Skip to content

Commit e316dd3

Browse files
haircommanderhaircommander
committed
features: set userns related features to have required min kubelet version to 1.30.0
which is the lowest version the kubelet will deny a pod if a userns can't be created Signed-off-by: Peter Hunt <[email protected]>
1 parent 180583c commit e316dd3

9 files changed

+173
-24
lines changed

‎.golangci.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,5 @@ issues:
2323
# Want to make sure that those adding new fields have an
2424
# opportunity to fix them when running the linter locally.
2525
max-issues-per-linter: 1000
26+
exclude-dirs:
27+
- features/

‎features/features.go

+3
Original file line numberDiff line numberDiff line change
@@ -677,6 +677,7 @@ var (
677677
productScope(kubernetes).
678678
enhancementPR("https://github.com/kubernetes/enhancements/issues/127").
679679
enableIn(configv1.DevPreviewNoUpgrade, configv1.TechPreviewNoUpgrade).
680+
enableInDefaultWhenRequiredMinimumComponentVersion(configv1.MinimumComponentKubelet, "1.30.0").
680681
mustRegister()
681682

682683
FeatureGateUserNamespacesPodSecurityStandards = newFeatureGate("UserNamespacesPodSecurityStandards").
@@ -685,6 +686,7 @@ var (
685686
productScope(kubernetes).
686687
enhancementPR("https://github.com/kubernetes/enhancements/issues/127").
687688
enableIn(configv1.DevPreviewNoUpgrade, configv1.TechPreviewNoUpgrade).
689+
enableInDefaultWhenRequiredMinimumComponentVersion(configv1.MinimumComponentKubelet, "1.30.0").
688690
mustRegister()
689691

690692
FeatureGateProcMountType = newFeatureGate("ProcMountType").
@@ -693,6 +695,7 @@ var (
693695
productScope(kubernetes).
694696
enhancementPR("https://github.com/kubernetes/enhancements/issues/4265").
695697
enableIn(configv1.DevPreviewNoUpgrade, configv1.TechPreviewNoUpgrade).
698+
enableInDefaultWhenRequiredMinimumComponentVersion(configv1.MinimumComponentKubelet, "1.30.0").
696699
mustRegister()
697700

698701
FeatureGateVSphereMultiNetworks = newFeatureGate("VSphereMultiNetworks").

‎features/util.go

+42-6
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,11 @@ type FeatureGateDescription struct {
2828
type FeatureGateEnabledDisabled struct {
2929
Enabled []FeatureGateDescription
3030
Disabled []FeatureGateDescription
31+
// Map of component -> map of version -> description
32+
// It would likely be better as map of component -> map of featureName -> version
33+
// but let's revisit that.
34+
// TODO FIXME
35+
EnabledGivenMinimumVersion map[configv1.MinimumComponent]map[string][]configv1.FeatureGateAttributes
3136
}
3237

3338
type ClusterProfileName string
@@ -46,11 +51,12 @@ var (
4651
)
4752

4853
type featureGateBuilder struct {
49-
name string
50-
owningJiraComponent string
51-
responsiblePerson string
52-
owningProduct OwningProduct
53-
enhancementPRURL string
54+
name string
55+
owningJiraComponent string
56+
responsiblePerson string
57+
owningProduct OwningProduct
58+
enhancementPRURL string
59+
minimumKubeletVersion string
5460

5561
statusByClusterProfileByFeatureSet map[ClusterProfileName]map[configv1.FeatureSet]bool
5662
}
@@ -111,6 +117,11 @@ func (b *featureGateBuilder) enableForClusterProfile(clusterProfile ClusterProfi
111117
return b
112118
}
113119

120+
func (b *featureGateBuilder) enableInDefaultWhenRequiredMinimumComponentVersion(component configv1.MinimumComponent, version string) *featureGateBuilder {
121+
b.minimumKubeletVersion = version
122+
return b
123+
}
124+
114125
func (b *featureGateBuilder) register() (configv1.FeatureGateName, error) {
115126
if len(b.name) == 0 {
116127
return "", fmt.Errorf("missing name")
@@ -142,9 +153,20 @@ func (b *featureGateBuilder) register() (configv1.FeatureGateName, error) {
142153
}
143154

