Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update pause image to v3.5 #100292

Merged
merged 1 commit into from
May 25, 2021
Merged

Update pause image to v3.5 #100292

merged 1 commit into from
May 25, 2021

Conversation

saschagrunert
Copy link
Member

@saschagrunert saschagrunert commented Mar 16, 2021 •
edited
Loading

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

Update dependencies and the test images to use pause 3.5. We also
provide a changelog entry for the new container image version.

Which issue(s) this PR fixes:

Refers to #97963

Special notes for your reviewer:

Previous 3.4.1 update PR: #98205

Does this PR introduce a user-facing change?

Updated pause image to version 3.5, which now runs per default as pseudo user and group `65535:65535`.
This does not have any effect on remote container runtimes like CRI-O and containerd, which setup the pod
sandbox user and group on their own.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

None

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. area/kubeadm area/kubectl area/kubelet area/provider/gcp Issues or PRs related to gcp provider area/test sig/cli Categorizes an issue or PR as relevant to SIG CLI. sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. sig/node Categorizes an issue or PR as relevant to SIG Node. sig/testing Categorizes an issue or PR as relevant to SIG Testing. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Mar 16, 2021
troy0820
troy0820 suggested changes Mar 16, 2021
View reviewed changes
Copy link
Member

@troy0820 troy0820 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Change tag in file build/pause/Makefile to 3.5 to coincide with the changed dependency.

@troy0820
Copy link
Member

/priority important-soon
/triage accepted

@k8s-ci-robot k8s-ci-robot added priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Mar 16, 2021
@troy0820 troy0820 mentioned this pull request Mar 16, 2021
Closed
13 tasks
@saschagrunert saschagrunert mentioned this pull request Mar 16, 2021
Merged
@saschagrunert
Copy link
Member Author

saschagrunert commented Mar 16, 2021 •
edited
Loading

We have to promote the new pause image first, see kubernetes/k8s.io#1793

@saschagrunert
Copy link
Member Author

Fixed the changelog entry ✔️

@justaugustus
Copy link
Member

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 4, 2021
@spiffxp
Copy link
Member

spiffxp commented May 4, 2021

As an end user I might find "pause runs as non-root user by default" more informative than "bumped to 3.5" as a release note. I see something like this is on a linked PR so maybe doesn't matter for this. However, does this require action on the part of someone upgrading their cluster if they for whatever reason require the previous behavior?

@BenTheElder
Copy link
Member

As an end user I might find "pause runs as non-root user by default" more informative than "bumped to 3.5" as a release note.

Has anyone verified that this is actually the end result with any of the runtimes? How pause is used will depend on what runtime you use, e.g. upgrading it here typically only impacts dockershim to begin with.

... if they for whatever reason require the previous behavior?

... That shouldn't be possible? ™️

@saschagrunert
Copy link
Member Author

saschagrunert commented May 5, 2021 •
edited
Loading

As an end user I might find "pause runs as non-root user by default" more informative than "bumped to 3.5" as a release note.

Has anyone verified that this is actually the end result with any of the runtimes? How pause is used will depend on what runtime you use, e.g. upgrading it here typically only impacts dockershim to begin with.

CRI-O does not pickup the username for the sandbox from the pause container image. It still uses 0:0 as user:group (for now).

@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 13, 2021
@k8s-ci-robot k8s-ci-robot removed lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels May 14, 2021
@saschagrunert
Copy link
Member Author

Had to rebase this one. Please take a look again @justaugustus @liggitt

@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 22, 2021
@saschagrunert
Update pause image to v3.5
b167fc2 
Update dependencies and the test images to use pause 3.5. We also
provide a changelog entry for the new container image version.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 25, 2021
@saschagrunert
Copy link
Member Author

Had to rebase again.

@dims
Copy link
Member

dims commented May 25, 2021

@saschagrunert we should probably add some release notes on what to expect / what to watch out for given the changes in #97963

/approve

@dims
Copy link
Member

dims commented May 25, 2021

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 25, 2021
cpanato
cpanato approved these changes May 25, 2021
View reviewed changes
Copy link
Member

@cpanato cpanato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: BenTheElder, cpanato, dims, hasheddan, justaugustus, liggitt, pacoxu, saschagrunert, troy0820

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@saschagrunert
Copy link
Member Author

saschagrunert commented May 25, 2021 •
edited
Loading

Updated the changelog to be more descriptive. I also already addressed the changelog file issue, so:
/hold cancel

@k8s-ci-robot k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 25, 2021
@k8s-ci-robot k8s-ci-robot merged commit 7229ea3 into kubernetes:master May 25, 2021
@saschagrunert saschagrunert deleted the pause-3.5 branch May 25, 2021 14:00
@github-actions github-actions bot mentioned this pull request May 26, 2021
Open
@rifelpet rifelpet mentioned this pull request Jul 2, 2021
Merged
@pacoxu pacoxu mentioned this pull request Aug 6, 2021
Merged
13 tasks
@troy0820 troy0820 mentioned this pull request Dec 20, 2021
Closed
13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@liggitt liggitt liggitt left review comments

@hasheddan hasheddan hasheddan approved these changes

@troy0820 troy0820 troy0820 approved these changes

@cpanato cpanato cpanato approved these changes

@pacoxu pacoxu pacoxu approved these changes

@ahg-g ahg-g Awaiting requested review from ahg-g

@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr

Assignees

@liggitt liggitt

@smarterclayton smarterclayton

@cblecker cblecker

@pacoxu pacoxu

@cpanato cpanato

@janetkuo janetkuo

@troy0820 troy0820

@SataQiu SataQiu

@yujuhong yujuhong

@hasheddan hasheddan

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/kubeadm area/kubectl area/kubelet area/provider/gcp Issues or PRs related to gcp provider area/test cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/cli Categorizes an issue or PR as relevant to SIG CLI. sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. sig/node Categorizes an issue or PR as relevant to SIG Node. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
SIG Node CI/Test Board
Archived in project
SIG Node: code and documentation PRs
Archived in project
Milestone
v1.22
Development

Successfully merging this pull request may close these issues.