-
Notifications
You must be signed in to change notification settings - Fork 62
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add initContainer to download model #613
Conversation
51ac04f
to
8661d19
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good, but also all initContainers need to drop unneeded privileged, and I think all of them to need the file access rights handling, as their actual workloads run under same user ID (1000).
Has this been tested with k8s volumes with ReadWriteMany where multiple containers update a shared volume? Or is it expected to work similar to the host path case? @lianhao can you comment this? |
092b755
to
639d67c
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Some further suggestions to improve security.
0efe89e
to
dffc70b
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Group ID settings went under wrong securityContext. Otherwise looks fine.
55cfcb6
to
9dcc625
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Approved!
(Group ID comment could now be moved to a better place though.)
# Init container sets the downloaded model dir to be group writable, so that container | ||
# can keep its lock file there. This relies on both containers using the same group ID. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think (with the last change) best place for these comments would be with the runAsGroup
check in the deployment's initContainer securityContext
, not any more here in values file.
Add initContainer to download model to avoid the permission conflict issue of the .locks directory in the host modeUseHostPath path, when sharing the host model directory between different services. Also always set securityContext in all cases. Signed-off-by: Lianhao Lu <[email protected]>
9dcc625
to
74f9d98
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
My K8s volume question went unanswered. I guess, I'll be filing issues if it does not work. My bet is that it won't... |
@poussa I remembered @yongfengdu has tested the PVC case, but only on NFS storage class if I remembered correctly. |
Description
Add initContainer to download model to avoid the permission conflict issue of the .locks directory in the host
modeUseHostPath
path, when sharing the host model directory between different services.Issues
n/a
.Type of change
List the type of change like below. Please delete options that are not relevant.
Dependencies
List the newly introduced 3rd party dependency if exists.
Tests
Describe the tests that you ran to verify your changes.