Introduce mount security mode for basic multi tenancy
Fixes#2164.
This adds three new parameters/options to StorageClass/flexvolume entry:
* `mountUser`
* `mountSecret`
* `mountSecretNamespace`
Signed-off-by: Alexander Trost <galexrt@googlemail.com>
This seems a bit misplaced, since CreateFilesystem is all about
doing the initial setup of the filesystem, and the daemons are
managed in a different block of code.
In a later patch, we're going to want to allow the CRD to spin
up MDS' for filesystems that already exist. Lift the code that
sets the MDS count into the caller.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Fixes#2239
Set Ceph logging to `/dev/stderr`, and run rgw setup commands without
combined output so that logging (no on stderr) isn't captured as part of
the result of commands.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
Previous code tried to interpret the string output as a `fmt.Sprintf`
string formatter, mangling `%` into `%!(MISSING)`, etc.
Thanks to go, I don't belive these are exploitable (unlike the similar
error in C).
Since this seemed to be a common error in the codebase, I did a quick
audit by visually inspecting the results of `git grep 'f([^"]'`. I
don't have a good suggestion for automated tests to prevent this in
future :(
Example error (look for `(MISSING)`):
```
E0927 05:31:07.618429 11227 driver-call.go:237] Failed to unmarshal output for command: unmount, output: "2018-09-27 05:31:07.191711 I | exec: Running command: df --type ceph /var/lib/kubelet/pods/95461479-c216-11e8-bcf0-02030782ac80/volumes/ceph.rook.io~rook/oe-scratch\n2018-09-27 05:46:43.808596 I | Filesystem 1K-blocks Used Available Use%!M(MISSING)ounted on\n2018-09-27 05:46:43.808659 I | 10.107.25.147:6790,10.109.173.79:6790,10.104.85.255:6790:/ 151678976 49410048 102268928 33%!/(MISSING)var/lib/kubelet/pods/95461479-c216-11e8-bcf0-02030782ac80/volumes/ceph.rook.io~rook/oe-scratch\n{\"status\":\"Success\"}\n", error: invalid character '-' after top-level value
```
Signed-off-by: Angus Lees <gus@inodes.org>
fix#2193
Fix regression introduced by PR allowing MDS config creation in init
container. This allows the new deployment-based mds clusters to scale
down where currently they can only remain constant or scale up.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
Progress toward issue #2003.
Includes design from design doc PR #1578
Use init containers to create configuration for Ceph mgrs. There is only
one init container in this design. The init container calls the Rook
binary to create Ceph config files which are then shared with the mds
daemon main container.
Once this init is run, the main mds daemon is run. Leaving room to use
the Ceph-versioned image in the future, call `ceph-mds --foreground ...`
to run the Ceph mds.
The refactor to using an init container also necessitated refactoring
the mdses replicaset implementation to a deployment-per-pod
implementation due to a chicken-egg problem. With a single container (in
the before times) the Rook binary was able to call the ceph-mds daemon
with an id generated from the pod name. Since the pod name is not known
before runtime, and the id is one of the few params that must be
specified to Ceph daemons on run, it is necessary to know the id
beforehand; thus the move to a deployment architecture following the
likes of the mon and mgr daemons.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
Progress toward issue #2003.
Includes design from design doc PR #1578
Use init containers to create configuration for Ceph mgrs. There is only
1 init container in this design:
1. Using the Rook image, call the Rook binary to create Ceph config
files shared with the mgr daemgr container.
Once this init is run, the main mgr daemgr is run. Leaving room to use
the Ceph-versioned image in the future, call `ceph-mgr --foreground ...`
to run the Ceph mgr.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
Add functions for helping test Kubernetes volumes and volume mounts.
- Create functions for testing the existence of volumes/mounts by
name in a list of vols/mounts without needing to know the index of
the vol/mount in the list.
- Create functions for printing vols/mounts in a human-readable format
so that tests may output more useful errors.
- Create a test definition for ensuring that all the volumes a pod
provides and all the mounts from each pod container match. For each
volume, there must be at least one container which mounts the volume,
and for each mount, there must be a source volume.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
Progress toward issue #2003.
Includes design from design doc PR #1578
Use init containers to create configuration for Ceph mons. There are 3
init containers in this design:
1. Using the Rook image, call the Rook binary to create Ceph config
files ultimately stored in a k8s EmptyDir which is shared between all
containers in a mon pod.
2. Leaving room to use the Ceph-versioned image in the future, call
`monmaptool` to generate the monmap, stored in a shared config dir.
3. Leaving room to use the Ceph-versioned image in the future, call
`ceph-mon --mkfs ...` to set up the mon filesystem on the host's disk.
Once this init is run, the main mon daemon is run. Leaving room to use
the Ceph-versioned image in the future, call `ceph-mon --foreground ...`
to run the Ceph mon.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
While creating a PVC, if the operator dies between successfully creating a rbd
image and associating it with a PV, that PVC will never be completed. A
restarted operator will also fail to complete the task as the requested rbd
image already exists. With the assumption that a PVC UID will always be unique,
this patch will try to use the existing volume and complete the PVC request.
Resolves: #2072
Signed-off-by: Ganesh Maharaj Mahalingam <ganesh.mahalingam@intel.com>
Create a cephconfig module in Ceph's daemon pkg source, and refactor the
config and keyring generation that exists in the mon package into the
new cephconfig package. The config/keyring generation code is used by
most all daemons and not just mon, so a new package is a more
appropriate place for this.
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
Current code will truncate the generated RBD image in some cases,
this PR will round up the size to make sure the final RBD image
generated can cover all the required data space.
Also, corresponding unit test cases added to verify the change.
Signed-off-by: Dennis Chen <dennis.chen@arm.com>
We don't use volume manager argument in NewClusterController()
and NewFlexvolumeServer() functions, so remove the unused volume
manager parameter from those functions.
Signed-off-by: Dennis Chen <dennis.chen@arm.com>
This has been the correct style since luminous. The
"allow *" version works fine but is more power than
needed.
Signed-off-by: John Spray <john.spray@redhat.com>
While the mgr can mostly do its job with just
mon caps, modules expect to also have access
to OSD and MDS daemons at will (e.g. for the dashboard
to display the MDS session list)
This change matches what other Ceph deployment tools do.
Signed-off-by: John Spray <john.spray@redhat.com>
Current Ceph volume manager code doesn't take the builtin
kernel module into the account, so the `modinfo` will fail
in this case. Also, we need to add error handling code to
make sure the volume manager does work when proceeding to
continue, otherwise we will encounter the `rbd` related issue
in the following step even we have an artificial `agent` pod
in running state.
Signed-off-by: Dennis Chen <dennis.chen@arm.com>
Fix some basic spellcheck errors. Also remove trailing spaces and make
sure files have a newline (my editor does automatically).
Signed-off-by: Blaine Gardner <blaine.gardner@suse.com>
Previously, if this failed mid-way it would then throw
an exception at the first operation when retrying (because it's
trying to reweight an OSD that might not be in the map any more)
Signed-off-by: John Spray <john.spray@redhat.com>
travisn
Alexander Trost
Jeff Layton
Andrey Laguta
Bogdan Luca
Blaine Gardner
Angus Lees
Ganesh Maharaj Mahalingam
Dennis Chen
Jared Watts
John Spray
Huamin Chen