mirrors/ceph-csi
1
0
Fork 0
mirror of https://github.com/ceph/ceph-csi.git synced 2024-12-18 02:50:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

nfs: add support for secTypes parameter in StorageClass

Browse Source 
CephNFS can enable different security flavours for exported volumes.
This can be configured in the optional `secTypes` parameter in the
StorageClass.

Signed-off-by: Niels de Vos <ndevos@redhat.com>
This commit is contained in:
Niels de Vos 2022-10-13 16:05:08 +02:00 committed by mergify[bot]
parent 3d6cdce353
commit 8265abc2c9
3 changed files with 36 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
e2e/nfs.go
View File

@ -408,7 +408,24 @@ var _ = Describe("nfs", func() {
}) })
By("create a storageclass with pool and a PVC then bind it to an app", func() { By("create a storageclass with pool and a PVC then bind it to an app", func() {
err := createNFSStorageClass(f.ClientSet, f, false, nil) err := createNFSStorageClass(f.ClientSet, f, true, nil)
if err != nil {
framework.Failf("failed to create NFS storageclass: %v", err)
}
err = validatePVCAndAppBinding(pvcPath, appPath, f)
if err != nil {
framework.Failf("failed to validate NFS pvc and application binding: %v", err)
}
err = deleteResource(nfsExamplePath + "storageclass.yaml")
if err != nil {
framework.Failf("failed to delete NFS storageclass: %v", err)
}
})
By("create a storageclass with sys,krb5i security and a PVC then bind it to an app", func() {
err := createNFSStorageClass(f.ClientSet, f, false, map[string]string{
"secTypes": "sys,krb5i",
})
if err != nil { if err != nil {
framework.Failf("failed to create NFS storageclass: %v", err) framework.Failf("failed to create NFS storageclass: %v", err)
} }

6
examples/nfs/storageclass.yaml
View File

@ -45,5 +45,11 @@ parameters:
# If omitted, defaults to "csi-vol-". # If omitted, defaults to "csi-vol-".
volumeNamePrefix: nfs-export- volumeNamePrefix: nfs-export-
# (optional) Security requirements for the NFS-export. Valid flavours
# include: none, sys, krb5, krb5i and krb5p. The <sectype-list> is a comma
# delimited string, for example "sys,krb5".
# This option is available with Ceph v17.2.6 and newer.
# secTypes: <sectype-list>
reclaimPolicy: Delete reclaimPolicy: Delete
allowVolumeExpansion: true allowVolumeExpansion: true

14
internal/nfs/controller/volume.go
View File

@ -131,6 +131,7 @@ func (nv *NFSVolume) CreateExport(backend *csi.Volume) error {
fs := backend.VolumeContext["fsName"] fs := backend.VolumeContext["fsName"]
nfsCluster := backend.VolumeContext["nfsCluster"] nfsCluster := backend.VolumeContext["nfsCluster"]
path := backend.VolumeContext["subvolumePath"] path := backend.VolumeContext["subvolumePath"]
secTypes := backend.VolumeContext["secTypes"]
err := nv.setNFSCluster(nfsCluster) err := nv.setNFSCluster(nfsCluster)
if err != nil { if err != nil {
@ -142,12 +143,21 @@ func (nv *NFSVolume) CreateExport(backend *csi.Volume) error {
return fmt.Errorf("failed to get NFSAdmin: %w", err) return fmt.Errorf("failed to get NFSAdmin: %w", err)
} }
_, err = nfsa.CreateCephFSExport(nfs.CephFSExportSpec{ export := nfs.CephFSExportSpec{
FileSystemName: fs, FileSystemName: fs,
ClusterID: nfsCluster, ClusterID: nfsCluster,
PseudoPath: nv.GetExportPath(), PseudoPath: nv.GetExportPath(),
Path: path, Path: path,
}) }
if secTypes != "" {
export.SecType = []nfs.SecType{}
for _, secType := range strings.Split(secTypes, ",") {
export.SecType = append(export.SecType, nfs.SecType(secType))
}
}
_, err = nfsa.CreateCephFSExport(export)
switch { switch {
case err == nil: case err == nil:
return nil return nil