From 86cbafe75925a1aa725a5c1bf0089a8327df24ba Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Tue, 22 Mar 2022 22:19:40 +0530 Subject: [PATCH 01/16] Placeholder for unauthorised volume mode conversion blog --- ...4-19-prevent-unauthorised-volume-mode-conversion.md | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md diff --git a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md new file mode 100644 index 0000000000..0436d056bd --- /dev/null +++ b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md @@ -0,0 +1,10 @@ +--- +layout: blog +title: 'Kubernetes 1.24: Prevent unauthorised volume mode conversion' +date: 2022-04-19 +slug: prevent-unauthorised-volume-mode-conversion-alpha + --- + +**Author:** Raunak Shah (Mirantis) + +Prevention of unauthorised volume mode conversion is introduce as an Alpha feature in 1.24. \ No newline at end of file From 7c2b6da8a71c7c39fb06e0a29bd501541e804417 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Wed, 6 Apr 2022 00:04:19 +0530 Subject: [PATCH 02/16] add newline --- .../2022-04-19-prevent-unauthorised-volume-mode-conversion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md index 0436d056bd..d019ce628d 100644 --- a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md @@ -7,4 +7,4 @@ slug: prevent-unauthorised-volume-mode-conversion-alpha **Author:** Raunak Shah (Mirantis) -Prevention of unauthorised volume mode conversion is introduce as an Alpha feature in 1.24. \ No newline at end of file +Prevention of unauthorised volume mode conversion is introduce as an Alpha feature in 1.24. From 51038193fb12c4c8b45f01eb549282dfbd2ff4d6 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Wed, 6 Apr 2022 00:06:54 +0530 Subject: [PATCH 03/16] Indentation --- .../2022-04-19-prevent-unauthorised-volume-mode-conversion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md index d019ce628d..d641f28ee6 100644 --- a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md @@ -3,7 +3,7 @@ layout: blog title: 'Kubernetes 1.24: Prevent unauthorised volume mode conversion' date: 2022-04-19 slug: prevent-unauthorised-volume-mode-conversion-alpha - --- +--- **Author:** Raunak Shah (Mirantis) From 19283fa38c103cb661fd5f236d0eb53596caacf6 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Tue, 12 Apr 2022 11:45:44 +0530 Subject: [PATCH 04/16] Blog for feature to prevent unauthorised volume mode conversion --- ...ent-unauthorised-volume-mode-conversion.md | 83 +++++++++++++++++++ ...ent-unauthorised-volume-mode-conversion.md | 10 --- 2 files changed, 83 insertions(+), 10 deletions(-) create mode 100644 content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md delete mode 100644 content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md diff --git a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md new file mode 100644 index 0000000000..0e171b13e9 --- /dev/null +++ b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md @@ -0,0 +1,83 @@ +--- +layout: blog +title: 'Prevent unauthorised volume mode conversion' +date: 2022-04-12 +slug: prevent-unauthorised-volume-mode-conversion-alpha +--- + +**Author:** Raunak Shah (Mirantis) + +Kubernetes v1.24 introduces a new alpha-level feature that prevents unauthorised users from modifying the volume mode of a [`PeristentVolumeClaim`](/docs/concepts/storage/persistent-volumes.md). This feature requires [`VolumeSnapshot`](/docs/concepts/storage/volume-snapshots.md) APIs with version `v6.0.0` onwards and `external-provisioner` version `v3.2.0` onwards. + +### The problem + +As of Kubernetes 1.23, users can leverage the `VolumeSnapshot` feature, which GA'd in Kubernetes 1.20, to create a `PersistentVolumeClaim` (or `PVC`) from a previously taken `VolumeSnapshot`. This is done by pointing the `Spec.dataSource` parameter of the `PVC` to an existing `VolumeSnapshot` instance. +There is no logic that validates whether the original volume mode of the `PVC`, whose snapshot was taken, matches the volume mode of the newly created `PVC`, that is being created from the existing `VolumeSnapshot`. + +There is logic in allowing this, as many popular storage backup vendors convert the volume mode, during the course of a backup operation, for efficiency purposes. + +However this also presents a security gap that allows malicious users to potentially exploit an as-yet-unknown CVE in the kernel. + +### Preventing unauthorised users from converting the volume mode + +If the alpha feature is enabled in `snapshot-controller` and `external-provisioner`, then unauthorised users will not be allowed to modify the volume mode of a `PVC` when it is being created from a `VolumeSnapshot`. +An unauthorised user is defined as one who does not have existing permissions to alter the cluster-scoped `VolumeSnapshotContent` resource. +Backup vendors normally have this permission on clusters where a backup is to be performed. + +To convert the volume mode, an authorised user must do the following: + +1. Identify the `VolumeSnapshot` that is to be used as the data source for a newly created `PVC`. +2. Identify the `VolumeSnapshotContent` bound to the above `VolumeSnapshot`. +3. Add a new annotation `snapshot.storage.kubernetes.io/allowVolumeModeChange` to the `VolumeSnapshotContent`. +This annotation can be added either via software or manually by the backup vendor. The VolumeSnapshotContent must look like below after this change: + +```yaml +kind: VolumeSnapshotContent +metadata: + annotations: + - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" +... +``` +NOTE: For pre-provisioned `VolumeSnapshotContents`, the user has an additional step of setting `Spec.SourceVolumeMode` field to either `Filesystem` or `Block`, depending on the volume from which this snapshot was taken. +An example is shown below: + +```yaml +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotContent +metadata: + name: new-snapshot-content-test +spec: + deletionPolicy: Delete + driver: hostpath.csi.k8s.io + source: + snapshotHandle: 7bdd0de3-aaeb-11e8-9aae-0242ac110002 + sourceVolumeMode: Filesystem + volumeSnapshotRef: + name: new-snapshot-test + namespace: default +``` + +Repeat (1)-(3) for all `VolumeSnapshotContent`s whose volume mode needs to be converted during a backup or restore operation. + +If the above annotation is present on a `VolumeSnapshotContent` object, Kubernetes will not prevent the volume mode from being converted. +Users should keep this in mind before they attempt to add the annotation to any `VolumeSnapshotContent`. + + +### How to enable the feature + +This feature can be enabled by setting `prevent-volume-mode-conversion` flag to `true` in the `snapshot-controller` and `external-provisioner` spec, as shown below: + +```yaml +apiVersion: apps/v1 +kind: Deployment +... +spec: + containers: + - args: + - --leader-election=true + - --prevent-volume-mode-conversion=true + image: snapshot-controller:v6.0.0 +... +``` + + diff --git a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md deleted file mode 100644 index d641f28ee6..0000000000 --- a/content/en/blog/_posts/2022-04-19-prevent-unauthorised-volume-mode-conversion.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -layout: blog -title: 'Kubernetes 1.24: Prevent unauthorised volume mode conversion' -date: 2022-04-19 -slug: prevent-unauthorised-volume-mode-conversion-alpha ---- - -**Author:** Raunak Shah (Mirantis) - -Prevention of unauthorised volume mode conversion is introduce as an Alpha feature in 1.24. From a28f1897164148085c3a763f6eb3ce421cb905dc Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Mon, 18 Apr 2022 14:27:43 +0530 Subject: [PATCH 05/16] Update blog with links to external documentation and reshuffle some points --- ...ent-unauthorised-volume-mode-conversion.md | 92 ++++++++++++------- 1 file changed, 61 insertions(+), 31 deletions(-) diff --git a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md index 0e171b13e9..471e263245 100644 --- a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md @@ -5,31 +5,63 @@ date: 2022-04-12 slug: prevent-unauthorised-volume-mode-conversion-alpha --- -**Author:** Raunak Shah (Mirantis) +**Author:** Raunak Pradip Shah (Mirantis) + +Kubernetes v1.24 introduces a new alpha-level feature that prevents unauthorised users +from modifying the volume mode of a [`PersistentVolumeClaim`](/docs/concepts/storage/persistent-volumes/) created from an +existing [`VolumeSnapshot`](/docs/concepts/storage/volumesnapshots/) in the Kubernetes cluster. + -Kubernetes v1.24 introduces a new alpha-level feature that prevents unauthorised users from modifying the volume mode of a [`PeristentVolumeClaim`](/docs/concepts/storage/persistent-volumes.md). This feature requires [`VolumeSnapshot`](/docs/concepts/storage/volume-snapshots.md) APIs with version `v6.0.0` onwards and `external-provisioner` version `v3.2.0` onwards. ### The problem -As of Kubernetes 1.23, users can leverage the `VolumeSnapshot` feature, which GA'd in Kubernetes 1.20, to create a `PersistentVolumeClaim` (or `PVC`) from a previously taken `VolumeSnapshot`. This is done by pointing the `Spec.dataSource` parameter of the `PVC` to an existing `VolumeSnapshot` instance. -There is no logic that validates whether the original volume mode of the `PVC`, whose snapshot was taken, matches the volume mode of the newly created `PVC`, that is being created from the existing `VolumeSnapshot`. +The [Volume Mode](/docs/concepts/storage/persistent-volumes/#volume-mode) determines whether a volume +is formatted into a filesystem or presented as a raw block device. -There is logic in allowing this, as many popular storage backup vendors convert the volume mode, during the course of a backup operation, for efficiency purposes. +Users can leverage the `VolumeSnapshot` feature, which has been stable since Kubernetes v1.20, +to create a `PersistentVolumeClaim` (shortened as PVC) from an existing `VolumeSnapshot` in +the Kubernetes cluster. The PVC spec includes a `dataSource` field, which can point to an +existing `VolumeSnapshot` instance. +Visit [Create a PersistentVolumeClaim from a Volume Snapshot](/docs/concepts/storage/persistent-volumes/#create-persistent-volume-claim-from-volume-snapshot) for more details. -However this also presents a security gap that allows malicious users to potentially exploit an as-yet-unknown CVE in the kernel. +When leveraging the above capability, there is no logic that validates whether the mode of the +original volume, whose snapshot was taken, matches the mode of the newly created volume. + +This presents a security gap that allows malicious users to potentially exploit an +as-yet-unknown vulnerability in the host operating system. + +Many popular storage backup vendors convert the volume mode during the course of a +backup operation, for efficiency purposes, which prevents Kubernetes from blocking +the operation completely and presents a challenge in distinguishing trusted +users from malicious ones. ### Preventing unauthorised users from converting the volume mode -If the alpha feature is enabled in `snapshot-controller` and `external-provisioner`, then unauthorised users will not be allowed to modify the volume mode of a `PVC` when it is being created from a `VolumeSnapshot`. -An unauthorised user is defined as one who does not have existing permissions to alter the cluster-scoped `VolumeSnapshotContent` resource. -Backup vendors normally have this permission on clusters where a backup is to be performed. +In this context, an authorised user is one who has access rights to perform `Update` +or `Patch` operations on `VolumeSnapshotContents`, which is a cluster-level resource. +It is upto the cluster administrator to provide these rights only to trusted users +or applications, like backup vendors. + +If the alpha feature is [enabled](https://kubernetes-csi.github.io/docs/) in +`snapshot-controller` and `external-provisioner`, then unauthorised users will +not be allowed to modify the volume mode of a PVC when it is being created from +a `VolumeSnapshot`. To convert the volume mode, an authorised user must do the following: -1. Identify the `VolumeSnapshot` that is to be used as the data source for a newly created `PVC`. +1. Identify the `VolumeSnapshot` that is to be used as the data source for a newly +created PVC in the given namespace. 2. Identify the `VolumeSnapshotContent` bound to the above `VolumeSnapshot`. -3. Add a new annotation `snapshot.storage.kubernetes.io/allowVolumeModeChange` to the `VolumeSnapshotContent`. -This annotation can be added either via software or manually by the backup vendor. The VolumeSnapshotContent must look like below after this change: + +```yaml +$ kubectl get volumesnapshot -n +``` + +3. Add the annotation [`snapshot.storage.kubernetes.io/allowVolumeModeChange`](/content/en/docs/reference/labels-annotations-taints/_index.md) +to the `VolumeSnapshotContent`. + +4. This annotation can be added either via software or manually by the authorised +user. The `VolumeSnapshotContent` must look like below after this change: ```yaml kind: