feat(deploy/chart): adding hostUsers property to pods by hjoshi123 · Pull Request #7973 · cert-manager/cert-manager

hjoshi123 · 2025-08-18T15:48:58Z

Pull Request Motivation

Refer to https://kubernetes.io/blog/2025/04/25/userns-enabled-by-default/ for more context on the feature.

Kind

/kind feature

Release Note

added experimental field `hostUsers` flag to all pods. Not set by default.

deploy/charts/cert-manager/values.yaml

hawksight · 2025-09-01T11:44:41Z

Hey @hjoshi123, thanks for taking the time to add this. I think there are 2 issues or points to discuss:

I think you can se with and coalesce helm functions here to minimise the YAML. For example, a similar global vs specific values here: https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/templates/startupapicheck-job.yaml#L79-L84 - (goal - less YAML / maintainability)
Given that this is default in 1.33 which is current minus 1, we might want to enable this is a way where we don't specify it by default. For example .Values.global.hostUsers: "" to make it blank. In which case, no YAML. Unless you can prove that providing the default value of hostUsers: false works on k8s 1.29 (from our supported releases for v1.18). If it works on a 1.29 kind cluster set to false, then we can ignore this point. - (goal - maintain support for all supported versions / backwards compatibility)

hjoshi123 · 2025-09-01T16:23:35Z

Hey @hjoshi123, thanks for taking the time to add this. I think there are 2 issues or points to discuss:

I think you can se with and coalesce helm functions here to minimise the YAML. For example, a similar global vs specific values here: https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/templates/startupapicheck-job.yaml#L79-L84 - (goal - less YAML / maintainability)

Given that this is default in 1.33 which is current minus 1, we might want to enable this is a way where we don't specify it by default. For example .Values.global.hostUsers: "" to make it blank. In which case, no YAML. Unless you can prove that providing the default value of hostUsers: false works on k8s 1.29 (from our supported releases for v1.18). If it works on a 1.29 kind cluster set to false, then we can ignore this point. - (goal - maintain support for all supported versions / backwards compatibility)

@hawksight yes it does make sense to use with here I think.. I can refactor the code and try to make it better.
On the second point, my intention was to only put the hostUsers field when its true; this way if the value is false then the field doesn't show up in the spec at all so we don't have to worry about compatibility issues below 1.33. 1.33 has the hostUsers field false by default.

hjoshi123 · 2025-09-01T16:29:15Z

Also, I am not sure if coalesce can handle booleans, was reading the documentation to make sure and they seem to mention lists

hawksight · 2025-09-02T08:58:59Z

@hjoshi123 - I'll join stand up today to talk about it hopefully, you are probably right.

I did a quick test in kind 1.27:

➜  cert-manager git:(feat/user-namespace-feature) ✗ k explain deployment.spec.template.spec.hostUsers
GROUP:      apps
KIND:       Deployment
VERSION:    v1

FIELD: hostUsers <boolean>


DESCRIPTION:
    Use the host's user namespace. Optional: Default to true. If set to true or
    not present, the pod will be run in the host user namespace, useful for when
    the pod needs a feature only available to the host user namespace, such as
    loading a kernel module with CAP_SYS_MODULE. When set to false, a new userns
    is created for the pod. Setting false is useful for mitigating container
    breakout vulnerabilities even allowing users to run their containers as root
    without actually having root privileges on the host. This field is
    alpha-level and is only honored by servers that enable the
    UserNamespacesSupport feature.


➜  cert-manager git:(feat/user-namespace-feature) ✗ k version
Client Version: v1.34.0
Kustomize Version: v5.7.1
Server Version: v1.27.13
Warning: version difference between client (1.34) and server (1.27) exceeds the supported minor version skew of +/-1

It's confusingly worded I find:

Optional: Default to true. If set to true or not present, the pod will be run in the host user namespace...

When set to false, a new userns is created for the pod.

