Merge pull request #2762 from bitoku/usernamespace

openshift-merge-bot[bot] · web-flow · commit 4f63a40a2970 · 2026-04-24T17:45:01.000Z
OCPBUGS-74525: OCPBUGS-74526: Remove UserNamespacesPodSecurityStandards and UserNamespacesSupport
diff --git a/features.md b/features.md
@@ -113,8 +113,6 @@
 | SigstoreImageVerificationPKI| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | StoragePerformantSecurityPolicy| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | UpgradeStatus| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
-| UserNamespacesPodSecurityStandards| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
-| UserNamespacesSupport| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | VSphereHostVMGroupZonal| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | VSphereMultiDisk| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | VSphereMultiNetworks| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
diff --git a/features/features.go b/features/features.go
@@ -622,24 +622,6 @@ var (
 						enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
 						mustRegister()
 
-	FeatureGateUserNamespacesSupport = newFeatureGate("UserNamespacesSupport").
-						reportProblemsToJiraComponent("Node").
-						contactPerson("haircommander").
-						productScope(kubernetes).
-						enhancementPR("https://github.com/kubernetes/enhancements/issues/127").
-						enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
-						mustRegister()
-
-	// Note: this feature is perma-alpha, but it is safe and desireable to enable.
-	// It was an oversight in upstream to not remove the feature gate after the version skew became safe in 1.33.
-	// See https://github.com/kubernetes/enhancements/tree/d4226c42/keps/sig-node/127-user-namespaces#pod-security-standards-pss-integration
-	FeatureGateUserNamespacesPodSecurityStandards = newFeatureGate("UserNamespacesPodSecurityStandards").
-							reportProblemsToJiraComponent("Node").
-							contactPerson("haircommander").
-							productScope(kubernetes).
-							enhancementPR("https://github.com/kubernetes/enhancements/issues/127").
-							enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
-							mustRegister()
 
 	FeatureGateVSphereMultiNetworks = newFeatureGate("VSphereMultiNetworks").
 					reportProblemsToJiraComponent("SPLAT").
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
@@ -355,12 +355,6 @@
                     {
                         "name": "UpgradeStatus"
                     },
-                    {
-                        "name": "UserNamespacesPodSecurityStandards"
-                    },
-                    {
-                        "name": "UserNamespacesSupport"
-                    },
                     {
                         "name": "VSphereHostVMGroupZonal"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
@@ -345,12 +345,6 @@
                     {
                         "name": "UpgradeStatus"
                     },
-                    {
-                        "name": "UserNamespacesPodSecurityStandards"
-                    },
-                    {
-                        "name": "UserNamespacesSupport"
-                    },
                     {
                         "name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
@@ -357,12 +357,6 @@
                     {
                         "name": "UpgradeStatus"
                     },
-                    {
-                        "name": "UserNamespacesPodSecurityStandards"
-                    },
-                    {
-                        "name": "UserNamespacesSupport"
-                    },
                     {
                         "name": "VSphereHostVMGroupZonal"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
@@ -348,12 +348,6 @@
                     {
                         "name": "UpgradeStatus"
                     },
-                    {
-                        "name": "UserNamespacesPodSecurityStandards"
-                    },
-                    {
-                        "name": "UserNamespacesSupport"
-                    },
                     {
                         "name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
@@ -355,12 +355,6 @@
                     {
                         "name": "UpgradeStatus"
                     },
-                    {
-                        "name": "UserNamespacesPodSecurityStandards"
-                    },
-                    {
-                        "name": "UserNamespacesSupport"
-                    },
                     {
                         "name": "VSphereHostVMGroupZonal"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
@@ -345,12 +345,6 @@
                     {
                         "name": "UpgradeStatus"
                     },
-                    {
-                        "name": "UserNamespacesPodSecurityStandards"
-                    },
-                    {
-                        "name": "UserNamespacesSupport"
-                    },
                     {
                         "name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
@@ -357,12 +357,6 @@
                     {
                         "name": "UpgradeStatus"
                     },
-                    {
-                        "name": "UserNamespacesPodSecurityStandards"
-                    },
-                    {
-                        "name": "UserNamespacesSupport"
-                    },
                     {
                         "name": "VSphereHostVMGroupZonal"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
@@ -348,12 +348,6 @@
                     {
                         "name": "UpgradeStatus"
                     },
-                    {
-                        "name": "UserNamespacesPodSecurityStandards"
-                    },
-                    {
-                        "name": "UserNamespacesSupport"
-                    },
                     {
                         "name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"
                     },
diff --git a/security/v1/generated.proto b/security/v1/generated.proto
diff --git a/security/v1/tests/securitycontextconstraints.security.openshift.io/UserNamespacesPodSecurityStandards.yaml b/security/v1/tests/securitycontextconstraints.security.openshift.io/UserNamespacesPodSecurityStandards.yaml
diff --git a/security/v1/types.go b/security/v1/types.go
@@ -103,7 +103,6 @@ type SecurityContextConstraints struct {
 	// When "AllowHostLevel" is set, a pod author may set `hostUsers` to either `true` or `false`.
 	// When "RequirePodLevel" is set, a pod author must set `hostUsers` to `false`.
 	// When omitted, the default value is "AllowHostLevel".
-	// +openshift:enable:FeatureGate=UserNamespacesPodSecurityStandards
 	// +kubebuilder:validation:Enum="AllowHostLevel";"RequirePodLevel"
 	// +kubebuilder:default:="AllowHostLevel"
 	// +default="AllowHostLevel"
diff --git a/security/v1/zz_generated.featuregated-crd-manifests.yaml b/security/v1/zz_generated.featuregated-crd-manifests.yaml
@@ -5,8 +5,7 @@ securitycontextconstraints.security.openshift.io:
   CRDName: securitycontextconstraints.security.openshift.io
   Capability: ""
   Category: ""
-  FeatureGates:
-  - UserNamespacesPodSecurityStandards
+  FeatureGates: []
   FilenameOperatorName: config-operator
   FilenameOperatorOrdering: "01"
   FilenameRunLevel: "0000_03"
diff --git a/security/v1/zz_generated.featuregated-crd-manifests/securitycontextconstraints.security.openshift.io/AAA_ungated.yaml b/security/v1/zz_generated.featuregated-crd-manifests/securitycontextconstraints.security.openshift.io/AAA_ungated.yaml
@@ -353,6 +353,18 @@ spec:
                   groups is used in the SecurityContext.
                 type: string
             type: object
+          userNamespaceLevel:
+            default: AllowHostLevel
+            description: |-
+              userNamespaceLevel determines if the policy allows host users in containers.
+              Valid values are "AllowHostLevel", "RequirePodLevel", and omitted.
+              When "AllowHostLevel" is set, a pod author may set `hostUsers` to either `true` or `false`.
+              When "RequirePodLevel" is set, a pod author must set `hostUsers` to `false`.
+              When omitted, the default value is "AllowHostLevel".
+            enum:
+            - AllowHostLevel
+            - RequirePodLevel
+            type: string
           users:
             description: The users who have permissions to use this security context
               constraints
diff --git a/security/v1/zz_generated.featuregated-crd-manifests/securitycontextconstraints.security.openshift.io/UserNamespacesPodSecurityStandards.yaml b/security/v1/zz_generated.featuregated-crd-manifests/securitycontextconstraints.security.openshift.io/UserNamespacesPodSecurityStandards.yaml

Original file line number	Diff line number	Diff line change
`@@ -355,12 +355,6 @@`
`355`	`355`	`{`
`356`	`356`	`"name": "UpgradeStatus"`
`357`	`357`	`},`
`358`		`- {`
`359`		`- "name": "UserNamespacesPodSecurityStandards"`
`360`		`- },`
`361`		`- {`
`362`		`- "name": "UserNamespacesSupport"`
`363`		`- },`
`364`	`358`	`{`
`365`	`359`	`"name": "VSphereHostVMGroupZonal"`
`366`	`360`	`},`
Original file line number	Diff line number	Diff line change
`@@ -345,12 +345,6 @@`
`345`	`345`	`{`
`346`	`346`	`"name": "UpgradeStatus"`
`347`	`347`	`},`
`348`		`- {`
`349`		`- "name": "UserNamespacesPodSecurityStandards"`
`350`		`- },`
`351`		`- {`
`352`		`- "name": "UserNamespacesSupport"`
`353`		`- },`
`354`	`348`	`{`
`355`	`349`	`"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"`
`356`	`350`	`},`
Original file line number	Diff line number	Diff line change
`@@ -357,12 +357,6 @@`
`357`	`357`	`{`
`358`	`358`	`"name": "UpgradeStatus"`
`359`	`359`	`},`
`360`		`- {`
`361`		`- "name": "UserNamespacesPodSecurityStandards"`
`362`		`- },`
`363`		`- {`
`364`		`- "name": "UserNamespacesSupport"`
`365`		`- },`
`366`	`360`	`{`
`367`	`361`	`"name": "VSphereHostVMGroupZonal"`
`368`	`362`	`},`
Original file line number	Diff line number	Diff line change
`@@ -348,12 +348,6 @@`
`348`	`348`	`{`
`349`	`349`	`"name": "UpgradeStatus"`
`350`	`350`	`},`
`351`		`- {`
`352`		`- "name": "UserNamespacesPodSecurityStandards"`
`353`		`- },`
`354`		`- {`
`355`		`- "name": "UserNamespacesSupport"`
`356`		`- },`
`357`	`351`	`{`
`358`	`352`	`"name": "VSphereConfigurableMaxAllowedBlockVolumesPerNode"`
`359`	`353`	`},`