Skip to content

Commit 2fd44b8

Browse files
everpeaceeverpeace
committed
KEP-3619: Add feature fields in Kubernetes API(NodeRuntimeFeatures) and CRI(RuntimeFeatures)
so that kubernetes can capture the implemented features of the underlying CRI implementation.
1 parent 23b2845 commit 2fd44b8

File tree

1 file changed

+139
-0
lines changed
  • keps/sig-node/3619-supplemental-groups-policy

1 file changed

+139
-0
lines changed

‎keps/sig-node/3619-supplemental-groups-policy/README.md

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,11 @@ tags, and then generate with `hack/update-toc.sh`.
1818
- [Kubernetes API](#kubernetes-api)
1919
- [SupplementalGroupsPolicy in PodSecurityContext](#supplementalgroupspolicy-in-podsecuritycontext)
2020
- [User in ContainerStatus](#user-in-containerstatus)
21+
- [RuntimeFeatures in NodeStatus which contains SupplementalGroupsPolicy field](#runtimefeatures-in-nodestatus-which-contains-supplementalgroupspolicy-field)
2122
- [CRI](#cri)
2223
- [SupplementalGroupsPolicy in SecurityContext](#supplementalgroupspolicy-in-securitycontext)
2324
- [user in ContainerStatus](#user-in-containerstatus-1)
25+
- [runtime_features in StatusResponse which contains supplemental_groups_policy field](#runtime_features-in-statusresponse-which-contains-supplemental_groups_policy-field)
2426
- [User Stories (Optional)](#user-stories-optional)
2527
- [Story 1: Deploy a Security Policy to enforce <code>SupplementalGroupsPolicy</code> field](#story-1-deploy-a-security-policy-to-enforce-supplementalgroupspolicy-field)
2628
- [Notes/Constraints/Caveats (Optional)](#notesconstraintscaveats-optional)
@@ -29,9 +31,11 @@ tags, and then generate with `hack/update-toc.sh`.
2931
- [Kubernetes API](#kubernetes-api-1)
3032
- [SupplementalGroupsPolicy in PodSecurityContext](#supplementalgroupspolicy-in-podsecuritycontext-1)
3133
- [User in ContainerStatus](#user-in-containerstatus-2)
34+
- [RuntimeFeatures in NodeStatus which contains SupplementalGroupsPolicy field](#runtimefeatures-in-nodestatus-which-contains-supplementalgroupspolicy-field-1)
3235
- [CRI](#cri-1)
3336
- [SupplementalGroupsPolicy in SecurityContext](#supplementalgroupspolicy-in-securitycontext-1)
3437
- [user in ContainerStatus](#user-in-containerstatus-3)
38+
- [runtime_features in StatusResponse which contains supplemental_groups_policy field](#runtime_features-in-statusresponse-which-contains-supplemental_groups_policy-field-1)
3539
- [Test Plan](#test-plan)
3640
- [Prerequisite testing updates](#prerequisite-testing-updates)
3741
- [Unit tests](#unit-tests)
@@ -201,6 +205,30 @@ Note that both policies diverge from the semantics of [`config.User` OCI image c
201205

202206
To provide users/administrators to know which identities are actually attached to the container process, it proposes to introduce new `User` field in `ContainerStatus`. `User` is an object which consists of `Uid`, `Gid`, `SupplementalGroups` fields for linux containers. This will help users to identify unexpected identities. This field is derived by CRI response (See [user in ContainerStatus](#user-in-containerstatus-1) section).
203207

208+
#### RuntimeFeatures in NodeStatus which contains SupplementalGroupsPolicy field
209+
210+
Because the actual control(calculation) of supplementary groups to be attached to the first container process will happen inside of CRI implementations (container runtimes), It proposes to add `RuntimeFeatures` field in `NodeStatus` which contains the `SupplementalGroupsPolicy` feature field in side of it like below so that kubernetes can correctly understand whether underlying CRI implementation implements the feature ot not. The field is assumed drived by CRI response.
211+
212+
```golang
213+
type NodeStatus struct {
214+
// RuntimeFeatures describes the set of implemented features implemented by the CRI implementation(NodeRuntime).
215+
RuntimeFeatures *NodeRuntimeFeatures
216+
}
217+
type NodeRuntimeFeatures struct {
218+
// SupplementalGroupsPolicy is set to true if the runtime supports SupplementalGroupsPolicy and ContainerUser.
219+
SupplementalGroupsPolicy *bool
220+
}
221+
```
222+
223+
Recently [KEP-3857: Recursive Read-only (RRO) mounts](https://kep.k8s.io/3857) introduced `RuntimeHandlers[].Features`. But this does not fit to use for this KEP because RRO mounts should require to inspect [the OCI runtime spec's Feature](https://github.com/opencontainers/runtime-spec/blob/main/features.md) to understand low-level OCI runtime supports RRO or not. However, for this KEP(SupplementalGroupsPolicy), it does not need to inspect [the OCI runtime spec's Feature](https://github.com/opencontainers/runtime-spec/blob/main/features.md) because this KEP only affects to [`Process.User.additionalGid`](https://github.com/opencontainers/runtime-spec/blob/main/config.md#user) and this does not depend on [the OCI runtime spec's Feature](https://github.com/opencontainers/runtime-spec/blob/main/features.md). So, introducing new `RuntimeFeatures` in `NodeStatus` does not make any confusion with `RuntimeHandlerFeatures` because we can clearly define how to use them as below:
224+
225+
- `RuntimeFeatures`(added in this KEP):
226+
- focses on features that depend only on cri implementation, be independent on runtime handlers(low-level container runtimes), (i.e. it should not require to inspect to any information from oci runtime-spec's features).
227+
- `RuntimeHandlerFeature` (introduced in KEP-3857):
228+
- focuses features that depend on the runtime handlers, (i.e. dependent to the information exposed by oci runtime-spec's features).
229+
230+
See [this section](#runtimefeatures-in-nodestatus-which-contains-supplementalgroupspolicy-field-1) for details.
231+
204232
### CRI
205233

206234
#### SupplementalGroupsPolicy in SecurityContext
@@ -232,6 +260,29 @@ message ContainerUser {
232260
}
233261
```
234262

263+
#### runtime_features in StatusResponse which contains supplemental_groups_policy field
264+
265+
To propagate whether the runtime supports fine-grained supplemental group control to `NodeRuntimeFeatures.SupplementalGroupsPolicy`, it proposes to add a corresponding field`runtime_features` in `StatusResponse`.
266+
267+
```proto
268+
// service RuntimeService {
269+
// ...
270+
// rpc Status(StatusRequest) returns (StatusResponse) {}
271+
// }
272+
message StatusResponse {
273+
...
274+
// runtime_features describes the set of features implemented by the CRI implementation.
275+
RuntimeFeatures runtime_features = ?;
276+
}
277+
message RuntimeFeatures {
278+
// supplemental_groups_policy is set to true if the runtime supports SupplementalGroupsPolicy and ContainerUser.
279+
bool supplemental_groups_policy = 1;
280+
}
281+
```
282+
283+
As discussed in [Kubernetes API section](#runtimefeatures-in-nodestatus-which-contains-supplementalgroupspolicy-field), `RuntimeHandlerFeature` introduced in [KEP-3857](https://kep.k8s.io/3857) should focus on features only for ones which requires to inspect [OCI runtime spec's Feature](https://github.com/opencontainers/runtime-spec/blob/main/features.md). But `RuntimeFeatuers` proposed in this KEP should focus on ones which does NOT require to inepect it.
284+
285+
235286
### User Stories (Optional)
236287

237288
#### Story 1: Deploy a Security Policy to enforce `SupplementalGroupsPolicy` field
@@ -356,6 +407,53 @@ type LinuxContainerUser struct {
356407
// }
357408
```
358409

