kubeflow / trainer / 28039484834

65%

master: 65%

Pull #3649

github

fix(runtimes): set file modes on MPI SSH secret volume

Set per-item file modes on the MPI SSH auth Secret volume to prevent
the private key from being world-readable inside training pods.

Private key uses 0o640 (not 0o600) because the builtin
deepspeed-distributed and mlx-distributed runtimes run as
runAsUser: 1000 while Secret volumes mount as root:root.

A volume-level DefaultMode of 0o400 is added as defense-in-depth
for any future items added without an explicit per-item mode.

Fixes #3262

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Dmytro Hryshchenko <dhryshch@redhat.com>

7 of 7 new or added lines in 1 file covered. (100.0%)

2337 of 3614 relevant lines covered (64.67%)

0.75 hits per line