VolumeSnapshotContent @@ -38,13 +70,19 @@ metadata: - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" ... ``` -NOTE: For pre-provisioned `VolumeSnapshotContents`, the user has an additional step of setting `Spec.SourceVolumeMode` field to either `Filesystem` or `Block`, depending on the volume from which this snapshot was taken. + +NOTE: For pre-provisioned `VolumeSnapshotContents`, the user has an additional +step of setting `spec.SourceVolumeMode` field to either `Filesystem` or `Block`, +depending on the volume from which this snapshot was taken. + An example is shown below: ```yaml apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotContent metadata: + annotations: + - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" name: new-snapshot-content-test spec: deletionPolicy: Delete @@ -57,27 +95,19 @@ spec: namespace: default ``` -Repeat (1)-(3) for all `VolumeSnapshotContent`s whose volume mode needs to be converted during a backup or restore operation. +Repeat (1)-(3) for all `VolumeSnapshotContents` whose volume mode needs to be +converted during a backup or restore operation. -If the above annotation is present on a `VolumeSnapshotContent` object, Kubernetes will not prevent the volume mode from being converted. -Users should keep this in mind before they attempt to add the annotation to any `VolumeSnapshotContent`. +If the above annotation is present on a `VolumeSnapshotContent` object, +Kubernetes will not prevent the volume mode from being converted. +Users should keep this in mind before they attempt to add the annotation +to any `VolumeSnapshotContent`. -### How to enable the feature +### What's next -This feature can be enabled by setting `prevent-volume-mode-conversion` flag to `true` in the `snapshot-controller` and `external-provisioner` spec, as shown below: - -```yaml -apiVersion: apps/v1 -kind: Deployment -... -spec: - containers: - - args: - - --leader-election=true - - --prevent-volume-mode-conversion=true - image: snapshot-controller:v6.0.0 -... -``` +[Enable this feature](https://kubernetes-csi.github.io/docs/) and let us know what you think! +We hope this feature causes no disruption to existing workflows while preventing malicious users from exploiting security vulnerabilities in their clusters. +For any issues, create a thread in the #sig-storage slack channel or an issue in the CSI external-snapshotter sidecar [repository](https://github.com/kubernetes-csi/external-snapshotter) and assign it to [@RaunakShah](https://github.com/RaunakShah). \ No newline at end of file From 2cc8fb4d7b2268c7a756b57d50130661cf587e04 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Mon, 18 Apr 2022 14:29:25 +0530 Subject: [PATCH 06/16] Use spaces instead of tabs --- .../2022-04-12-prevent-unauthorised-volume-mode-conversion.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md index 471e263245..feb9d33708 100644 --- a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md @@ -66,8 +66,8 @@ user. The `VolumeSnapshotContent` must look like below after this change: ```yaml kind: VolumeSnapshotContent metadata: - annotations: - - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" + annotations: + - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" ... ``` From 47b201deedac907a0ee657c9c6bbd6127e733f1c Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Mon, 18 Apr 2022 15:04:01 +0530 Subject: [PATCH 07/16] fix links --- ...-prevent-unauthorised-volume-mode-conversion.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md index feb9d33708..485566a5a8 100644 --- a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md @@ -9,7 +9,7 @@ slug: prevent-unauthorised-volume-mode-conversion-alpha Kubernetes v1.24 introduces a new alpha-level feature that prevents unauthorised users from modifying the volume mode of a [`PersistentVolumeClaim`](/docs/concepts/storage/persistent-volumes/) created from an -existing [`VolumeSnapshot`](/docs/concepts/storage/volumesnapshots/) in the Kubernetes cluster. +existing [`VolumeSnapshot`](/docs/concepts/storage/volume-snapshots/) in the Kubernetes cluster. @@ -57,7 +57,7 @@ created PVC in the given namespace. $ kubectl get volumesnapshot -n ``` -3. Add the annotation [`snapshot.storage.kubernetes.io/allowVolumeModeChange`](/content/en/docs/reference/labels-annotations-taints/_index.md) +3. Add the annotation [`snapshot.storage.kubernetes.io/allowVolumeModeChange`](/content/en/docs/reference/labels-annotations-taints/) to the `VolumeSnapshotContent`. 