storage: document Windows projected volume limitations #30366

aravindhp · 2021-11-04T22:11:35Z

Document the limitation wrt file ownership with Windows Pods that have a projected volume and RunAsUsername set in it's SecurityContext

xref: kubernetes/kubernetes#102849

/sig storage
/sig windows
/cc @sftim @marosset @jsturtevant @zshihang

marosset · 2021-11-04T22:18:14Z

/cc @brasmith-ms

k8s-ci-robot · 2021-11-04T22:18:15Z

@marosset: GitHub didn't allow me to request PR reviews from the following users: brasmith-ms.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/cc @brasmith-ms

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

netlify · 2021-11-04T22:25:37Z

✔️ Deploy Preview for kubernetes-io-main-staging ready!

🔨 Explore the source changes: 4c296c6

🔍 Inspect the deploy log: https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/61943c0b7b69390007d33a2e

😎 Browse the preview: https://deploy-preview-30366--kubernetes-io-main-staging.netlify.app

tengqm · 2021-11-05T00:34:43Z

content/en/docs/concepts/storage/projected-volumes.md

+          items:
+            - key: config
+              path: my-group/my-config
+```


I'd suggest we move this and the following YAML files out of the page, into the 'examples' directory.

Or somewhere under tasks?

OK, I will move the text into configure-projected-volume-storage.md with yaml in the storage examples folder.

Looks like tasks are more like for trying out rather than just for explanations. I will just move the yaml to the examples folders and link to it.

You can use a codenew shortcode rather than a link, if that's relevant / useful.

jsturtevant · 2021-11-05T14:37:54Z

content/en/docs/concepts/storage/projected-volumes.md

+* [`secret`](/docs/concepts/storage/volumes/#secret)
+* [`downwardAPI`](/docs/concepts/storage/volumes/#downwardapi)
+* [`configMap`](/docs/concepts/storage/volumes/#configmap)
+* `serviceAccountToken`


is there a link for this one?

I could not find a link for this in volumes so I just moved it over as is.

content/en/docs/concepts/storage/projected-volumes.md

marosset · 2021-11-05T16:56:54Z

content/en/docs/concepts/storage/projected-volumes.md

+In Windows pods that have a projected volume and `RunAsUsername` is set in the
+Pod `SecurityContext`, the ownership is not enforced due to the way user
+accounts are managed in Windows. Windows stores and manages local user and group
+accounts in a database file called Security Account Manager (SAM). This database


@brasmith-ms should we use SID or account in this documentation?

SAM tracks both, so either term is fine. In this case I would opt for account since the SIDs in the container are not necessarily unique between containers.

marosset · 2021-11-05T17:01:59Z

content/en/docs/concepts/storage/projected-volumes.md

+read, write and execute access while, non-administrator users will have read and
+execute access.
+
+{{< note >}}


kubernetes/kubernetes#104693 (part ofhttps://github.com/kubernetes/enhancements/issues/2802) will deny pods with RunAsUser specified if os=windows is also set and the feature is enabled.

kubernetes/kubernetes#104693 will not be backported. So my plan was to get this merged and backported and then open a PR removing or updating the note. WDYT?

Sounds good!

content/en/docs/concepts/storage/projected-volumes.md

Move inline examples into the examples folder

aravindhp · 2021-11-09T00:10:46Z

@tengqm @marosset @jsturtevant @brasmith-ms I have addressed your comments. PTAL.

marosset · 2021-11-09T19:16:43Z

/lgtm
Thanks @aravindhp!

k8s-ci-robot · 2021-11-09T19:17:06Z

LGTM label has been added.

Git tree hash: 71500498d9d844db0450113e63d10bfdad884263

brasmith-ms · 2021-11-10T00:49:08Z

LGTM! Thank you @aravindhp!!

tengqm · 2021-11-10T01:57:32Z

/lgtm

...from kubernetes/website#30366

xref: kubernetes/kubernetes#102849

linux-foundation-easycla · 2021-11-16T23:17:36Z

❌ - Aravindh Puthiyaparambil The commit (c0dd24a ,4c296c6ad09affef1482063a8df7b5baecf7ba68) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please submit a support request ticket.

marosset · 2021-11-16T23:21:56Z

/lgtm

k8s-ci-robot · 2021-11-16T23:22:17Z

LGTM label has been added.

Git tree hash: 46bd88d0cd209dde9a5001600d6c31ccc381b014

jsturtevant · 2021-11-16T23:59:13Z

/lgtm

sftim

This is an improvement. Let's merge it.

sftim · 2021-11-17T00:07:59Z

content/en/docs/concepts/storage/projected-volumes.md

+The [proposal for file permission handling in projected service account volume](https://github.com/kubernetes/enhancements/pull/1598)
+enhancement introduced the projected files having the the correct owner
+permissions set.


