Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[1.9] subpath fixes #61045

Merged
merged 3 commits into from Mar 12, 2018
Merged

[1.9] subpath fixes #61045

merged 3 commits into from Mar 12, 2018

Conversation

liggitt
Copy link
Member

@liggitt liggitt commented Mar 12, 2018 •
edited

cherrypick of #61044

fixes #60813 for 1.9

Fixes CVE-2017-1002101 - See https://issue.k8s.io/60813 for details

@jsafrane
Lock subPath volumes
16caae3 
Users must not be allowed to step outside the volume with subPath.
Therefore the final subPath directory must be "locked" somehow
and checked if it's inside volume.

On Windows, we lock the directories. On Linux, we bind-mount the final
subPath into /var/lib/kubelet/pods/<uid>/volume-subpaths/<container name>/<subPathName>,
it can't be changed to symlink user once it's bind-mounted.
@jsafrane
Add subpath e2e tests
1d3072c
@jsafrane
Add feature gate for subpath
c05e204
@k8s-ci-robot k8s-ci-robot added do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 12, 2018
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: liggitt
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: smarterclayton

Assign the PR to them by writing /assign @smarterclayton in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-github-robot k8s-github-robot added the do-not-merge/cherry-pick-not-approved Indicates that a PR is not yet approved to merge into a release branch. label Mar 12, 2018
@k8s-github-robot
Copy link

This PR is not for the master branch but does not have the cherrypick-approved label. Adding the do-not-merge/cherry-pick-not-approved label.

@mbohlool mbohlool added cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/cherry-pick-not-approved Indicates that a PR is not yet approved to merge into a release branch. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Mar 12, 2018
@mbohlool mbohlool merged commit bee2d15 into kubernetes:release-1.9 Mar 12, 2018
@liggitt liggitt added the sig/storage Categorizes an issue or PR as relevant to SIG Storage. label Mar 12, 2018
@liggitt liggitt added this to the v1.9 milestone Mar 12, 2018
@liggitt liggitt added priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. kind/bug Categorizes issue or PR as related to a bug. labels Mar 12, 2018
@k8s-ci-robot k8s-ci-robot added do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. and removed release-note-none Denotes a PR that doesn't merit a release note. labels Mar 12, 2018
@liggitt liggitt changed the title subpath fixes [1.9] subpath fixes Mar 12, 2018
@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Mar 12, 2018 •
edited

@liggitt: The following test failed, say /retest to rerun them all:

Test name Commit Details Rerun command
pull-kubernetes-kubemark-e2e-gce c05e204 link /test pull-kubernetes-kubemark-e2e-gce

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Mar 12, 2018
@liggitt liggitt mentioned this pull request Mar 12, 2018
Closed
@dominik-bln dominik-bln mentioned this pull request Mar 20, 2018
Merged
@liggitt liggitt deleted the subpath-1.9 branch April 22, 2019 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bowei bowei Awaiting requested review from bowei

@brendandburns brendandburns Awaiting requested review from brendandburns

@copejon copejon Awaiting requested review from copejon

@dims dims Awaiting requested review from dims

@gmarek gmarek Awaiting requested review from gmarek

@gnufied gnufied Awaiting requested review from gnufied

@jingxu97 jingxu97 Awaiting requested review from jingxu97

@msau42 msau42 Awaiting requested review from msau42

@rootfs rootfs Awaiting requested review from rootfs

@sjpotter sjpotter Awaiting requested review from sjpotter

Assignees
No one assigned
Labels
area/security cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/storage Categorizes an issue or PR as relevant to SIG Storage. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Milestone
v1.9
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@liggitt @k8s-ci-robot @k8s-github-robot @mbohlool @jsafrane