Recommend volume mounting with readOnly flag set to true

[baijum]

Under Reconciler Implementation section, the spec should recommend volume mounting with readOnly flag set to true.

The configuration will look like this:

...
    volumeMounts:
    - name: foo
      mountPath: "/etc/foo"
      readOnly: true

[baijum]

Looks like the secret is always mounted as read-only irrespective of readOnly flag value.

Refer:

• CVE-2017-1002102
• Discussion: configMap and secrets volumeMount are always mounted readOnly in 1.9.6 kubernetes/kubernetes#62099

But I think, a recommendation to set readOnly would be good to make it explicit.

[scothis]

This is something an implementation is free to do, but I don't believe it belongs in the spec as it doesn't define user facing behavior or aid portability.

[baijum]

This is something an implementation is free to do, but I don't believe it belongs in the spec as it doesn't define user facing behavior or aid portability.

Probably there should be another document, say "Recommendations for Implementations", to help implementors with these kinds of practical suggestions.

[nebhale]

@baijum I've opened #100 and added this as the first thing we should cover. If you're satisfied with that issue, we can close this one out. Feel free to flesh out #100 a bit more if you'd like to note more of the content of this issue.

[baijum]

@baijum I've opened #100 and added this as the first thing we should cover. If you're satisfied with that issue, we can close this one out. Feel free to flesh out #100 a bit more if you'd like to note more of the content of this issue.

That must be issue #101

Thanks! I am closing this issue.