* Rebasing HostProcess security changes.
* Incorporated initial round of feedback
* Minor wording updates
* Finished up remaining todo items
* Apply suggestions from code review
Co-authored-by: Jordan Liggitt <jordan@liggitt.net>
Co-authored-by: Mark Rossetti <marosset@microsoft.com>
* Moved HostProcess security documentation into PSS and create-host-process-pod docs
* Updated with for James' review
* Apply suggestions from code review
Co-authored-by: Tim Bannister <tim@scalefactory.com>
Co-authored-by: James Sturtevant <jsturtevant@gmail.com>
* Minor edits
* Modifications for additional feedback
Co-authored-by: Jordan Liggitt <jordan@liggitt.net>
Co-authored-by: Mark Rossetti <marosset@microsoft.com>
Co-authored-by: Tim Bannister <tim@scalefactory.com>
Co-authored-by: James Sturtevant <jsturtevant@gmail.com>
Enables support for running kubelet in a user namespace.
The user namespace has to be created before running kubelet.
All the node components such as CRI need to be running in the same user namespace.
- Tracking issue: kubernetes/enhancements issue 2033
- KEP: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2033-kubelet-in-userns-aka-rootless
- Implementation: kubernetes/kubernetes PR 92863
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Here is a second batch for feature gate updates in 1.22.
- CPUManagerPolicyOptions kubernetes/kubernetes#101432
- ControllerManagerLeaderMigration kubernetes/kubernetes#103533
- DynamicKubeletConfig kubernetes/kubernetes#102966
- EndpointSliceProxying kubernetes/kubernetes#103451
- EndpointSliceTerminatingCondition kubernetes/kubernetes#103596
- HugePageStorageMediumSize kubernetes/kubernetes#99144
- JobTrackingWithFinalizers kubernetes/kubernetes#98817
(also tracked in #28841, can rebase).
- ServiceInternalTrafficPolicy kubernetes/kubernetes#103462
- WindowsEndpointSliceProxying kubernetes/kubernetes#103451
Some of these needs more detailed documentation.
The enhancement https://github.com/kubernetes/enhancements/issues/2625
want to add a new kubelet option to fine tune the behaviour of the
cpu manager policies, and to do so we add support for cpu manager policy
options themselves.
Signed-off-by: Francesco Romani <fromani@redhat.com>
The term "control plane" is written as title case (e.g. Control Plane) only in this document. When it is referenced, it creates inconsistency in other documents. This commit will fix it by lower-casing the second word.
Victor Palade
Kubernetes Prow Robot
Brandon Smith
Akihiro Suda
Jiawei Wang
Rob Scott
Qiming Teng
James Sturtevant
Francesco Romani
Monis Khan
Samuel Roth
Elana Hashman
Cheng Xing
Ed Bartosh
xiaoxubeii
Aldo Culquicondor
Sinan Kahveci
yxxhero
Shannon Kularathna
Andrew Keesler
Chris Negus