Skip to content

KEP-4639: Allow writeable, container isolated volume content#5288

Closed
saschagrunert wants to merge 1 commit intokubernetes:masterfrom
saschagrunert:kep-4639-read-write-images
Closed

KEP-4639: Allow writeable, container isolated volume content#5288
saschagrunert wants to merge 1 commit intokubernetes:masterfrom
saschagrunert:kep-4639-read-write-images

Conversation

@saschagrunert
Copy link
Member

@saschagrunert saschagrunert commented May 7, 2025 •
edited
Loading

This proposal changes the KEP to allow writing the image volume contents in the same way as we already support it for the actual running container image. Runtimes have to ensure that the isolation is restricted to the running container by using technologies like overlayfs.

Refers to #4639, kubernetes/kubernetes#131557, cri-o/cri-o#9174

PTAL @kubernetes/sig-node-feature-requests @mikebrow @haircommander

@k8s-ci-robot k8s-ci-robot added sig/node Categorizes an issue or PR as relevant to SIG Node. kind/feature Categorizes issue or PR as related to a new feature. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels May 7, 2025
@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented May 7, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: saschagrunert
Once this PR has been reviewed and has the lgtm label, please assign mrunalp for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot requested review from dchen1107 and mrunalp May 7, 2025 13:21
@k8s-ci-robot k8s-ci-robot added kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels May 7, 2025
@saschagrunert saschagrunert force-pushed the kep-4639-read-write-images branch from d5b7133 to 687d127 Compare May 7, 2025 13:23
kwilczynski
kwilczynski reviewed May 7, 2025
View reviewed changes
@saschagrunert saschagrunert force-pushed the kep-4639-read-write-images branch from 687d127 to ddb30d6 Compare May 7, 2025 13:39
haircommander
haircommander reviewed May 7, 2025
View reviewed changes
@saschagrunert saschagrunert force-pushed the kep-4639-read-write-images branch from ddb30d6 to 32ab875 Compare May 7, 2025 14:26
haircommander
haircommander reviewed May 7, 2025
View reviewed changes
@saschagrunert saschagrunert force-pushed the kep-4639-read-write-images branch from 32ab875 to c3b24aa Compare May 8, 2025 05:36
@saschagrunert saschagrunert mentioned this pull request May 13, 2025
Closed
@samuelkarp samuelkarp mentioned this pull request May 13, 2025
Open
samuelkarp
samuelkarp reviewed May 13, 2025
View reviewed changes
@saschagrunert saschagrunert force-pushed the kep-4639-read-write-images branch 2 times, most recently from bd7a285 to fd5c3bc Compare May 14, 2025 06:45
AkihiroSuda
AkihiroSuda reviewed May 17, 2025
View reviewed changes
@saschagrunert
KEP-4639: Allow writeable, container isolated volume content
2d4ec5e 
This proposal changes the KEP to allow writing the image volume contents
in the same way as we already support it for the actual running
container image. Runtimes have to ensure that the isolation is
restricted to the running container by using technologies like
overlayfs.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
@saschagrunert saschagrunert force-pushed the kep-4639-read-write-images branch from fd5c3bc to 2d4ec5e Compare May 19, 2025 07:46
@saschagrunert
Copy link
Member Author

saschagrunert commented May 19, 2025

/retest

@travisghansen travisghansen mentioned this pull request May 27, 2025
Open
@bitoku bitoku mentioned this pull request May 30, 2025
Merged
@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 17, 2025
@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Jun 17, 2025

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@saschagrunert
Copy link
Member Author

saschagrunert commented Jun 23, 2025 •
edited
Loading

@haircommander @bitoku do we still need/want this?

@haircommander
Copy link
Contributor

haircommander commented Jun 23, 2025

personally I think we should extend the image volume API to include a readOnly field and use that to determine RO status, instead of opaquely leaving it up to the CRI

@saschagrunert saschagrunert deleted the kep-4639-read-write-images branch July 14, 2025 13:31
@saschagrunert
Copy link
Member Author

saschagrunert commented Jul 14, 2025

The plan is now to GA with read-only volumes and extend the API as follow-up KEP.

@travisghansen
Copy link

travisghansen commented Jul 14, 2025

Can we keep this open until the follow up kep is created and linked?

@saschagrunert saschagrunert mentioned this pull request Jul 15, 2025
Open
18 tasks
@saschagrunert
Copy link
Member Author

saschagrunert commented Jul 15, 2025

Can we keep this open until the follow up kep is created and linked?

I linked it in the main KEP as follow-up: #4639 (comment)

@saschagrunert saschagrunert mentioned this pull request Nov 26, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@haircommander haircommander haircommander left review comments

@dchen1107 dchen1107 Awaiting requested review from dchen1107

@mrunalp mrunalp Awaiting requested review from mrunalp

+4 more reviewers

@travisghansen travisghansen travisghansen left review comments

@kwilczynski kwilczynski kwilczynski left review comments

@samuelkarp samuelkarp samuelkarp left review comments

@AkihiroSuda AkihiroSuda AkihiroSuda left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. sig/node Categorizes an issue or PR as relevant to SIG Node. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@saschagrunert @k8s-ci-robot @haircommander @travisghansen @kwilczynski @samuelkarp @AkihiroSuda