Should we actually link to https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/2451-service-account-token-volumes#token-volume-projection ?

sftim · 2021-11-17T00:08:17Z

content/en/docs/concepts/storage/projected-volumes.md

+
+By default, the projected files will have the following ownership as shown for
+an example projected volume file:
+```powershell


This is not a valid PowerShell script.

sftim · 2021-11-17T00:08:39Z

content/en/docs/concepts/storage/volumes.md

-receive updates for those volume sources.
-{{< /note >}}
+A projected volume maps several existing volume sources into the same
+directory. For more details, see [projected volumes](/docs/concepts/storage/projected-volumes/)


nit:

Suggested change

directory. For more details, see [projected volumes](/docs/concepts/storage/projected-volumes/)

directory. For more details, see [projected volumes](/docs/concepts/storage/projected-volumes/).

k8s-ci-robot · 2021-11-17T00:10:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sftim

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [sftim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

aravindhp · 2021-12-02T18:07:58Z

@sftim this PR along with #30559 needs to be backported for older K8s versions that has this problem. What is the process for doing that with docs? Use the cherry-pick bot?

k8s-ci-robot requested review from jsturtevant, marosset, sftim and zshihang November 4, 2021 22:11

tengqm reviewed Nov 5, 2021

View reviewed changes

jsturtevant reviewed Nov 5, 2021

View reviewed changes

marosset reviewed Nov 5, 2021

View reviewed changes

brasmith-ms suggested changes Nov 5, 2021

View reviewed changes

storage: create new file for projected volumes

c0dd24a

Move inline examples into the examples folder

aravindhp force-pushed the windows-projected-volume branch from df866b4 to e7ede28 Compare November 9, 2021 00:08

k8s-ci-robot assigned marosset Nov 9, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 9, 2021

k8s-ci-robot assigned tengqm Nov 10, 2021

aravindhp added a commit to aravindhp/windows-machine-config-operator that referenced this pull request Nov 10, 2021

[docs] Update project volume verbiage

0f5ad4f

...from kubernetes/website#30366

aravindhp added a commit to aravindhp/windows-machine-config-operator that referenced this pull request Nov 10, 2021

[docs] Update SAM verbiage in project volume doc

e4eba77

...from kubernetes/website#30366

aravindhp mentioned this pull request Nov 10, 2021

[docs] Update SAM verbiage in project volume doc openshift/windows-machine-config-operator#798

Merged

aravindhp added a commit to aravindhp/windows-machine-config-operator that referenced this pull request Nov 15, 2021

[docs] Update SAM verbiage in project volume doc

ee54a26

...from kubernetes/website#30366

storage: document Windows projected volume limitations

4c296c6

xref: kubernetes/kubernetes#102849

aravindhp force-pushed the windows-projected-volume branch from e7ede28 to 4c296c6 Compare November 16, 2021 23:17

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 16, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 16, 2021

k8s-ci-robot assigned jsturtevant Nov 16, 2021

sftim approved these changes Nov 17, 2021

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 17, 2021

k8s-ci-robot merged commit cee6c71 into kubernetes:main Nov 17, 2021

aravindhp deleted the windows-projected-volume branch November 18, 2021 23:36

aravindhp mentioned this pull request Nov 18, 2021

storage: Minor fixes to Windows projected volumes #30559

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

storage: document Windows projected volume limitations #30366

storage: document Windows projected volume limitations #30366

aravindhp commented Nov 4, 2021

marosset commented Nov 4, 2021

k8s-ci-robot commented Nov 4, 2021

netlify bot commented Nov 4, 2021 •

edited

tengqm Nov 5, 2021

marosset Nov 5, 2021

aravindhp Nov 5, 2021

aravindhp Nov 5, 2021

sftim Nov 17, 2021

jsturtevant Nov 5, 2021

aravindhp Nov 5, 2021

marosset Nov 5, 2021

brasmith-ms Nov 5, 2021

marosset Nov 5, 2021 •

edited

aravindhp Nov 5, 2021

marosset Nov 9, 2021

aravindhp commented Nov 9, 2021

marosset commented Nov 9, 2021

k8s-ci-robot commented Nov 9, 2021

brasmith-ms commented Nov 10, 2021

tengqm commented Nov 10, 2021

linux-foundation-easycla bot commented Nov 16, 2021

marosset commented Nov 16, 2021

k8s-ci-robot commented Nov 16, 2021

jsturtevant commented Nov 16, 2021

sftim left a comment

sftim Nov 17, 2021

sftim Nov 17, 2021

sftim Nov 17, 2021

k8s-ci-robot commented Nov 17, 2021

aravindhp commented Dec 2, 2021

	directory. For more details, see [projected volumes](/docs/concepts/storage/projected-volumes/)
	directory. For more details, see [projected volumes](/docs/concepts/storage/projected-volumes/).

storage: document Windows projected volume limitations #30366

storage: document Windows projected volume limitations #30366

Conversation

aravindhp commented Nov 4, 2021

marosset commented Nov 4, 2021

k8s-ci-robot commented Nov 4, 2021

netlify bot commented Nov 4, 2021 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marosset Nov 5, 2021 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aravindhp commented Nov 9, 2021

marosset commented Nov 9, 2021

k8s-ci-robot commented Nov 9, 2021

brasmith-ms commented Nov 10, 2021

tengqm commented Nov 10, 2021

linux-foundation-easycla bot commented Nov 16, 2021

marosset commented Nov 16, 2021

k8s-ci-robot commented Nov 16, 2021

jsturtevant commented Nov 16, 2021

sftim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Nov 17, 2021

aravindhp commented Dec 2, 2021

netlify bot commented Nov 4, 2021 •

edited

marosset Nov 5, 2021 •

edited