<p dir="auto">It failed in gce suite. I honestly have no idea under which team it falls: <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/bgrant0607/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/bgrant0607">@bgrant0607</a> <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/thockin/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/thockin">@thockin</a> <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/ixdy/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/ixdy">@ixdy</a> <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/wojtek-t/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/wojtek-t">@wojtek-t</a>.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/es_cluster_logging.go:46 Nov 27 02:50:59.145: Failed to find all 300 log lines"><pre class="notranslate"><code class="notranslate">/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/es_cluster_logging.go:46 Nov 27 02:50:59.145: Failed to find all 300 log lines
</code></pre></div>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.): secret permission mode</p>
<p dir="auto"><strong>Kubernetes version</strong> (use <code class="notranslate">kubectl version</code>):<br>
v1.5.0-alpha.0.1251+e05e8664d5dd7a</p>
<p dir="auto"><strong>Environment</strong>:</p>
<ul dir="auto">
<li><strong>OS</strong> (e.g. from /etc/os-release): Red Hat Enterprise Linux Server 7.2</li>
<li><strong>Kernel</strong> (e.g. <code class="notranslate">uname -a</code>): 3.10.0-327.22.2.el7.x86_64</li>
</ul>
<p dir="auto"><strong>What happened</strong>:<br>
Didn't handle invalid permission mode: '0008' properly. I think we don't need to change to 0010 with octonary number in here. We should add limitation for these invalid value, such as 8 and 9. For reference, linux os doesn't allow user set "chmod 008" always.</p>
<p dir="auto"><strong>How to reproduce it</strong> (as minimally and precisely as possible):<br>
<strong>1. Create a secret: <code class="notranslate">kubectl create -f secret.yaml</code></strong></p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="apiVersion: v1
kind: Secret
metadata:
  name: test-secret
data:
  data-1: dmFsdWUtMQ0K
  data-2: dmFsdWUtMg0KDQo="><pre class="notranslate"><code class="notranslate">apiVersion: v1
kind: Secret
metadata:
  name: test-secret
data:
  data-1: dmFsdWUtMQ0K
  data-2: dmFsdWUtMg0KDQo=
</code></pre></div>
<p dir="auto"><strong>2. Create a pod with specifying secret permission mode(0008): <code class="notranslate">kubectl create -f secret-permission-pod.yaml</code></strong></p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="apiVersion: v1
kind: Pod
metadata:
  name: secret-permission-pod
spec:
  containers:
  - name: secret-permission-pod
    image: redis
    volumeMounts:
    - name: foo-volume
      mountPath: &quot;/etc/foo&quot;
  volumes:
  - name: foo-volume
    secret:
      secretName: test-secret
      defaultMode: 8"><pre class="notranslate"><code class="notranslate">apiVersion: v1
kind: Pod
metadata:
  name: secret-permission-pod
spec:
  containers:
  - name: secret-permission-pod
    image: redis
    volumeMounts:
    - name: foo-volume
      mountPath: "/etc/foo"
  volumes:
  - name: foo-volume
    secret:
      secretName: test-secret
      defaultMode: 8
</code></pre></div>
<p dir="auto"><strong>Actual results</strong>:<br>
Created succeful and set 0010 for files in secret volume.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# kc create -f secret-permission-pod.yaml
pod &quot;secret-permission-pod&quot; created
# kc get pod
NAME                    READY     STATUS    RESTARTS   AGE
secret-permission-pod   1/1       Running   0          19s
# kc exec -it secret-permission-pod sh
# ls -l /etc/foo/..data/
total 8
------x---. 1 root root  9 Sep 26 05:13 data-1
------x---. 1 root root 11 Sep 26 05:13 data-2"><pre class="notranslate"><code class="notranslate"># kc create -f secret-permission-pod.yaml
pod "secret-permission-pod" created
# kc get pod
NAME                    READY     STATUS    RESTARTS   AGE
secret-permission-pod   1/1       Running   0          19s
# kc exec -it secret-permission-pod sh
# ls -l /etc/foo/..data/
total 8
------x---. 1 root root  9 Sep 26 05:13 data-1
------x---. 1 root root 11 Sep 26 05:13 data-2
</code></pre></div>
<p dir="auto"><strong>Expected results</strong>:<br>
Pod should be created failed with properly warnning info.</p>