feat: add readOnlyRootFilesystem if possible #422

farodin91 · 2023-03-03T14:28:29Z

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespaces from that line:

/kind api-change
/kind bug
/kind cleanup
/kind design
/kind documentation
/kind failing-test
/kind feature
/kind flake

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

add securityContext for pod and container

k8s-ci-robot · 2023-03-03T14:28:37Z

Welcome @farodin91!

It looks like this is your first PR to kubernetes-csi/csi-driver-nfs 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-csi/csi-driver-nfs has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2023-03-03T14:28:38Z

Hi @farodin91. Thanks for your PR.

I'm waiting for a kubernetes-csi member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

farodin91 · 2023-03-03T14:29:12Z

/kind feature

andyzhangx · 2023-03-04T06:03:32Z

charts/latest/csi-driver-nfs/templates/csi-nfs-node.yaml

@@ -79,12 +83,11 @@ spec:
            - name: registration-dir
              mountPath: /registration
          resources: {{- toYaml .Values.node.resources.nodeDriverRegistrar | nindent 12 }}
-        - name: nfs
+          {{- with .Values.node.containerSecurityContext.nodeDriverRegistrar }}
          securityContext:


currently only nfs container needs securityContext, I don't think it's necessary to set securityContext for every sidecar container

We want to set readonlyrootfilesystem. You have set it on every container.

then just set readOnlyRootFilesystem for other containers by default, and only need to set .Values.node.securityContext and .Values.controller.securityContext for nfs container.

I changed the behavior

Signed-off-by: Jan Jansen <jan.jansen@gdata.de>

coveralls · 2023-03-07T13:36:43Z

Pull Request Test Coverage Report for Build 4423932402

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 77.33%

Totals
Change from base Build 4244154160:	0.0%
Covered Lines:	614
Relevant Lines:	794

💛 - Coveralls

andyzhangx · 2023-03-07T13:42:49Z

/ok-to-test

andyzhangx · 2023-03-07T15:08:15Z

seems it does not work:
https://storage.googleapis.com/kubernetes-jenkins/pr-logs/pull/kubernetes-csi_csi-driver-nfs/422/pull-csi-driver-nfs-e2e/1633100910487932928/build-log.txt

failed to provision volume with StorageClass "nfs-7201-nfs.csi.k8s.io-dynamic-sc-p4hsv": rpc error: code = Internal desc = failed to mount nfs server: rpc error: code = Internal desc = mkdir /tmp/pvc-0d199297-cb02-4cf3-b2d4-f1deeb878d82: read-only file system

farodin91 · 2023-03-13T15:47:19Z

@andyzhangx i did some refactoring

andyzhangx · 2023-03-14T14:16:27Z

/retest

Signed-off-by: Jan Jansen <jan.jansen@gdata.de>

farodin91 · 2023-03-15T07:47:13Z

@andyzhangx chart.tar.gz updated

andyzhangx

/lgtm

k8s-ci-robot · 2023-03-18T01:37:35Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andyzhangx, farodin91

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [andyzhangx]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 3, 2023

k8s-ci-robot requested review from humblec and j-griffith March 3, 2023 14:28

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Mar 3, 2023

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Mar 3, 2023

k8s-ci-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Mar 3, 2023

farodin91 force-pushed the securityContext branch from 2448866 to c5f3d4f Compare March 3, 2023 15:44

andyzhangx reviewed Mar 4, 2023

View reviewed changes

feat: add readOnlyRootFilesystem if possible

2ba311b

Signed-off-by: Jan Jansen <jan.jansen@gdata.de>

farodin91 force-pushed the securityContext branch from c5f3d4f to 2ba311b Compare March 6, 2023 10:22

farodin91 changed the title ~~feat: add securityContext for pod and container~~ feat: add readOnlyRootFilesystem if possible Mar 6, 2023

k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 6, 2023

chore: update chart file config

215f821

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 7, 2023

andyzhangx mentioned this pull request Mar 8, 2023

feat: add readOnlyRootFilesystem if possible kubernetes-csi/csi-driver-smb#589

Merged

4 tasks

mark workingMountDir as emptyDir

d9796d1

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Mar 13, 2023

update charts

18432fa

Signed-off-by: Jan Jansen <jan.jansen@gdata.de>

andyzhangx approved these changes Mar 18, 2023

View reviewed changes

k8s-ci-robot assigned andyzhangx Mar 18, 2023

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 18, 2023

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 18, 2023

k8s-ci-robot merged commit 2999e7e into kubernetes-csi:master Mar 18, 2023

andyzhangx mentioned this pull request Jun 9, 2024

Mounting fails with error "/usr/sbin/start-statd: 10: cannot create /run/rpc.statd.lock: Read-only file system" #678

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add readOnlyRootFilesystem if possible #422

feat: add readOnlyRootFilesystem if possible #422

farodin91 commented Mar 3, 2023 •

edited

Loading

k8s-ci-robot commented Mar 3, 2023

k8s-ci-robot commented Mar 3, 2023

farodin91 commented Mar 3, 2023

andyzhangx Mar 4, 2023

farodin91 Mar 4, 2023

andyzhangx Mar 4, 2023

farodin91 Mar 6, 2023

coveralls commented Mar 7, 2023 •

edited

Loading

andyzhangx commented Mar 7, 2023

andyzhangx commented Mar 7, 2023 •

edited

Loading

farodin91 commented Mar 13, 2023

andyzhangx commented Mar 14, 2023

farodin91 commented Mar 15, 2023

andyzhangx left a comment

k8s-ci-robot commented Mar 18, 2023

feat: add readOnlyRootFilesystem if possible #422

feat: add readOnlyRootFilesystem if possible #422

Conversation

farodin91 commented Mar 3, 2023 • edited Loading

k8s-ci-robot commented Mar 3, 2023

k8s-ci-robot commented Mar 3, 2023

farodin91 commented Mar 3, 2023

andyzhangx Mar 4, 2023

Choose a reason for hiding this comment

farodin91 Mar 4, 2023

Choose a reason for hiding this comment

andyzhangx Mar 4, 2023

Choose a reason for hiding this comment

farodin91 Mar 6, 2023

Choose a reason for hiding this comment

coveralls commented Mar 7, 2023 • edited Loading

Pull Request Test Coverage Report for Build 4423932402

💛 - Coveralls

andyzhangx commented Mar 7, 2023

andyzhangx commented Mar 7, 2023 • edited Loading

farodin91 commented Mar 13, 2023

andyzhangx commented Mar 14, 2023

farodin91 commented Mar 15, 2023

andyzhangx left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Mar 18, 2023

farodin91 commented Mar 3, 2023 •

edited

Loading

coveralls commented Mar 7, 2023 •

edited

Loading

andyzhangx commented Mar 7, 2023 •

edited

Loading