Readonly volumes in Kubernetes are a mess

[saad-ali]

What happened:

Kubernetes currently has 5 places where you can specify if a volume is readonly:

1. PVC/PV access modes may be ReadOnlyMany.
2. Pod.spec.volumes.persistentVolumeClaim.readOnly boolean
3. PersistentVolume.spec.[volumeSource].readOnly boolean where [volumeSource] could be CSIPersistentVolumeSource, GCEPersistentDiskVolumeSource, etc.
4. Pod.spec.containers.volumeMounts[x].readOnly boolean.

The current state appears to be:

1. Is used for binding PV/PVC only.
2. Some plugins use this for controlling if a volume is attached as readonly.
3. Some plugins use this for controlling if a volume is attached as readonly.
4. Some plugins use this for controlling if a volume is mounted as readonly.

What you expected to happen:

Because of Kubernetes API deprecation policy, we can't remove any of these from the API. But we should at least define (for consistency) or at least document what the various combinations of these parameters do for different volume plugins.

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?:

Environment:

• Kubernetes version (use kubectl version):
• Cloud provider or hardware configuration:
• OS (e.g. from /etc/os-release):
• Kernel (e.g. uname -a):
• Install tools:
• Others:

/kind bug

[saad-ali]

/sig storage

[saad-ali]

Number 2 in the list above ("Pod.spec.volumes.persistentVolumeClaim.readOnly boolean") is problematic because if you have multiple pods referencing the same PVC, each pod can effectively specify a different readonly value for attach.

@thockin pointed out that historically number 2 was supposed to be a "override" for number 4, i.e. master switch for mounting readonly (if set to true regardless of number 4, the volume should be mounted readonly).

[saad-ali]

@cduchense pointed out that number 3 is problematic because: a) it is unclear how it is set (provisioner must set it), and 2) it is unclear how it is changed -- PV.spec is immutable and even if it wasn't requires cluster admin privileges to change (since it is a non namespaced object).

[saad-ali]

We will try and be more clear with CSI before it goes GA: #70505

For the existing volume plugins, we should document what the current behavior is.

If we ever redo the k8s API we should fix the API.

[AishSundar]

@saad-ali should this issue be tracked for 1.13 or is it already covered by #70505?

/cc @nikopen

[saad-ali]

70505 is CSI specific. This issue is for Kubernetes in general. It is not a 1.13 blocker (since this has been the case for a long time).

[humblec]

2.Some plugins use this for controlling if a volume is attached as readonly.
3.Some plugins use this for controlling if a volume is attached as readonly.

@saad-ali state 2 and 3 are same.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[nikopen]

/reopen

[k8s-ci-robot]

@nikopen: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

@venkatsc: You can't reopen an issue/PR unless you authored it or you are a collaborator.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[venkatsc]

@saad-ali ReadOnly can also be specified as mount flag through PV.spec.mountOptions or StorageClass.mountOptions