kubernetes
/
website
mirror of https://github.com/kubernetes/website.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

azure-file storage class: add missing parameter for multi tenancy #14762 (#14763) 

* initial commit

* azure-file storage class: add missing parameter for multi tenancy #14762

* Update storage-classes.md
pull/15872/head
Vincent Gramer 2019-08-15 07:48:36 +02:00 committed by Kubernetes Prow Robot
parent ec9092d4ed
commit 4821582b89
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
content/en/docs/concepts/storage/storage-classes.md
View File

@ -610,13 +610,25 @@ parameters:
group are searched to find one that matches `skuName` and `location`. If a group are searched to find one that matches `skuName` and `location`. If a
storage account is provided, it must reside in the same resource group as the storage account is provided, it must reside in the same resource group as the
cluster, and `skuName` and `location` are ignored. cluster, and `skuName` and `location` are ignored.
* `secretNamespace`: the namespace of the secret that contains the Azure Storage
Account Name and Key. Default is the same as the Pod.
* `secretName`: the name of the secret that contains the Azure Storage Account Name and
Key. Default is `azure-storage-account-<accountName>-secret`
* `readOnly`: a flag indicating whether the storage will be mounted as read only.
Defaults to false which means a read/write mount. This setting will impact the
`ReadOnly` setting in VolumeMounts as well.
During provision, a secret is created for mounting credentials. If the cluster During storage provisioning, a secret named by `secretName` is created for the
has enabled both [RBAC](/docs/reference/access-authn-authz/rbac/) and mounting credentials. If the cluster has enabled both
[RBAC](/docs/reference/access-authn-authz/rbac/) and
[Controller Roles](/docs/reference/access-authn-authz/rbac/#controller-roles), [Controller Roles](/docs/reference/access-authn-authz/rbac/#controller-roles),
add the `create` permission of resource `secret` for clusterrole add the `create` permission of resource `secret` for clusterrole
`system:controller:persistent-volume-binder`. `system:controller:persistent-volume-binder`.
In a multi-tenancy context, it is strongly recommended to set the value for
`secretNamespace` explicitly, otherwise the storage account credentials may
be read by other users.
### Portworx Volume ### Portworx Volume
```yaml ```yaml