cri: Throw an error if idmap mounts is requested

We need support in containerd and the OCI runtime to use idmap mounts.
Let's just throw an error for now if the kubelet requests some mounts
with mappings.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

pkg/cri/opts/spec_linux_opts.go

@@ -163,6 +163,10 @@ func WithMounts(osi osinterface.OS, config *runtime.ContainerConfig, extra []*ru
 					return fmt.Errorf("relabel %q with %q failed: %w", src, mountLabel, err)
 				}
 			}
+			if mount.UidMappings != nil || mount.GidMappings != nil {
+				return fmt.Errorf("idmap mounts not yet supported, but they were requested for: %q", src)
+			}
+
 			s.Mounts = append(s.Mounts, runtimespec.Mount{
 				Source:      src,
 				Destination: dst,