Skip to content

Commit c0dd24a

Browse files
aravindhparavindhp
committed
storage: create new file for projected volumes
Move inline examples into the examples folder
1 parent a812761 commit c0dd24a

File tree

5 files changed

+154
-137
lines changed

5 files changed

+154
-137
lines changed

‎content/en/docs/concepts/storage/projected-volumes.md

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
---
2+
reviewers:
3+
- sftim
4+
- marosset
5+
- jsturtevant
6+
- zshihang
7+
title: Projected Volumes
8+
content_type: concept
9+
---
10+
11+
<!-- overview -->
12+
13+
This document describes the current state of _projected volumes_ in Kubernetes. Familiarity with [volumes](/docs/concepts/storage/volumes/) is suggested.
14+
15+
<!-- body -->
16+
17+
## Introduction
18+
19+
A `projected` volume maps several existing volume sources into the same directory.
20+
21+
Currently, the following types of volume sources can be projected:
22+
23+
* [`secret`](/docs/concepts/storage/volumes/#secret)
24+
* [`downwardAPI`](/docs/concepts/storage/volumes/#downwardapi)
25+
* [`configMap`](/docs/concepts/storage/volumes/#configmap)
26+
* `serviceAccountToken`
27+
28+
All sources are required to be in the same namespace as the Pod. For more details,
29+
see the [all-in-one volume design document](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/all-in-one-volume.md).
30+
31+
### Example configuration with a secret, a downwardAPI, and a configMap {#example-configuration-secret-downwardapi-configmap}
32+
33+
{{< codenew file="pods/storage/projected-secret-downwardapi-configmap.yaml" >}}
34+
35+
### Example configuration: secrets with a non-default permission mode set {#example-configuration-secrets-nondefault-permission-mode}
36+
37+
{{< codenew file="pods/storage/projected-secrets-nondefault-permission-mode.yaml" >}}
38+
39+
Each projected volume source is listed in the spec under `sources`. The
40+
parameters are nearly the same with two exceptions:
41+
42+
* For secrets, the `secretName` field has been changed to `name` to be consistent
43+
with ConfigMap naming.
44+
* The `defaultMode` can only be specified at the projected level and not for each
45+
volume source. However, as illustrated above, you can explicitly set the `mode`
46+
for each individual projection.
47+
48+
When the `TokenRequestProjection` feature is enabled, you can inject the token
49+
for the current [service account](/docs/reference/access-authn-authz/authentication/#service-account-tokens)
50+
into a Pod at a specified path. For example:
51+
52+
{{< codenew file="pods/storage/projected-service-account-token.yaml" >}}
53+
54+
The example Pod has a projected volume containing the injected service account
55+
token. This token can be used by a Pod's containers to access the Kubernetes API
56+
server. The `audience` field contains the intended audience of the
57+
token. A recipient of the token must identify itself with an identifier specified
58+
in the audience of the token, and otherwise should reject the token. This field
59+
is optional and it defaults to the identifier of the API server.
60+
61+
The `expirationSeconds` is the expected duration of validity of the service account
62+
token. It defaults to 1 hour and must be at least 10 minutes (600 seconds). An administrator
63+
can also limit its maximum value by specifying the `--service-account-max-token-expiration`
64+
option for the API server. The `path` field specifies a relative path to the mount point
65+
of the projected volume.
66+
67+
{{< note >}}
68+
A container using a projected volume source as a [`subPath`](/docs/concepts/storage/volumes/#using-subpath)
69+
volume mount will not receive updates for those volume sources.
70+
{{< /note >}}

‎content/en/docs/concepts/storage/volumes.md

Lines changed: 2 additions & 137 deletions
Original file line numberDiff line numberDiff line change
@@ -801,143 +801,8 @@ For more details, see the [Portworx volume](https://github.com/kubernetes/exampl
801801

