15546: Add support for hostPath

knative · Dec 9, 2024 · e1c0c42 · e1c0c42
1 parent 2d5a1e9
commit e1c0c42
Show file tree

Hide file tree

Showing 11 changed files with 1,728 additions and 1,436 deletions.
diff --git a/config/core/300-resources/configuration.yaml b/config/core/300-resources/configuration.yaml
@@ -1213,6 +1213,10 @@ spec:
                                 description: This is accessible behind a feature flag - kubernetes.podspec-emptydir
                                 type: object
                                 x-kubernetes-preserve-unknown-fields: true
+                              hostPath:
+                                description: This is accessible behind a feature flag - kubernetes.podspec-hostpath
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
                               name:
                                 description: |-
                                   name of the volume.
@@ -1578,4 +1582,4 @@ spec:
                     ObservedGeneration is the 'Generation' of the Service that
                     was last processed by the controller.
                   type: integer
-                  format: int64
+                  format: int64
diff --git a/config/core/300-resources/revision.yaml b/config/core/300-resources/revision.yaml
diff --git a/config/core/300-resources/service.yaml b/config/core/300-resources/service.yaml
@@ -1233,6 +1233,10 @@ spec:
                                 description: This is accessible behind a feature flag - kubernetes.podspec-emptydir
                                 type: object
                                 x-kubernetes-preserve-unknown-fields: true
+                              hostPath:
+                                description: This is accessible behind a feature flag - kubernetes.podspec-hostpath
+                                type: object
+                                x-kubernetes-preserve-unknown-fields: true
                               name:
                                 description: |-
                                   name of the volume.
@@ -1728,4 +1732,4 @@ spec:
                   description: |-
                     URL holds the url that will distribute traffic over the provided traffic targets.
                     It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix}
-                  type: string
+                  type: string
diff --git a/config/core/configmaps/features.yaml b/config/core/configmaps/features.yaml
@@ -22,7 +22,7 @@ metadata:
     app.kubernetes.io/component: controller
     app.kubernetes.io/version: devel
   annotations:
-    knative.dev/example-checksum: "9ff569ad"
+    knative.dev/example-checksum: "63a13754"
 data:
   _example: |-
     ################################
@@ -200,6 +200,14 @@ data:
     # 2. Disabled: disabling EmptyDir volume support
     kubernetes.podspec-volumes-emptydir: "enabled"
 
+    # Controls whether volume support for HostPath is enabled or not.
+    # WARNING: Cannot safely be disabled once enabled.
+    # WARNING: If you can avoid using a hostPath volume, you should.
+    # Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature.
+    # 1. Enabled: enabling HostPath volume support
+    # 2. Disabled: disabling HostPath volume support
+    kubernetes.podspec-volumes-hostpath: "disabled"
+
     # Controls whether init containers support is enabled or not.
     # 1. Enabled: enabling init containers support
     # 2. Disabled: disabling init containers support
@@ -233,4 +241,4 @@ data:
     queueproxy.mount-podinfo: "disabled"
 
