kubeflow / trainer / 28092757024

65%

push

github

fix(runtimes): set defaultMode on MPI SSH Secret volume (#3649)

* fix(runtimes): set file modes on MPI SSH secret volume

Set per-item file modes on the MPI SSH auth Secret volume to prevent
the private key from being world-readable inside training pods.

Private key uses 0o640 (not 0o600) because the builtin
deepspeed-distributed and mlx-distributed runtimes run as
runAsUser: 1000 while Secret volumes mount as root:root.

A volume-level DefaultMode of 0o400 is added as defense-in-depth
for any future items added without an explicit per-item mode.

Fixes #3262

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Dmytro Hryshchenko <dhryshch@redhat.com>

* docs: update pkg/constants/constants.go

Co-authored-by: Andrey Velichkevich <andrey.velichkevich@gmail.com>
Signed-off-by: Dmytro Hryshchenko <dmytrohryshchenkowork@gmail.com>

---------

Signed-off-by: Dmytro Hryshchenko <dhryshch@redhat.com>
Signed-off-by: Dmytro Hryshchenko <dmytrohryshchenkowork@gmail.com>
Co-authored-by: Andrey Velichkevich <andrey.velichkevich@gmail.com>

7 of 7 new or added lines in 1 file covered. (100.0%)

2337 of 3614 relevant lines covered (64.67%)

0.75 hits per line