0a151e913 results in a bug which causes null pointer dereference when
Kerberos is not setup. This causes a failure in Unit test
TestReconcileCephNFS_addSecurityConfigsToPod
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
This will enable us to use GSSAPI in sssd for authentication when
connecting to the remote LDAP server.
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
We add a new field domainName to the Kerberos section. The field is used
to setup /etc/idmapd.conf with the domain name. This allows idmapper to
map to kerberos credential to the correct uid/gid.
We add Spec.Security.Kerberos.DomainName to the CRD
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Pare down the available volume sources for NFS config files so that the
CRD isn't unnecessarily huge. This allows us to recommend
`kubectl apply` again in the upgrade doc.
Size of the NFS CRD is reduced by approximately 60%.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
When using sssd, the /etc/nsswitch.conf should also include local files
for lookups. This is required when looking up uid 0 and the root user
which are not handled by ldap or other sources.
Closes: https://github.com/rook/rook/issues/11925
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
The sssd.conf may refer to additional files, like a CA bundle or TLS
certificates. These files need to be made available in the SSSD sidecar.
With the new `sssdGenericFiles` reference to a VolumeSource and a
`MountPath`, a provided `sssd.conf` can use the additional files.
Signed-off-by: Niels de Vos <ndevos@redhat.com>
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Implement the SSSD sidecar design for NFS.
Because NFS documents are getting long, create an NFS
`Storage-Configuration` section with separated topics to keep the `NFS
Overview` document sane.
Adjust the SSSD design to allow any VolumeSource, not just ConfigMaps.
Signed-off-by: Blaine Gardner <blaine.gardner@redhat.com>
Sachin Prabhu
Blaine Gardner
Niels de Vos