     # Default queue proxy resource requests and limits to good values for most cases if set.
-    queueproxy.resource-defaults: "disabled"
+    queueproxy.resource-defaults: "disabled"
diff --git a/hack/schemapatch-config.yaml b/hack/schemapatch-config.yaml
@@ -12,18 +12,25 @@ k8s.io/api/core/v1.VolumeSource:
     # Following are behind feature flags
     - EmptyDir
     - PersistentVolumeClaim
+    - HostPath
 k8s.io/api/core/v1.PersistentVolumeClaimVolumeSource:
   description: "This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim"
   additionalMarkers:
-  # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-  - kubebuilder:validation:DropProperties
-  - kubebuilder:pruning:PreserveUnknownFields
+    # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+    - kubebuilder:validation:DropProperties
+    - kubebuilder:pruning:PreserveUnknownFields
 k8s.io/api/core/v1.EmptyDirVolumeSource:
   description: "This is accessible behind a feature flag - kubernetes.podspec-emptydir"
   additionalMarkers:
-  # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-  - kubebuilder:validation:DropProperties
-  - kubebuilder:pruning:PreserveUnknownFields
+    # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+    - kubebuilder:validation:DropProperties
+    - kubebuilder:pruning:PreserveUnknownFields
+k8s.io/api/core/v1.HostPathVolumeSource:
+  description: "This is accessible behind a feature flag - kubernetes.podspec-hostpath"
+  additionalMarkers:
+    # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+    - kubebuilder:validation:DropProperties
+    - kubebuilder:pruning:PreserveUnknownFields
 k8s.io/api/core/v1.VolumeProjection:
   fieldMask:
     - Secret
@@ -79,17 +86,17 @@ k8s.io/api/core/v1.PodSpec:
     Affinity:
       description: "This is accessible behind a feature flag - kubernetes.podspec-affinity"
       additionalMarkers:
-      # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-      - kubebuilder:validation:DropProperties
-      - kubebuilder:pruning:PreserveUnknownFields
+        # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+        - kubebuilder:validation:DropProperties
+        - kubebuilder:pruning:PreserveUnknownFields
     DNSPolicy:
       description: "This is accessible behind a feature flag - kubernetes.podspec-dnspolicy"
     DNSConfig:
       description: "This is accessible behind a feature flag - kubernetes.podspec-dnsconfig"
       additionalMarkers:
-      # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-      - kubebuilder:validation:DropProperties
-      - kubebuilder:pruning:PreserveUnknownFields
+        # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+        - kubebuilder:validation:DropProperties
+        - kubebuilder:pruning:PreserveUnknownFields
     EnableServiceLinks:
       description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.'
     HostAliases:
@@ -99,9 +106,9 @@ k8s.io/api/core/v1.PodSpec:
       itemOverride:
         description: "This is accessible behind a feature flag - kubernetes.podspec-hostaliases"
         additionalMarkers:
-        # # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-        - kubebuilder:validation:DropProperties
-        - kubebuilder:pruning:PreserveUnknownFields
+          # # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+          - kubebuilder:validation:DropProperties
+          - kubebuilder:pruning:PreserveUnknownFields
     Containers:
       additionalMarkers:
         - kubebuilder:validation:DropListMapMarkers
@@ -111,33 +118,33 @@ k8s.io/api/core/v1.PodSpec:
       itemOverride:
         description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers"
         additionalMarkers:
-        # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-        - kubebuilder:validation:DropProperties
-        - kubebuilder:pruning:PreserveUnknownFields
+          # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+          - kubebuilder:validation:DropProperties
+          - kubebuilder:pruning:PreserveUnknownFields
     NodeSelector:
       description: "This is accessible behind a feature flag - kubernetes.podspec-nodeselector"
       additionalMarkers:
-      # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-      - kubebuilder:validation:DropProperties
-      - kubebuilder:pruning:PreserveUnknownFields
+        # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+        - kubebuilder:validation:DropProperties
+        - kubebuilder:pruning:PreserveUnknownFields
     PriorityClassName:
       description: "This is accessible behind a feature flag - kubernetes.podspec-priorityclassname"
       additionalMarkers:
-      # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-      - kubebuilder:validation:DropProperties
-      - kubebuilder:pruning:PreserveUnknownFields
+        # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+        - kubebuilder:validation:DropProperties
+        - kubebuilder:pruning:PreserveUnknownFields
     RuntimeClassName:
       description: "This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname"
       additionalMarkers:
-      # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-      - kubebuilder:validation:DropProperties
-      - kubebuilder:pruning:PreserveUnknownFields
+        # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+        - kubebuilder:validation:DropProperties
+        - kubebuilder:pruning:PreserveUnknownFields
     SchedulerName:
       description: "This is accessible behind a feature flag - kubernetes.podspec-schedulername"
       additionalMarkers:
-      # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-      - kubebuilder:validation:DropProperties
-      - kubebuilder:pruning:PreserveUnknownFields
+        # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+        - kubebuilder:validation:DropProperties
+        - kubebuilder:pruning:PreserveUnknownFields
     SecurityContext:
       description: "This is accessible behind a feature flag - kubernetes.podspec-securitycontext"
       additionalMarkers:
@@ -153,9 +160,9 @@ k8s.io/api/core/v1.PodSpec:
     HostIPC:
       description: "This is accessible behind a feature flag - kubernetes.podspec-hostipc"
       additionalMarkers:
-      # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-      - kubebuilder:validation:DropProperties
-      - kubebuilder:pruning:PreserveUnknownFields
+        # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+        - kubebuilder:validation:DropProperties
+        - kubebuilder:pruning:PreserveUnknownFields
     HostPID:
       description: "This is accessible behind a feature flag - kubernetes.podspec-hostpid"
       additionalMarkers:
@@ -173,19 +180,19 @@ k8s.io/api/core/v1.PodSpec:
       itemOverride:
         description: "This is accessible behind a feature flag - kubernetes.podspec-tolerations"
         additionalMarkers:
-        # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-        - kubebuilder:validation:DropProperties
-        - kubebuilder:pruning:PreserveUnknownFields
+          # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+          - kubebuilder:validation:DropProperties
+          - kubebuilder:pruning:PreserveUnknownFields
     TopologySpreadConstraints:
       description: "This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints"
       additionalMarkers:
         - kubebuilder:validation:DropListMapMarkers
       itemOverride:
         description: "This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints"
         additionalMarkers:
-        # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-        - kubebuilder:validation:DropProperties
-        - kubebuilder:pruning:PreserveUnknownFields
+          # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+          - kubebuilder:validation:DropProperties
+          - kubebuilder:pruning:PreserveUnknownFields
 k8s.io/api/core/v1.Container:
   fieldMask:
     - Name
@@ -208,10 +215,10 @@ k8s.io/api/core/v1.Container:
   fieldOverrides:
     Name:
       additionalMarkers:
-      - optional
+        - optional
     Ports:
       additionalMarkers:
-      - optional
+        - optional
 k8s.io/api/core/v1.VolumeMount:
   fieldMask:
     - Name
@@ -252,15 +259,15 @@ k8s.io/api/core/v1.HTTPGetAction:
   fieldOverrides:
     Port:
       additionalMarkers:
-      - optional
+        - optional
 k8s.io/api/core/v1.TCPSocketAction:
   fieldMask:
     - Host
     - Port
   fieldOverrides:
     Port:
       additionalMarkers:
-      - optional
+        - optional
 k8s.io/api/core/v1.ContainerPort:
   fieldMask:
     - ContainerPort
@@ -281,15 +288,15 @@ k8s.io/api/core/v1.EnvVarSource:
     FieldRef:
       description: "This is accessible behind a feature flag - kubernetes.podspec-fieldref"
       additionalMarkers:
-      # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-      - kubebuilder:validation:DropProperties
-      - kubebuilder:pruning:PreserveUnknownFields
+        # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+        - kubebuilder:validation:DropProperties
+        - kubebuilder:pruning:PreserveUnknownFields
     ResourceFieldRef:
       description: "This is accessible behind a feature flag - kubernetes.podspec-fieldref"
       additionalMarkers:
-      # Part of a feature flag - so we want to omit the schema and preserve unknown fields
-      - kubebuilder:validation:DropProperties
-      - kubebuilder:pruning:PreserveUnknownFields
+        # Part of a feature flag - so we want to omit the schema and preserve unknown fields
+        - kubebuilder:validation:DropProperties
+        - kubebuilder:pruning:PreserveUnknownFields
 k8s.io/api/core/v1.LocalObjectReference:
   fieldMask:
     - Name
@@ -340,4 +347,4 @@ k8s.io/api/core/v1.ObjectReference:
   fieldMask:
     - APIVersion
     - Kind
-    - Name
+    - Name
diff --git a/pkg/apis/config/features.go b/pkg/apis/config/features.go
@@ -72,6 +72,7 @@ func defaultFeaturesConfig() *Features {
 		ContainerSpecAddCapabilities:     Disabled,
 		PodSpecTolerations:               Disabled,
 		PodSpecVolumesEmptyDir:           Enabled,
+		PodSpecVolumesHostPath:           Disabled,
 		PodSpecPersistentVolumeClaim:     Disabled,
 		PodSpecPersistentVolumeWrite:     Disabled,
 		QueueProxyMountPodInfo:           Disabled,
@@ -107,6 +108,7 @@ func NewFeaturesConfigFromMap(data map[string]string) (*Features, error) {
 		asFlag("kubernetes.containerspec-addcapabilities", &nc.ContainerSpecAddCapabilities),
 		asFlag("kubernetes.podspec-tolerations", &nc.PodSpecTolerations),
 		asFlag("kubernetes.podspec-volumes-emptydir", &nc.PodSpecVolumesEmptyDir),
+		asFlag("kubernetes.podspec-volumes-hostpath", &nc.PodSpecVolumesHostPath),
 		asFlag("kubernetes.podspec-hostipc", &nc.PodSpecHostIPC),
 		asFlag("kubernetes.podspec-hostpid", &nc.PodSpecHostPID),
 		asFlag("kubernetes.podspec-hostnetwork", &nc.PodSpecHostNetwork),
@@ -151,6 +153,7 @@ type Features struct {
 	ContainerSpecAddCapabilities     Flag
 	PodSpecTolerations               Flag
 	PodSpecVolumesEmptyDir           Flag
+	PodSpecVolumesHostPath           Flag
 	PodSpecInitContainers            Flag
 	PodSpecPersistentVolumeClaim     Flag
 	PodSpecPersistentVolumeWrite     Flag

diff --git a/pkg/apis/config/features_test.go b/pkg/apis/config/features_test.go
@@ -438,6 +438,24 @@ func TestFeaturesConfiguration(t *testing.T) {
 			data: map[string]string{
 				"kubernetes.podspec-volumes-emptydir": "Enabled",
 			},
+		}, {
+			name:    "kubernetes.podspec-volumes-hostpath Disabled",
+			wantErr: false,
+			wantFeatures: defaultWith(&Features{
+				PodSpecVolumesHostPath: Disabled,
+			}),
+			data: map[string]string{
+				"kubernetes.podspec-volumes-hostpath": "Disabled",
+			},
+		}, {
+			name:    "kubernetes.podspec-volumes-hostpath Enabled",
+			wantErr: false,
+			wantFeatures: defaultWith(&Features{
+				PodSpecVolumesHostPath: Enabled,
+			}),
+			data: map[string]string{
+				"kubernetes.podspec-volumes-hostpath": "Enabled",
+			},
 		}, {
 			name:    "kubernetes.podspec-persistent-volume-claim Disabled",
 			wantErr: false,

diff --git a/pkg/apis/serving/fieldmask.go b/pkg/apis/serving/fieldmask.go
@@ -66,6 +66,10 @@ func VolumeSourceMask(ctx context.Context, in *corev1.VolumeSource) *corev1.Volu
 		out.PersistentVolumeClaim = in.PersistentVolumeClaim
 	}
 
+	if cfg.Features.PodSpecVolumesHostPath != config.Disabled {
+		out.HostPath = in.HostPath
+	}
+
 	// Too many disallowed fields to list
 
 	return out