ProcMount 1.30 update #45152

haircommander · 2024-02-15T17:03:00Z

netlify · 2024-02-15T17:03:06Z

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	`c3e2106`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/6602d5ddb15ecb00088f159b

dipesh-rawat · 2024-02-15T17:44:27Z

/retitle [WIP] ProcMount beta bump
/sig node

reylejano · 2024-02-16T06:33:16Z

/milestone 1.30

Vyom-Yadav · 2024-03-05T17:32:17Z

Hey @haircommander 👋 please take a look at Documenting for a release - PR Ready for Review to get your PR ready for review before Tuesday March 12th 2024 18:00 PST. Thank you!

sftim

Thanks; it'll need a few changes before we can merge this.

content/en/docs/tasks/configure-pod-container/security-context.md

sftim · 2024-03-15T16:44:48Z

content/en/docs/tasks/configure-pod-container/security-context.md

+
+{{< feature-state for_k8s_version="v1.12" state="alpha" >}}
+
+By default, containers have multiple paths that are both


Suggested change

By default, containers have multiple paths that are both

For runtimes that follow the OCI runtime specification, containers default to running in a mode where

there are multiple paths that are both

sftim · 2024-03-15T16:45:26Z

content/en/docs/tasks/configure-pod-container/security-context.md

+them. A list of the paths are found in the [Kubernetes source
+code](https://github.com/kubernetes/kubernetes/blob/964529b227/pkg/securitycontext/util.go#L193-L211):


Avoid linking to the source code; instead, if we want to put a list in, pop it inside a new (small) page within https://kubernetes.io/docs/reference/node/

how do you feel about me dropping the link to the source code but not adding a reference? having it in 3 places seems more likely to skew eventually

That's fine.

content/en/docs/tasks/configure-pod-container/security-context.md

sftim · 2024-03-15T16:49:32Z

content/en/docs/tasks/configure-pod-container/security-context.md

+  - `/proc/timer_stats`
+  - `/proc/sched_debug`
+  - `/proc/scsi`
+  - `/sys/firmware`


We might want to call out this one especially, as it's outside /proc.

What I mean is: people might think that procMount only covers /proc.

I left a note below does that suffice?

content/en/docs/tasks/configure-pod-container/security-context.md

sftim · 2024-03-15T16:54:50Z

Please also fix the merge conflict (rebase against dev-1.30)

Vyom-Yadav · 2024-03-16T04:44:52Z

Hello @mrunalp 👋 please provide a technical review for this PR by March 26th 2024 18:00 PT to get this into the release. Thank you!

Vyom-Yadav · 2024-03-21T17:02:43Z

Hey @haircommander @mrunalp 👋🏼

I'm reaching out from the Docs team. Just checking in as we approach Docs Freeze on Tuesday March 26th 18:00 PDT. This documentation appears to still be under review. To meet the Docs Freeze, this PR must have a technical review as well as lgtm and approve labels applied, without any unaddressed comments or concerns from SIG Docs. The status of this enhancement is marked as at risk for docs freeze. Thank you!

mrunalp

/approve
Technically LGTM from sig-node.

drewhagen · 2024-03-26T02:13:48Z

Just a heads up that Doc Freeze is approaching fast tomorrow March 26th at 18:00 PDT and starting this cycle, we need to file an Exception after this time.
This one looks pretty close and we'd like to help you get it over the finish line!

@kubernetes/sig-docs-en-owners Does this one look good for an approve from y'all? Thanks!

dipesh-rawat

@haircommander The PR is currently lacking the doc change to transition the feature gate from Alpha to Beta. The necessary change should be made in the feature gate description file - proc-mount-type.md (here).

~~Please refer to the documentation here for further information.~~

EDIT: This review comment can be disregarded as the confirmation (here) indicates that this feature is still in the alpha stage.

Vyom-Yadav · 2024-03-26T13:21:19Z

The PR is currently lacking the doc change to transition the feature gate from Alpha to Beta.

