Update security considerations for CSI inline ephemeral volumes #32667

dobsonj · 2022-03-31T00:10:52Z

This PR:

Updates the documentation for CSI inline volumes per the KEP's Security Considerations section.
Removes the reference to PodSecurityPolicy for both CSI inline volumes AND Generic ephemeral volumes. PodSecurityPolicy has been deprecated since 1.21 and will be removed in 1.25.

KEP: https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/596-csi-inline-volumes
Enhancement: kubernetes/enhancements#596

netlify · 2022-03-31T00:10:57Z

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	`f9ba38b`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/62559f67d30bcc00086745e5

dobsonj · 2022-03-31T22:43:28Z

/retitle Update security considerations for CSI inline ephemeral volumes
/cc @jsafrane

reylejano · 2022-04-04T14:18:15Z

/sig storage

jsafrane · 2022-04-05T10:13:31Z

/lgtm

k8s-ci-robot · 2022-04-05T10:13:49Z

LGTM label has been added.

Git tree hash: 80f9e32e9f020d8653a947b92ca69c0b5420e860

divya-mohan0209

Grammatical nits + rephrasing for clarity.

content/en/docs/concepts/storage/ephemeral-volumes.md

dobsonj · 2022-04-11T18:15:46Z

/assign @xing-yang @jingxu97

jingxu97 · 2022-04-12T01:53:35Z

/lgtm

k8s-ci-robot · 2022-04-12T01:53:50Z

LGTM label has been added.

Git tree hash: df9f8bd610519d587d15e4a079a41fc1d57f179f

jingxu97 · 2022-04-12T01:53:55Z

/approve

dobsonj · 2022-04-12T02:20:54Z

/assign @kbhawkey

divya-mohan0209

Minor nits + rephrasing for clarity.

divya-mohan0209 · 2022-04-12T04:34:31Z

content/en/docs/concepts/storage/ephemeral-volumes.md

@@ -127,14 +127,15 @@ instructions.

 ### CSI driver restrictions

-{{< feature-state for_k8s_version="v1.21" state="deprecated" >}}
+CSI ephemeral volumes allow users to provide volumeAttributes


Suggested change

CSI ephemeral volumes allow users to provide volumeAttributes

CSI ephemeral volumes allow users to provide `volumeAttributes`

Would we also want to link the volumeAttributes to its description at: https://kubernetes.io/docs/concepts/storage/volumes/ ?

Would we also want to link the volumeAttributes to its description at: https://kubernetes.io/docs/concepts/storage/volumes/ ?

These attributes are driver-specific, and there is already a bit of text above this section referring to the driver-specific documentation:

website/content/en/docs/concepts/storage/ephemeral-volumes.md

Lines 123 to 126 in 89cf5eb

The `volumeAttributes` determine what volume is prepared by the

driver. These attributes are specific to each driver and not

standardized. See the documentation of each CSI driver for further

instructions.

divya-mohan0209 · 2022-04-12T04:36:25Z

content/en/docs/concepts/storage/ephemeral-volumes.md

-{{< feature-state for_k8s_version="v1.21" state="deprecated" >}}
+CSI ephemeral volumes allow users to provide volumeAttributes
+directly to the CSI driver as part of the Pod spec. A CSI driver
+requiring volumeAttributes which are typically restricted to


Suggested change

requiring volumeAttributes which are typically restricted to

requiring `volumeAttributes`, typically restricted to

Hi @divya-mohan0209 I want to clarify that not all volumeAttributes are restricted to administrators. I updated the wording to (hopefully) clarify what to look for.

divya-mohan0209 · 2022-04-12T04:36:51Z

content/en/docs/concepts/storage/ephemeral-volumes.md

+CSI ephemeral volumes allow users to provide volumeAttributes
+directly to the CSI driver as part of the Pod spec. A CSI driver
+requiring volumeAttributes which are typically restricted to
+administrators is NOT suitable for use in an inline ephemeral volume.


Suggested change

administrators is NOT suitable for use in an inline ephemeral volume.

administrators, is NOT suitable for use in an inline ephemeral volume.

xing-yang · 2022-04-12T13:57:15Z

content/en/docs/concepts/storage/ephemeral-volumes.md

-{{< /note >}}
+Cluster administrators who need to restrict the CSI drivers that are
+allowed to be used as inline volumes within a Pod spec may do so by:
+- Removing `Ephemeral` from `volumeLifecycleModes` in the CSIDriver spec.


Removing Ephemeral from volumeLifecycleModes in the CSIDriver spec means this CSI Driver cannot support CSI ephemeral volumes, right? Can you clarify?

That's correct, I updated this line to clarify.

xing-yang · 2022-04-12T15:50:47Z

/lgtm

k8s-ci-robot · 2022-04-12T15:51:04Z

LGTM label has been added.

