From dd330b3f94ff493049381ca8af56885d3c920595 Mon Sep 17 00:00:00 2001 From: Rodrigo Campos Date: Wed, 1 Feb 2023 12:14:46 +0100 Subject: [PATCH] KEP-127: Update TOC Signed-off-by: Rodrigo Campos --- keps/sig-node/127-user-namespaces/README.md | 24 +++++++++++---------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/keps/sig-node/127-user-namespaces/README.md b/keps/sig-node/127-user-namespaces/README.md index 16f60e5b0cd3..5d4e83b60000 100644 --- a/keps/sig-node/127-user-namespaces/README.md +++ b/keps/sig-node/127-user-namespaces/README.md @@ -18,13 +18,13 @@ - [Design Details](#design-details) - [Pod.spec changes](#podspec-changes) - [CRI changes](#cri-changes) - - [Phases](#phases) - - [Phase 1: pods "without" volumes](#phase-1-pods-without-volumes) - - [pkg/volume changes for phase I](#pkgvolume-changes-for-phase-i) - - [Phase 2: pods with volumes](#phase-2-pods-with-volumes) - - [Phase 3: TBD](#phase-3-tbd) - - [Unresolved](#unresolved) - - [Summary of the Proposed Changes](#summary-of-the-proposed-changes) + - [Support for stateless pods](#support-for-stateless-pods) + - [Handling of stateless volumes](#handling-of-stateless-volumes) + - [Example of how idmap mounts work](#example-of-how-idmap-mounts-work) + - [Example without idmap mounts](#example-without-idmap-mounts) + - [Example without idmap mounts](#example-without-idmap-mounts-1) + - [Regarding the previous implementation for volumes](#regarding-the-previous-implementation-for-volumes) + - [Unresolved](#unresolved) - [Test Plan](#test-plan) - [Prerequisite testing updates](#prerequisite-testing-updates) - [Unit tests](#unit-tests) @@ -47,6 +47,8 @@ - [Implementation History](#implementation-history) - [Drawbacks](#drawbacks) - [Alternatives](#alternatives) + - [64k mappings?](#64k-mappings) + - [Allow runtimes to pick the mapping?](#allow-runtimes-to-pick-the-mapping) - [Infrastructure Needed (Optional)](#infrastructure-needed-optional) @@ -418,9 +420,9 @@ In other words, we can make sure the pod can read files instead of chowning them all using the host IDs the pod is mapped to, by just using an idmap mount that has the same mapping that we use for the pod user namespace. -##### Regarding the previous implementation for volumes -We previously added to the [KubeletVolumeHost -interface][kubeletVolumeHost-interface] the following method: +#### Regarding the previous implementation for volumes +We previously added to the [KubeletVolumeHost interface][kubeletVolumeHost-interface] +the following method: ``` GetHostIDsForPod(pod *v1.Pod, containerUID, containerGID *int64) (hostUID, hostGID *int64, err error) @@ -431,7 +433,7 @@ components that implement the interface. [kubeletVolumeHost-interface]: https://github.com/kubernetes/kubernetes/blob/36450ee422d57d53a3edaf960f86b356578fe996/pkg/volume/plugins.go#L322 -#### Unresolved +### Unresolved Here is a list of considerations raised in PRs discussion that hasn't yet settle. This list is not exhaustive, we are just trying to put the things that