Allow to set hostUsers: false for all workloads

[sebhoss]

Is your feature request related to a problem? Please describe.

We want to run as many pods as possible with user namespaces to enhance security in our cluster.

Describe the solution you'd like

The helm chart should allow us to set the hostUsers field for all workloads. It should still allow not setting this field at all for users who run an old Kubernetes version or a runtime that does not support user namespaces yet.

Describe alternatives you've considered

A kustomize-based patch on top of the helm chart.

Additional context

User namespaces will be GA with Kubernetes 1.35 but are already enabled by default since 1.33.

[benbz]

Hi, thanks for raising this. We agree it would be a good enhancement however it isn't high up our priority list, though we'd be happy to reconsider the priority of it on request from an ESS Pro customer.

In the mean time community PR would be welcome to implement this, however it would need to support all components and have appropriate manifest tests to be accepted. I'm also unsure how feasible it is to have integration tests for this. e.g. is it possible to use user namespaces in k3d given the cgroups are being delegated from Docker? what kind of coverage do we want given we wouldn't want to switch the default tests over to user namespaces and we wouldn't want to double them either

[sebhoss]

I'm not that familiar with k3d but my understanding is that it just starts k3s in a container (the host) which in turn uses containerd to create more containers. As long as k3s uses a containerd version that supports user namespaces (containerd >= 2.0) this should just(tm) work. The image specified in https://github.com/element-hq/ess-helm/blob/main/tests/integration/fixtures/files/clusters/k3d.yml should be ok in this regard.

Wrt. tests: I think it's impossible that something does work exclusively with user namespaces enabled but does not work when user namespaces are disabled. Therefore, I think it is safe to enable user namespaces for all tests, since this is the most restrictive form of running containers. As long as this works, disabling user namespaces should just work fine as well.

[benbz]

I don't think we want to set hostUsers: false as the default in the chart or in all tests

• Not supported on Windows
• Not supported if hostNetwork: true, which is a valid option for MatrixRTC's SFU
• Requires either manually enabling the alpha feature gate or being on >= 1.33 when the feature gate goes to beta

I think a single test that runs everything but MatrixRTC's SFU with hostUsers: false is probably acceptable

[sebhoss]

Ok yeah sounds good. The hostNetwork: true stuff will eventually be possible thanks to kubernetes/enhancements#5607