Git tree hash: 53e6aaf62be28281b957fa505197c7940c117c4c

tengqm · 2022-04-13T02:15:06Z

/approve

k8s-ci-robot · 2022-04-13T02:15:34Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jingxu97, tengqm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [tengqm]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added this to the 1.24 milestone Mar 31, 2022

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 31, 2022

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. labels Mar 31, 2022

k8s-ci-robot requested review from saad-ali and thockin March 31, 2022 00:11

dobsonj force-pushed the kep-596-1.24-updates branch from 312195d to 55af29e Compare March 31, 2022 22:34

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Mar 31, 2022

k8s-ci-robot requested a review from jsafrane March 31, 2022 22:43

k8s-ci-robot changed the title ~~[WIP] Update security considerations for CSI inline ephemeral volumes~~ Update security considerations for CSI inline ephemeral volumes Mar 31, 2022

k8s-ci-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Mar 31, 2022

dobsonj force-pushed the kep-596-1.24-updates branch from 55af29e to ee88864 Compare April 1, 2022 18:03

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 1, 2022

reylejano added the sig/storage Categorizes an issue or PR as relevant to SIG Storage. label Apr 4, 2022

k8s-ci-robot assigned jsafrane Apr 5, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 5, 2022

divya-mohan0209 requested changes Apr 6, 2022

View reviewed changes

dobsonj force-pushed the kep-596-1.24-updates branch from ee88864 to a664a29 Compare April 6, 2022 17:05

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 6, 2022

dobsonj mentioned this pull request Apr 6, 2022

Update security considerations for CSI inline ephemeral volumes kubernetes-csi/docs#508

Merged

k8s-ci-robot assigned jingxu97 and xing-yang Apr 11, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 12, 2022

k8s-ci-robot assigned kbhawkey Apr 12, 2022

divya-mohan0209 requested changes Apr 12, 2022

View reviewed changes

dobsonj force-pushed the kep-596-1.24-updates branch from a664a29 to e043203 Compare April 12, 2022 13:55

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 12, 2022

k8s-ci-robot requested review from jingxu97, kbhawkey and xing-yang April 12, 2022 13:55

xing-yang reviewed Apr 12, 2022

View reviewed changes

Update security considerations for CSI inline ephemeral volumes

f9ba38b

dobsonj force-pushed the kep-596-1.24-updates branch from e043203 to f9ba38b Compare April 12, 2022 15:48

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Apr 12, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 12, 2022

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 13, 2022

k8s-ci-robot merged commit f80cf4d into kubernetes:dev-1.24 Apr 13, 2022

saad-ali mentioned this pull request Jul 28, 2022

CSI Inline Volume Support kubernetes/enhancements#596

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update security considerations for CSI inline ephemeral volumes #32667

Update security considerations for CSI inline ephemeral volumes #32667

dobsonj commented Mar 31, 2022 •

edited

Loading

netlify bot commented Mar 31, 2022 •

edited

Loading

dobsonj commented Mar 31, 2022

reylejano commented Apr 4, 2022

jsafrane commented Apr 5, 2022

k8s-ci-robot commented Apr 5, 2022

divya-mohan0209 left a comment

dobsonj commented Apr 11, 2022

jingxu97 commented Apr 12, 2022

k8s-ci-robot commented Apr 12, 2022

jingxu97 commented Apr 12, 2022

dobsonj commented Apr 12, 2022

divya-mohan0209 left a comment

divya-mohan0209 Apr 12, 2022

divya-mohan0209 Apr 12, 2022

dobsonj Apr 12, 2022

divya-mohan0209 Apr 12, 2022

dobsonj Apr 12, 2022

divya-mohan0209 Apr 12, 2022

xing-yang Apr 12, 2022

dobsonj Apr 12, 2022

xing-yang commented Apr 12, 2022

k8s-ci-robot commented Apr 12, 2022

tengqm commented Apr 13, 2022

k8s-ci-robot commented Apr 13, 2022

	CSI ephemeral volumes allow users to provide volumeAttributes
	CSI ephemeral volumes allow users to provide `volumeAttributes`

	The `volumeAttributes` determine what volume is prepared by the
	driver. These attributes are specific to each driver and not
	standardized. See the documentation of each CSI driver for further
	instructions.

	requiring volumeAttributes which are typically restricted to
	requiring `volumeAttributes`, typically restricted to

	administrators is NOT suitable for use in an inline ephemeral volume.
	administrators, is NOT suitable for use in an inline ephemeral volume.

Update security considerations for CSI inline ephemeral volumes #32667

Update security considerations for CSI inline ephemeral volumes #32667

Conversation

dobsonj commented Mar 31, 2022 • edited Loading

netlify bot commented Mar 31, 2022 • edited Loading

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

dobsonj commented Mar 31, 2022

reylejano commented Apr 4, 2022

jsafrane commented Apr 5, 2022

k8s-ci-robot commented Apr 5, 2022

divya-mohan0209 left a comment

Choose a reason for hiding this comment

dobsonj commented Apr 11, 2022

jingxu97 commented Apr 12, 2022

k8s-ci-robot commented Apr 12, 2022

jingxu97 commented Apr 12, 2022

dobsonj commented Apr 12, 2022

divya-mohan0209 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

xing-yang commented Apr 12, 2022

k8s-ci-robot commented Apr 12, 2022

tengqm commented Apr 13, 2022

k8s-ci-robot commented Apr 13, 2022

dobsonj commented Mar 31, 2022 •

edited

Loading

netlify bot commented Mar 31, 2022 •

edited

Loading