I actually think we want to default it to false, unless someone explicitly needs it true.
I guess we need to check with maintainers to see if there are any host user namespace capabilities needed. My gut says no.

hawksight · 2025-09-02T09:14:59Z

If we assume we want to set it to a safe default of "false", then the logic could be shorter:

      {{- if hasKey .Values.cainjector "hostUsers" }}
      hostUsers: {{ .Values.cainjector.hostUsers }}
      {{- else }}
      hostUsers: {{ .Values.global.hostUsers }}
      {{- end }}

hjoshi123 · 2025-09-02T11:39:47Z

If we assume we want to set it to a safe default of "false", then the logic could be shorter:

      {{- if hasKey .Values.cainjector "hostUsers" }}

      hostUsers: {{ .Values.cainjector.hostUsers }}

      {{- else }}

      hostUsers: {{ .Values.global.hostUsers }}

      {{- end }}

Ah yes that makes it simpler. So it is a valid field in 1.27 too then. I will make the change. Thank you @hawksight

hjoshi123 · 2025-09-02T23:59:41Z

@hawksight changed the code.. could you take a look at it again?

hjoshi123 · 2025-09-03T00:01:11Z

/release-note-edit

added `hostUsers` flag to all pods. Defaults to false.

hjoshi123 · 2025-09-03T00:14:00Z

/retest

hjoshi123 · 2025-09-03T03:51:35Z

not sure why the tests are failing.. locally all tests seem to be running..
/retest

deploy/charts/cert-manager/templates/deployment.yaml

deploy/charts/cert-manager/values.yaml

hawksight · 2025-09-05T14:43:55Z

/retest
/lgtm

hjoshi123 · 2025-09-13T15:33:00Z

I lean towards the first option and adding comments about how to use the false value if required. This way users can be prepared if they want to. The default value for this field is true after 1.33 anyway. And then once its GA we can mark it as false. WDYT?

Not sure if I understand. 😅 We use cert-manager, and I don't want to have the hostUsers field set at all in the pod template. At least not until all supported K8s versions understand it.

Ah I understand now.. so we make the field optional then i.e. not set any value at all and then add comments about the fact that its an experimental feature? I understand what you are arriving at but still confused how i would implement it 😅

erikgb · 2025-09-13T15:42:27Z

Ah I understand now.. so we make the field optional then i.e. not set any value at all and then add comments about the fact that its an experimental feature? I understand what you are arriving at but still confused how i would implement it 😅

That's a typical Helm issue. I think you need to distinguish between an unset value and the false value. There must be some way of doing this in Helm......

hjoshi123 · 2025-09-14T04:07:45Z

@erikgb pushed some changes according to our discussions.. the comments may not be that polished so let me know if it needs changing

…ce-feature Signed-off-by: hjoshi123 <mail@hjoshi.me>

deploy/charts/cert-manager/values.yaml

Co-authored-by: Erik Godding Boye <egboye@gmail.com> Signed-off-by: Hemant Joshi <mail2hemantjoshi@pm.me> Signed-off-by: hjoshi123 <mail@hjoshi.me>

erikgb

Thanks a lot for working on this, @hjoshi123. It's a very interesting subject, and I am glad we spent some time deciding on where to go here. Your solution looks good now, and I hope both you and @hawksight agree?

I've added a suggestion to the value docs. The last part is no longer correct, and I think the text was a bit hard to read. With a little help from ChatGPT, I put in a suggestion. Feel free to adjust.

/approve

deploy/charts/cert-manager/values.yaml

cert-manager-prow · 2025-09-15T20:22:40Z

@hjoshi123: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cert-manager-master-license	`7c5a26a`	link	false	`/test pull-cert-manager-master-license`
pull-cert-manager-master-e2e-v1-33	`cbc99c8`	link	true	`/test pull-cert-manager-master-e2e-v1-33`
pull-cert-manager-master-e2e-v1-33-upgrade	`cbc99c8`	link	true	`/test pull-cert-manager-master-e2e-v1-33-upgrade`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Co-authored-by: Erik Godding Boye <egboye@gmail.com> Signed-off-by: Hemant Joshi <mail2hemantjoshi@pm.me> Signed-off-by: hjoshi123 <mail@hjoshi.me>

erikgb

Great work, @hjoshi123! 🚀

/lgtm
/approve

cert-manager-prow · 2025-09-15T20:57:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erikgb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [erikgb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

erikgb · 2025-09-15T20:58:11Z

/hold

Can you update release notes, please?

