Does hostPath support readOnly = false

[0bach0]

Does hostPath support write mode?

I set the service like this one, but in the ksvc config Read Only is always true

Service yaml file

apiVersion: serving.knative.dev/v1
kind: Service
...
     containers:
        ...
        volumeMounts:
         - mountPath: /root/.cache
            readOnly: false
            name: vllm-cache
        ....
     volumes:
        - name: vllm-cache
          hostPath:
            path: /tmp/vllm-cache
            type: DirectoryOrCreate

ksvc config

$ kubectl describe ksvc/above-service
...
         Volume Mounts:
          Mount Path:       /root/.cache
          Name:                vllm-cache
          Read Only:         true                  <- Always be `true`, even I skip `readOnly` in `volumeMounts`
...

I am using knative v1.19, already enable those feature flag

      kubernetes.podspec-persistent-volume-claim: "enabled"
      kubernetes.podspec-persistent-volume-write: "enabled"
      kubernetes.podspec-volumes-hostpath: "enabled"

[0bach0]

Hi @amarflybot, could you help review this question?

I tagged you since you contributed to enabling hostPath — thanks for your great work!

#15648

[linkvt]

Hi @0bach0 ,

there seems to be a check that forces readOnly to be set on all volumeMounts except emptyDir and PVCs:

serving/pkg/apis/serving/v1/revision_defaults.go

Lines 146 to 157 in 029c5be

	vNames := make(sets.Set[string])
	for _, v := range rs.PodSpec.Volumes {
	if v.EmptyDir != nil || v.PersistentVolumeClaim != nil {
	vNames.Insert(v.Name)
	}
	}
	vms := container.VolumeMounts
	for i := range vms {
	if !vNames.Has(vms[i].Name) {
	vms[i].ReadOnly = true
	}
	}

I guess you could workaround by creating a PV and PVC for the hostPath mount and use that one?

Without any background how you would do this usually with vllm I'm questioning if it makes sense to share a single hostPath mount with potentially many pods in a read-write way? Not sure if concurrent writes or a partial write by one pod and reads by other pods could be a problem.
Have you checked the vllm docs on this?

Besides that I can't tell right now if that's the desired behavior or not - maybe there is another maintainer with a better understanding of this and its history.
Allowing writeable mounts of PVCs but not of hostPath mounts seems a bit inconsistent to me though.

[dprotaso]

hostPath mounts are behind a feature flag because it's generally not 'safe' in a serverless environment and from a security point of view.

So hostPath is sorta YOLO setting. I would say if a user sets readOnly: false on a hostMount explicitly we should honour that. I would say this is a bug then.

[0bach0]

Hi @linkvt

Thank you for your response. In my usecase, I would like to share torch.compile result and share to other pod.

https://docs.vllm.ai/en/latest/design/torch_compile.html

I understand your consideration, for now we choose to use gke filestore and mount it via PV/PVC for caching the compile result.