forked from rook/rook
Blaine Gardner
eea43b7b79
Allow RGW users to mount arbitrary volumes to RGW pods. This follows the pattern that was established for NFS to support SSSD and LDAP, and reuses much of the same code. This opens the door wider for advanced users to take advantage of some Ceph RGW features that Rook doesn't have first class support for. Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
367 lines
11 KiB
Go
367 lines
11 KiB
Go
/*
|
|
Copyright 2022 The Rook Authors. All rights reserved.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package nfs
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
cephv1 "github.com/rook/rook/pkg/apis/ceph.rook.io/v1"
|
|
v1 "k8s.io/api/core/v1"
|
|
"k8s.io/apimachinery/pkg/types"
|
|
)
|
|
|
|
func (r *ReconcileCephNFS) addSecurityConfigsToPod(nfs *cephv1.CephNFS, pod *v1.PodSpec) error {
|
|
nsName := types.NamespacedName{Namespace: nfs.Namespace, Name: nfs.Name}
|
|
|
|
sec := nfs.Spec.Security
|
|
if sec == nil {
|
|
return nil
|
|
}
|
|
|
|
if sec.SSSD != nil {
|
|
logger.Debugf("configuring system security services daemon (SSSD) for CephNFS %q", nsName)
|
|
addSSSDConfigsToPod(r, nfs, pod)
|
|
}
|
|
|
|
if sec.Kerberos != nil {
|
|
logger.Debugf("configuring Kerberos for CephNFS %q", nsName)
|
|
addKerberosConfigsToPod(r, nfs, pod)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func addSSSDConfigsToPod(r *ReconcileCephNFS, nfs *cephv1.CephNFS, pod *v1.PodSpec) {
|
|
nsName := types.NamespacedName{Namespace: nfs.Namespace, Name: nfs.Name}
|
|
|
|
// generate /etc/nsswitch.conf file for the nfs-ganesha pod
|
|
nssCfgInitContainer, nssCfgVol, nssCfgMount := generateSssdNsswitchConfResources(r, nfs)
|
|
|
|
pod.InitContainers = append(pod.InitContainers, *nssCfgInitContainer)
|
|
pod.Volumes = append(pod.Volumes, *nssCfgVol)
|
|
// assume the first container is the NFS-Ganesha container
|
|
pod.Containers[0].VolumeMounts = append(pod.Containers[0].VolumeMounts, *nssCfgMount)
|
|
|
|
sidecarCfg := nfs.Spec.Security.SSSD.Sidecar
|
|
if sidecarCfg != nil {
|
|
logger.Debugf("configuring SSSD sidecar for CephNFS %q", nsName)
|
|
init, sidecar, vols, mounts := generateSssdSidecarResources(nfs, sidecarCfg)
|
|
|
|
pod.InitContainers = append(pod.InitContainers, *init)
|
|
pod.Containers = append(pod.Containers, *sidecar)
|
|
pod.Volumes = append(pod.Volumes, vols...)
|
|
// assume the first container is the NFS-Ganesha container
|
|
pod.Containers[0].VolumeMounts = append(pod.Containers[0].VolumeMounts, mounts...)
