server: support ping_group_range if in a userns #8174
Conversation
|
Skipping CI for Draft Pull Request. |
ping_group_range sysctl requires the upper bound be within the range of IDs the user has access to. ping_group_range is often set to the max allowable range "0 2147483647", but this will break for every usernamespace pod. Instead, hack around it by updating the max GID to be the largest one we find in the IDMappings Signed-off-by: Peter Hunt <[email protected]>
656fb7e to
64b991b
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: giuseppe, haircommander The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
|
||
| func configurePingGroupRangeGivenIDMappings(ctx context.Context, g *generate.Generator, sandboxIDMappings *idtools.IDMappings, sysctls map[string]string) map[string]string { | ||
| // We have to manually fuss with this specific sysctl. | ||
| // It's commonly set to the max range by default "0 2147483647". |
There was a problem hiding this comment.
For posterity:
This value, for the upper limit, is the same as 2^31-1.
There was a problem hiding this comment.
Also, a fun fact:
| maxID := 0 | ||
| for _, mapping := range sandboxIDMappings.GIDs() { | ||
| topOfRange := mapping.ContainerID + mapping.Size - 1 | ||
| if maxID < topOfRange { | ||
| maxID = topOfRange | ||
| } | ||
| } |
There was a problem hiding this comment.
The recent Go version has the max() built-in:
var maxID int
for _, mapping := range sandboxIDMappings.GIDs() {
maxID = max(maxID, mapping.ContainerID + mapping.Size - 1)
}There was a problem hiding this comment.
added a follow up #8184
|
/cherry-pick release-1.29 |
|
@haircommander: new pull request created: #8185 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/cherry-pick release-1.30 |
|
@haircommander: new pull request created: #8186 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
What type of PR is this?
/kind bug
What this PR does / why we need it:
ping_group_range sysctl requires the upper bound be within the range of IDs the user has access to. ping_group_range is often set to the max allowable range "0 2147483647", but this will break for every usernamespace pod.
Instead, hack around it by updating the max GID to be the largest one we find in the IDMappings
Which issue(s) this PR fixes:
Special notes for your reviewer:
Does this PR introduce a user-facing change?