user-namespaces: add idsPerPod configuration

[AkihiroSuda]

Description

Kubernetes v1.33 will support setting userNamespaces.idsPerPod in KubeletConfiguration.

Depends on:

• kubelet: config: add userNamespaces.idsPerPod kubernetes#130028

Issue

Closes: NONE

[AkihiroSuda]

cc @rata

[netlify]

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	4691c9c
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/67aea5f71f51ab0008718003
😎 Deploy Preview	https://deploy-preview-49749--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[netlify]

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	ba6bf9d
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/67b836e071e9640009094d29
😎 Deploy Preview	https://deploy-preview-49749--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[rata]

LGTM.

Left an idea of a possible clarification, but I'm not the best with wordings, feel free to leave it out :D

[rata]

@AkihiroSuda the change LGTM, however I just realize it's against the wrong branch. See the comment, it should be against the branch dev-1.33. Can you adjust that?

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rata
Once this PR has been reviewed and has the lgtm label, please assign salaxander for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• content/en/docs/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	ba6bf9d
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/67b836e070aed40008558a44

[rata]

@AkihiroSuda found another place we needed to update, left a suggestion on how to change it. Other than that, I think you can mark this PR as ready for review :)

[rata]

This file, above this diff says:

The valid UIDs/GIDs when this feature is enabled is the range 0-65535. This applies to files and processes (runAsUser, runAsGroup, etc.).

Files using a UID/GID outside this range will be seen as belonging to the overflow ID, usually 65534 (configured in /proc/sys/kernel/overflowuid and /proc/sys/kernel/overflowgid). However, it is not possible to modify those files, even by running as the 65534 user/group.

What if we add a note there (a "by default" in the first paragraph and a note after these two paragraphs), like:

By default, the valid UIDs/GIDs when this feature is enabled is the range 0-65535. This applies to files and processes (runAsUser, runAsGroup, etc.). 

Files using a UID/GID outside this range will be seen as belonging to the overflow ID, usually 65534 (configured in /proc/sys/kernel/overflowuid and /proc/sys/kernel/overflowgid). However, it is not possible to modify those files, even by running as the 65534 user/group.

If the range 0-65536 is extended with a configuration knob, the aforementioned restrictions apply to the extended range.