erikgb · 2025-09-15T20:59:51Z

/unhold

hjoshi123 · 2025-09-15T21:09:13Z

/release-note-edit

added experimental field `hostUsers` flag to all pods. Not set by default.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cert-manager](https://cert-manager.io) ([source](https://github.com/cert-manager/cert-manager)) | minor | `v1.18.2` -> `v1.19.0` | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.19.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.19.0) [Compare Source](cert-manager/cert-manager@v1.18.2...v1.19.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. This release focuses on expanding platform compatibility, improving deployment flexibility, enhancing observability, and addressing key reliability issues. > 📖 Read the full release notes at cert-manager.io: <https://cert-manager.io/docs/releases/release-notes/release-notes-1.19> Changes since `v1.18.0`: #### Feature - Add IPv6 rules to the default network policy ([#7726](cert-manager/cert-manager#7726), [@jcpunk](https://github.com/jcpunk)) - Add `global.nodeSelector` to helm chart to allow for a single `nodeSelector` to be set across all services. ([#7818](cert-manager/cert-manager#7818), [@StingRayZA](https://github.com/StingRayZA)) - Add a feature gate to default to Ingress `pathType` `Exact` in ACME HTTP01 Ingress challenge solvers. ([#7795](cert-manager/cert-manager#7795), [@sspreitzer](https://github.com/sspreitzer)) - Add generated `applyconfigurations` allowing clients to make type-safe server-side apply requests for cert-manager resources. ([#7866](cert-manager/cert-manager#7866), [@erikgb](https://github.com/erikgb)) - Added API defaults to issuer references group (cert-manager.io) and kind (Issuer). ([#7414](cert-manager/cert-manager#7414), [@erikgb](https://github.com/erikgb)) - Added `certmanager_certificate_challenge_status` Prometheus metric. ([#7736](cert-manager/cert-manager#7736), [@hjoshi123](https://github.com/hjoshi123)) - Added `protocol` field for `rfc2136` DNS01 provider ([#7881](cert-manager/cert-manager#7881), [@hjoshi123](https://github.com/hjoshi123)) - Added experimental field `hostUsers` flag to all pods. Not set by default. ([#7973](cert-manager/cert-manager#7973), [@hjoshi123](https://github.com/hjoshi123)) - Support configurable resource requests and limits for ACME HTTP01 solver pods through ClusterIssuer and Issuer specifications, allowing granular resource management that overrides global `--acme-http01-solver-resource-*` settings. ([#7972](cert-manager/cert-manager#7972), [@lunarwhite](https://github.com/lunarwhite)) - The `CAInjectorMerging` feature has been promoted to BETA and is now enabled by default ([#8017](cert-manager/cert-manager#8017), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - The controller, webhook and ca-injector now log their version and git commit on startup for easier debugging and support. ([#8072](cert-manager/cert-manager#8072), [@prasad89](https://github.com/prasad89)) - Updated `certificate` metrics to the collector approach. ([#7856](cert-manager/cert-manager#7856), [@hjoshi123](https://github.com/hjoshi123)) #### Bug or Regression - ACME: Increased challenge authorization timeout to 2 minutes to fix `error waiting for authorization` ([#7796](cert-manager/cert-manager#7796), [@hjoshi123](https://github.com/hjoshi123)) - BUGFIX: permitted URI domains were incorrectly used to set the excluded URI domains in the CSR's name constraints ([#7816](cert-manager/cert-manager#7816), [@kinolaev](https://github.com/kinolaev)) - Enforced ACME HTTP-01 solver validation to properly reject configurations when multiple ingress options (`class`, `ingressClassName`, `name`) are specified simultaneously ([#8021](cert-manager/cert-manager#8021), [@lunarwhite](https://github.com/lunarwhite)) - Increase maximum sizes of PEM certificates and chains which can be parsed in cert-manager, to handle leaf certificates with large numbers of DNS names or other identities ([#7961](cert-manager/cert-manager#7961), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Reverted adding the `global.rbac.disableHTTPChallengesRole` Helm option. ([#7836](cert-manager/cert-manager#7836), [@inteon](https://github.com/inteon)) - This change removes the `path` label of core ACME client metrics and will require users to update their monitoring dashboards and alerting rules if using those metrics. ([#8109](cert-manager/cert-manager#8109), [@mladen-rusev-cyberark](https://github.com/mladen-rusev-cyberark)) - Use the latest version of `ingress-nginx` in E2E tests to ensure compatibility ([#7792](cert-manager/cert-manager#7792), [@wallrj](https://github.com/wallrj)) #### Other (Cleanup or Flake) - Helm: Fix naming template of `tokenrequest` RoleBinding resource to improve consistency ([#7761](cert-manager/cert-manager#7761), [@lunarwhite](https://github.com/lunarwhite)) - Improve error messages when certificates, CRLs or private keys fail admission due to malformed or missing PEM data ([#7928](cert-manager/cert-manager#7928), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Major upgrade of Akamai SDK. NOTE: The new version has not been fully tested end-to-end due to the lack of cloud infrastructure. ([#8003](cert-manager/cert-manager#8003), [@hjoshi123](https://github.com/hjoshi123)) - Update kind images to include the Kubernetes 1.33 node image ([#7786](cert-manager/cert-manager#7786), [@wallrj](https://github.com/wallrj)) - Use `maps.Copy` for cleaner map handling ([#8092](cert-manager/cert-manager#8092), [@quantpoet](https://github.com/quantpoet)) - Vault: Migrate Vault E2E add-on tests from deprecated `vault-client-go` to the new `vault/api` client. ([#8059](cert-manager/cert-manager#8059), [@armagankaratosun](https://github.com/armagankaratosun)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1711 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