802802
### projected
803803

804-
A `projected` volume maps several existing volume sources into the same directory.
805-
806-
Currently, the following types of volume sources can be projected:
807-
808-
* [`secret`](#secret)
809-
* [`downwardAPI`](#downwardapi)
810-
* [`configMap`](#configmap)
811-
* `serviceAccountToken`
812-
813-
All sources are required to be in the same namespace as the Pod. For more details,
814-
see the [all-in-one volume design document](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/all-in-one-volume.md).
815-
816-
#### Example configuration with a secret, a downwardAPI, and a configMap {#example-configuration-secret-downwardapi-configmap}
817-
818-
```yaml
819-
apiVersion: v1
820-
kind: Pod
821-
metadata:
822-
name: volume-test
823-
spec:
824-
containers:
825-
- name: container-test
826-
image: busybox
827-
volumeMounts:
828-
- name: all-in-one
829-
mountPath: "/projected-volume"
830-
readOnly: true
831-
volumes:
832-
- name: all-in-one
833-
projected:
834-
sources:
835-
- secret:
836-
name: mysecret
837-
items:
838-
- key: username
839-
path: my-group/my-username
840-
- downwardAPI:
841-
items:
842-
- path: "labels"
843-
fieldRef:
844-
fieldPath: metadata.labels
845-
- path: "cpu_limit"
846-
resourceFieldRef:
847-
containerName: container-test
848-
resource: limits.cpu
849-
- configMap:
850-
name: myconfigmap
851-
items:
852-
- key: config
853-
path: my-group/my-config
854-
```
855-
856-
#### Example configuration: secrets with a non-default permission mode set {#example-configuration-secrets-nondefault-permission-mode}
857-
858-
```yaml
859-
apiVersion: v1
860-
kind: Pod
861-
metadata:
862-
name: volume-test
863-
spec:
864-
containers:
865-
- name: container-test
866-
image: busybox
867-
volumeMounts:
868-
- name: all-in-one
869-
mountPath: "/projected-volume"
870-
readOnly: true
871-
volumes:
872-
- name: all-in-one
873-
projected:
874-
sources:
875-
- secret:
876-
name: mysecret
877-
items:
878-
- key: username
879-
path: my-group/my-username
880-
- secret:
881-
name: mysecret2
882-
items:
883-
- key: password
884-
path: my-group/my-password
885-
mode: 511
886-
```
887-
888-
Each projected volume source is listed in the spec under `sources`. The
889-
parameters are nearly the same with two exceptions:
890-
891-
* For secrets, the `secretName` field has been changed to `name` to be consistent
892-
with ConfigMap naming.
893-
* The `defaultMode` can only be specified at the projected level and not for each
894-
volume source. However, as illustrated above, you can explicitly set the `mode`
895-
for each individual projection.
896-
897-
When the `TokenRequestProjection` feature is enabled, you can inject the token
898-
for the current [service account](/docs/reference/access-authn-authz/authentication/#service-account-tokens)
899-
into a Pod at a specified path. For example:
900-
901-
```yaml
902-
apiVersion: v1
903-
kind: Pod
904-
metadata:
905-
name: sa-token-test
906-
spec:
907-
containers:
908-
- name: container-test
909-
image: busybox
910-
volumeMounts:
911-
- name: token-vol
912-
mountPath: "/service-account"
913-
readOnly: true
914-
volumes:
915-
- name: token-vol
916-
projected:
917-
sources:
918-
- serviceAccountToken:
919-
audience: api
920-
expirationSeconds: 3600
921-
path: token
922-
```
923-
924-
The example Pod has a projected volume containing the injected service account
925-
token. This token can be used by a Pod's containers to access the Kubernetes API
926-
server. The `audience` field contains the intended audience of the
927-
token. A recipient of the token must identify itself with an identifier specified
928-
in the audience of the token, and otherwise should reject the token. This field
929-
is optional and it defaults to the identifier of the API server.
930-
931-
The `expirationSeconds` is the expected duration of validity of the service account
932-
token. It defaults to 1 hour and must be at least 10 minutes (600 seconds). An administrator
933-
can also limit its maximum value by specifying the `--service-account-max-token-expiration`
934-
option for the API server. The `path` field specifies a relative path to the mount point
935-
of the projected volume.
936-
937-
{{< note >}}
938-
A container using a projected volume source as a [`subPath`](#using-subpath) volume mount will not
939-
receive updates for those volume sources.
940-
{{< /note >}}
804+
A projected volume maps several existing volume sources into the same
805+
directory. For more details, see [projected volumes](/docs/concepts/storage/projected-volumes/)
941806

942807
### quobyte (deprecated) {#quobyte}
943808

‎content/en/examples/pods/storage/projected-secret-downwardapi-configmap.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: volume-test
5+
spec:
6+
containers:
7+
- name: container-test
8+
image: busybox
9+
volumeMounts:
10+
- name: all-in-one
11+
mountPath: "/projected-volume"
12+
readOnly: true
13+
volumes:
14+
- name: all-in-one
15+
projected:
16+
sources:
17+
- secret:
18+
name: mysecret
19+
items:
20+
- key: username
21+
path: my-group/my-username
22+
- downwardAPI:
23+
items:
24+
- path: "labels"
25+
fieldRef:
26+
fieldPath: metadata.labels
27+
- path: "cpu_limit"
28+
resourceFieldRef:
29+
containerName: container-test
30+
resource: limits.cpu
31+
- configMap:
32+
name: myconfigmap
33+
items:
34+
- key: config
35+
path: my-group/my-config

‎content/en/examples/pods/storage/projected-secrets-nondefault-permission-mode.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: volume-test
5+
spec:
6+
containers:
7+
- name: container-test
8+
image: busybox
9+
volumeMounts:
10+
- name: all-in-one
11+
mountPath: "/projected-volume"
12+
readOnly: true
13+
volumes:
14+
- name: all-in-one
15+
projected:
16+
sources:
17+
- secret:
18+
name: mysecret
19+
items:
20+
- key: username
21+
path: my-group/my-username
22+
- secret:
23+
name: mysecret2
24+
items:
25+
- key: password
26+
path: my-group/my-password
27+
mode: 511

‎content/en/examples/pods/storage/projected-service-account-token.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: sa-token-test
5+
spec:
6+
containers:
7+
- name: container-test
8+
image: busybox
9+
volumeMounts:
10+
- name: token-vol
11+
mountPath: "/service-account"
12+
readOnly: true
13+
volumes:
14+
- name: token-vol
15+
projected:
16+
sources:
17+
- serviceAccountToken:
18+
audience: api
19+
expirationSeconds: 3600
20+
path: token

0 commit comments

Comments
 (0)