Bind external folders to Kubelet with mount propagation?

Rancher 2.x
1

Hi :slight_smile: When I bind an external folder to Kubelet via the extra_binds option, the binds are created with the default rprivate mount propagation option, which makes any host-originating mounts in that folder invisible to Kubelet - and pods mounting it, even if they use mountPropagation: HostToContainer. You can check it by inspecting the Kubelet container:

# docker container inspect kubelet
"Mounts": [
{
    "Type": "bind",
    "Source": "/local",
    "Destination": "/local",
    "Mode": "",
    "RW": true,
    "Propagation": "rprivate"
},
...

This is the result of cluster.yaml containing this config:

services:
  kubelet:
    extra_binds:
      - "/local:/local"

Here’s how to do it in Docker: Use bind mounts | Docker Documentation

But how do I tell Rancher to bind the folder with an rslave or rshared option instead of rprivate? :thinking:

2

In order to bind with eg. rslave propagation, I had to add :rslave suffix to the bind spec, like this:

services:
  kubelet:
    extra_binds:
      - "/local:/local:rslave"

Which is reflected in Kubelet container config (when cluster update is complete):

# docker container inspect kubelet
"Mounts": [
{
    "Type": "bind",
    "Source": "/local",
    "Destination": "/local",
    "Mode": "rslave",
    "RW": true,
    "Propagation": "rslave"
},
...

However, existing mounts inside the /local folder are not propagated to pods, only the new mounts :face_with_raised_eyebrow:
Moreover, the pods which got new mounts propagated to /local, cannot be deleted until the mounts are first unmounted by the host :frowning:

3

Bug reported: