0, create a file with the following contents in /etc/crio/crio.conf.d/01-userns-workload.conf

docs and tests: update for user namespace modes #5476

docs and tests: update for user namespace modes #5476

Uh oh!

Conversation

haircommander commented Nov 29, 2021

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

codecov bot commented Nov 29, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

mrunalp commented Nov 30, 2021

Uh oh!

giuseppe left a comment

Choose a reason for hiding this comment

Uh oh!

TomSweeneyRedHat Dec 1, 2021

Choose a reason for hiding this comment

Uh oh!

TomSweeneyRedHat Dec 1, 2021

Choose a reason for hiding this comment

Uh oh!

TomSweeneyRedHat Dec 1, 2021

Choose a reason for hiding this comment

Uh oh!

TomSweeneyRedHat commented Dec 1, 2021

Uh oh!

nee1esh commented Dec 1, 2021

Uh oh!

nee1esh commented Dec 1, 2021

Uh oh!

haircommander commented Dec 2, 2021

Uh oh!

haircommander commented Dec 2, 2021

Uh oh!

haircommander commented Dec 7, 2021

Uh oh!

haircommander commented Dec 8, 2021

Uh oh!

haircommander commented Dec 8, 2021

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

saschagrunert Dec 9, 2021

Choose a reason for hiding this comment

Uh oh!

haircommander Dec 13, 2021

Choose a reason for hiding this comment

Uh oh!

saschagrunert commented Dec 9, 2021

Uh oh!

nalind commented Dec 9, 2021

Uh oh!

haircommander commented Dec 13, 2021

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

haircommander commented Dec 14, 2021

Uh oh!

openshift-ci bot commented Dec 14, 2021

Uh oh!

haircommander commented Dec 15, 2021

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Dec 16, 2021

Uh oh!

openshift-bot commented Dec 16, 2021

Uh oh!

openshift-bot commented Dec 16, 2021

Uh oh!

openshift-ci bot commented Dec 16, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

codecov bot commented Nov 29, 2021 •

edited

Loading

openshift-ci bot commented Dec 16, 2021 •

edited

Loading