wallrj-cyberark · 2025-10-15T15:55:39Z

@hjoshi123 We have released this. Please test and feedback: https://github.com/cert-manager/cert-manager/releases/tag/v1.19.1

jcpunk · 2025-12-19T21:25:51Z

Adding a note here: kind doesn't work with hostUsers: false. So while I fully support making user namespaces the default, I'll need a way to continue testing my environment in kind...

hjoshi123 force-pushed the feat/user-namespace-feature branch from d49a30d to 5c7c2ab Compare August 18, 2025 16:46

cert-manager-prow bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Aug 18, 2025

hjoshi123 force-pushed the feat/user-namespace-feature branch 4 times, most recently from f524509 to 6339771 Compare August 18, 2025 17:45

hawksight reviewed Sep 1, 2025

View reviewed changes

deploy/charts/cert-manager/values.yaml Outdated Show resolved Hide resolved

hjoshi123 force-pushed the feat/user-namespace-feature branch from 6339771 to 2c4f3a8 Compare September 2, 2025 23:59

hjoshi123 force-pushed the feat/user-namespace-feature branch from 2c4f3a8 to f57cb82 Compare September 3, 2025 01:36

hawksight reviewed Sep 3, 2025

View reviewed changes

deploy/charts/cert-manager/templates/deployment.yaml Show resolved Hide resolved

hawksight reviewed Sep 3, 2025

View reviewed changes

deploy/charts/cert-manager/values.yaml Outdated Show resolved Hide resolved

hjoshi123 force-pushed the feat/user-namespace-feature branch 2 times, most recently from de7b4df to a4401ab Compare September 3, 2025 15:41

hjoshi123 force-pushed the feat/user-namespace-feature branch from cbc99c8 to 0afdc2f Compare September 14, 2025 04:06

cert-manager-prow bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Sep 14, 2025

Merge remote-tracking branch 'upstream/master' into feat/user-namespa…

80e38ec

…ce-feature Signed-off-by: hjoshi123 <mail@hjoshi.me>

hjoshi123 force-pushed the feat/user-namespace-feature branch from 0afdc2f to 80e38ec Compare September 14, 2025 04:15

erikgb reviewed Sep 14, 2025

View reviewed changes

deploy/charts/cert-manager/values.yaml Outdated Show resolved Hide resolved

deploy/charts/cert-manager/values.yaml Outdated Show resolved Hide resolved

Update deploy/charts/cert-manager/values.yaml

13f2ed8

Co-authored-by: Erik Godding Boye <egboye@gmail.com> Signed-off-by: Hemant Joshi <mail2hemantjoshi@pm.me> Signed-off-by: hjoshi123 <mail@hjoshi.me>

hjoshi123 force-pushed the feat/user-namespace-feature branch from b34d68f to 13f2ed8 Compare September 14, 2025 20:22

hjoshi123 requested review from erikgb and hawksight September 14, 2025 20:24

erikgb reviewed Sep 15, 2025

View reviewed changes

deploy/charts/cert-manager/values.yaml Outdated Show resolved Hide resolved

cert-manager-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 15, 2025

Update deploy/charts/cert-manager/values.yaml

caeb2d0

Co-authored-by: Erik Godding Boye <egboye@gmail.com> Signed-off-by: Hemant Joshi <mail2hemantjoshi@pm.me> Signed-off-by: hjoshi123 <mail@hjoshi.me>

hjoshi123 force-pushed the feat/user-namespace-feature branch from a7fd37e to caeb2d0 Compare September 15, 2025 20:35

erikgb reviewed Sep 15, 2025

View reviewed changes

cert-manager-prow bot added the lgtm Indicates that a PR is ready to be merged. label Sep 15, 2025

cert-manager-prow bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 15, 2025

cert-manager-prow bot merged commit 954cb20 into cert-manager:master Sep 15, 2025
6 checks passed

cert-manager-prow bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 15, 2025

Conversation

hjoshi123 commented Aug 18, 2025 • edited by cert-manager-prow bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Motivation

Kind

Release Note

Uh oh!

Uh oh!

hawksight commented Sep 1, 2025

Uh oh!

hjoshi123 commented Sep 1, 2025

Uh oh!

hjoshi123 commented Sep 1, 2025

Uh oh!

hawksight commented Sep 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hawksight commented Sep 2, 2025

Uh oh!

hjoshi123 commented Sep 2, 2025

Uh oh!

hjoshi123 commented Sep 2, 2025

Uh oh!

hjoshi123 commented Sep 3, 2025

Uh oh!

hjoshi123 commented Sep 3, 2025

Uh oh!

hjoshi123 commented Sep 3, 2025

Uh oh!

Uh oh!

Uh oh!

hawksight commented Sep 5, 2025

Uh oh!

hjoshi123 commented Sep 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

erikgb commented Sep 13, 2025

Uh oh!

hjoshi123 commented Sep 14, 2025

Uh oh!

Uh oh!

Uh oh!

erikgb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cert-manager-prow bot commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

erikgb left a comment

Choose a reason for hiding this comment

Uh oh!

cert-manager-prow bot commented Sep 15, 2025

Uh oh!

erikgb commented Sep 15, 2025

Uh oh!

Uh oh!

erikgb commented Sep 15, 2025

Uh oh!

hjoshi123 commented Sep 15, 2025

Uh oh!

wallrj-cyberark commented Oct 15, 2025

Uh oh!

jcpunk commented Dec 19, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

hjoshi123 commented Aug 18, 2025 •

edited by cert-manager-prow bot

Loading

hawksight commented Sep 2, 2025 •

edited

Loading

hjoshi123 commented Sep 13, 2025 •

edited

Loading

cert-manager-prow bot commented Sep 15, 2025 •

edited

Loading