KEP-5607: Add implementation content for v1.36

[HirazawaUi]

• One-line PR description: Add a UserNamespacesHostNetwork Runtime Handler for the UserNamespacesHostNetwork feature gate, and integrate node feature declaration feature.

• Issue link: Allow HostNetwork Pods to Use User Namespaces #5607

• Other comments:

[haircommander]

I think I could use a bit of clarity on https://github.com/kubernetes/kubernetes/pull/135828/changes#r2733484515: if the node has some runtime handlers that use this, but some that don't, then is it possible to have the scheduler deny, or is potentially getting stuck in ContainerCreating in that case unavoidable?

[HirazawaUi]

Regarding the issue of mount options, there is currently some controversy as we have not yet clarified whether we should adopt rro or continue using ro for now. Therefore, I have documented the CRI implementation here in the hope of fostering more discussion.

Some context for the discussion: containerd/containerd#12518 (comment)

/cc @AkihiroSuda @rata @haircommander @giuseppe @mikebrow

[rata]

I was talking with some kernel devs and using rro is safe and the recommended way from their POV.

Ideally we would want a bind, not rbind, mount of sysfs. But that is not really possible because it has mount-points inside, the kernel doesn't allow it. Then, what we need to do is use rbind and rro and in this way we make sure the container can't change anything there.

This is safe as is, but even more if we take into account that using the host network namespace is a privileged PSS in Kubernetes.

LGTM. Thanks!

[haircommander]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: HirazawaUi, mrunalp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• keps/sig-node/5607-hostnetwork-userns/OWNERS [mrunalp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment