@@ -269,6 +269,11 @@ and attaching the ID to one or more files. By default (and as
269
269
utilized herein), if a project ID is attached to a directory, it is
270
270
inherited by any files created under that directory.
271
271
272
+ To use quotas to track a pod's resource usage, the pod must be in
273
+ a user namespace. Within user namespaces, the kernel restricts changes
274
+ to projectIDs on the filesystem, ensuring the reliability of storage
275
+ metrics calculated by quotas.
276
+
272
277
_If we elect to use the quota as enforcing, we impose a quota
273
278
consistent with the desired limit._ If we elect to use it as
274
279
non-enforcing, we impose a large quota that in practice cannot be
@@ -279,7 +284,7 @@ below](#implementation-detailsnotesconstraints-optional).
279
284
280
285
### Control over Use of Quotas
281
286
282
- At present, two feature gates control operation of quotas:
287
+ At present, three feature gates control operation of quotas:
283
288
284
289
* ` LocalStorageCapacityIsolation` must be enabled for any use of
285
290
quotas.
@@ -289,6 +294,9 @@ At present, two feature gates control operation of quotas:
289
294
present, this defaults to False, but the intention is that this will
290
295
default to True by initial release.
291
296
297
+ * Ensure the `UserNamespacesSupport`
298
+ is enabled, and that the kernel, CRI implementation and OCI runtime support user namespaces.
299
+
292
300
# ## Operation Flow -- Applying a Quota
293
301
294
302
* Caller (emptydir volume manager or container runtime) creates an
0 commit comments