Persistent Volume Endpoints and Secrets do not have explicit namespace

[childsb]

For both Secrets and Endpoints the namespace is assumed to be the binding PVC namespace. This is problematic when creating PVs & secrets/endpoints before the PVC exist.

Any field specifying an Endpoint or Secret in PV should also specify the namespace for each item.

Example:

apiVersion: v1 
kind: PersistentVolume
metadata:
  name: ceph
spec:
  capacity:
   storage: 5Gi
  accessModes:
   - ReadWriteOnce
  persistentVolumeReclaimPolicy: Recycle
  rbd:
   monitors: ['172.17.0.2:6789']
   pool: rbd
   image: foo
   user: admin
   secretRef:
     name: 'ceph-secret'
     namespace: 'storage-admin'
   keyring: ''
   fsType: 'ext4'
   readOnly: false

[childsb]

Oops, closing in favor of this: #31869

[childsb]

After talking with others this issue is similar to #31869 but requires a fix to current API objects and not a design decision on how StorageClass implements a similar function.

[eparis]

Thanks brad. I think #31869 is specifically asking about StorageClass and provisioning. You are specifically asking about attach/mount/unmount/detach. I personally think the solutions to your problem are more restrictive than the problem in #31869 as I describe in #31869 (comment) . If we choose to follow my thoughts there for how to do a PV it may inform our decision on how to handle StorageClass.

[eparis]

potential solutions to the 'endpoints' problem are also discussed:
#31616 - just hard code that mess yo'
openshift/origin#6331 - lets talk

[erinboyd]

That generally seems like a bad idea

[dims]

ok to move this to 1.6? please holler if not appropriate

[ethernetdan]

Moving to 1.7 as late to happen in 1.6. Feel free to switch back if this is incorrect.

[saad-ali]

@liggitt to make sure this is kosher.

Moving to 1.8 since this didn't make it in to 1.7

[childsb]

The design is to specify the namespace for secrets or endpoints as part of the storageClass. RBD work was completed in 1.8, but iscsi, gluster and others are still in progress:

#51530

[k8s-github-robot]

[MILESTONENOTIFIER] Milestone Removed

@childsb

Important: This issue was missing labels required for the v1.9 milestone for more than 3 days:

kind: Must specify exactly one of kind/bug, kind/cleanup or kind/feature.

Help

• Additional instructions
• Commands for setting labels

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten
/remove-lifecycle stale

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close