4. This annotation can be added either via software or manually by the authorised @@ -106,8 +106,12 @@ to any `VolumeSnapshotContent`. ### What's next -[Enable this feature](https://kubernetes-csi.github.io/docs/) and let us know what you think! +[Enable this feature](https://kubernetes-csi.github.io/docs/) and let us know +what you think! -We hope this feature causes no disruption to existing workflows while preventing malicious users from exploiting security vulnerabilities in their clusters. +We hope this feature causes no disruption to existing workflows while preventing +malicious users from exploiting security vulnerabilities in their clusters. -For any issues, create a thread in the #sig-storage slack channel or an issue in the CSI external-snapshotter sidecar [repository](https://github.com/kubernetes-csi/external-snapshotter) and assign it to [@RaunakShah](https://github.com/RaunakShah). \ No newline at end of file +For any issues, create a thread in the #sig-storage slack channel or an issue +in the CSI external-snapshotter sidecar [repository](https://github.com/kubernetes-csi/external-snapshotter) +and assign it to [@RaunakShah](https://github.com/RaunakShah). \ No newline at end of file From 1999f87c886c68527fe6f711e019a1a2e80095bf Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Tue, 19 Apr 2022 09:00:22 +0530 Subject: [PATCH 08/16] Minor updates to whats next section --- .../2022-04-12-prevent-unauthorised-volume-mode-conversion.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md index 485566a5a8..a36f5c465e 100644 --- a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md @@ -113,5 +113,4 @@ We hope this feature causes no disruption to existing workflows while preventing malicious users from exploiting security vulnerabilities in their clusters. For any issues, create a thread in the #sig-storage slack channel or an issue -in the CSI external-snapshotter sidecar [repository](https://github.com/kubernetes-csi/external-snapshotter) -and assign it to [@RaunakShah](https://github.com/RaunakShah). \ No newline at end of file +in the CSI external-snapshotter [repository](https://github.com/kubernetes-csi/external-snapshotter). \ No newline at end of file From 5ff754a820b4a0ec4d2d42b3dca577e44b256083 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Fri, 29 Apr 2022 14:23:51 +0530 Subject: [PATCH 09/16] Change date to 05-18 and update file name --- ...22-05-18-prevent-unauthorised-volume-mode-conversion.md} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename content/en/blog/_posts/{2022-04-12-prevent-unauthorised-volume-mode-conversion.md => 2022-05-18-prevent-unauthorised-volume-mode-conversion.md} (98%) diff --git a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md similarity index 98% rename from content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md rename to content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md index a36f5c465e..8c8b336275 100644 --- a/content/en/blog/_posts/2022-04-12-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md @@ -1,7 +1,7 @@ --- layout: blog title: 'Prevent unauthorised volume mode conversion' -date: 2022-04-12 +date: 2022-05-18 slug: prevent-unauthorised-volume-mode-conversion-alpha --- @@ -53,8 +53,8 @@ To convert the volume mode, an authorised user must do the following: created PVC in the given namespace. 2. Identify the `VolumeSnapshotContent` bound to the above `VolumeSnapshot`. -```yaml -$ kubectl get volumesnapshot -n +``` +kubectl get volumesnapshot -n ``` 3. Add the annotation [`snapshot.storage.kubernetes.io/allowVolumeModeChange`](/content/en/docs/reference/labels-annotations-taints/) From c3cb144b11097f8f03f41e1176efddbbfa09acb0 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Fri, 29 Apr 2022 14:32:04 +0530 Subject: [PATCH 10/16] Minor changes to steps 4 and 5 --- ...18-prevent-unauthorised-volume-mode-conversion.