410+
#### RuntimeFeatures in NodeStatus which contains SupplementalGroupsPolicy field
411+
412+
```golang
413+
type NodeStatus struct {
414+
// RuntimeFeatures describes the set of implemented features implemented by the CRI implementation(NodeRuntime).
415+
// +featureGate=SupplementalGroupsPolicy
416+
// +optional
417+
RuntimeFeatures *NodeRuntimeFeatures
418+
419+
// The available runtime handlers.
420+
// +featureGate=RecursiveReadOnlyMounts
421+
// +optional
422+
RuntimeHandlers []RuntimeHandlers
423+
}
424+
425+
// RuntimeFeatures describes the set of implemented features implemented by the CRI implementation(NodeRuntime).
426+
// THE FEATURES CONTAINED IN THE NodeRuntimeFeatures SHOULD DEPEND ON ONLY CRI IMPLEMENTATION, BE INDEPENDENT ON RUNTIME HANDLERS,
427+
// (I.E. IT SHOULD NOT REQUIRE TO INSPECT TO ANY INFORMATION FROM OCI RUNTIME-SPEC'S FEATURES).
428+
type NodeRuntimeFeatures {
429+
// SupplementalGroupsPolicy is set to true if the runtime supports SupplementalGroupsPolicy and ContainerUser.
430+
// +optional
431+
SupplementalGroupsPolicy *bool
432+
}
433+
434+
// NodeRuntimeHandler is a set of runtime handler information.
435+
type NodeRuntimeHandler struct {
436+
// Runtime handler name.
437+
// Empty for the default runtime handler.
438+
// +optional
439+
Name string
440+
// Supported features in the runtime handlers.
441+
// +optional
442+
Features *NodeRuntimeHandlerFeatures
443+
}
444+
445+
// NodeRuntimeHandlerFeatures is a set of features implementedy by the runtime handler.
446+
// THE FEATURES CONTAINED IN THE NodeRuntimeHandlerFeatures SHOULD DEPEND ON THE RUNTIME HANDLERS,
447+
// (I.E. DEPENDENT TO THE INFORMATION EXPOSED BY OCI RUNTIME-SPEC'S FEATURES).
448+
type NodeRuntimeHandlerFeatures struct {
449+
// RecursiveReadOnlyMounts is set to true if the runtime handler supports RecursiveReadOnlyMounts.
450+
// +featureGate=RecursiveReadOnlyMounts
451+
// +optional
452+
RecursiveReadOnlyMounts *bool
453+
// Reserved: UserNamespaces *bool
454+
}
455+
```
456+
359457
### CRI
360458

361459
#### SupplementalGroupsPolicy in SecurityContext
@@ -414,6 +512,47 @@ message LinuxContainerUser {
414512
// }
415513
```
416514

515+
#### runtime_features in StatusResponse which contains supplemental_groups_policy field
516+
517+
```proto
518+
// service RuntimeService {
519+
// ...
520+
// rpc Status(StatusRequest) returns (StatusResponse) {}
521+
// }
522+
message StatusResponse {
523+
...
524+
// Runtime handlers.
525+
repeated RuntimeHandler runtime_handlers = 3;
526+
527+
// runtime_features describes the set of features implemented by the CRI implementation.
528+
RuntimeFeatures runtime_features = ?;
529+
}
530+
531+
// RuntimeFeatures describes the set of features implemented by the CRI implementation.
532+
// THE FEATURES CONTAINED IN THE RuntimeFeatures SHOULD DEPEND ON ONLY CRI IMPLEMENTATION, BE INDEPENDENT ON RUNTIME HANDLERS,
533+
// (I.E. IT SHOULD NOT REQUIRE TO INSPECT TO ANY INFORMATION FROM OCI RUNTIME-SPEC'S FEATURES).
534+
message RuntimeFeatures {
535+
// supplemental_groups_policy is set to true if the runtime supports SupplementalGroupsPolicy and ContainerUser.
536+
bool supplemental_groups_policy = 1;
537+
}
538+
539+
// message RuntimeHandler {
540+
// // Name must be unique in StatusResponse.
541+
// // An empty string denotes the default handler.
542+
// string name = 1;
543+
// // Supported features.
544+
// RuntimeHandlerFeatures features = 2;
545+
// }
546+
547+
// RuntimeHandlerFeatures is a set of features implementedy by the runtime handler.
548+
// THE FEATURES CONTAINED IN THE RuntimeHandlerFeatures SHOULD DEPEND ON THE RUNTIME HANDLERS,
549+
// (I.E. DEPENDENT TO THE INFORMATION EXPOSED BY OCI RUNTIME-SPEC'S FEATURES).
550+
message RuntimeHandlerFeatures {
551+
bool recursive_read_only_mounts = 1;
552+
bool user_namespaces = 2;
553+
}
554+
```
555+
417556
### Test Plan
418557

419558
<!--

0 commit comments

Comments
 (0)