@dipesh-rawat I don't think PR is targeting beta. KEP-4265 was updated to stage/alpha. So the feature gate will not be bumped. Rest @haircommander can confirm.

content/en/docs/tasks/configure-pod-container/security-context.md

sftim · 2024-03-26T13:47:19Z

content/en/docs/tasks/configure-pod-container/security-context.md

+{{< note >}}
+<!-- remove after Kubernetes v1.30 is released -->
+If you are running Kubernetes v1.25, refer to the v1.25 version of this task page:
+[Configure a Security Context for a Pod or Container](https://v1-25.docs.kubernetes.io/docs/tasks/configure-pod-container/security-context/) (v1.25).  
+There is an important note in that documentation about a situation where the kubelet
+can lose track of volume labels after restart. This deficiency has been fixed
+in Kubernetes 1.26.
+{{< /note >}}


Suggested change

{{< note >}}



If you are running Kubernetes v1.25, refer to the v1.25 version of this task page:

[Configure a Security Context for a Pod or Container](https://v1-25.docs.kubernetes.io/docs/tasks/configure-pod-container/security-context/) (v1.25).

There is an important note in that documentation about a situation where the kubelet

can lose track of volume labels after restart. This deficiency has been fixed

in Kubernetes 1.26.

{{< /note >}}

sftim · 2024-03-26T13:50:00Z

Also see #45152 (comment)

haircommander · 2024-03-26T13:57:37Z

The PR is currently lacking the doc change to transition the feature gate from Alpha to Beta.

@dipesh-rawat I don't think PR is targeting beta. KEP-4265 was updated to stage/alpha. So the feature gate will not be bumped. Rest @haircommander can confirm.

correct! we're not bumping this to beta in this release

Signed-off-by: Peter Hunt <pehunt@redhat.com>

drewhagen · 2024-03-26T17:32:08Z

Looks like feedback was addressed. @kubernetes/sig-docs-en-owners Is this ready to approve?

reylejano · 2024-03-26T20:25:36Z

Looks like feed back has been addressed and there is a technical lgtm from SIG Node
/approve

k8s-ci-robot · 2024-03-26T20:25:59Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mrunalp, reylejano

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [reylejano]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

drewhagen · 2024-03-26T21:09:58Z

/lgtm

k8s-ci-robot · 2024-03-26T21:10:03Z

LGTM label has been added.

Git tree hash: ad6831d71905f05dcaa0904442d3075d6baf7d32

sftim · 2024-03-27T11:32:12Z

content/en/docs/tasks/configure-pod-container/security-context.md

@@ -523,3 +575,7 @@ kubectl delete pod security-context-demo-4
 * For more information about security mechanisms in Linux, see
  [Overview of Linux Kernel Security Features](https://www.linux.com/learn/overview-linux-kernel-security-features)
  (Note: Some information is out of date)
+* Read about [User Namespaces](/docs/concepts/workloads/pods/user-namespaces.md)


Ideally we'd have fixed this broken link before a merge. I'll file an issue.

Actually, I'll just send in a PR.

drewhagen · 2024-04-25T23:26:51Z

/milestone 1.30

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Feb 15, 2024

haircommander mentioned this pull request Feb 15, 2024

add ProcMount option kubernetes/enhancements#4265

Open

8 tasks

k8s-ci-robot added the sig/node Categorizes an issue or PR as relevant to SIG Node. label Feb 15, 2024

k8s-ci-robot changed the title ~~placeholder for ProcMount beta bump~~ [WIP] ProcMount beta bump Feb 15, 2024

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 15, 2024

k8s-ci-robot added this to the 1.30 milestone Feb 16, 2024

haircommander force-pushed the proc-mount-beta-1.30 branch from cb2c973 to c55db29 Compare March 11, 2024 20:43

haircommander changed the title ~~[WIP] ProcMount beta bump~~ ProcMount 1.30 update Mar 11, 2024

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 11, 2024

sftim reviewed Mar 15, 2024

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 15, 2024

haircommander force-pushed the proc-mount-beta-1.30 branch 3 times, most recently from 9f7a627 to e1e410e Compare March 25, 2024 19:15

mrunalp approved these changes Mar 25, 2024

View reviewed changes

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 25, 2024

dipesh-rawat reviewed Mar 26, 2024

View reviewed changes

sftim reviewed Mar 26, 2024

View reviewed changes

content/en/docs/tasks/configure-pod-container/security-context.md Outdated Show resolved Hide resolved

sftim reviewed Mar 26, 2024

View reviewed changes

haircommander force-pushed the proc-mount-beta-1.30 branch from e1e410e to 198826d Compare March 26, 2024 13:59

add documentation for the ProcMount field, originally introduced in 1.12

c3e2106

Signed-off-by: Peter Hunt <pehunt@redhat.com>

haircommander force-pushed the proc-mount-beta-1.30 branch from 198826d to c3e2106 Compare March 26, 2024 14:04

