User Namespaces

Guide on how to configure Talos Cluster to support User Namespaces

User Namespaces are a feature of the Linux kernel that allows unprivileged users to have their own range of UIDs and GIDs, without needing to be root.

Refer to the Kubernetes User Namespaces documentation for more information.

Prerequisites

UserNamespacesSupport is enabled by default in the Kubernetes versions Talos supports, so no feature gates need to be set. The only configuration needed is raising the kernel’s limit on the number of user namespaces.

Add the following to your Talos machine configuration using the SysctlConfig document:

apiVersion: v1alpha1
kind: SysctlConfig
params:
    user.max_user_namespaces: "11255"

On Talos versions earlier than v1.14, use the older configuration field:

machine:
  sysctls:
    user.max_user_namespaces: "11255"

Using User Namespaces

After applying the configuration, set hostUsers: false on your pod spec to opt in. Refer to the Kubernetes User Namespaces task guide for workload configuration details.