From 01a44d22cf785c1741f3d438fec7fc9534124ad1 Mon Sep 17 00:00:00 2001 From: Jan Safranek Date: Thu, 12 Apr 2018 13:57:54 +0200 Subject: [PATCH] Add private mount propagation to API. And make it default --- pkg/apis/core/types.go | 6 ++++++ pkg/apis/core/validation/validation.go | 2 +- pkg/apis/core/validation/validation_test.go | 7 +++++++ pkg/kubelet/kubelet_pods.go | 6 ++++-- pkg/kubelet/kubelet_pods_test.go | 16 +++++++++------- staging/src/k8s.io/api/core/v1/types.go | 6 ++++++ 6 files changed, 33 insertions(+), 10 deletions(-) diff --git a/pkg/apis/core/types.go b/pkg/apis/core/types.go index 7cef78b8f3b..c2b429ccb59 100644 --- a/pkg/apis/core/types.go +++ b/pkg/apis/core/types.go @@ -1540,6 +1540,12 @@ type VolumeMount struct { type MountPropagationMode string const ( + // MountPropagationNone means that the volume in a container will + // not receive new mounts from the host or other containers, and filesystems + // mounted inside the container won't be propagated to the host or other + // containers. + // Note that this mode corresponds to "private" in Linux terminology. + MountPropagationNone MountPropagationMode = "None" // MountPropagationHostToContainer means that the volume in a container will // receive new mounts from the host or other containers, but filesystems // mounted inside the container won't be propagated to the host or other diff --git a/pkg/apis/core/validation/validation.go b/pkg/apis/core/validation/validation.go index fd3d63a3482..006bae7bdfa 100644 --- a/pkg/apis/core/validation/validation.go +++ b/pkg/apis/core/validation/validation.go @@ -1140,7 +1140,7 @@ func validateMountPropagation(mountPropagation *core.MountPropagationMode, conta return allErrs } - supportedMountPropagations := sets.NewString(string(core.MountPropagationBidirectional), string(core.MountPropagationHostToContainer)) + supportedMountPropagations := sets.NewString(string(core.MountPropagationBidirectional), string(core.MountPropagationHostToContainer), string(core.MountPropagationNone)) if !supportedMountPropagations.Has(string(*mountPropagation)) { allErrs = append(allErrs, field.NotSupported(fldPath, *mountPropagation, supportedMountPropagations.List())) } diff --git a/pkg/apis/core/validation/validation_test.go b/pkg/apis/core/validation/validation_test.go index 2fac66f74a7..fabd63a72f9 100644 --- a/pkg/apis/core/validation/validation_test.go +++ b/pkg/apis/core/validation/validation_test.go @@ -4704,6 +4704,7 @@ func TestValidateMountPropagation(t *testing.T) { propagationBidirectional := core.MountPropagationBidirectional propagationHostToContainer := core.MountPropagationHostToContainer + propagationNone := core.MountPropagationNone propagationInvalid := core.MountPropagationMode("invalid") tests := []struct { @@ -4723,6 +4724,12 @@ func TestValidateMountPropagation(t *testing.T) { defaultContainer, false, }, + { + // non-privileged container + None + core.VolumeMount{Name: "foo", MountPath: "/foo", MountPropagation: &propagationNone}, + defaultContainer, + false, + }, { // error: implicitly non-privileged container + Bidirectional core.VolumeMount{Name: "foo", MountPath: "/foo", MountPropagation: &propagationBidirectional}, diff --git a/pkg/kubelet/kubelet_pods.go b/pkg/kubelet/kubelet_pods.go index e5cd1026519..6411848fe29 100644 --- a/pkg/kubelet/kubelet_pods.go +++ b/pkg/kubelet/kubelet_pods.go @@ -269,12 +269,14 @@ func translateMountPropagation(mountMode *v1.MountPropagationMode) (runtimeapi.M } switch { case mountMode == nil: - // HostToContainer is the default - return runtimeapi.MountPropagation_PROPAGATION_HOST_TO_CONTAINER, nil + // PRIVATE is the default + return runtimeapi.MountPropagation_PROPAGATION_PRIVATE, nil case *mountMode == v1.MountPropagationHostToContainer: return runtimeapi.MountPropagation_PROPAGATION_HOST_TO_CONTAINER, nil case *mountMode == v1.MountPropagationBidirectional: return runtimeapi.MountPropagation_PROPAGATION_BIDIRECTIONAL, nil + case *mountMode == v1.MountPropagationNone: + return runtimeapi.MountPropagation_PROPAGATION_PRIVATE, nil default: return 0, fmt.Errorf("invalid MountPropagation mode: %q", mountMode) } diff --git a/pkg/kubelet/kubelet_pods_test.go b/pkg/kubelet/kubelet_pods_test.go index 3f2a00870e8..0dba688b8e5 100644 --- a/pkg/kubelet/kubelet_pods_test.go +++ b/pkg/kubelet/kubelet_pods_test.go @@ -55,6 +55,7 @@ func TestMakeMounts(t *testing.T) { bTrue := true propagationHostToContainer := v1.MountPropagationHostToContainer propagationBidirectional := v1.MountPropagationBidirectional + propagationNone := v1.MountPropagationNone testCases := map[string]struct { container v1.Container @@ -79,9 +80,10 @@ func TestMakeMounts(t *testing.T) { MountPropagation: &propagationHostToContainer, }, { - MountPath: "/mnt/path3", - Name: "disk", - ReadOnly: true, + MountPath: "/mnt/path3", + Name: "disk", + ReadOnly: true, + MountPropagation: &propagationNone, }, { MountPath: "/mnt/path4", @@ -110,7 +112,7 @@ func TestMakeMounts(t *testing.T) { HostPath: "/mnt/disk", ReadOnly: true, SELinuxRelabel: false, - Propagation: runtimeapi.MountPropagation_PROPAGATION_HOST_TO_CONTAINER, + Propagation: runtimeapi.MountPropagation_PROPAGATION_PRIVATE, }, { Name: "disk4", @@ -118,7 +120,7 @@ func TestMakeMounts(t *testing.T) { HostPath: "/mnt/host", ReadOnly: false, SELinuxRelabel: false, - Propagation: runtimeapi.MountPropagation_PROPAGATION_HOST_TO_CONTAINER, + Propagation: runtimeapi.MountPropagation_PROPAGATION_PRIVATE, }, { Name: "disk5", @@ -126,7 +128,7 @@ func TestMakeMounts(t *testing.T) { HostPath: "/var/lib/kubelet/podID/volumes/empty/disk5", ReadOnly: false, SELinuxRelabel: false, - Propagation: runtimeapi.MountPropagation_PROPAGATION_HOST_TO_CONTAINER, + Propagation: runtimeapi.MountPropagation_PROPAGATION_PRIVATE, }, }, expectErr: false, @@ -185,7 +187,7 @@ func TestMakeMounts(t *testing.T) { HostPath: "/mnt/host", ReadOnly: false, SELinuxRelabel: false, - Propagation: runtimeapi.MountPropagation_PROPAGATION_HOST_TO_CONTAINER, + Propagation: runtimeapi.MountPropagation_PROPAGATION_PRIVATE, }, }, expectErr: false, diff --git a/staging/src/k8s.io/api/core/v1/types.go b/staging/src/k8s.io/api/core/v1/types.go index 90f012d50ac..73f35c81173 100644 --- a/staging/src/k8s.io/api/core/v1/types.go +++ b/staging/src/k8s.io/api/core/v1/types.go @@ -1624,6 +1624,12 @@ type VolumeMount struct { type MountPropagationMode string const ( + // MountPropagationNone means that the volume in a container will + // not receive new mounts from the host or other containers, and filesystems + // mounted inside the container won't be propagated to the host or other + // containers. + // Note that this mode corresponds to "private" in Linux terminology. + MountPropagationNone MountPropagationMode = "None" // MountPropagationHostToContainer means that the volume in a container will // receive new mounts from the host or other containers, but filesystems // mounted inside the container won't be propagated to the host or other