|
|
}
|
|
}
|
|
|
|
func addKerberosConfigsToPod(r *ReconcileCephNFS, nfs *cephv1.CephNFS, pod *v1.PodSpec) {
|
|
init, volume, ganeshaMounts := generateKrbConfResources(r, nfs)
|
|
|
|
pod.InitContainers = append(pod.InitContainers, *init)
|
|
pod.Volumes = append(pod.Volumes, *volume)
|
|
// assume the first container is the NFS-Ganesha container
|
|
for _, m := range ganeshaMounts {
|
|
pod.Containers[0].VolumeMounts = append(pod.Containers[0].VolumeMounts, *m)
|
|
}
|
|
|
|
configVolSrc := nfs.Spec.Security.Kerberos.ConfigFiles.VolumeSource
|
|
if configVolSrc != nil {
|
|
vol, mnt := kerberosConfigFilesVolAndMount(*configVolSrc)
|
|
|
|
pod.Volumes = append(pod.Volumes, vol)
|
|
pod.Containers[0].VolumeMounts = append(pod.Containers[0].VolumeMounts, mnt)
|
|
}
|
|
|
|
keytabVolSrc := nfs.Spec.Security.Kerberos.KeytabFile.VolumeSource
|
|
if keytabVolSrc != nil {
|
|
vol, mnt := keytabVolAndMount(*keytabVolSrc)
|
|
|
|
pod.Volumes = append(pod.Volumes, vol)
|
|
pod.Containers[0].VolumeMounts = append(pod.Containers[0].VolumeMounts, mnt)
|
|
}
|
|
}
|
|
|
|
func generateSssdSidecarResources(nfs *cephv1.CephNFS, sidecarCfg *cephv1.SSSDSidecar) (
|
|
init *v1.Container,
|
|
sidecar *v1.Container,
|
|
volumes []v1.Volume, // add these volumes to the pod
|
|
ganeshaMounts []v1.VolumeMount, // add these volume mounts to the nfs-ganesha container
|
|
) {
|
|
socketVolName := "sssd-sockets"
|
|
mmapCacheVolName := "sssd-mmap-cache"
|
|
|
|
socketVol := v1.Volume{
|
|
Name: socketVolName,
|
|
VolumeSource: v1.VolumeSource{
|
|
EmptyDir: &v1.EmptyDirVolumeSource{},
|
|
},
|
|
}
|
|
socketMount := v1.VolumeMount{
|
|
Name: socketVolName,
|
|
MountPath: "/var/lib/sss/pipes",
|
|
}
|
|
|
|
mmapCacheVol := v1.Volume{
|
|
Name: mmapCacheVolName,
|
|
VolumeSource: v1.VolumeSource{
|
|
EmptyDir: &v1.EmptyDirVolumeSource{},
|
|
},
|
|
}
|
|
mmapCacheMount := v1.VolumeMount{
|
|
Name: mmapCacheVolName,
|
|
MountPath: "/var/lib/sss/mc",
|
|
}
|
|
|
|
volumes = []v1.Volume{socketVol, mmapCacheVol}
|
|
|
|
// conf file mount not needed in the ganesha pod, only the SSSD sidecar
|
|
ganeshaMounts = []v1.VolumeMount{socketMount, mmapCacheMount}
|
|
|
|
sssdMounts := []v1.VolumeMount{socketMount, mmapCacheMount}
|
|
|
|
volSource := sidecarCfg.SSSDConfigFile.VolumeSource
|
|
if volSource != nil {
|
|
vol, mount := sssdConfigVolAndMount(*volSource.ToKubernetesVolumeSource())
|
|
|
|
volumes = append(volumes, vol)
|
|
sssdMounts = append(sssdMounts, mount)
|
|
}
|
|
|
|
genericVols, genericMounts := sidecarCfg.AdditionalFiles.GenerateVolumesAndMounts("/etc/sssd/rook-additional/")
|
|
volumes = append(volumes, genericVols...)
|
|
sssdMounts = append(sssdMounts, genericMounts...)
|
|
|
|
// The volumes for krb5.conf and krb5.keytab are created separately
|
|
// for the nfs-ganesha container. We reuse it here.
|
|
if nfs.Spec.Security.Kerberos != nil {
|
|
krb5ConfVolName := "krb5-conf-d"
|
|
generatedKrbConfVolName := "generated-krb5-conf"
|
|
|
|
krb5ConfD := v1.VolumeMount{
|
|
Name: krb5ConfVolName,
|
|
MountPath: "/etc/krb5.conf.rook/",
|
|
}
|
|
krbConfMount := v1.VolumeMount{
|
|
Name: generatedKrbConfVolName,
|
|
MountPath: "/etc/krb5.conf",
|
|
SubPath: "krb5.conf",
|
|
}
|
|
sssdMounts = append(sssdMounts, krb5ConfD, krbConfMount)
|
|
|
|
if nfs.Spec.Security.Kerberos.KeytabFile.VolumeSource != nil {
|
|
volName := "krb5-keytab"
|
|
keytabMount := v1.VolumeMount{
|
|
Name: volName,
|
|
MountPath: "/etc/krb5.keytab",
|
|
SubPath: "krb5.keytab",
|
|
}
|
|
sssdMounts = append(sssdMounts, keytabMount)
|
|
}
|
|
}
|
|
|
|
// the init container is needed to copy the starting content from the /var/lib/sss/pipes
|
|
// directory into the shared sockets dir so that SSSD has the content it needs to start up
|
|
init = &v1.Container{
|
|
Name: "copy-sssd-sockets",
|
|
Command: []string{
|
|
"bash", "-c",
|
|
`set -ex
|
|
cp --archive --verbose /var/lib/sss/pipes/* /tmp/var/lib/sss/pipes/.
