Skip to content

Commit

Permalink
Merge pull request kubernetes#28936 from rata/secret-configmap-file-mode
Browse files Browse the repository at this point in the history 
Automatic merge from submit-queue

Allow setting permission mode bits on secrets, configmaps and downwardAPI files

cc @thockin @pmorie 

Here is the first round to implement: kubernetes#28733.

I made two commits: one with the actual change and the other with the auto-generated code. I think it's easier to review this way, but let me know if you prefer in some other way.

I haven't written any tests yet, I wanted to have a first glance and not write them till this (and the API) are more close to the "LGTM" :)

There are some things:
 * I'm not sure where to do the "AND 0777". I'll try to look better in the code base, but suggestions are always welcome :)
 * The write permission on group and others is not set when you do an `ls -l` on the running container. It does work with write permissions to the owner. Debugging seems to show that is something happening after this is correctly set on creation. Will look closer.
 * The default permission (when the new fields are not specified) are the same that on kubernetes v1.3
 * I do realize there are conflicts with master, but I think this is good enough to have a look. The conflicts is with the autog-enerated code, so the actual code is actually the same (and it takes like ~30 minutes to generate it here)
 * I didn't generate the docs (`generated-docs` and `generated-swagger-docs` from `hack/update-all.sh`) because my machine runs out of mem. So that's why it isn't in this first PR, will try to investigate and see why it happens.

Other than that, this works fine here with some silly scripts I did to create a secret&configmap&downwardAPI, a pod and check the file permissions. Tested the "defaultMode" and "mode" for all. But of course, will write tests once this is looking fine :)


Thanks a lot again!
Rodrigo
  • Loading branch information
Kubernetes Submit Queue authored Aug 18, 2016
2 parents bba4a3b + 4e9a14a commit 6824f4c
Show file tree
Hide file tree
Showing 34 changed files with 37,631 additions and 35,372 deletions.
25 changes: 25 additions & 0 deletions api/swagger-spec/apps_v1alpha1.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1526,6 +1526,11 @@
"$ref": "v1.KeyToPath"
},
"description": "If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error. Paths must be relative and may not contain the '..' path or start with '..'."
},
"defaultMode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand All @@ -1544,6 +1549,11 @@
"path": {
"type": "string",
"description": "The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'."
},
"mode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand Down Expand Up @@ -1808,6 +1818,11 @@
"$ref": "v1.DownwardAPIVolumeFile"
},
"description": "Items is a list of downward API volume file"
},
"defaultMode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand All @@ -1829,6 +1844,11 @@
"resourceFieldRef": {
"$ref": "v1.ResourceFieldSelector",
"description": "Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported."
},
"mode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand Down Expand Up @@ -1936,6 +1956,11 @@
"$ref": "v1.KeyToPath"
},
"description": "If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error. Paths must be relative and may not contain the '..' path or start with '..'."
},
"defaultMode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand Down
25 changes: 25 additions & 0 deletions api/swagger-spec/batch_v1.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1531,6 +1531,11 @@
"$ref": "v1.KeyToPath"
},
"description": "If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error. Paths must be relative and may not contain the '..' path or start with '..'."
},
"defaultMode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand All @@ -1549,6 +1554,11 @@
"path": {
"type": "string",
"description": "The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'."
},
"mode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand Down Expand Up @@ -1813,6 +1823,11 @@
"$ref": "v1.DownwardAPIVolumeFile"
},
"description": "Items is a list of downward API volume file"
},
"defaultMode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand All @@ -1834,6 +1849,11 @@
"resourceFieldRef": {
"$ref": "v1.ResourceFieldSelector",
"description": "Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported."
},
"mode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand Down Expand Up @@ -1941,6 +1961,11 @@
"$ref": "v1.KeyToPath"
},
"description": "If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error. Paths must be relative and may not contain the '..' path or start with '..'."
},
"defaultMode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand Down
25 changes: 25 additions & 0 deletions api/swagger-spec/extensions_v1beta1.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8695,6 +8695,11 @@
"$ref": "v1.KeyToPath"
},
"description": "If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error. Paths must be relative and may not contain the '..' path or start with '..'."
},
"defaultMode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand All @@ -8713,6 +8718,11 @@
"path": {
"type": "string",
"description": "The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'."
},
"mode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand Down Expand Up @@ -8977,6 +8987,11 @@
"$ref": "v1.DownwardAPIVolumeFile"
},
"description": "Items is a list of downward API volume file"
},
"defaultMode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand All @@ -8998,6 +9013,11 @@
"resourceFieldRef": {
"$ref": "v1.ResourceFieldSelector",
"description": "Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported."
},
"mode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand Down Expand Up @@ -9105,6 +9125,11 @@
"$ref": "v1.KeyToPath"
},
"description": "If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error. Paths must be relative and may not contain the '..' path or start with '..'."
},
"defaultMode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand Down
25 changes: 25 additions & 0 deletions api/swagger-spec/v1.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17927,6 +17927,11 @@
"$ref": "v1.KeyToPath"
},
"description": "If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error. Paths must be relative and may not contain the '..' path or start with '..'."
},
"defaultMode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand All @@ -17945,6 +17950,11 @@
"path": {
"type": "string",
"description": "The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'."
},
"mode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand Down Expand Up @@ -17975,6 +17985,11 @@
"$ref": "v1.DownwardAPIVolumeFile"
},
"description": "Items is a list of downward API volume file"
},
"defaultMode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand All @@ -17996,6 +18011,11 @@
"resourceFieldRef": {
"$ref": "v1.ResourceFieldSelector",
"description": "Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported."
},
"mode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand Down Expand Up @@ -18051,6 +18071,11 @@
"$ref": "v1.KeyToPath"
},
"description": "If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error. Paths must be relative and may not contain the '..' path or start with '..'."
},
"defaultMode": {
"type": "integer",
"format": "int32",
"description": "Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set."
}
}
},
Expand Down
37 changes: 36 additions & 1 deletion docs/api-reference/batch/v1/definitions.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -851,6 +851,13 @@ <h3 id="_v1_downwardapivolumesource">v1.DownwardAPIVolumeSource</h3>
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_downwardapivolumefile">v1.DownwardAPIVolumeFile</a> array</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">defaultMode</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">integer (int32)</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
</tbody>
</table>

