KEP-127 (UserNS): allow customizing subids length

[AkihiroSuda]

• One-line PR description: KEP-127 (UserNS): allow customizing subids length

• Issue link: Support User Namespaces in pods #127

• Other comments:

The number of subuids and subgids for each of pods is hard-coded to 65536, regardless to the total ID count specified in /etc/subuid and /etc/subgid: https://github.com/kubernetes/kubernetes/blob/v1.32.0/pkg/kubelet/userns/userns_manager.go#L211-L228

This is not enough for some images.
Nested containerization needs a huge number of subids too.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: AkihiroSuda
Once this PR has been reviewed and has the lgtm label, please assign mrunalp for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• keps/sig-node/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sftim]

I'd got the impression we might want to make the mapping size configurable on a per-Pod basis.

[sftim]

(what if you have a particular Pod that assigns a (POSIX) ID to each user, and you have 42000000 users, but all your other Pods only need 65000 UIDs?)

[haircommander]

I think it's possible but not a common case IMO, and the implementation of adding a pod API field would be much more complex than adding a kubelet configuration field. I'm not sure the maintenance burden is worth it

[sftim]

So long as we're not accidentally tying ourselves into not being able to extend the Pod API in the future. If we are tying ourselves, let's make sure we'd never want the option.