[pending UserNamespace beta]promote LocalStorageCapacityIsolationFSQuotaMonitoring to beta #112626

pacoxu · 2022-09-21T10:21:36Z

This reverts commit 32a90f5.
This feature gate was promoted to beta only in v1.25.0 and was reverted in v1.25.1 for a regression issue.

See the history in #107329 and #112076

The KEP can be found in kubernetes/enhancements#2697

Action Items:

/kind feature
Xrefs kubernetes/enhancements#1029

promote LocalStorageCapacityIsolationFSQuotaMonitoring to beta

pacoxu · 2022-09-21T10:22:19Z

/test pull-kubernetes-node-kubelet-serial-crio-cgroupv1
/test pull-kubernetes-node-kubelet-serial-crio-cgroupv2
/test pull-kubernetes-node-crio-cgrpv2-e2e
/test pull-kubernetes-node-crio-cgrpv2-e2e-kubetest2
/test pull-kubernetes-node-crio-e2e
/test pull-kubernetes-node-crio-e2e-kubetest2

test/e2e_node/quota_lsci_test.go

SergeyKanzhelev · 2022-09-21T16:24:14Z

pkg/features/kube_features.go

@@ -939,7 +940,7 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS

 	LocalStorageCapacityIsolation: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.27

-	LocalStorageCapacityIsolationFSQuotaMonitoring: {Default: false, PreRelease: featuregate.Alpha},
+	LocalStorageCapacityIsolationFSQuotaMonitoring: {Default: true, PreRelease: featuregate.Beta},


is the isue fix in this pr: #112625? Is this PR just WIP than?

I think this should be pending until #112625 is merged to fix the regression.

I still need more verifying for the fix.

Since the fsquota related bug is fixed, I think we can promote it again. I will update the KEP as soon as possible in kubernetes/enhancements#3821

k8s-triage-robot · 2022-12-21T04:10:14Z

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

pacoxu · 2022-12-26T05:37:30Z

/remove-lifecycle stale
pending on #112624 and maybe #114506

SergeyKanzhelev · 2023-01-04T18:27:19Z

/assign @rphillips

Let's evaluate whether we can really promote it to beta as there seems to be bugs still that needs to be looked at.

/hold

pacoxu · 2023-10-15T13:29:51Z

/unhold
/triage accepted
/priority important-soon
/assign @dchen1107 @mrunalp

pacoxu · 2023-10-20T07:42:56Z

Any further comments on this? @SergeyKanzhelev @rphillips as kubernetes/enhancements#3821 was merged for v1.29.

@rphillips @SergeyKanzhelev @derekwaynecarr Do you have any comments on this feature promotion?

pacoxu · 2023-10-20T07:43:12Z

/assign @derekwaynecarr

pacoxu · 2023-10-31T07:19:10Z

Any further comments on this? @SergeyKanzhelev @rphillips as kubernetes/enhancements#3821 was merged for v1.29.

@rphillips @SergeyKanzhelev @derekwaynecarr Do you have any comments on this feature promotion?

Ping again before the code freeze.

pacoxu · 2023-12-15T10:26:43Z

Kernel issue. Other bugs reported
#112626
Mrunal and Peter to check on kernel issue

@mrunalp @haircommander do you have the kernel issue link?

haircommander · 2023-12-19T18:12:10Z

It's not so much an issue as expected behavior, and actually I may have been wrong. Any process in the root user namespace can change the project ID of a path, effectively nullifying the quota for a malicious user. In some of the documentation, users need CAP_SYS_RESOURCE to change the hard limit, and I'm not sure if that also applies to changing the project ID. there seems to have been a discussion on this but it's not clear where this went.

I am trying to investigate further. If a user does need CAP_SYS_RESOURCE to change a project ID, then we're good to move forward with this beta IMO. Otherwise, we will need to wait until user namespaces are more prevalent to move forward with this feature

haircommander · 2023-12-20T18:58:35Z

Okay I confirmed with kernel engineer. It's not actually documented other than in the code, but a process just needs to own the file or have CAP_FOWNER. If it's in a user namespace it can't change the projid, so we would need to require user namespace support. Theoretically we could pursue beta for this in 1.30, since we're pushing for user namespace beta then, but we may want to wait for the feature to be on by default (maybe 1.31?)

pacoxu · 2023-12-21T02:44:43Z

Okay I confirmed with kernel engineer. It's not actually documented other than in the code, but a process just needs to own the file or have CAP_FOWNER. If it's in a user namespace it can't change the projid, so we would need to require user namespace support. Theoretically we could pursue beta for this in 1.30, since we're pushing for user namespace beta then, but we may want to wait for the feature to be on by default (maybe 1.31?)

I may update the KEP based on this.

If user namespace FG is off and LocalStorageCapacityIsolationFSQuotaMonitoring is on, should we give a warning to user about this?

