--userns=keep-id replacement in kube yaml?

[MartinX3]

Dear community,

is it possible to define something in the kube yaml which has the same effect as --userns=keep-id or do I need to continue the CLI command?
In my case it would be more user friendly because I build AOSP in a container but the source code and the out folder are on the host machine.
Using a pod for both would be very inconvenient. Especially since I sometimes need to adjust the code natively on my host machine to avoid sync errors in relation to the changing aosp branches and .repo/local_manifest.

[eriksjolund]

In podman-systemd.unit(5) in the section Kube units [Kube] there is an option

UserNS=keep-id:uid=200,gid=210

[rhatdan]

@ygalblum Do you know if this is possible? I think keep-id is a Podman concept, so it probably will only work when executed directly by podman. In certain cases we have added attributes to a kube.YAML file to support podman concepts. But I don't know if usernamespace settings have been effected.

[rhatdan]

@umohnani8 Any idea?

[ygalblum]

Looking at the code here: https://github.com/containers/podman/blob/main/pkg/domain/infra/abi/play.go#L555 it seems that this functionality is already supported via the io.podman.annotations.userns annotation.

[umohnani8]

Yes, podman will honor any userns configurations in the io.podman.annotations.userns annotation when doing podman kube play file.yaml. It is possible that we don't support all the available userns options and can probably fix those if any are missing.

[rhatdan]

Awesome.

This is mildly documented in the podman-kube-play man page.

       Note: To set userns of a pod, use the io.podman.annotations.userns annotation in  the
       pod/deployment definition. This can be overridden with the --userns flag.

It probably would be nice to add an example to the man page.