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md index 8c8b336275..82e14bddc8 100644 --- a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md @@ -55,13 +55,15 @@ created PVC in the given namespace. ``` kubectl get volumesnapshot -n +NAME READYTOUSE SOURCEPVC SOURCESNAPSHOTCONTENT RESTORESIZE SNAPSHOTCLASS SNAPSHOTCONTENT CREATIONTIME AGE +new-snapshot-demo-v1 true hpvc 1Gi csi-hostpath-snapclass-v1 snapcontent-ea59cb6d-1e05-4462-aeee-7e2e7d0d9707 8d 8d ``` 3. Add the annotation [`snapshot.storage.kubernetes.io/allowVolumeModeChange`](/content/en/docs/reference/labels-annotations-taints/) to the `VolumeSnapshotContent`. -4. This annotation can be added either via software or manually by the authorised -user. The `VolumeSnapshotContent` must look like below after this change: +4. This annotation can be added either via software or manually by the authorised +user. The `VolumeSnapshotContent` annotation must look like following manifest fragment: ```yaml kind: VolumeSnapshotContent @@ -71,9 +73,9 @@ metadata: ... ``` -NOTE: For pre-provisioned `VolumeSnapshotContents`, the user has an additional -step of setting `spec.SourceVolumeMode` field to either `Filesystem` or `Block`, -depending on the volume from which this snapshot was taken. +**Note**: For pre-provisioned `VolumeSnapshotContents`, you must take an extra +step of setting `spec.sourceVolumeMode` field to either `Filesystem` or `Block`, +depending on the mode of the volume from which this snapshot was taken. An example is shown below: From 48ac4c60da3035510bbd257183c34d3a6271ed02 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Fri, 29 Apr 2022 14:36:33 +0530 Subject: [PATCH 11/16] Remove output --- .../2022-05-18-prevent-unauthorised-volume-mode-conversion.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md index 82e14bddc8..209b47a2bb 100644 --- a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md @@ -55,8 +55,6 @@ created PVC in the given namespace. ``` kubectl get volumesnapshot -n -NAME READYTOUSE SOURCEPVC SOURCESNAPSHOTCONTENT RESTORESIZE SNAPSHOTCLASS SNAPSHOTCONTENT CREATIONTIME AGE -new-snapshot-demo-v1 true hpvc 1Gi csi-hostpath-snapclass-v1 snapcontent-ea59cb6d-1e05-4462-aeee-7e2e7d0d9707 8d 8d ``` 3. Add the annotation [`snapshot.storage.kubernetes.io/allowVolumeModeChange`](/content/en/docs/reference/labels-annotations-taints/) From 9af1df69146f99201a4ab9348268ecf0d548c4de Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah <5894281+RaunakShah@users.noreply.github.com> Date: Thu, 5 May 2022 14:51:13 +0530 Subject: [PATCH 12/16] Update content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md Co-authored-by: divya-mohan0209 --- .../2022-05-18-prevent-unauthorised-volume-mode-conversion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md index 209b47a2bb..a66f5ca4c8 100644 --- a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md @@ -95,7 +95,7 @@ spec: namespace: default ``` -Repeat (1)-(3) for all `VolumeSnapshotContents` whose volume mode needs to be +Repeat steps 1 to 3 for all `VolumeSnapshotContents` whose volume mode needs to be converted during a backup or restore operation. If the above annotation is present on a `VolumeSnapshotContent` object, From 04f00d55665cf395ef72cb03ec4ce5fa5f5dd5d5 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Thu, 5 May 2022 14:57:49 +0530 Subject: [PATCH 13/16] Address latest comments --- ...5-18-prevent-unauthorised-volume-mode-conversion.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md index a66f5ca4c8..31d8e36795 100644 --- a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md @@ -43,9 +43,9 @@ It is upto the cluster administrator to provide these rights only to trusted use or applications, like backup vendors. If the alpha feature is [enabled](https://kubernetes-csi.github.io/docs/) in -`snapshot-controller` and `external-provisioner`, then unauthorised users will -not be allowed to modify the volume mode of a PVC when it is being created from -a `VolumeSnapshot`. +`snapshot-controller`, `snapshot-validation-webhook` and `external-provisioner`, +then unauthorised users will not be allowed to modify the volume mode of a PVC +when it is being created from a `VolumeSnapshot`. To convert the volume mode, an authorised user must do the following: @@ -98,8 +98,8 @@ spec: Repeat steps 1 to 3 for all `VolumeSnapshotContents` whose volume mode needs to be converted during a backup or restore operation. -If the above annotation is present on a `VolumeSnapshotContent` object, -Kubernetes will not prevent the volume mode from being converted. +If the annotation shown in step 4 above is present on a `VolumeSnapshotContent` +object, Kubernetes