Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

UPSTREAM: 58720: Ensure that the runtime mounts RO volumes read-only #18255

Merged
merged 1 commit into from
Feb 9, 2018
Merged

UPSTREAM: 58720: Ensure that the runtime mounts RO volumes read-only #18255

merged 1 commit into from
Feb 9, 2018

Conversation

joelsmith
Copy link
Contributor

This is a backport of kubernetes/kubernetes#58720

This change makes it so that containers cannot write to secret, configMap, downwardAPI and projected volumes since the runtime will now mount them read-only. This change makes things less confusing for a user since any attempt to update a secret volume will result in an error rather than a successful change followed by a revert by the kubelet when the volume next syncs.

Which issue(s) this PR fixes
N/A

Release note:

Containers now mount secret, configMap, downwardAPI and projected volumes read-only.

@openshift-merge-robot openshift-merge-robot added the vendor-update Touching vendor dir or related files label Jan 23, 2018
@openshift-ci-robot openshift-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jan 23, 2018
@joelsmith joelsmith changed the title **What this PR does / why we need it**: UPSTREAM: 58720: Ensure that the runtime mounts RO volumes read-only Jan 23, 2018
@openshift-ci-robot openshift-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 23, 2018
@openshift-ci-robot openshift-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Feb 1, 2018
@jsafrane
Copy link
Contributor

jsafrane commented Feb 2, 2018 

++ Building go targets for linux/amd64: cmd/openshift cmd/oc cmd/oadm cmd/template-service-broker vendor/k8s.io/kubernetes/cmd/hyperkube pkg/network/sdn-cni-plugin vendor/github.com/containernetworking/plugins/plugins/ipam/host-local vendor/github.com/containernetworking/plugins/plugins/main/loopback
# github.com/openshift/origin/vendor/k8s.io/kubernetes/pkg/features
vendor/k8s.io/kubernetes/pkg/features/kube_features.go:276:54: undefined: feature.Deprecated

@joelsmith
Copy link
Contributor Author

/test unit

sjenning
sjenning reviewed Feb 5, 2018
View reviewed changes
vendor/k8s.io/kubernetes/test/e2e/common/downwardapi_volume.go
@@ -273,7 +273,7 @@ func downwardAPIVolumePodForModeTest(name, filePath string, itemMode, defaultMod
VolumeMounts: []v1.VolumeMount{
{
Name: "podinfo",
MountPath: "/etc",
MountPath: "/etc/podinfo",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for fixing this! I noticed this while working on a flake for this test and was surprised when it overwrote /etc :P

sjenning
sjenning reviewed Feb 5, 2018
View reviewed changes
vendor/k8s.io/kubernetes/cluster/addons/dashboard/dashboard-controller.yaml
@@ -56,8 +56,7 @@ spec:
timeoutSeconds: 30
volumes:
- name: kubernetes-dashboard-certs
secret:
secretName: kubernetes-dashboard-certs
emptyDir: {}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does this work? does the dashboard create its own certs at start time?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@joelsmith could you respond here?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

irrelevant for this pick.

@aveshagarwal
Copy link
Contributor

@joelsmith could you check for failures if there is anything relevant?

@aveshagarwal
Copy link
Contributor

@smarterclayton could you approve this?

@smarterclayton
Copy link
Contributor

smarterclayton commented Feb 7, 2018 via email

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 7, 2018
@sjenning
Copy link
Contributor

sjenning commented Feb 7, 2018

/retest

@aveshagarwal
Copy link
Contributor

Since upstream PR is merged, is it ok to give lgtm here? @derekwaynecarr

@derekwaynecarr
Copy link
Member

/approved
/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Feb 8, 2018
@openshift-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: derekwaynecarr, joelsmith, smarterclayton

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@openshift-merge-robot
Copy link
Contributor

Automatic merge from submit-queue (batch tested with PRs 18423, 18255, 18526, 18539, 18509).

@openshift-merge-robot openshift-merge-robot merged commit 6ce0af0 into openshift:master Feb 9, 2018
@liggitt liggitt mentioned this pull request Mar 12, 2018
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sjenning sjenning sjenning left review comments

@aveshagarwal aveshagarwal aveshagarwal left review comments

@derekwaynecarr derekwaynecarr derekwaynecarr left review comments

@gnufied gnufied Awaiting requested review from gnufied

@jsafrane jsafrane Awaiting requested review from jsafrane

@rootfs rootfs Awaiting requested review from rootfs

@screeley44 screeley44 Awaiting requested review from screeley44

@smarterclayton smarterclayton Awaiting requested review from smarterclayton

Assignees

@derekwaynecarr derekwaynecarr

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. vendor-update Touching vendor dir or related files
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
8 participants
@joelsmith @jsafrane @aveshagarwal @smarterclayton @sjenning @derekwaynecarr @openshift-ci-robot @openshift-merge-robot