Expand Down Expand Up @@ -1039,6 +1046,13 @@ <h3 id="_v1_configmapvolumesource">v1.ConfigMapVolumeSource</h3>
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_keytopath">v1.KeyToPath</a> array</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">defaultMode</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">integer (int32)</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
</tbody>
</table>

Expand Down Expand Up @@ -2527,6 +2541,13 @@ <h3 id="_v1_secretvolumesource">v1.SecretVolumeSource</h3>
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_keytopath">v1.KeyToPath</a> array</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">defaultMode</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Optional: mode bits to use on created files by default. Must be a value between 0 and 0777. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">integer (int32)</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
</tbody>
</table>

Expand Down Expand Up @@ -2863,6 +2884,13 @@ <h3 id="_v1_keytopath">v1.KeyToPath</h3>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">mode</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">integer (int32)</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
</tbody>
</table>

Expand Down Expand Up @@ -3619,6 +3647,13 @@ <h3 id="_v1_downwardapivolumefile">v1.DownwardAPIVolumeFile</h3>
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_resourcefieldselector">v1.ResourceFieldSelector</a></p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">mode</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Optional: mode bits to use on this file, must be a value between 0 and 0777. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">integer (int32)</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
</tbody>
</table>

Expand Down Expand Up @@ -4103,7 +4138,7 @@ <h3 id="_any">any</h3>
</div>
<div id="footer">
<div id="footer-text">
Last updated 2016-08-17 09:55:58 UTC
Last updated 2016-08-17 18:39:38 UTC
</div>
</div>
</body>
Expand Down
Loading

0 comments on commit 6824f4c

Please sign in to comment.