mirror of
https://github.com/ceph/ceph-csi.git
synced 2024-11-09 16:00:22 +00:00
cephfs: support selinux mount options
- mount host's /etc/selinux in node plugins
- process mount options in all code paths for cephfs volume options
Signed-off-by: Alexandre Lossent <alexandre.lossent@cern.ch>
(cherry picked from commit 5cba04c470
)
This commit is contained in:
parent
b866bd491c
commit
7688bc3a7a
@ -112,6 +112,9 @@ spec:
|
|||||||
name: host-mount
|
name: host-mount
|
||||||
- mountPath: /sys
|
- mountPath: /sys
|
||||||
name: host-sys
|
name: host-sys
|
||||||
|
- mountPath: /etc/selinux
|
||||||
|
name: etc-selinux
|
||||||
|
readOnly: true
|
||||||
- mountPath: /lib/modules
|
- mountPath: /lib/modules
|
||||||
name: lib-modules
|
name: lib-modules
|
||||||
readOnly: true
|
readOnly: true
|
||||||
@ -167,6 +170,9 @@ spec:
|
|||||||
- name: host-sys
|
- name: host-sys
|
||||||
hostPath:
|
hostPath:
|
||||||
path: /sys
|
path: /sys
|
||||||
|
- name: etc-selinux
|
||||||
|
hostPath:
|
||||||
|
path: /etc/selinux
|
||||||
- name: host-mount
|
- name: host-mount
|
||||||
hostPath:
|
hostPath:
|
||||||
path: /run/mount
|
path: /run/mount
|
||||||
|
@ -38,6 +38,8 @@ spec:
|
|||||||
readOnly: false
|
readOnly: false
|
||||||
- pathPrefix: '/sys'
|
- pathPrefix: '/sys'
|
||||||
readOnly: false
|
readOnly: false
|
||||||
|
- pathPrefix: '/etc/selinux'
|
||||||
|
readOnly: true
|
||||||
- pathPrefix: '/lib/modules'
|
- pathPrefix: '/lib/modules'
|
||||||
readOnly: true
|
readOnly: true
|
||||||
- pathPrefix: '{{ .Values.kubeletDir }}'
|
- pathPrefix: '{{ .Values.kubeletDir }}'
|
||||||
|
@ -106,6 +106,9 @@ spec:
|
|||||||
name: host-mount
|
name: host-mount
|
||||||
- mountPath: /sys
|
- mountPath: /sys
|
||||||
name: host-sys
|
name: host-sys
|
||||||
|
- mountPath: /etc/selinux
|
||||||
|
name: etc-selinux
|
||||||
|
readOnly: true
|
||||||
- mountPath: /lib/modules
|
- mountPath: /lib/modules
|
||||||
name: lib-modules
|
name: lib-modules
|
||||||
readOnly: true
|
readOnly: true
|
||||||
@ -175,6 +178,9 @@ spec:
|
|||||||
- name: host-sys
|
- name: host-sys
|
||||||
hostPath:
|
hostPath:
|
||||||
path: /sys
|
path: /sys
|
||||||
|
- name: etc-selinux
|
||||||
|
hostPath:
|
||||||
|
path: /etc/selinux
|
||||||
- name: lib-modules
|
- name: lib-modules
|
||||||
hostPath:
|
hostPath:
|
||||||
path: /lib/modules
|
path: /lib/modules
|
||||||
|
@ -38,6 +38,8 @@ spec:
|
|||||||
readOnly: false
|
readOnly: false
|
||||||
- pathPrefix: '/sys'
|
- pathPrefix: '/sys'
|
||||||
readOnly: false
|
readOnly: false
|
||||||
|
- pathPrefix: '/etc/selinux'
|
||||||
|
readOnly: true
|
||||||
- pathPrefix: '/lib/modules'
|
- pathPrefix: '/lib/modules'
|
||||||
readOnly: true
|
readOnly: true
|
||||||
- pathPrefix: '{{ .Values.kubeletDir }}'
|
- pathPrefix: '{{ .Values.kubeletDir }}'
|
||||||
|
@ -84,6 +84,9 @@ spec:
|
|||||||
mountPropagation: "Bidirectional"
|
mountPropagation: "Bidirectional"
|
||||||
- name: host-sys
|
- name: host-sys
|
||||||