will not prevent the volume mode from being converted. Users should keep this in mind before they attempt to add the annotation to any `VolumeSnapshotContent`. From c2fe0d7575b996893763e8233a68b92bcaa5e91f Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah <5894281+RaunakShah@users.noreply.github.com> Date: Thu, 5 May 2022 21:58:05 +0530 Subject: [PATCH 14/16] Update content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md Co-authored-by: Tim Bannister --- .../2022-05-18-prevent-unauthorised-volume-mode-conversion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md index 31d8e36795..46a31af475 100644 --- a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md @@ -1,6 +1,6 @@ --- layout: blog -title: 'Prevent unauthorised volume mode conversion' +title: 'Kubernetes 1.24: Prevent unauthorised volume mode conversion' date: 2022-05-18 slug: prevent-unauthorised-volume-mode-conversion-alpha --- From fd9c195a81c50db9907376abf069d8abe731d458 Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah <5894281+RaunakShah@users.noreply.github.com> Date: Thu, 5 May 2022 21:58:13 +0530 Subject: [PATCH 15/16] Update content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md Co-authored-by: Tim Bannister --- .../2022-05-18-prevent-unauthorised-volume-mode-conversion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md index 46a31af475..b2874e3ce2 100644 --- a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md @@ -57,7 +57,7 @@ created PVC in the given namespace. kubectl get volumesnapshot -n ``` -3. Add the annotation [`snapshot.storage.kubernetes.io/allowVolumeModeChange`](/content/en/docs/reference/labels-annotations-taints/) +3. Add the annotation [`snapshot.storage.kubernetes.io/allowVolumeModeChange`](/docs/reference/labels-annotations-taints/#snapshot-storage-kubernetes-io-allowvolumemodechange) to the `VolumeSnapshotContent`. 4. This annotation can be added either via software or manually by the authorised From c7b91e905956313aecff41f29fe2c14a22dda45e Mon Sep 17 00:00:00 2001 From: Raunak Pradip Shah Date: Thu, 5 May 2022 22:03:08 +0530 Subject: [PATCH 16/16] Add indentation to yamls --- ...ent-unauthorised-volume-mode-conversion.md | 42 +++++++++---------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md index b2874e3ce2..814177f97c 100644 --- a/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md +++ b/content/en/blog/_posts/2022-05-18-prevent-unauthorised-volume-mode-conversion.md @@ -54,7 +54,7 @@ created PVC in the given namespace. 2. Identify the `VolumeSnapshotContent` bound to the above `VolumeSnapshot`. ``` -kubectl get volumesnapshot -n + kubectl get volumesnapshot -n ``` 3. Add the annotation [`snapshot.storage.kubernetes.io/allowVolumeModeChange`](/docs/reference/labels-annotations-taints/#snapshot-storage-kubernetes-io-allowvolumemodechange) @@ -64,11 +64,11 @@ to the `VolumeSnapshotContent`. user. The `VolumeSnapshotContent` annotation must look like following manifest fragment: ```yaml -kind: VolumeSnapshotContent -metadata: - annotations: - - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" -... + kind: VolumeSnapshotContent + metadata: + annotations: + - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" + ... ``` **Note**: For pre-provisioned `VolumeSnapshotContents`, you must take an extra @@ -78,21 +78,21 @@ depending on the mode of the volume from which this snapshot was taken. An example is shown below: ```yaml -apiVersion: snapshot.storage.k8s.io/v1 -kind: VolumeSnapshotContent -metadata: - annotations: - - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" - name: new-snapshot-content-test -spec: - deletionPolicy: Delete - driver: hostpath.csi.k8s.io - source: - snapshotHandle: 7bdd0de3-aaeb-11e8-9aae-0242ac110002 - sourceVolumeMode: Filesystem - volumeSnapshotRef: - name: new-snapshot-test - namespace: default + apiVersion: snapshot.storage.k8s.io/v1 + kind: VolumeSnapshotContent + metadata: + annotations: + - snapshot.storage.kubernetes.io/allowVolumeModeChange: "true" + name: new-snapshot-content-test + spec: + deletionPolicy: Delete + driver: hostpath.csi.k8s.io + source: + snapshotHandle: 7bdd0de3-aaeb-11e8-9aae-0242ac110002 + sourceVolumeMode: Filesystem + volumeSnapshotRef: + name: new-snapshot-test + namespace: default ``` Repeat steps 1 to 3 for all `VolumeSnapshotContents` whose volume mode needs to be