|
|
ls --all --recursive /tmp/var/lib/sss/pipes`,
|
|
},
|
|
VolumeMounts: []v1.VolumeMount{
|
|
{Name: socketVolName, MountPath: "/tmp/var/lib/sss/pipes"},
|
|
},
|
|
Image: sidecarCfg.Image,
|
|
Resources: sidecarCfg.Resources,
|
|
}
|
|
|
|
sidecar = &v1.Container{
|
|
Name: "sssd",
|
|
Command: []string{
|
|
"sssd",
|
|
},
|
|
Args: []string{
|
|
"--interactive",
|
|
"--logger=stderr",
|
|
},
|
|
VolumeMounts: sssdMounts,
|
|
Image: sidecarCfg.Image,
|
|
Resources: sidecarCfg.Resources,
|
|
}
|
|
|
|
if sidecarCfg.DebugLevel > 0 {
|
|
sidecar.Args = append(sidecar.Args, fmt.Sprintf("--debug-level=%d", sidecarCfg.DebugLevel))
|
|
}
|
|
|
|
return init, sidecar, volumes, ganeshaMounts
|
|
}
|
|
|
|
func generateKrbConfResources(r *ReconcileCephNFS, nfs *cephv1.CephNFS) (
|
|
init *v1.Container,
|
|
volume *v1.Volume, // add these volumes to the pod
|
|
ganeshaMounts []*v1.VolumeMount, // add these volume mounts to the nfs-ganesha container
|
|
) {
|
|
generatedKrbConfVolName := "generated-krb5-conf"
|
|
kerberosDomainName := nfs.Spec.Security.Kerberos.DomainName
|
|
|
|
volume = &v1.Volume{
|
|
Name: generatedKrbConfVolName,
|
|
VolumeSource: v1.VolumeSource{
|
|
EmptyDir: &v1.EmptyDirVolumeSource{},
|
|
},
|
|
}
|
|
krbConfMount := &v1.VolumeMount{
|
|
Name: generatedKrbConfVolName,
|
|
MountPath: "/etc/krb5.conf",
|
|
SubPath: "krb5.conf",
|
|
}
|
|
ganeshaMounts = append(ganeshaMounts, krbConfMount)
|
|
|
|
domainNameCommand := ""
|
|
domainName := nfs.Spec.Security.Kerberos.DomainName
|
|
if domainName != "" {
|
|
domainNameCommand = `
|
|
cat << EOF > /tmp/etc/idmapd.conf
|
|
[General]
|
|
Domain = ` + kerberosDomainName + `
|
|
EOF
|
|
cat /etc/idmapd.conf`
|
|
idmapdConfMount := &v1.VolumeMount{
|
|
Name: generatedKrbConfVolName,
|
|
MountPath: "/etc/idmapd.conf",
|
|
SubPath: "idmapd.conf",
|
|
}
|
|
ganeshaMounts = append(ganeshaMounts, idmapdConfMount)
|
|
}
|
|
|
|
// the init container is needed to copy the starting content from the /var/lib/sss/pipes
|
|
// directory into the shared sockets dir so that SSSD has the content it needs to start up
|
|
init = &v1.Container{
|
|
Name: "generate-krb5-conf",
|
|
Command: []string{
|
|
"bash", "-c",
|
|
`set -ex
|
|
cat << EOF > /tmp/etc/krb5.conf
|
|
[logging]
|
|
default = STDERR
|
|
|
|
includedir /etc/krb5.conf.rook/
|
|
EOF
|
|
cat /tmp/etc/krb5.conf
|
|
` + domainNameCommand,
|
|
},
|
|
VolumeMounts: []v1.VolumeMount{
|
|
{Name: generatedKrbConfVolName, MountPath: "/tmp/etc"},
|
|
},
|
|
Image: r.cephClusterSpec.CephVersion.Image,
|
|
Resources: nfs.Spec.Server.Resources,
|
|
}
|
|
|
|
return init, volume, ganeshaMounts
|
|
}
|
|
|
|
func sssdConfigVolAndMount(volSource v1.VolumeSource) (v1.Volume, v1.VolumeMount) {
|
|
volName := "sssd-conf"
|
|
vol := v1.Volume{
|
|
Name: volName,
|
|
VolumeSource: volSource,
|
|
}
|
|
mount := v1.VolumeMount{
|
|
Name: volName,
|
|
MountPath: "/etc/sssd/sssd.conf",
|
|
SubPath: "sssd.conf",
|
|
}
|
|
|
|
return vol, mount
|
|
}
|
|
|
|
func generateSssdNsswitchConfResources(r *ReconcileCephNFS, nfs *cephv1.CephNFS) (*v1.Container, *v1.Volume, *v1.VolumeMount) {
|
|
volName := "nsswitch-conf"
|
|
|
|
podVol := &v1.Volume{
|
|
Name: volName,
|
|
VolumeSource: v1.VolumeSource{
|
|
EmptyDir: &v1.EmptyDirVolumeSource{},
|
|
},
|
|
}
|
|
|
|
nfsGaneshaContainerMount := &v1.VolumeMount{
|
|
Name: volName,
|
|
MountPath: "/etc/nsswitch.conf",
|
|
SubPath: "nsswitch.conf",
|
|
}
|
|
|
|
// what happens here is that an empty dir is mounted to /tmp/etc, and this init container
|
|
// creates the nsswitch.conf file in it. Once the file is created, subsequent containers can
|
|
// mount the nsswitch.conf file to /etc/nsswitch.conf using 'subPath'
|
|
init := &v1.Container{
|
|
Name: "generate-nsswitch-conf",
|
|
Command: []string{
|
|
"bash", "-c",
|
|
`set -ex
|
|
cat << EOF > /tmp/etc/nsswitch.conf
|
|
passwd: files sss
|
|
group: files sss
|
|
netgroup: sss
|
|
EOF
|
|
chmod 444 /tmp/etc/nsswitch.conf
|
|
cat /tmp/etc/nsswitch.conf`,
|
|
},
|
|
VolumeMounts: []v1.VolumeMount{
|
|
{Name: volName, MountPath: "/tmp/etc"},
|
|
},
|
|
|
|
// use CephCluster image and NFS server resources here because this container should be used
|
|
// to configure /etc/nsswitch.conf even if the SSSD sidecar isn't configured
|
|
Image: r.cephClusterSpec.CephVersion.Image,
|
|
Resources: nfs.Spec.Server.Resources,
|
|
}
|
|
|
|
return init, podVol, nfsGaneshaContainerMount
|
|
}
|
|
|
|
func kerberosConfigFilesVolAndMount(volSource cephv1.ConfigFileVolumeSource) (v1.Volume, v1.VolumeMount) {
|
|
volName := "krb5-conf-d"
|
|
vol := v1.Volume{
|
|
Name: volName,
|
|
VolumeSource: *volSource.ToKubernetesVolumeSource(),
|
|
}
|
|
mount := v1.VolumeMount{
|
|
Name: volName,
|
|
MountPath: "/etc/krb5.conf.rook/",
|
|
}
|
|
|
|
return vol, mount
|
|
}
|
|
|
|
func keytabVolAndMount(volSource cephv1.ConfigFileVolumeSource) (v1.Volume, v1.VolumeMount) {
|
|
volName := "krb5-keytab"
|
|
vol := v1.Volume{
|
|
Name: volName,
|
|
VolumeSource: *volSource.ToKubernetesVolumeSource(),
|
|
}
|
|
mount := v1.VolumeMount{
|
|
Name: volName,
|
|
MountPath: "/etc/krb5.keytab",
|
|
SubPath: "krb5.keytab",
|
|
}
|
|
|
|
return vol, mount
|
|
}
|