- 
    Feature 
- 
    Resolution: Unresolved
- 
    Major 
- 
    None
- 
    None
Feature Overview (aka. Goal Summary)
Control Plane containers to have isolated permissions to protect the host and each other from potential security threats.
In OpenShift 4.17 there's a new feature that allows running containers in Linux user namespaces (https://docs.openshift.com/container-platform/4.17/nodes/pods/nodes-pods-user-namespaces.html).
This feature would enable the Hosted Control Plane pods to leverage this functionality to further protect the host and the multi-tenancy environment in HCP.
Why Is User Namespace Isolation Important?
Default Setup: Containers usually run in the host's root namespace, sometimes required for specific features.
Security Risk: Running in the host namespace can allow container breakouts, where a container process could access or modify files on the host or other containers.
OCPSTRAT-1654 adds full support to user namespaces in pods.
Kubernetes v1.33 (OpenShift 4.20) includes this by default https://kubernetes.io/blog/2025/04/25/userns-enabled-by-default/
- clones
- 
                    OCPSTRAT-1735 Control Plane Pods in User Namespaces -         
- In Progress
 
-         
- depends on
- 
                    OCPSTRAT-1654 GA User Name Space in OpenShift 4.20 -         
- Closed
 
-         
- links to