Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update security considerations for CSI inline ephemeral volumes #508

Merged
merged 1 commit into from
Apr 27, 2022

Conversation

dobsonj
Copy link
Member

@dobsonj dobsonj commented Mar 31, 2022

This PR:

  • Updates the milestones for Generic Ephemeral Inline Volumes (already went GA in 1.23)
  • Updates the documentation for CSI inline volumes per the KEP's Security Considerations and Read-only Volumes sections.

KEP: https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/596-csi-inline-volumes
Enhancement: kubernetes/enhancements#596

Update security considerations for CSI inline ephemeral volumes

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 31, 2022
@k8s-ci-robot k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Mar 31, 2022
@dobsonj dobsonj force-pushed the kep-596-1.24-updates branch 3 times, most recently from 5c60121 to c1da70a Compare March 31, 2022 22:15
@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Mar 31, 2022
@dobsonj
Copy link
Member Author

dobsonj commented Mar 31, 2022

/retitle Update security considerations for CSI inline ephemeral volumes
/cc @jsafrane

@k8s-ci-robot k8s-ci-robot requested a review from jsafrane March 31, 2022 22:40
@k8s-ci-robot k8s-ci-robot changed the title [WIP] Update security considerations for CSI inline ephemeral volumes Update security considerations for CSI inline ephemeral volumes Mar 31, 2022
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 31, 2022
@jsafrane
Copy link
Contributor

jsafrane commented Apr 5, 2022

/lgtm
I'd prefer second pair of eyes to approve this too.

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 5, 2022
@jsafrane
Copy link
Contributor

jsafrane commented Apr 5, 2022

cc @msau42 @jingxu97

@dobsonj dobsonj force-pushed the kep-596-1.24-updates branch from c1da70a to 515d169 Compare April 6, 2022 17:05
@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 6, 2022
@dobsonj
Copy link
Member Author

dobsonj commented Apr 6, 2022

Latest push just mirrors the grammatical corrections from kubernetes/website#32667

@jsafrane
Copy link
Contributor

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 11, 2022
@dobsonj
Copy link
Member Author

dobsonj commented Apr 11, 2022

/assign @xing-yang @jingxu97

@jingxu97
Copy link
Contributor

/lgtm


Cluster administrators who need to restrict the CSI drivers that are
allowed to be used as inline volumes within a Pod spec may do so by:
- removing `Ephemeral` from `volumeLifecycleModes` in the CSIDriver spec
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you change this to be the same as what you have in the K8s website doc PR?

Removing `Ephemeral` from `volumeLifecycleModes` in the CSIDriver spec, which prevents the driver from being used as an inline ephemeral volume.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated, thanks!

@dobsonj dobsonj force-pushed the kep-596-1.24-updates branch from 515d169 to c177112 Compare April 26, 2022 15:18
@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 26, 2022
@xing-yang
Copy link
Contributor

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 27, 2022
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dobsonj, xing-yang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 27, 2022
@k8s-ci-robot k8s-ci-robot merged commit d03a0cb into kubernetes-csi:master Apr 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants