You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem?/Why is this needed
Currently in subDir there are some substitutions allowed: pvc.metadata.name, pv.metadata.name and namespace.
Because (in a namespace) pvc.metadata.name HAS to be unique AND has DNS name requirements, directory names created are forced to be unnecessary long and are very limited in characters that can be used.
For example, having:
That would create for example on nfs following: /SHARE/test/deployment1-nfs-data, /SHARE/test/deployment1-nfs-shared
where I would like to be able to create just: /SHARE/test/data, /SHARE/test/shared
Describe the solution you'd like in detail
I suppose easiest would be to allow use of annotation for templating, like ${pvc.metadata.annotations[annotation_name]} or similar (similar as external-provisioner can reference secrets via pvc I guess?).
Describe alternatives you've considered
I cannot name PVC shorter due to clashed between different deployments and different storage classes. Also using inline/ephemeral volumes is not possible as CSIDriver specifies that it supports only Persistent volumes.
I could share some PVC between deployments, but that depends on accessMode as well, but that shaves off deployment1- from name only.
Another option is using PVC name like nfs and mounting using subPath, but then PVC/PV deletion removes too much.
One way I found is to use separate StorageClass for each pod with static subDir, but that is a bit of overkill/misuse I guess?
Unless I am trying to use this completely wrong and there is a better way that I did not consider?
The text was updated successfully, but these errors were encountered:
I have a corporate requirement to mount share that has preexisting structure, roughly /SHARE/${namespace}/${deployment.name} and I cannot find a way to satisfy that requirement using Kubernetes while retaining functionality to create that directory dynamically if it is missing.
And this goes from 2018 ...
People argue that adding annotation support in subDir templating imposes a security risk while already existing secrets lookup poses same risk as it is possible to guess secret that has better credentials (like going from RO to RW). Misuse of StorageClass can lead to wipe of whole share as well (via Recycle/Delete, happened to me while testing), while properly configured subDir cannot grant access to different shares (just prefix it with namespace or even constant path depending on tenant)...
And in the meantime there is a number of proprietary provisioners that walk around this limitation. It can be made secure or insecure, all depends on user/administrator provided configuration.
Is your feature request related to a problem?/Why is this needed
Currently in subDir there are some substitutions allowed: pvc.metadata.name, pv.metadata.name and namespace.
Because (in a namespace) pvc.metadata.name HAS to be unique AND has DNS name requirements, directory names created are forced to be unnecessary long and are very limited in characters that can be used.
For example, having:
That would create for example on nfs following:
/SHARE/test/deployment1-nfs-data
,/SHARE/test/deployment1-nfs-shared
where I would like to be able to create just:
/SHARE/test/data
,/SHARE/test/shared
Describe the solution you'd like in detail
I suppose easiest would be to allow use of annotation for templating, like
${pvc.metadata.annotations[annotation_name]}
or similar (similar as external-provisioner can reference secrets via pvc I guess?).Describe alternatives you've considered
I cannot name PVC shorter due to clashed between different deployments and different storage classes. Also using inline/ephemeral volumes is not possible as CSIDriver specifies that it supports only Persistent volumes.
I could share some PVC between deployments, but that depends on accessMode as well, but that shaves off
deployment1-
from name only.Another option is using PVC name like
nfs
and mounting usingsubPath
, but then PVC/PV deletion removes too much.One way I found is to use separate StorageClass for each pod with static subDir, but that is a bit of overkill/misuse I guess?
Unless I am trying to use this completely wrong and there is a better way that I did not consider?
The text was updated successfully, but these errors were encountered: