… The Pod must use a PersistentVolumeClaim with applicable accessModes : Either the volume has accessModes: "ReadWriteOncePod" or the volume can use any other access mode s , provided that the feature gates SELinuxChangePolicy and SELinuxMount are both enabled and the Pod has spec.securityContext.seL… …
… This can lead to unexpected access control issues, particularly when accessing volumes see kubernetes/kubernetes 112879 for details because file permission is controlled by UID/GIDs in Linux. …
… Even if the sidecar restarts on its own, the main container may be stuck trying to access an outdated or broken connection. …
… DRA features in beta Admin access for secure resource monitoring DRA supports controlled administrative access via the adminAccess field in ResourceClaims or ResourceClaimTemplates, allowing cluster operators to access devices already in use by others for monitoring or diagnostics. …
… Existing workloads with nodes/proxy permissions continue to work, while new deployments can adopt least-privilege access from day one. …
… The transition of DRA admin access to GA provides a permanent, secure framework for cluster administrators to access and manage hardware resources globally, while the stabilization of prioritized lists ensures that resource selection logic remains consistent and predictable across all cluster envir… …
… Expose node topology labels via Downward API Accessing node topology information, such as region and zone, from within a Pod has typically required querying the Kubernetes API server. …
… With feature gate DRAAdminAccess enabled, only users authorized to create ResourceClaim or ResourceClaimTemplate objects in namespaces labeled with resource.k8s.io/admin-access: "true" can use the adminAccess field. This ensures that non-admin users cannot misuse the adminAccess feature. …
… Granting access to it is a security risk, so ensure you have the appropriate administrative permissions before executing these commands. …
… Note that changing PV node affinity alone will not actually change the accessibility of the underlying volume. Before using this feature, you must first update the underlying volume in the storage provider, and understand which nodes can access the volume after the update. …