►
From YouTube: SIG Cluster Lifecycle - kubeadm office hours 2022-01-05
A
A
B
A
B
A
A
A
A
B
A
A
B
A
Yes,
I'm
going
to
open
the
discussion
of
the
bailling
list.
First,
if
I
think
that
it's
not
sufficient,
we
can
try
using,
I
mean
I'm
possibly
also
going
to
ping
swag
anyway,
like
kubernetes,
like
you
know,
I
can
also
give
it
to
some
of
the
sub
projects.
Like
mini
q,
mentioned
people,
yes
kinds,
and
so
on.
A
Rock
control
plane
has
no
roots.
This
is
in
this.
We
started
a
bit
of
a
discussion
before
new
year,
so
the
future
is
called
the
alpha.
The
plan
was
to
graduate
in
123.
We
delayed
with
one
release
because
we
weren't
sure
if
we
want
to
get
this
feature
so
early
to
beat
them
without
feedback.
We
haven't
gotten
any
feedback
and
I
think
we
have
a
couple
of
users,
at
least
so.
A
A
The
linux
supports
user
namespaces
and
I
knew
this
for
a
long
time.
But
for
some
reason
I
was
never
asking
the
question
why
kubernetes
do
not
support
username
species.
So
when
you
run
a
container
what
you
get
inside
the
container
as
a
root
user
potentially
is
the
root
user
of
the
host.
It's
the
same
id,
the
same
privilege
and
the
same
user,
but
username
spaces.
Allow
you
to
sandbox
the
root
user
inside
the
container
to
be
a
completely
different
root
user.
So
in
the
host
you
can
have
the
container
running
as
id
1000.
A
So
it's
like
a
completely
decoupling
of
the
mapping
of
users
and
groups
and
that's
what
the
this
feature
in
the
kernel
has
and
if
you
think
about
kubernetes
spots,
the
question
here
was
like:
why
don't
kubernetes
spots
give
you
a
toggle
to
do
this,
like
I
want
to
enable
this
mapping
or
this
mapping,
apparently
just
a
missing
feature:
kubernetes
doesn't
have
it
the
details
in
the
cap.
I
have
read
it
already
and
I
I
know
the
vinayak,
the
author
of
the
cuba
dm
rootless
feature
knows
about
this
cable.
B
B
B
B
A
B
The
problem
is
that
okay,
we
enabled
it
by
default
by
default,
it
will
go
on
all
the
cluster
api
and
customer
api.
We
have
we
use
image
which
are
built
by
image
builder
and
if
everything
does
not
fit
in
place,
basically,
we
as
a
sig,
we
don't
do,
we
we
don't
make
a.
Let
me
say
it
will
not
good
as
a
sig.
So
let's
try
to
anticipate
the
problem
that
that's
only
my
my
only
concern
sure.
A
I
see
what
you
mean,
so
video
told
me
that
this
feature
from
what
I
gathered.
I
think
he
also
wants
this
feature
to
land
problem
with
it
is
that
it's
going
to
take
a
while
to
graduate
and
to
get
it
properly
done,
because
from
understanding
there's
some
sort
of
problem
with
host
mounts
because
horse
puff
mounts.
A
So
from
other
settings,
vinayak
is
going
to
potentially
try
to
push
for
to
get
the
cube
idea.
Future
graduated
to
bitter
in
this
window
of
time.
But
my
concern
there
is
going
to
be
that
if
we
switch
this
feature
on
by
default
in
cube
adm,
we
have
to
maintain
it
for
longer
periods
of
time.
Obviously,
potentially
one
year
after
we
switch
it
and
also
it
means
that
we
might
actually
opt
in
users
that
don't
want
to
be
opt-in
and
potentially
break
on
some
operating
systems
that
have
weird
system.
First,.
B
B
We
know
that
we
will
work
it
or
just
wait
until
if
the,
if
waiting
is
reasonable,
if
we
are
talking
to
wait
one
or
two
cycle,
I
think
that
is
reasonable
if
we
are
talking
about
waiting
two
years.
No,
so
let's
try
to
put
the
piece
of
the
puzzle
together
and
enrich
to
a
decision,
but
given
that
there
is
a
better
alternative,
let
me
say
being
discussed:
let's
wait
at
least
to
to
see
if
this
cap
emerges
and
the
implementation
plan.
A
A
Improvement,
sweet
cd11
pro
lightness
probes.
I
know
that
indeed,
where
we
had
this
problem,
people
saw
it
in
the
company
within
this
internal
testing
problem
here
is
that,
as
discussion
pointed
out,
we
have
the
fix
in
a
new
lcd
release,
but
we
cannot
backport
it.