144155
featureGateName := configv1.FeatureGateName(b.name)
156+
var minComponentVersions []configv1.MinimumComponentVersion
157+
if b.minimumKubeletVersion != "" {
158+
if minComponentVersions == nil {
159+
minComponentVersions = []configv1.MinimumComponentVersion{}
160+
}
161+
minComponentVersions = append(minComponentVersions, configv1.MinimumComponentVersion{
162+
Component: configv1.MinimumComponentKubelet,
163+
Version: b.minimumKubeletVersion,
164+
})
165+
}
145166
description := FeatureGateDescription{
146167
FeatureGateAttributes: configv1.FeatureGateAttributes{
147-
Name: featureGateName,
168+
Name: featureGateName,
169+
RequiredMinimumComponentVersions: minComponentVersions,
148170
},
149171
OwningJiraComponent: b.owningJiraComponent,
150172
ResponsiblePerson: b.responsiblePerson,
@@ -167,6 +189,20 @@ func (b *featureGateBuilder) register() (configv1.FeatureGateName, error) {
167189
} else {
168190
allFeatureGates[clusterProfile][featureSet].Disabled = append(allFeatureGates[clusterProfile][featureSet].Disabled, description)
169191
}
192+
if b.minimumKubeletVersion != "" {
193+
if allFeatureGates[clusterProfile][featureSet].EnabledGivenMinimumVersion == nil {
194+
allFeatureGates[clusterProfile][featureSet].EnabledGivenMinimumVersion = map[configv1.MinimumComponent]map[string][]configv1.FeatureGateAttributes{}
195+
}
196+
if _, ok := allFeatureGates[clusterProfile][featureSet].EnabledGivenMinimumVersion[configv1.MinimumComponentKubelet]; !ok {
197+
allFeatureGates[clusterProfile][featureSet].EnabledGivenMinimumVersion[configv1.MinimumComponentKubelet] = map[string][]configv1.FeatureGateAttributes{}
198+
}
199+
features, ok := allFeatureGates[clusterProfile][featureSet].EnabledGivenMinimumVersion[configv1.MinimumComponentKubelet][b.minimumKubeletVersion]
200+
if !ok {
201+
features = []configv1.FeatureGateAttributes{}
202+
}
203+
// TODO FIXME: This is hellish, is there a better way?
204+
allFeatureGates[clusterProfile][featureSet].EnabledGivenMinimumVersion[configv1.MinimumComponentKubelet][b.minimumKubeletVersion] = append(features, description.FeatureGateAttributes)
205+
}
170206
}
171207
}
172208

‎payload-manifests/featuregates/featureGate-Hypershift-Default.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,13 @@
152152
"name": "PlatformOperators"
153153
},
154154
{
155-
"name": "ProcMountType"
155+
"name": "ProcMountType",
156+
"requiredMinimumComponentVersions": [
157+
{
158+
"component": "Kubelet",
159+
"version": "1.30.0"
160+
}
161+
]
156162
},
157163
{
158164
"name": "RouteAdvertisements"
@@ -188,10 +194,22 @@
188194
"name": "UpgradeStatus"
189195
},
190196
{
191-
"name": "UserNamespacesPodSecurityStandards"
197+
"name": "UserNamespacesPodSecurityStandards",
198+
"requiredMinimumComponentVersions": [
199+
{
200+
"component": "Kubelet",
201+
"version": "1.30.0"
202+
}
203+
]
192204
},
193205
{
194-
"name": "UserNamespacesSupport"
206+
"name": "UserNamespacesSupport",
207+
"requiredMinimumComponentVersions": [
208+
{
209+
"component": "Kubelet",
210+
"version": "1.30.0"
211+
}
212+
]
195213
},
196214
{
197215
"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"

‎payload-manifests/featuregates/featureGate-Hypershift-DevPreviewNoUpgrade.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,13 @@
234234
"name": "PrivateHostedZoneAWS"
235235
},
236236
{
237-
"name": "ProcMountType"
237+
"name": "ProcMountType",
238+
"requiredMinimumComponentVersions": [
239+
{
240+
"component": "Kubelet",
241+
"version": "1.30.0"
242+
}
243+
]
238244
},
239245
{
240246
"name": "RouteAdvertisements"
@@ -273,10 +279,22 @@
273279
"name": "UpgradeStatus"
274280
},
275281
{
276-
"name": "UserNamespacesPodSecurityStandards"
282+
"name": "UserNamespacesPodSecurityStandards",
283+
"requiredMinimumComponentVersions": [
284+
{
285+
"component": "Kubelet",
286+
"version": "1.30.0"
287+
}
288+
]
277289
},
278290
{
279-
"name": "UserNamespacesSupport"
291+
"name": "UserNamespacesSupport",
292+
"requiredMinimumComponentVersions": [
293+
{
294+
"component": "Kubelet",
295+
"version": "1.30.0"
296+
}
297+
]
280298
},
281299
{
282300
"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"

