Skip to content

Commit 2b1af83

Browse files
haircommanderhaircommander
committed
features: set userns related features to have required min kubelet version to 1.30.0
which is the lowest version the kubelet will deny a pod if a userns can't be created Signed-off-by: Peter Hunt <[email protected]>
1 parent 687a252 commit 2b1af83

8 files changed

+155
-24
lines changed

‎features/features.go

+3
Original file line numberDiff line numberDiff line change
@@ -677,6 +677,7 @@ var (
677677
productScope(kubernetes).
678678
enhancementPR("https://github.com/kubernetes/enhancements/issues/127").
679679
enableIn(configv1.DevPreviewNoUpgrade, configv1.TechPreviewNoUpgrade).
680+
requiredMinimumKubeletVersion("1.30.0").
680681
mustRegister()
681682

682683
FeatureGateUserNamespacesPodSecurityStandards = newFeatureGate("UserNamespacesPodSecurityStandards").
@@ -685,6 +686,7 @@ var (
685686
productScope(kubernetes).
686687
enhancementPR("https://github.com/kubernetes/enhancements/issues/127").
687688
enableIn(configv1.DevPreviewNoUpgrade, configv1.TechPreviewNoUpgrade).
689+
requiredMinimumKubeletVersion("1.30.0").
688690
mustRegister()
689691

690692
FeatureGateProcMountType = newFeatureGate("ProcMountType").
@@ -693,6 +695,7 @@ var (
693695
productScope(kubernetes).
694696
enhancementPR("https://github.com/kubernetes/enhancements/issues/4265").
695697
enableIn(configv1.DevPreviewNoUpgrade, configv1.TechPreviewNoUpgrade).
698+
requiredMinimumKubeletVersion("1.30.0").
696699
mustRegister()
697700

698701
FeatureGateVSphereMultiNetworks = newFeatureGate("VSphereMultiNetworks").

‎features/util.go

+26-6
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ import (
99
)
1010

1111
// FeatureGateDescription is a golang-only interface used to contains details for a feature gate.
12+
//
13+
//nolint:all
1214
type FeatureGateDescription struct {
1315
// FeatureGateAttributes is the information that appears in the API
1416
FeatureGateAttributes configv1.FeatureGateAttributes
@@ -45,12 +47,14 @@ var (
4547
kubernetes = OwningProduct("Kubernetes")
4648
)
4749

50+
//nolint:all
4851
type featureGateBuilder struct {
49-
name string
50-
owningJiraComponent string
51-
responsiblePerson string
52-
owningProduct OwningProduct
53-
enhancementPRURL string
52+
name string
53+
owningJiraComponent string
54+
responsiblePerson string
55+
owningProduct OwningProduct
56+
enhancementPRURL string
57+
minimumKubeletVersion string
5458

5559
statusByClusterProfileByFeatureSet map[ClusterProfileName]map[configv1.FeatureSet]bool
5660
}
@@ -111,6 +115,11 @@ func (b *featureGateBuilder) enableForClusterProfile(clusterProfile ClusterProfi
111115
return b
112116
}
113117

118+
func (b *featureGateBuilder) requiredMinimumKubeletVersion(version string) *featureGateBuilder {
119+
b.minimumKubeletVersion = version
120+
return b
121+
}
122+
114123
func (b *featureGateBuilder) register() (configv1.FeatureGateName, error) {
115124
if len(b.name) == 0 {
116125
return "", fmt.Errorf("missing name")
@@ -142,9 +151,20 @@ func (b *featureGateBuilder) register() (configv1.FeatureGateName, error) {
142151
}
143152

