From d2cd6ca2662a176746c9412a621340b47c91bfc9 Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Thu, 23 Mar 2023 11:47:01 +0100 Subject: [PATCH] content: Mention containerd 1.7 supports user namespaces containerd 1.7 was just released with user namespaces support. Let's mention which kubernetes versions should work with container 1.7. While we are there, let's clarify the CRI-O version and not duplicate the requirements in the concept and task pages and just add a link Signed-off-by: Rodrigo Campos --- .../concepts/workloads/pods/user-namespaces.md | 14 ++++++++------ .../configure-pod-container/user-namespaces.md | 10 ++++++---- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/content/en/docs/concepts/workloads/pods/user-namespaces.md b/content/en/docs/concepts/workloads/pods/user-namespaces.md index 0217490aa8..ca536ad48d 100644 --- a/content/en/docs/concepts/workloads/pods/user-namespaces.md +++ b/content/en/docs/concepts/workloads/pods/user-namespaces.md @@ -29,22 +29,24 @@ mitigate some future vulnerabilities too. ## {{% heading "prerequisites" %}} -{{% thirdparty-content single="true" %}} - +{{% thirdparty-content %}} + This is a Linux only feature. In addition, support is needed in the {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}} to use this feature with Kubernetes stateless pods: -* CRI-O: v1.25 has support for user namespaces. +* CRI-O: version 1.25 (and later) supports user namespaces for containers. -* containerd: support is planned for the 1.7 release. See containerd - issue [#7063][containerd-userns-issue] for more details. +* containerd: version 1.7 supports user namespaces for containers, compatible + with Kubernetes v1.25 and v1.26, but not with later releases. If you are + running a different version of Kubernetes, check the documentation for that + Kubernetes release. Support for this in [cri-dockerd is not planned][CRI-dockerd-issue] yet. [CRI-dockerd-issue]: https://github.com/Mirantis/cri-dockerd/issues/74 -[containerd-userns-issue]: https://github.com/containerd/containerd/issues/7063 ## Introduction diff --git a/content/en/docs/tasks/configure-pod-container/user-namespaces.md b/content/en/docs/tasks/configure-pod-container/user-namespaces.md index 96e1ff2d01..5c7c2dfe5d 100644 --- a/content/en/docs/tasks/configure-pod-container/user-namespaces.md +++ b/content/en/docs/tasks/configure-pod-container/user-namespaces.md @@ -43,11 +43,13 @@ this is true when user namespaces are used. * You need to be able to exec into pods * Feature gate `UserNamespacesStatelessPodsSupport` need to be enabled. -In addition, support is needed in the -{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}} -to use this feature with Kubernetes stateless pods: +The cluster that you're using **must** include at least one node that meets the +[requirements](/docs/concepts/workloads/pods/user-namespaces/#before-you-begin) +for using user namespaces with Pods. -* CRI-O: v1.25 has support for user namespaces. +If you have a mixture of nodes and only some of the nodes provide user namespace support for +Pods, you also need to ensure that the user namespace Pods are +[scheduled](/docs/concepts/scheduling-eviction/assign-pod-node/) to suitable nodes. Please note that **if your container runtime doesn't support user namespaces, the new `pod.spec` field will be silently ignored and the pod will be created without