whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document recursive chown feature (#19391)

Browse Source 
* Add placeholder docs for recursive chown feature

* Update content/en/docs/concepts/policy/pod-security-policy.md

Co-Authored-By: Tim Bannister <tim@scalefactory.com>

* Update content/en/docs/concepts/policy/pod-security-policy.md

Co-Authored-By: Tim Bannister <tim@scalefactory.com>

* Address feedback

* Move recursive chown docs to correct place

* Address review feedback

* Apply suggestions from code review

Co-Authored-By: Tim Bannister <tim@scalefactory.com>

* move bit about ephemental volumes to note

* Update content/en/docs/tasks/configure-pod-container/security-context.md

Co-Authored-By: Tim Bannister <tim@scalefactory.com>

Co-authored-by: Tim Bannister <tim@scalefactory.com>
This commit is contained in:
Hemant Kumar
2020-03-17 06:26:23 -04:00
committed by GitHub
parent 098400c958
commit 5c2e807d0a
2 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/reference/command-line-tools-reference/feature-gates.md
+2
View File
@@ -75,6 +75,7 @@ different Kubernetes components.
| `CSIMigrationGCEComplete` | `false` | Alpha | 1.17 | |
| `CSIMigrationOpenStack` | `false` | Alpha | 1.14 | |
| `CSIMigrationOpenStackComplete` | `false` | Alpha | 1.17 | |
| `ConfigurableFSGroupPolicy` | `false` | Alpha | 1.18 | |
| `CustomCPUCFSQuotaPeriod` | `false` | Alpha | 1.12 | |
| `CustomResourceDefaulting` | `false` | Alpha| 1.15 | 1.15 |
| `CustomResourceDefaulting` | `true` | Beta | 1.16 | |
@@ -348,6 +349,7 @@ Each feature gate is designed for enabling/disabling a specific feature:
ServiceAccountTokenVolumeProjection.
Check [Service Account Token Volumes](https://git.k8s.io/community/contributors/design-proposals/storage/svcacct-token-volume-source.md)
for more details.
- `ConfigurableFSGroupPolicy`: Allows user to configure volume permission change policy for fsGroups when mounting a volume in a Pod. See [Configure volume permission and ownership change policy for Pods](/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods) for more details.
- `CPUManager`: Enable container level CPU affinity support, see [CPU Management Policies](/docs/tasks/administer-cluster/cpu-management-policies/).
- `CRIContainerLogRotation`: Enable container log rotation for cri container runtime.
- `CSIBlockVolume`: Enable external CSI volume drivers to support block storage. See the [`csi` raw block volume support](/docs/concepts/storage/volumes/#csi-raw-block-volume-support) documentation for more details.
content/en/docs/tasks/configure-pod-container/security-context.md
+39
View File
@@ -140,6 +140,45 @@ Exit your shell:
exit
```
## Configure volume permission and ownership change policy for Pods
{{< feature-state for_k8s_version="v1.18" state="alpha" >}}
By default, Kubernetes recursively changes ownership and permissions for the contents of each
volume to match the `fsGroup` specified in a Pod's `securityContext` when that volume is
mounted.
For large volumes, checking and changing ownership and permissions can take a lot of time,
slowing Pod startup. You can use the `fsGroupChangePolicy` field inside a `securityContext`
to control the way that Kubernetes checks and manages ownership and permissions
for a volume.
**fsGroupChangePolicy** - `fsGroupChangePolicy` defines behavior for changing ownership and permission of the volume
before being exposed inside a Pod. This field only applies to volume types that support
`fsGroup` controlled ownership and permissions. This field has two possible values:
* _OnRootMismatch_: Only change permissions and ownership if permission and ownership of root directory does not match with expected permissions of the volume. This could help shorten the time it takes to change ownership and permission of a volume.
* _Always_: Always change permission and ownership of the volume when volume is mounted.
For example:
```yaml
securityContext:
runAsUser: 1000
runAsGroup: 3000
fsGroup: 2000
fsGroupChangePolicy: "OnRootMismatch"
```
This is an alpha feature. To use it, enable the [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) `ConfigurableFSGroupPolicy` for the kube-api-server, the kube-controller-manager, and for the kubelet.
{{< note >}}
This field has no effect on ephemeral volume types such as
[`secret`](https://kubernetes.io/docs/concepts/storage/volumes/#secret),
[`configMap`](https://kubernetes.io/docs/concepts/storage/volumes/#configmap),
and [`emptydir`](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir).
{{< /note >}}
## Set the security context for a Container
To specify security settings for a Container, include the `securityContext` field