As a risk, we'd better to wait for User Namespace beta before promoting this to beta in my opinion.

haircommander · 2023-12-21T16:36:43Z

If user namespace FG is off and LocalStorageCapacityIsolationFSQuotaMonitoring is on, should we give a warning to user about this?

yeah probably

As a risk, we'd better to wait for kubernetes/enhancements#127 beta before promoting this to beta in my opinion.

works for me!

pacoxu · 2024-02-28T06:39:47Z

/remove-priority important-soon

k8s-triage-robot · 2024-05-28T07:06:47Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-ci-robot requested review from dchen1107 and krmayankk September 21, 2022 10:21

pacoxu mentioned this pull request Sep 21, 2022

fsquota: only generate pod uuid is nil #112624

Merged

SergeyKanzhelev reviewed Sep 21, 2022

View reviewed changes

test/e2e_node/quota_lsci_test.go Outdated Show resolved Hide resolved

SergeyKanzhelev reviewed Sep 21, 2022

View reviewed changes

pacoxu force-pushed the promote-fsquota-beta-again branch from 6441bbe to 9715ba4 Compare September 22, 2022 02:13

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 21, 2022

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 26, 2022

k8s-ci-robot assigned rphillips Jan 4, 2023

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 4, 2023

pacoxu mentioned this pull request Oct 12, 2023

[WIP] Update LocalStorageCapacityIsolationFSQuotaMonitoring to beta kubernetes/website#43455

Closed

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 15, 2023

k8s-ci-robot assigned dchen1107 and mrunalp Oct 15, 2023

k8s-ci-robot assigned derekwaynecarr Oct 20, 2023

pacoxu changed the title ~~promote LocalStorageCapacityIsolationFSQuotaMonitoring to beta~~ [pending UserNamespace beta]promote LocalStorageCapacityIsolationFSQuotaMonitoring to beta Dec 21, 2023

pacoxu marked this pull request as draft February 18, 2024 06:34

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 18, 2024

k8s-ci-robot added needs-priority Indicates a PR lacks a `priority/foo` label and requires one. and removed priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. labels Feb 28, 2024

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 28, 2024

pacoxu closed this May 29, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[pending UserNamespace beta]promote LocalStorageCapacityIsolationFSQuotaMonitoring to beta #112626

[pending UserNamespace beta]promote LocalStorageCapacityIsolationFSQuotaMonitoring to beta #112626

pacoxu commented Sep 21, 2022 •

edited

Loading

pacoxu commented Sep 21, 2022

SergeyKanzhelev Sep 21, 2022

pacoxu Sep 22, 2022 •

edited

Loading

pacoxu Sep 8, 2023

k8s-triage-robot commented Dec 21, 2022

pacoxu commented Dec 26, 2022 •

edited

Loading

SergeyKanzhelev commented Jan 4, 2023

pacoxu commented Oct 15, 2023

pacoxu commented Oct 20, 2023

pacoxu commented Oct 20, 2023

pacoxu commented Oct 31, 2023

pacoxu commented Dec 15, 2023

haircommander commented Dec 19, 2023

haircommander commented Dec 20, 2023

pacoxu commented Dec 21, 2023 •

edited

Loading

haircommander commented Dec 21, 2023

pacoxu commented Feb 28, 2024

k8s-triage-robot commented May 28, 2024

[pending UserNamespace beta]promote LocalStorageCapacityIsolationFSQuotaMonitoring to beta #112626

[pending UserNamespace beta]promote LocalStorageCapacityIsolationFSQuotaMonitoring to beta #112626

Conversation

pacoxu commented Sep 21, 2022 • edited Loading

pacoxu commented Sep 21, 2022

SergeyKanzhelev Sep 21, 2022

Choose a reason for hiding this comment

pacoxu Sep 22, 2022 • edited Loading

Choose a reason for hiding this comment

pacoxu Sep 8, 2023

Choose a reason for hiding this comment

k8s-triage-robot commented Dec 21, 2022

pacoxu commented Dec 26, 2022 • edited Loading

SergeyKanzhelev commented Jan 4, 2023

pacoxu commented Oct 15, 2023

pacoxu commented Oct 20, 2023

pacoxu commented Oct 20, 2023

pacoxu commented Oct 31, 2023

pacoxu commented Dec 15, 2023

haircommander commented Dec 19, 2023

haircommander commented Dec 20, 2023

pacoxu commented Dec 21, 2023 • edited Loading

haircommander commented Dec 21, 2023

pacoxu commented Feb 28, 2024

k8s-triage-robot commented May 28, 2024

pacoxu commented Sep 21, 2022 •

edited

Loading

pacoxu Sep 22, 2022 •

edited

Loading

pacoxu commented Dec 26, 2022 •

edited

Loading

pacoxu commented Dec 21, 2023 •

edited

Loading