diff --git a/content/en/docs/concepts/workloads/pods/user-namespaces.md b/content/en/docs/concepts/workloads/pods/user-namespaces.md index 0217490aa8..ca536ad48d 100644 --- a/content/en/docs/concepts/workloads/pods/user-namespaces.md +++ b/content/en/docs/concepts/workloads/pods/user-namespaces.md @@ -29,22 +29,24 @@ mitigate some future vulnerabilities too. ## {{% heading "prerequisites" %}} -{{% thirdparty-content single="true" %}} - +{{% thirdparty-content %}} + This is a Linux only feature. In addition, support is needed in the {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}} to use this feature with Kubernetes stateless pods: -* CRI-O: v1.25 has support for user namespaces. +* CRI-O: version 1.25 (and later) supports user namespaces for containers. -* containerd: support is planned for the 1.7 release. See containerd - issue [#7063][containerd-userns-issue] for more details. +* containerd: version 1.7 supports user namespaces for containers, compatible + with Kubernetes v1.25 and v1.26, but not with later releases. If you are + running a different version of Kubernetes, check the documentation for that + Kubernetes release. Support for this in [cri-dockerd is not planned][CRI-dockerd-issue] yet. [CRI-dockerd-issue]: https://github.com/Mirantis/cri-dockerd/issues/74 -[containerd-userns-issue]: https://github.com/containerd/containerd/issues/7063 ## Introduction diff --git a/content/en/docs/tasks/configure-pod-container/user-namespaces.md b/content/en/docs/tasks/configure-pod-container/user-namespaces.md index 96e1ff2d01..5c7c2dfe5d 100644 --- a/content/en/docs/tasks/configure-pod-container/user-namespaces.md +++ b/content/en/docs/tasks/configure-pod-container/user-namespaces.md @@ -43,11 +43,13 @@ this is true when user namespaces are used. * You need to be able to exec into pods * Feature gate `UserNamespacesStatelessPodsSupport` need to be enabled. -In addition, support is needed in the -{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}} -to use this feature with Kubernetes stateless pods: +The cluster that you're using **must** include at least one node that meets the +[requirements](/docs/concepts/workloads/pods/user-namespaces/#before-you-begin) +for using user namespaces with Pods. -* CRI-O: v1.25 has support for user namespaces. +If you have a mixture of nodes and only some of the nodes provide user namespace support for +Pods, you also need to ensure that the user namespace Pods are +[scheduled](/docs/concepts/scheduling-eviction/assign-pod-node/) to suitable nodes. Please note that **if your container runtime doesn't support user namespaces, the new `pod.spec` field will be silently ignored and the pod will be created without