mountPath: /sys
|
mountPath: /sys
|
||||||
|
- name: etc-selinux
|
||||||
|
mountPath: /etc/selinux
|
||||||
|
readOnly: true
|
||||||
- name: lib-modules
|
- name: lib-modules
|
||||||
mountPath: /lib/modules
|
mountPath: /lib/modules
|
||||||
readOnly: true
|
readOnly: true
|
||||||
@ -137,6 +140,9 @@ spec:
|
|||||||
- name: host-sys
|
- name: host-sys
|
||||||
hostPath:
|
hostPath:
|
||||||
path: /sys
|
path: /sys
|
||||||
|
- name: etc-selinux
|
||||||
|
hostPath:
|
||||||
|
path: /etc/selinux
|
||||||
- name: lib-modules
|
- name: lib-modules
|
||||||
hostPath:
|
hostPath:
|
||||||
path: /lib/modules
|
path: /lib/modules
|
||||||
|
@ -32,6 +32,8 @@ spec:
|
|||||||
readOnly: false
|
readOnly: false
|
||||||
- pathPrefix: '/sys'
|
- pathPrefix: '/sys'
|
||||||
readOnly: false
|
readOnly: false
|
||||||
|
- pathPrefix: '/etc/selinux'
|
||||||
|
readOnly: true
|
||||||
- pathPrefix: '/lib/modules'
|
- pathPrefix: '/lib/modules'
|
||||||
readOnly: true
|
readOnly: true
|
||||||
- pathPrefix: '/var/lib/kubelet/pods'
|
- pathPrefix: '/var/lib/kubelet/pods'
|
||||||
|
@ -32,6 +32,8 @@ spec:
|
|||||||
readOnly: false
|
readOnly: false
|
||||||
- pathPrefix: '/sys'
|
- pathPrefix: '/sys'
|
||||||
readOnly: false
|
readOnly: false
|
||||||
|
- pathPrefix: '/etc/selinux'
|
||||||
|
readOnly: true
|
||||||
- pathPrefix: '/lib/modules'
|
- pathPrefix: '/lib/modules'
|
||||||
readOnly: true
|
readOnly: true
|
||||||
- pathPrefix: '/var/lib/kubelet/pods'
|
- pathPrefix: '/var/lib/kubelet/pods'
|
||||||
|
@ -93,6 +93,9 @@ spec:
|
|||||||
name: host-sys
|
name: host-sys
|
||||||
- mountPath: /run/mount
|
- mountPath: /run/mount
|
||||||
name: host-mount
|
name: host-mount
|
||||||
|
- mountPath: /etc/selinux
|
||||||
|
name: etc-selinux
|
||||||
|
readOnly: true
|
||||||
- mountPath: /lib/modules
|
- mountPath: /lib/modules
|
||||||
name: lib-modules
|
name: lib-modules
|
||||||
readOnly: true
|
readOnly: true
|
||||||
@ -153,6 +156,9 @@ spec:
|
|||||||
- name: host-sys
|
- name: host-sys
|
||||||
hostPath:
|
hostPath:
|
||||||
path: /sys
|
path: /sys
|
||||||
|
- name: etc-selinux
|
||||||
|
hostPath:
|
||||||
|
path: /etc/selinux
|
||||||
- name: host-mount
|
- name: host-mount
|
||||||
hostPath:
|
hostPath:
|
||||||
path: /run/mount
|
path: /run/mount
|
||||||
|
@ -411,6 +411,14 @@ func newVolumeOptionsFromMonitorList(
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if err = extractOptionalOption(&opts.KernelMountOptions, "kernelMountOptions", options); err != nil {
|
||||||
|
return nil, nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if err = extractOptionalOption(&opts.FuseMountOptions, "fuseMountOptions", options); err != nil {
|
||||||
|
return nil, nil, err
|
||||||
|
}
|
||||||
|
|
||||||
if err = extractMounter(&opts.Mounter, options); err != nil {
|
if err = extractMounter(&opts.Mounter, options); err != nil {
|
||||||
return nil, nil, err
|
return nil, nil, err
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user