diff --git a/pkg/apis/core/validation/validation.go b/pkg/apis/core/validation/validation.go index 6502d9c210a3b..96f6be0839c78 100644 --- a/pkg/apis/core/validation/validation.go +++ b/pkg/apis/core/validation/validation.go @@ -3256,25 +3256,6 @@ func validateHostUsers(spec *core.PodSpec, fldPath *field.Path) field.ErrorList return allErrs } - // For now only these volumes are supported: - // - configmap - // - secret - // - downwardAPI - // - emptyDir - // - projected - // So reject anything else. - for i, vol := range spec.Volumes { - switch { - case vol.EmptyDir != nil: - case vol.Secret != nil: - case vol.DownwardAPI != nil: - case vol.ConfigMap != nil: - case vol.Projected != nil: - default: - allErrs = append(allErrs, field.Forbidden(fldPath.Child("volumes").Index(i), "volume type not supported when `pod.Spec.HostUsers` is false")) - } - } - // We decided to restrict the usage of userns with other host namespaces: // https://github.com/kubernetes/kubernetes/pull/111090#discussion_r935994282 // The tl;dr is: you can easily run into permission issues that seem unexpected, we don't diff --git a/pkg/apis/core/validation/validation_test.go b/pkg/apis/core/validation/validation_test.go index 7474473f81607..46167e32f492b 100644 --- a/pkg/apis/core/validation/validation_test.go +++ b/pkg/apis/core/validation/validation_test.go @@ -21780,8 +21780,8 @@ func TestValidateHostUsers(t *testing.T) { }}, }, }, { - name: "hostUsers=false - unsupported volume", - success: false, + name: "hostUsers=false - stateful volume", + success: true, spec: &core.PodSpec{ SecurityContext: &core.PodSecurityContext{ HostUsers: &falseVar, @@ -21794,7 +21794,6 @@ func TestValidateHostUsers(t *testing.T) { }}, }, }, { - // It should ignore unsupported volumes with hostUsers=true. name: "hostUsers=true - unsupported volume", success: true, spec: &core.PodSpec{