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 26, 2024

k8s-ci-robot assigned drewhagen Mar 26, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 26, 2024

k8s-ci-robot merged commit 5145a6a into kubernetes:dev-1.30 Mar 26, 2024
6 checks passed

sftim reviewed Mar 27, 2024

View reviewed changes

k8s-ci-robot added this to the 1.30 milestone Apr 25, 2024

Shubham82 mentioned this pull request Jul 29, 2024

Add /sys/devices/virtual/powercap to Masked Paths #47229

Merged

everpeace mentioned this pull request Aug 14, 2024

[ja] Update content/ja/docs/tasks/configure-pod-container/security-context.md #47497

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ProcMount 1.30 update #45152

ProcMount 1.30 update #45152

haircommander commented Feb 15, 2024

netlify bot commented Feb 15, 2024 •

edited

Loading

dipesh-rawat commented Feb 15, 2024

reylejano commented Feb 16, 2024

Vyom-Yadav commented Mar 5, 2024

sftim left a comment

sftim Mar 15, 2024

sftim Mar 15, 2024

haircommander Mar 25, 2024

sftim Mar 26, 2024

sftim Mar 15, 2024

sftim Mar 26, 2024

haircommander Mar 26, 2024

sftim commented Mar 15, 2024

Vyom-Yadav commented Mar 16, 2024

Vyom-Yadav commented Mar 21, 2024

mrunalp left a comment

drewhagen commented Mar 26, 2024

dipesh-rawat left a comment •

edited

Loading

Vyom-Yadav commented Mar 26, 2024

sftim Mar 26, 2024

sftim commented Mar 26, 2024

haircommander commented Mar 26, 2024

drewhagen commented Mar 26, 2024

reylejano commented Mar 26, 2024

k8s-ci-robot commented Mar 26, 2024

drewhagen commented Mar 26, 2024

k8s-ci-robot commented Mar 26, 2024

sftim Mar 27, 2024

sftim Mar 27, 2024

drewhagen commented Apr 25, 2024


		{{< feature-state for_k8s_version="v1.12" state="alpha" >}}

		By default, containers have multiple paths that are both

	By default, containers have multiple paths that are both
	For runtimes that follow the OCI runtime specification, containers default to running in a mode where
	there are multiple paths that are both

		them. A list of the paths are found in the [Kubernetes source
		code](https://github.com/kubernetes/kubernetes/blob/964529b227/pkg/securitycontext/util.go#L193-L211):

ProcMount 1.30 update #45152

ProcMount 1.30 update #45152

Conversation

haircommander commented Feb 15, 2024

netlify bot commented Feb 15, 2024 • edited Loading

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

dipesh-rawat commented Feb 15, 2024

reylejano commented Feb 16, 2024

Vyom-Yadav commented Mar 5, 2024

sftim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sftim commented Mar 15, 2024

Vyom-Yadav commented Mar 16, 2024

Vyom-Yadav commented Mar 21, 2024

mrunalp left a comment

Choose a reason for hiding this comment

drewhagen commented Mar 26, 2024

dipesh-rawat left a comment • edited Loading

Choose a reason for hiding this comment

Vyom-Yadav commented Mar 26, 2024

Choose a reason for hiding this comment

sftim commented Mar 26, 2024

haircommander commented Mar 26, 2024

drewhagen commented Mar 26, 2024

reylejano commented Mar 26, 2024

k8s-ci-robot commented Mar 26, 2024

drewhagen commented Mar 26, 2024

k8s-ci-robot commented Mar 26, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

drewhagen commented Apr 25, 2024

netlify bot commented Feb 15, 2024 •

edited

Loading

dipesh-rawat left a comment •

edited

Loading