New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Default StorageClass would benefit from namespace binding #73879

briantopping opened this Issue Feb 9, 2019 · 1 comment


None yet
2 participants
Copy link

briantopping commented Feb 9, 2019

What would you like to be added:
The default StorageClass is currently marked with an annotation. Since StorageClass is namespace-free, it is a bit like the Highlander, there can be only one.

Why is this needed:

Because storage is such an unpredictable thing between installations, deployments often just add PV templates that depend on the some default StorageClass to act on them. I often use the CephFS provisioner with separate StorageClass instances to achieve security isolation provided by it's generation of separate authentication tokens and filesystem ACLs per instance. With a global default StorageClass, random PVCs would find themselves in the same space, breaking this isolation.

My current workflow when installing new deployments, I need to watch if they go Pending for volumes and see if I can create PVCs before the deployments timeout. In some cases where this iterates for a long time, I have no choice but apply the default annotation, but if it takes days to get the deployment finished and I forget to remove the annotation, the CephFS isolation might require extensive repair to delete artifacts of some future, unrelated install.


This comment has been minimized.

Copy link
Contributor Author

briantopping commented Feb 9, 2019

/sig storage

@k8s-ci-robot k8s-ci-robot added sig/storage and removed needs-sig labels Feb 9, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment