Control permissions of non-emptyDir volumes

[pmorie]

Forking from #2630

This issue is to discuss how we can offer control of permissions on volumes that are not emptyDir or based on emptyDir (secrets, git repo, downward API) so that they can be used easily with packages that have requirements about perms.

@thockin @eparis @smarterclayton

[smarterclayton]

So existing proposal is there is a pod wide security context that applies
to volumes (explicit or inferred). Volumes need to know the uid, gid,
SELinux label. They also may need perm flags, but I assume that is per
volume?

On Jul 15, 2015, at 2:12 PM, Paul Morie [email protected] wrote:

Forking from #2630
#2630

This issue is to discuss how we can offer control of permissions on volumes
that are not emptyDir or based on emptyDir (secrets, git repo, downward
API) so that they can be used easily with packages that have requirements
about perms.

@thockin https://github.com/thockin @eparis https://github.com/eparis
@smarterclayton https://github.com/smarterclayton

—
Reply to this email directly or view it on GitHub
#11319.

[pmorie]

@smarterclayton I'm not sure whether I think it should be per-volume type -- it cuts across all volume types, doesn't it?

[smarterclayton]

Maybe - I wasn't sure whether one of the types might not be amenable to having a perm forced.

[pmorie]

@smarterclayton I am also not sure; I am talking to folks about this now.

[fejta-bot]

Issues go stale after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle rotten
/remove-lifecycle stale

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close