KEP-495keps/sig-node/495-pod-pid-namespace

Shared PID Namespace

implementedstablesig-node

KEP on GitHub kep.yaml Ask about this KEP

We will add support for configuring pod-shared process namespaces by adding a new boolean field ShareProcessNamespace to the pod spec. The default to false means that each container will have a separate process namespace. When set to true, all containers in the pod will share a single process namespace. The Container Runtime Interface (CRI) will be updated to support three namespace modes: Container, Pod & Node. The Runtime Manager will translate the pod spec into one of these modes as follows: Pod shareProcessNamespace | Pod hostPID | CRI PID Mode --------------------------- | ------------- | ------------ false | false | Container false | true | Node true | false | Pod true | true | Error If a runtime does not implement a particular PID mode, it must return an error. For reference, Docker will support all three modes when using version >= 1.13.1. The shared PID functionality will be hidden behind a new feature gate in both the API server and the kubelet, and the existing --docker-disable-shared-pid flag will be removed from the kubelet, subject to deprecation policy.

Facts

Authors: @verb
Approvers: @dchen1107
Reviewers: @yujuhong
PRR approvers: none
Tracking issue: #495(opens GitHub in a new tab) closedcompletedclosed 2020-09-11 10:44 UTCsig/nodestage/stablekind/feature
Milestones: none
Participating SIGs: none
Feature gates: none
Created / last updated: 2016-12-21 / 2019-09-30

Who decided each state, with the evidence.
Decided	Decision	Deciders	Evidence
2020-12-17 17:41 UTC	status_transition KEP-495 status set to implemented in PR #2193, approved by johnbelamaric; merged by automation (k8s-ci-robot) on 2020-12-17.	@wojtek-t author @johnbelamaric approve_command @johnbelamaric lgtm @k8s-ci-robot merger	Commit kubernetes/enhancements@7eef794bb549a50c6b08c457556ff0eac98a4c6b(opens GitHub in a new tab) StatusChange status ∅ → implemented (2020-12-17)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#2193 Migrate some node KEPs to new template(opens GitHub in a new tab) Review kubernetes/enhancements/pulls/reviews/554835705(opens GitHub in a new tab)
2021-10-20 23:38 UTC	stage_graduation KEP-495 graduated to stable in PR #3007, approved by justaugustus, jeremyrickard, johnbelamaric; merged by automation (k8s-ci-robot) on 2021-10-20.	@justaugustus approver @justaugustus approve_command @justaugustus lgtm @jeremyrickard approve_command @spiffxp author @johnbelamaric approve_command @k8s-ci-robot merger	Commit kubernetes/enhancements@761668f82fef6727d2cbee10e632c371dfded529(opens GitHub in a new tab) StatusChange stage ∅ → stable (2021-10-08)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#3007 pkg/kepval: enable PRR check for implemented KEPs

Metadata, label and milestone changes, oldest first.Showing 1–10 of 38Rows

Status history
At	Kind	Field	Change	Actor	Evidence
2017-10-24 12:07 UTC	label	sig/node added	none → sig/node	@k8s-ci-robot	source(opens GitHub in a new tab)
2017-10-24 17:34 UTC	label	stage/alpha added	none → stage/alpha	@idvoretskyi	source

Relationships as stored, Person → KEP, from kep.yaml(opens GitHub in a new tab)
Person	Relationship
@verb GitHub(opens GitHub in a new tab)	—AUTHORED→
@yujuhong GitHub(opens GitHub in a new tab)	—REVIEWS→
@dchen1107 GitHub(opens GitHub in a new tab)	—APPROVES→

How they connect

Shortest paths in the graph between this KEP and its SIG or one of its people, up to four hops.

Impact of change

Rows returned by the tool
Kep	Depth	Reached	By hop	Open pull requests	Hop	Sigs	People
{ "label": "KEP", "key": "keps/sig-node/495-pod-pid-namespace", "title": "Shared PID Namespace", "url": "https://github.com/kubernetes/enhancements/tree/6ebe0a94771723b3f27cb4a757f0cc22f29e38a2/keps/sig-node/495-pod-pid-namespace", "evidence_id": "secmnd72eej6", "number": 495, "owning_sig": "sig-node", "status": "implemented", "stage": "stable", "creation_date": "2016-12-21", "last_updated": "2019-09-30", "metadata_invalid": false }	2	3	{ "1": { "sigs": 1, "people": 2 } }	not in graph (merged pull requests only)	none	none	none
none	none	none	none	none	1	[ { "label": "SIG", "key": "sig-node", "title": "Node", "url": "https://github.com/kubernetes/community/tree/440e496d3a172234d81728df1bfe43849b589adf/sig-node", "evidence_id": "nrsuxu2xcxa7", "display_name": "Node", "sig_label": "node", "in_scope": true } ]	[ { "label": "Person", "key": "verb", "title": "verb", "url": "https://github.com/verb", "evidence_id": "4mno7khjok6m", "login": "verb", "is_bot": false }, { "label": "Person", "key": "dchen1107", "title": "dchen1107", "url": "https://github.com/dchen1107", "evidence_id": "frhgjvzxlrsh", "login": "dchen1107", "is_bot": false } ]