‎payload-manifests/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -246,7 +246,13 @@
246246
"name": "PrivateHostedZoneAWS"
247247
},
248248
{
249-
"name": "ProcMountType"
249+
"name": "ProcMountType",
250+
"requiredMinimumComponentVersions": [
251+
{
252+
"component": "Kubelet",
253+
"version": "1.30.0"
254+
}
255+
]
250256
},
251257
{
252258
"name": "RouteAdvertisements"
@@ -273,10 +279,22 @@
273279
"name": "UpgradeStatus"
274280
},
275281
{
276-
"name": "UserNamespacesPodSecurityStandards"
282+
"name": "UserNamespacesPodSecurityStandards",
283+
"requiredMinimumComponentVersions": [
284+
{
285+
"component": "Kubelet",
286+
"version": "1.30.0"
287+
}
288+
]
277289
},
278290
{
279-
"name": "UserNamespacesSupport"
291+
"name": "UserNamespacesSupport",
292+
"requiredMinimumComponentVersions": [
293+
{
294+
"component": "Kubelet",
295+
"version": "1.30.0"
296+
}
297+
]
280298
},
281299
{
282300
"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"

‎payload-manifests/featuregates/featureGate-SelfManagedHA-Default.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,13 @@
152152
"name": "PlatformOperators"
153153
},
154154
{
155-
"name": "ProcMountType"
155+
"name": "ProcMountType",
156+
"requiredMinimumComponentVersions": [
157+
{
158+
"component": "Kubelet",
159+
"version": "1.30.0"
160+
}
161+
]
156162
},
157163
{
158164
"name": "RouteAdvertisements"
@@ -188,10 +194,22 @@
188194
"name": "UpgradeStatus"
189195
},
190196
{
191-
"name": "UserNamespacesPodSecurityStandards"
197+
"name": "UserNamespacesPodSecurityStandards",
198+
"requiredMinimumComponentVersions": [
199+
{
200+
"component": "Kubelet",
201+
"version": "1.30.0"
202+
}
203+
]
192204
},
193205
{
194-
"name": "UserNamespacesSupport"
206+
"name": "UserNamespacesSupport",
207+
"requiredMinimumComponentVersions": [
208+
{
209+
"component": "Kubelet",
210+
"version": "1.30.0"
211+
}
212+
]
195213
},
196214
{
197215
"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"

‎payload-manifests/featuregates/featureGate-SelfManagedHA-DevPreviewNoUpgrade.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,13 @@
234234
"name": "PrivateHostedZoneAWS"
235235
},
236236
{
237-
"name": "ProcMountType"
237+
"name": "ProcMountType",
238+
"requiredMinimumComponentVersions": [
239+
{
240+
"component": "Kubelet",
241+
"version": "1.30.0"
242+
}
243+
]
238244
},
239245
{
240246
"name": "RouteAdvertisements"
@@ -273,10 +279,22 @@
273279
"name": "UpgradeStatus"
274280
},
275281
{
276-
"name": "UserNamespacesPodSecurityStandards"
282+
"name": "UserNamespacesPodSecurityStandards",
283+
"requiredMinimumComponentVersions": [
284+
{
285+
"component": "Kubelet",
286+
"version": "1.30.0"
287+
}
288+
]
277289
},
278290
{
279-
"name": "UserNamespacesSupport"
291+
"name": "UserNamespacesSupport",
292+
"requiredMinimumComponentVersions": [
293+
{
294+
"component": "Kubelet",
295+
"version": "1.30.0"
296+
}
297+
]
280298
},
281299
{
282300
"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"

‎payload-manifests/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml

+21-3
Original file line numberDiff line numberDiff line change
@@ -246,7 +246,13 @@
246246
"name": "PrivateHostedZoneAWS"
247247
},
248248
{
249-
"name": "ProcMountType"
249+
"name": "ProcMountType",
250+
"requiredMinimumComponentVersions": [
251+
{
252+
"component": "Kubelet",
253+
"version": "1.30.0"
254+
}
255+
]
250256
},
251257
{
252258
"name": "RouteAdvertisements"
@@ -273,10 +279,22 @@
273279
"name": "UpgradeStatus"
274280
},
275281
{
276-
"name": "UserNamespacesPodSecurityStandards"
282+
"name": "UserNamespacesPodSecurityStandards",
283+
"requiredMinimumComponentVersions": [
284+
{
285+
"component": "Kubelet",
286+
"version": "1.30.0"
287+
}
288+
]
277289
},
278290
{
279-
"name": "UserNamespacesSupport"
291+
"name": "UserNamespacesSupport",
292+
"requiredMinimumComponentVersions": [
293+
{
294+
"component": "Kubelet",
295+
"version": "1.30.0"
296+
}
297+
]
280298
},
281299
{
282300
"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"

0 commit comments

Comments
 (0)