use anonymous volume for /var/lib/kubelet #773
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: BenTheElder The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
approved
|
FYI @cjwagner this should obviate the need for the additional mount in the local prowjob tool. |
BenTheElder
added
the
priority/critical-urgent
is 770 correct here? |
|
corrected to 771 |
| // ensure pods etc. are not on container filesystem | ||
| // TODO: we could do this in the image instead | ||
| // However this would leave old images with this issue | ||
| "-v", "/var/lib/kubelet", |
There was a problem hiding this comment.
hm, this would expose the kind nodes to the host /var/lib/kubelet that may already contain kubelet data, which may result in:
- the kubelet on the node re-using the existing kubelet certificates
- the kubelet on the node stomping kubelet data on the host
EDIT: 771
There was a problem hiding this comment.
hm, this would expose the kind nodes to the host /var/lib/kubelet that may already contain kubelet data, which may result in: ...
no, that's not what this does. this is an anonymous volume, not a bind mount.
There was a problem hiding this comment.
There was a problem hiding this comment.
this flag format does a lot of in-band signaling 😅
soon moving this to higher level logic... going to need to re-work that a bit now 🙃
k8s-ci-robot
added
the
lgtm
|
prow is broken at the moment. I've tested this locally and FWIW this is the same thing we do for |
fixes #771