144153
featureGateName := configv1.FeatureGateName(b.name)
154+
var minComponentVersions []configv1.MinimumComponentVersion
155+
if b.minimumKubeletVersion != "" {
156+
if minComponentVersions == nil {
157+
minComponentVersions = []configv1.MinimumComponentVersion{}
158+
}
159+
minComponentVersions = append(minComponentVersions, configv1.MinimumComponentVersion{
160+
Component: configv1.MinimumComponentKubelet,
161+
Version: b.minimumKubeletVersion,
162+
})
163+
}
145164
description := FeatureGateDescription{
146165
FeatureGateAttributes: configv1.FeatureGateAttributes{
147-
Name: featureGateName,
166+
Name: featureGateName,
167+
RequiredMinimumComponentVersions: minComponentVersions,
148168
},
149169
OwningJiraComponent: b.owningJiraComponent,
150170
ResponsiblePerson: b.responsiblePerson,

‎payload-manifests/featuregates/featureGate-Hypershift-Default.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,13 @@
152152
"name": "PlatformOperators"
153153
},
154154
{
155-
"name": "ProcMountType"
155+
"name": "ProcMountType",
156+
"requiredMinimumComponentVersions": [
157+
{
158+
"component": "Kubelet",
159+
"version": "1.30.0"
160+
}
161+
]
156162
},
157163
{
158164
"name": "RouteAdvertisements"
@@ -188,10 +194,22 @@
188194
"name": "UpgradeStatus"
189195
},
190196
{
191-
"name": "UserNamespacesPodSecurityStandards"
197+
"name": "UserNamespacesPodSecurityStandards",
198+
"requiredMinimumComponentVersions": [
199+
{
200+
"component": "Kubelet",
201+
"version": "1.30.0"
202+
}
203+
]
192204
},
193205
{
194-
"name": "UserNamespacesSupport"
206+
"name": "UserNamespacesSupport",
207+
"requiredMinimumComponentVersions": [
208+
{
209+
"component": "Kubelet",
210+
"version": "1.30.0"
211+
}
212+
]
195213
},
196214
{
197215
"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"

‎payload-manifests/featuregates/featureGate-Hypershift-DevPreviewNoUpgrade.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,13 @@
234234
"name": "PrivateHostedZoneAWS"
235235
},
236236
{
237-
"name": "ProcMountType"
237+
"name": "ProcMountType",
238+
"requiredMinimumComponentVersions": [
239+
{
240+
"component": "Kubelet",
241+
"version": "1.30.0"
242+
}
243+
]
238244
},
239245
{
240246
"name": "RouteAdvertisements"
@@ -273,10 +279,22 @@
273279
"name": "UpgradeStatus"
274280
},
275281
{
276-
"name": "UserNamespacesPodSecurityStandards"
282+
"name": "UserNamespacesPodSecurityStandards",
283+
"requiredMinimumComponentVersions": [
284+
{
285+
"component": "Kubelet",
286+
"version": "1.30.0"
287+
}
288+
]
277289
},
278290
{
279-
"name": "UserNamespacesSupport"
291+
"name": "UserNamespacesSupport",
292+
"requiredMinimumComponentVersions": [
293+
{
294+
"component": "Kubelet",
295+
"version": "1.30.0"
296+
}
297+
]
280298
},
281299
{
282300
"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"

‎payload-manifests/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -246,7 +246,13 @@
246246
"name": "PrivateHostedZoneAWS"
247247
},
248248
{
249-
"name": "ProcMountType"
249+
"name": "ProcMountType",
250+
"requiredMinimumComponentVersions": [
251+
{
252+
"component": "Kubelet",
253+
"version": "1.30.0"
254+
}
255+
]
250256
},
251257
{
252258
"name": "RouteAdvertisements"
@@ -273,10 +279,22 @@
273279
"name": "UpgradeStatus"
274280
},
275281
{
276-
"name": "UserNamespacesPodSecurityStandards"
282+
"name": "UserNamespacesPodSecurityStandards",
283+
"requiredMinimumComponentVersions": [
284+
{
285+
"component": "Kubelet",
286+
"version": "1.30.0"
287+
}
288+
]
277289
},
278290
{
279-
"name": "UserNamespacesSupport"
291+
"name": "UserNamespacesSupport",
292+
"requiredMinimumComponentVersions": [
293+
{
294+
"component": "Kubelet",
295+
"version": "1.30.0"
296+
}
297+
]
280298
},
281299
{
282300
"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"