Rows returned by the tool
Kep	Depth	Reached	By hop	Open pull requests	Hop	Sigs	People
{ "label": "KEP", "key": "keps/sig-node/495-pod-pid-namespace", "title": "Shared PID Namespace", "url": "https://github.com/kubernetes/enhancements/tree/6ebe0a94771723b3f27cb4a757f0cc22f29e38a2/keps/sig-node/495-pod-pid-namespace", "evidence_id": "secmnd72eej6", "number": 495, "owning_sig": "sig-node", "status": "implemented", "stage": "stable", "creation_date": "2016-12-21", "last_updated": "2019-09-30", "metadata_invalid": false }	2	3	{ "1": { "sigs": 1, "people": 2 } }	not in graph (merged pull requests only)	none	none	none
none	none	none	none	none	1	[ { "label": "SIG", "key": "sig-node", "title": "Node", "url": "https://github.com/kubernetes/community/tree/440e496d3a172234d81728df1bfe43849b589adf/sig-node", "evidence_id": "nrsuxu2xcxa7", "display_name": "Node", "sig_label": "node", "in_scope": true } ]	[ { "label": "Person", "key": "verb", "title": "verb", "url": "https://github.com/verb", "evidence_id": "4mno7khjok6m", "login": "verb", "is_bot": false }, { "label": "Person", "key": "dchen1107", "title": "dchen1107", "url": "https://github.com/dchen1107", "evidence_id": "frhgjvzxlrsh", "login": "dchen1107", "is_bot": false } ]

Kep

Depth

Reached

By hop

Open pull requests

Hop

Sigs

People

{
  "label": "KEP",
  "key": "keps/sig-node/495-pod-pid-namespace",
  "title": "Shared PID Namespace",
  "url": "https://github.com/kubernetes/enhancements/tree/6ebe0a94771723b3f27cb4a757f0cc22f29e38a2/keps/sig-node/495-pod-pid-namespace",
  "evidence_id": "secmnd72eej6",
  "number": 495,
  "owning_sig": "sig-node",
  "status": "implemented",
  "stage": "stable",
  "creation_date": "2016-12-21",
  "last_updated": "2019-09-30",
  "metadata_invalid": false
}

{
  "1": {
    "sigs": 1,
    "people": 2
  }
}

not in graph (merged pull requests only)

[
  {
    "label": "SIG",
    "key": "sig-node",
    "title": "Node",
    "url": "https://github.com/kubernetes/community/tree/440e496d3a172234d81728df1bfe43849b589adf/sig-node",
    "evidence_id": "nrsuxu2xcxa7",
    "display_name": "Node",
    "sig_label": "node",
    "in_scope": true
  }
]

[
  {
    "label": "Person",
    "key": "verb",
    "title": "verb",
    "url": "https://github.com/verb",
    "evidence_id": "4mno7khjok6m",
    "login": "verb",
    "is_bot": false
  },
  {
    "label": "Person",
    "key": "dchen1107",
    "title": "dchen1107",
    "url": "https://github.com/dchen1107",
    "evidence_id": "frhgjvzxlrsh",
    "login": "dchen1107",
    "is_bot": false
  }
]

MATCH (k:KEP {key: $key}) RETURN k LIMIT 1 ; MATCH (k:KEP {key: $key}) MATCH path = (k)-[:REPLACES|SUPERSEDED_BY|SEE_ALSO|GATED_BY*1..2]-(n) WHERE n <> k AND (n:KEP OR n:FeatureGate) AND all(x IN nodes(path)[1..-1] WHERE x <> k AND (x:KEP OR (x:FeatureGate AND NOT x.key IN $placeholders))) WITH n, path ORDER BY length(path), [x IN nodes(path) | x.key] WITH n, collect(path)[0] AS path RETURN n AS node, length(path) AS hop, path ORDER BY hop, n.key LIMIT 150 ; UNWIND $keys AS kk MATCH (k:KEP {key: kk}) RETURN k.key AS kep, [(k)-[r_0:OWNED_BY]->(s_0:SIG) WHERE coalesce(r_0.valid_to, $open) = $open | s_0] AS sigs, [(p_1:Person)-[r_1:AUTHORED]->(k) WHERE coalesce(r_1.valid_to, $open) = $open AND coalesce(p_1.is_bot, false) = false | p_1] AS authors, [(p_2:Person)-[r_2:APPROVES]->(k) WHERE coalesce(r_2.valid_to, $open) = $open AND coalesce(p_2.is_bot, false) = false | p_2] AS approvers, [(k)-[r_3:TRACKED_BY]->(i_3:Issue) WHERE coalesce(r_3.valid_to, $open) = $open AND i_3.state = 'open' | i_3] AS open_issues LIMIT 200

Shared PID Namespace

Facts

How they connect

Impact of change

Keyboard shortcuts

Everywhere

Go to a page

Ask

Search lists

KEP page

Findings table

How they connect

Impact of change

Hop 1

Impact of change

Impact of change

Hop 1