docs: correct volume mount permissions - #704
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Updates Talos v1.14 documentation and generated references to clarify which volumes remain executable and where noexec is applied when using secure mount options, especially for dedicated vs. directory-backed system volumes.
Changes:
- Clarifies that
EPHEMERAL(and directory-backed volumes) remain executable while secure dedicatedETCD/LOGmounts arenoexec. - Updates generated schema/reference descriptions for
mount.secureacross VolumeConfig and related volume config kinds. - Improves storage docs around directory-backed (
volumeType: directory) user volumes and inherited mount attributes.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| public/talos/v1.14/schemas/config.schema.json | Updates schema field descriptions for mount.secure to reflect noexec behavior and supported volumes. |
| public/talos/v1.14/reference/configuration/block/volumeconfig.mdx | Updates generated reference text for mount.secure support and conditional noexec behavior. |
| public/talos/v1.14/reference/configuration/block/uservolumeconfig.mdx | Updates generated reference text for mount.secure to include noexec. |
| public/talos/v1.14/reference/configuration/block/externalvolumeconfig.mdx | Updates generated reference text for mount.secure to include noexec. |
| public/talos/v1.14/reference/configuration/block/existingvolumeconfig.mdx | Updates generated reference text for mount.secure to include noexec. |
| public/talos/v1.14/getting-started/what's-new-in-talos.mdx | Removes outdated EPHEMERAL noexec note and adds corrected dedicated-volume mount semantics. |
| public/talos/v1.14/configure-your-talos-cluster/storage-and-disk-management/disk-management/user.mdx | Clarifies behavior/limitations of directory-backed user volumes and improves examples. |
| public/talos/v1.14/configure-your-talos-cluster/storage-and-disk-management/disk-management/system.mdx | Clarifies executable policy and mount.secure semantics for directory-backed vs. dedicated system volumes. |
| public/talos/v1.14/configure-your-talos-cluster/lifecycle-management/upgrading-talos.mdx | Updates upgrade notes to reflect corrected executable vs. noexec volume behavior. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
393
to
+398
| "secure": { | ||
| "type": "boolean", | ||
| "title": "secure", | ||
| "description": "Enable secure mount options (nosuid, nodev).\n\nDefaults to true for better security.\n", | ||
| "markdownDescription": "Enable secure mount options (nosuid, nodev).\n\nDefaults to true for better security.", | ||
| "x-intellij-html-description": "\u003cp\u003eEnable secure mount options (nosuid, nodev).\u003c/p\u003e\n\n\u003cp\u003eDefaults to true for better security.\u003c/p\u003e\n" | ||
| "description": "Enable secure mount options (nosuid, nodev).\n\nFor dedicated ETCD and LOG volumes, this also enables noexec.\n\nDefaults to true for better security.\nSupported for EPHEMERAL and dedicated ETCD, CRI, KUBELET and LOG volumes.\n", | ||
| "markdownDescription": "Enable secure mount options (nosuid, nodev).\n\nFor dedicated ETCD and LOG volumes, this also enables noexec.\n\nDefaults to true for better security.\nSupported for EPHEMERAL and dedicated ETCD, CRI, KUBELET and LOG volumes.", | ||
| "x-intellij-html-description": "\u003cp\u003eEnable secure mount options (nosuid, nodev).\u003c/p\u003e\n\n\u003cp\u003eFor dedicated ETCD and LOG volumes, this also enables noexec.\u003c/p\u003e\n\n\u003cp\u003eDefaults to true for better security.\nSupported for EPHEMERAL and dedicated ETCD, CRI, KUBELET and LOG volumes.\u003c/p\u003e\n" |
Iheanacho-ai
approved these changes
Aug 10, 2026
Member
Author
|
/m |
|
@frezbo merge was not performed: merge: fatal: Not possible to fast-forward, aborting. |
Document that EPHEMERAL, CRI, and KUBELET remain executable while secure dedicated ETCD and LOG volumes use noexec. Clarify inherited permissions for directory-backed volumes and update generated references. Signed-off-by: Noel Georgi <git@frezbo.dev>
frezbo
force-pushed
the
docs/fix-volume-permissions
branch
from
August 10, 2026 16:57
b207f69 to
a2c2fae
Compare
Member
Author
|
/m |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Document that EPHEMERAL, CRI, and KUBELET remain executable while secure dedicated ETCD and LOG volumes use noexec. Clarify inherited permissions for directory-backed volumes and update generated references.