From 006020b71e8d702a06148eb19dc76d21ea54b164 Mon Sep 17 00:00:00 2001 From: Hemant Kumar Date: Thu, 5 Nov 2020 12:29:31 -0500 Subject: [PATCH] Move fsGroupChangePolicy feature to beta --- api/openapi-spec/swagger.json | 2 +- pkg/apis/core/types.go | 2 +- pkg/features/kube_features.go | 3 ++- staging/src/k8s.io/api/core/v1/generated.proto | 2 +- staging/src/k8s.io/api/core/v1/types.go | 2 +- staging/src/k8s.io/api/core/v1/types_swagger_doc_generated.go | 2 +- 6 files changed, 7 insertions(+), 6 deletions(-) diff --git a/api/openapi-spec/swagger.json b/api/openapi-spec/swagger.json index a618dc27427..b55ff86f27b 100644 --- a/api/openapi-spec/swagger.json +++ b/api/openapi-spec/swagger.json @@ -8675,7 +8675,7 @@ "type": "integer" }, "fsGroupChangePolicy": { - "description": "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are \"OnRootMismatch\" and \"Always\". If not specified defaults to \"Always\".", + "description": "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used.", "type": "string" }, "runAsGroup": { diff --git a/pkg/apis/core/types.go b/pkg/apis/core/types.go index eaea31151c3..4276de1d0d1 100644 --- a/pkg/apis/core/types.go +++ b/pkg/apis/core/types.go @@ -2964,7 +2964,7 @@ type PodSecurityContext struct { // volume types which support fsGroup based ownership(and permissions). // It will have no effect on ephemeral volume types such as: secret, configmaps // and emptydir. - // Valid values are "OnRootMismatch" and "Always". If not specified defaults to "Always". + // Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. // +optional FSGroupChangePolicy *PodFSGroupChangePolicy // Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported diff --git a/pkg/features/kube_features.go b/pkg/features/kube_features.go index ab6d4867533..d1e310188fa 100644 --- a/pkg/features/kube_features.go +++ b/pkg/features/kube_features.go @@ -444,6 +444,7 @@ const ( // owner: @gnufied // alpha: v1.18 + // beta: v1.20 // Allows user to configure volume permission change policy for fsGroups when mounting // a volume in a Pod. ConfigurableFSGroupPolicy featuregate.Feature = "ConfigurableFSGroupPolicy" @@ -708,7 +709,7 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS CSIMigrationOpenStack: {Default: false, PreRelease: featuregate.Beta}, // Off by default (requires OpenStack Cinder CSI driver) CSIMigrationOpenStackComplete: {Default: false, PreRelease: featuregate.Alpha}, VolumeSubpath: {Default: true, PreRelease: featuregate.GA}, - ConfigurableFSGroupPolicy: {Default: false, PreRelease: featuregate.Alpha}, + ConfigurableFSGroupPolicy: {Default: true, PreRelease: featuregate.Beta}, BalanceAttachedNodeVolumes: {Default: false, PreRelease: featuregate.Alpha}, CSIBlockVolume: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.20 CSIInlineVolume: {Default: true, PreRelease: featuregate.Beta}, diff --git a/staging/src/k8s.io/api/core/v1/generated.proto b/staging/src/k8s.io/api/core/v1/generated.proto index 0d8218ef46c..f3d2e9293a1 100644 --- a/staging/src/k8s.io/api/core/v1/generated.proto +++ b/staging/src/k8s.io/api/core/v1/generated.proto @@ -3344,7 +3344,7 @@ message PodSecurityContext { // volume types which support fsGroup based ownership(and permissions). // It will have no effect on ephemeral volume types such as: secret, configmaps // and emptydir. - // Valid values are "OnRootMismatch" and "Always". If not specified defaults to "Always". + // Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. // +optional optional string fsGroupChangePolicy = 9; diff --git a/staging/src/k8s.io/api/core/v1/types.go b/staging/src/k8s.io/api/core/v1/types.go index 45fd5d82367..9a012622fb0 100644 --- a/staging/src/k8s.io/api/core/v1/types.go +++ b/staging/src/k8s.io/api/core/v1/types.go @@ -3298,7 +3298,7 @@ type PodSecurityContext struct { // volume types which support fsGroup based ownership(and permissions). // It will have no effect on ephemeral volume types such as: secret, configmaps // and emptydir. - // Valid values are "OnRootMismatch" and "Always". If not specified defaults to "Always". + // Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. // +optional FSGroupChangePolicy *PodFSGroupChangePolicy `json:"fsGroupChangePolicy,omitempty" protobuf:"bytes,9,opt,name=fsGroupChangePolicy"` // The seccomp options to use by the containers in this pod. diff --git a/staging/src/k8s.io/api/core/v1/types_swagger_doc_generated.go b/staging/src/k8s.io/api/core/v1/types_swagger_doc_generated.go index a277e05eb70..eb713f05d9a 100644 --- a/staging/src/k8s.io/api/core/v1/types_swagger_doc_generated.go +++ b/staging/src/k8s.io/api/core/v1/types_swagger_doc_generated.go @@ -1602,7 +1602,7 @@ var map_PodSecurityContext = map[string]string{ "supplementalGroups": "A list of groups applied to the first process run in each container, in addition to the container's primary GID. If unspecified, no groups will be added to any container.", "fsGroup": "A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:\n\n1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw ", "sysctls": "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch.", - "fsGroupChangePolicy": "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are \"OnRootMismatch\" and \"Always\". If not specified defaults to \"Always\".", + "fsGroupChangePolicy": "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used.", "seccompProfile": "The seccomp options to use by the containers in this pod.", }