Add KEP-5502 for EmptyDir volume sticky bit support by oliverguenther · Pull Request #5857 · kubernetes/enhancements

oliverguenther · 2026-01-30T21:24:18Z

This KEP proposes adding an optional stickyBit field to EmptyDirVolumeSource that sets directory permissions to 01777 instead of 0777, preventing users from deleting files they don't own.

References

Enhancement issue: #5502

Implementation PR: kubernetes/kubernetes#130277

k8s-ci-robot · 2026-01-30T21:24:26Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: oliverguenther
Once this PR has been reviewed and has the lgtm label, please assign saad-ali for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

keps/sig-storage/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2026-01-30T21:24:27Z

Welcome @oliverguenther!

It looks like this is your first PR to kubernetes/enhancements 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/enhancements has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2026-01-30T21:24:28Z

Hi @oliverguenther. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

kannon92 · 2026-02-03T03:41:21Z

/ok-to-test

kannon92 · 2026-02-03T03:41:44Z

keps/sig-storage/5502-emptydir-stickybit/approvers/prod-readiness/alpha.yaml

@@ -0,0 +1,3 @@
+# PRR approval file for alpha
+# To be filled by prod-readiness team
+approver: TBD


Please post on #prod-readiness on k8s slack and ask for an approver.

I can take this.

This KEP proposes adding an optional `stickyBit` field to EmptyDirVolumeSource that sets directory permissions to 01777 instead of 0777, preventing users from deleting files they don't own. References: Enhancement issue: kubernetes#5502 Implementation PR: kubernetes/kubernetes#130277

kannon92 · 2026-02-05T21:45:30Z

keps/sig-storage/5502-emptydir-stickybit/kep.yaml

+milestone:
+  alpha: "v1.36"
+
+feature-gates: []


Please add the feature gate here you are adding.

kannon92 · 2026-02-05T21:45:46Z

keps/sig-storage/5502-emptydir-stickybit/kep.yaml

+status: provisional
+creation-date: 2026-01-30
+reviewers:
+  - TBD


Do you have reviewers from sig-storage

kannon92 · 2026-02-05T21:47:31Z

keps/sig-storage/5502-emptydir-stickybit/README.md

+###### How can this feature be enabled / disabled in a live cluster?
+
+- [ ] Feature gate (also fill in values in `kep.yaml`)
+  - Feature gate name:


API changes require feature gates.

https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/feature-gates.md#using-a-feature-gate-in-code

kannon92 · 2026-02-05T21:49:41Z

keps/sig-storage/5502-emptydir-stickybit/README.md

+
+## Alternatives
+
+### Alternative 1: Provide more flexible mount options on emptyDir


I was curious on this actually.

Can you expand why this was rejected?

kannon92 · 2026-02-05T21:54:50Z

keps/sig-storage/5502-emptydir-stickybit/kep.yaml

+status: provisional
+creation-date: 2026-01-30
+reviewers:
+  - TBD


cc @gnufied @jsafrane @msau42

I'm honestly a little confused on who should review this.

#5502 (comment)

Looks like @haircommander opt in for this for sig-node but I'm unclear if storage has acknowledged this KEP.

kannon92 · 2026-02-05T21:55:27Z

keps/sig-storage/5502-emptydir-stickybit/README.md

+- Implementing this feature for volume types other than emptyDir
+- Supporting this feature on platforms that don't support Unix-style file permissions (e.g., Windows)


What validation are we going to protect against a windows user specifying this stickyBit?

kannon92

This needs a feature gate to proceed and I ask that you please get acknowledge from a SIG to review.

The KEP seems straightforward.

I did not finish the PRR review because of the feature gate issue and the questions I have about sigs.

gnufied · 2026-02-06T17:28:12Z

keps/sig-storage/5502-emptydir-stickybit/README.md

+   }
+   ```
+
+3. Apply the appropriate permissions when creating the directory


emptydir volumes undergo recursive chown/chmod via https://github.com/kubernetes/kubernetes/blob/master/pkg/volume/volume_linux.go before being exposed to the pods. IIRC - that code automatically sets sticky bit on directories.

pmengelbert · 2026-02-06T18:28:00Z

keps/sig-storage/5502-emptydir-stickybit/approvers/prod-readiness/alpha.yaml

This file should have a basename after the KEP number, not alpha.yaml. That is, it should be 5502.yaml, and the yaml format of this file is wrong (the approver needs to be nested under the stage).

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jan 30, 2026

k8s-ci-robot requested review from saad-ali and xing-yang January 30, 2026 21:24

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jan 30, 2026

k8s-ci-robot added kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory sig/storage Categorizes an issue or PR as relevant to SIG Storage. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 30, 2026

oliverguenther mentioned this pull request Jan 30, 2026

Add stickyBit support for emptydir volumes #5502

Open

4 tasks

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 3, 2026

kannon92 reviewed Feb 3, 2026

View reviewed changes

oliverguenther force-pushed the kep-5502-emptydir-stickybit branch from 5dffd6e to 26795c3 Compare February 3, 2026 13:29

kannon92 reviewed Feb 5, 2026

View reviewed changes

kannon92 requested changes Feb 5, 2026

View reviewed changes

gnufied reviewed Feb 6, 2026

View reviewed changes

pmengelbert reviewed Feb 6, 2026

View reviewed changes


		## Alternatives

		### Alternative 1: Provide more flexible mount options on emptyDir

		- Implementing this feature for volume types other than emptyDir
		- Supporting this feature on platforms that don't support Unix-style file permissions (e.g., Windows)

Conversation

oliverguenther commented Jan 30, 2026

Uh oh!

k8s-ci-robot commented Jan 30, 2026

Uh oh!

k8s-ci-robot commented Jan 30, 2026

Uh oh!

k8s-ci-robot commented Jan 30, 2026

Uh oh!

kannon92 commented Feb 3, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kannon92 Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kannon92 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kannon92 Feb 5, 2026 •

edited

Loading