‎payload-manifests/featuregates/featureGate-SelfManagedHA-Default.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,13 @@
152152
"name": "PlatformOperators"
153153
},
154154
{
155-
"name": "ProcMountType"
155+
"name": "ProcMountType",
156+
"requiredMinimumComponentVersions": [
157+
{
158+
"component": "Kubelet",
159+
"version": "1.30.0"
160+
}
161+
]
156162
},
157163
{
158164
"name": "RouteAdvertisements"
@@ -188,10 +194,22 @@
188194
"name": "UpgradeStatus"
189195
},
190196
{
191-
"name": "UserNamespacesPodSecurityStandards"
197+
"name": "UserNamespacesPodSecurityStandards",
198+
"requiredMinimumComponentVersions": [
199+
{
200+
"component": "Kubelet",
201+
"version": "1.30.0"
202+
}
203+
]
192204
},
193205
{
194-
"name": "UserNamespacesSupport"
206+
"name": "UserNamespacesSupport",
207+
"requiredMinimumComponentVersions": [
208+
{
209+
"component": "Kubelet",
210+
"version": "1.30.0"
211+
}
212+
]
195213
},
196214
{
197215
"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"

‎payload-manifests/featuregates/featureGate-SelfManagedHA-DevPreviewNoUpgrade.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,13 @@
234234
"name": "PrivateHostedZoneAWS"
235235
},
236236
{
237-
"name": "ProcMountType"
237+
"name": "ProcMountType",
238+
"requiredMinimumComponentVersions": [
239+
{
240+
"component": "Kubelet",
241+
"version": "1.30.0"
242+
}
243+
]
238244
},
239245
{
240246
"name": "RouteAdvertisements"
@@ -273,10 +279,22 @@
273279
"name": "UpgradeStatus"
274280
},
275281
{
276-
"name": "UserNamespacesPodSecurityStandards"
282+
"name": "UserNamespacesPodSecurityStandards",
283+
"requiredMinimumComponentVersions": [
284+
{
285+
"component": "Kubelet",
286+
"version": "1.30.0"
287+
}
288+
]
277289
},
278290
{
279-
"name": "UserNamespacesSupport"
291+
"name": "UserNamespacesSupport",
292+
"requiredMinimumComponentVersions": [
293+
{
294+
"component": "Kubelet",
295+
"version": "1.30.0"
296+
}
297+
]
280298
},
281299
{
282300
"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"

‎payload-manifests/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -246,7 +246,13 @@
246246
"name": "PrivateHostedZoneAWS"
247247
},
248248
{
249-
"name": "ProcMountType"
249+
"name": "ProcMountType",
250+
"requiredMinimumComponentVersions": [
251+
{
252+
"component": "Kubelet",
253+
"version": "1.30.0"
254+
}
255+
]
250256
},
251257
{
252258
"name": "RouteAdvertisements"
@@ -273,10 +279,22 @@
273279
"name": "UpgradeStatus"
274280
},
275281
{
276-
"name": "UserNamespacesPodSecurityStandards"
282+
"name": "UserNamespacesPodSecurityStandards",
283+
"requiredMinimumComponentVersions": [
284+
{
285+
"component": "Kubelet",
286+
"version": "1.30.0"
287+
}
288+
]
277289
},
278290
{
279-
"name": "UserNamespacesSupport"
291+
"name": "UserNamespacesSupport",
292+
"requiredMinimumComponentVersions": [
293+
{
294+
"component": "Kubelet",
295+
"version": "1.30.0"
296+
}
297+
]
280298
},
281299
{
282300
"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"

0 commit comments

Comments
 (0)