sig-node: Kubelet-in-UserNS, aka Rootless mode

[AkihiroSuda]

Enhancement Description

• One-line enhancement description (can be used as a release note):
  Allow running the entire Kubernetes components (kubelet, CRI, OCI, CNI, and all kube-*) as a non-root user on the host.

• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2033-kubelet-in-userns-aka-rootless

• Discussion Link:

  • POC: https://github.com/rootless-containers/usernetes
  • k/k PR: kubelet & kube-proxy: ignore sysctl errors and rlimit errors when running in UserNS (for rootless) kubernetes#92863 (merged in v1.22)
  • Proposal in kind repo: Support Rootless Docker / Kubernetes kubernetes-sigs/kind#1797
  • Proposal in minikube repo: add support for rootless Docker minikube#10836
  • Documentation PR: Add KubeletInUserNamespace feature gate website#28827

• Primary contact (assignee):
  @AkihiroSuda

• Responsible SIGs:
  SIG-node

• PRs by stage and milestone:

  • Alpha - v1.22
    • KEP (k/enhancements) update PR(s): sig-node: Kubelet-in-UserNS, aka Rootless mode #1371
    • Code (k/k) update PR(s): kubelet & kube-proxy: ignore sysctl errors and rlimit errors when running in UserNS (for rootless) kubernetes#92863
    • Docs (k/website) update PR(s): Add KubeletInUserNamespace feature gate website#28827
  • Beta - v1.35
    • KEP (k/enhancements) update PR(s): KEP-2033: KubeletInUserNamespace: update the template; promote to beta #5388
    • Code (k/k) update PR(s):
    • Docs (k/website) update(s):
  • Stable - v1.xx
    • KEP (k/enhancements) update PR(s):
    • Code (k/k) update PR(s):
    • Docs (k/website) update(s):

[AkihiroSuda]

/sig node

[kikisdeliveryservice]

Thanks for opening this @AkihiroSuda !

As a reminder Enhancements Freeze is next Tuesday October 6th, by which time KEPs must be merged in an implementable state (you have this), have test plans(you have this) and graduation criteria (you have this).

[kendallroden]

Hi @AkihiroSuda , Just a reminder that the outstanding PR (#1371) must be merged by EOD PST tomorrow (10/6) for this KEP to be included in the Enhancements Freeze for the 1.20 release. After that time you will need to request an Exception to be included in the 1.20 Release.

Best,
Kendall
Enhancements Team 1.20

[kikisdeliveryservice]

Hi @AkihiroSuda

Enhancements Freeze is now in effect. Unfortunately, your KEP PR did not merge. If you wish to be included in the 1.20 Release, please submit an Exception Request as soon as possible.

Best,
Kirsten
1.20 Enhancements Lead