Merge pull request #18255 from joelsmith/master

Automatic merge from submit-queue (batch tested with PRs 18423, 18255, 18526, 18539, 18509). UPSTREAM: 58720: Ensure that the runtime mounts RO volumes read-only This is a backport of kubernetes/kubernetes#58720 This change makes it so that containers cannot write to secret, configMap, downwardAPI and projected volumes since the runtime will now mount them read-only. This change makes things less confusing for a user since any attempt to update a secret volume will result in an error rather than a successful change followed by a revert by the kubelet when the volume next syncs. **Which issue(s) this PR fixes** N/A **Release note**: ``` Containers now mount secret, configMap, downwardAPI and projected volumes read-only. ```
openshift · Feb 9, 2018 · 6ce0af0 · 6ce0af0
2 parents acfac49 + 62cd305
commit 6ce0af0
Show file tree

Hide file tree

Showing 5 changed files with 53 additions and 42 deletions.
diff --git a/vendor/k8s.io/kubernetes/cluster/addons/dashboard/dashboard-controller.yaml b/vendor/k8s.io/kubernetes/cluster/addons/dashboard/dashboard-controller.yaml
diff --git a/vendor/k8s.io/kubernetes/pkg/features/kube_features.go b/vendor/k8s.io/kubernetes/pkg/features/kube_features.go
diff --git a/vendor/k8s.io/kubernetes/pkg/kubelet/kubelet_pods.go b/vendor/k8s.io/kubernetes/pkg/kubelet/kubelet_pods.go
diff --git a/vendor/k8s.io/kubernetes/test/e2e/common/downwardapi_volume.go b/vendor/k8s.io/kubernetes/test/e2e/common/downwardapi_volume.go
diff --git a/vendor/k8s.io/kubernetes/test/e2e/common/projected.go b/vendor/k8s.io/kubernetes/test/e2e/common/projected.go