They
I
to
buy
the
staining
hcd
will
not
backport
it
to
other
hd
releases,
which
means
that
the
fix
will
land
in
the
future,
potentially
in
a
new
hcd
miner
release,
but,
like
I
said
here,
it
might
take
one
year
for
the
new
hd
release
to
land.
A
A
Machine
readable
outputs:
this
is
it's
pretty
much
help
wanted
at
this
point,
but
I'm
not
adding
the
label.
If
somebody
wants
to
continue
work
on
the
cap,
it's
welcome.
We
only
have
a
few
commands
that
support
it.
This
is
also
help
wanted
the
kubernetes
I'm
trying
to
get
them
in
turn
to
work
on
this.
A
B
B
The
discussion
was
triggered
by
the
ignition
pr
that
is
kind
of
that
is
conflicting.
Basically,
a
lot
of
kubernetes
booster
concern
and
machine
booster
of
concern,
because
now
we
have
ignition
and
cloud
in
it
inside
the
same
provider,
which
is
hard
to
maintain.
So
maybe
that
also
in
cluster
api,
we're
going
to
change
something
in
in
the
bootstrap
or
how
we've
wrapped
could
mean,
but
not
sure,
because
we
we
still
have
to
close
our
roadmap
for
2022..
B
C
A
A
A
The
I'm
following
the
discussions
about
the
cri
dash
docker
d
provider.
Sorry,
it's
a
service
cri
docker,
this
service,
which
is
the
replacement
for
dockership,
and
I
can
discuss
it
later
in
the
we
have
an
issue
about
dockership.
Basically,
what
is
happening
there
that
we,
they
started
pushing
releases
and
we
might
want
to
bring
docker
testing
back
to
cuba
dm
eventually.
B
A
A
Yet
if
we
start
getting
users,
I'm
going
to
watch,
of
course
all
the
channels,
but
if
we
start
getting
users
that
use
cri
docker
d-
and
we
don't
have
signal
for
it-
and
if
we
have
special
paths
in
cuba
dm
that
we
want
to
actually
test,
then
this
is
going
to
be
worth
adding
a
new
go,
adding
back
the
docker
signal
to
the
kinder
jobs,
which
means
we
have
to
continue
maintaining
the
a
docker
base
image
like
it's
a
sequence
of
events.
That's
going
to
happen.
Yeah.
B
A
A
A
A
B
A
C
A
A
D
B
A
And
I
tried
it
and
I
tried
it
multiple
times
and
it
doesn't
work
because
of
leader
election
to
my
understanding,
because
in
the
lb,
when
you
connect
to
the
lb
you're
going
to
get
an
active
api
server,
that
is
the
one
that
you
want
the
leader
in
the
aha.
Yes
and
it
you
can
bootstrap
to
this
api
server.
But
if
you
get
the
local
api
server,
it's
not
elected
as
a
leader,
so
it
cannot
fiddle
with
the
csr
logic
at
all.
B
A
A
D
A
C
A
A
A
A
A
So,
basically,
if
the
cra
socket
path
does
not
have
unix
or
named
pipe
on
windows,
we
are
now
going
to
show
a
warning
to
the
users
and
also
our
upgrade
code
is
going
to
try
to
automatically
prefix
the
url
scheme
schemes
everywhere,
where
we
store
the
socket
paths.
So
this
is
okay.
This
is
a
change
we
are
doing.
A
A
A
B
A
B
B
B
A
A
A
So
if,
if
there
is
a
cri
dash,
docker
d
project
that
maintains
their
own
socket
is
now
we
consider
this
like
a
separate
sierra
implementation,
and
if
there
are
multiple
cris
on
the
host,
we
will
throw
an
error.
The
the
user
has
to
be
explicit
if
they
have
multiple
ones.
Okay,
you
have
docker.
We
have
sorry,
you
have
the
cri
docker
d.
You
have
cryo,
you
have
container
d,
you
have
to
be
explicit,
which
one
you
want
to
use
agreed.
A
A
A
A
So
if
you
pass
the
though
the
legacy
docker
shield
socket
inside
the
kubernetes
joint
or
in
it
configuration
you
can
actually
use
this,
you
can
continue
using
the
old
couplet,
the
123
kubrick.
Am
I
actually
adding
this
because
it's
very
difficult
for
people
to
migrate,
some
big
clusters
to
124
couplets
and
I'm
adding
this
option
if
they
want
to
stay
within
the
support
skew
of
the
couplet,
which
is
you
know,
kubernetes
supports
one
couplet
behind
123.,
okay,
so
this
is
the.