Commit Graph

39 Commits

Author SHA1 Message Date
Niels de Vos
dd668e59f1 Address security concerns reported by 'gosec'
gosec reports several issues, none of them looks very critical. With
this change the following concerns have been addressed:

[pkg/cephfs/nodeserver.go:229] - G302: Expect file permissions to be 0600 or less (Confidence: HIGH, Severity: MEDIUM)
  > os.Chmod(targetPath, 0777)

[pkg/cephfs/util.go:39] - G204: Subprocess launched with variable (Confidence: HIGH, Severity: MEDIUM)
  > exec.Command(program, args...)

[pkg/rbd/nodeserver.go:156] - G302: Expect file permissions to be 0600 or less (Confidence: HIGH, Severity: MEDIUM)
  > os.Chmod(stagingTargetPath, 0777)

[pkg/rbd/nodeserver.go:205] - G302: Expect file permissions to be 0600 or less (Confidence: HIGH, Severity: MEDIUM)
  > os.OpenFile(mountPath, os.O_CREATE|os.O_RDWR, 0750)

[pkg/rbd/rbd_util.go:797] - G304: Potential file inclusion via variable (Confidence: HIGH, Severity: MEDIUM)
  > ioutil.ReadFile(fPath)

[pkg/util/cephcmds.go:35] - G204: Subprocess launched with variable (Confidence: HIGH, Severity: MEDIUM)
  > exec.Command(program, args...)

[pkg/util/credentials.go:47] - G104: Errors unhandled. (Confidence: HIGH, Severity: LOW)
  > os.Remove(tmpfile.Name())

[pkg/util/credentials.go:92] - G104: Errors unhandled. (Confidence: HIGH, Severity: LOW)
  > os.Remove(cr.KeyFile)

[pkg/util/pidlimit.go:74] - G304: Potential file inclusion via variable (Confidence: HIGH, Severity: MEDIUM)
  > os.Open(pidsMax)

URL: https://github.com/securego/gosec
Signed-off-by: Niels de Vos <ndevos@redhat.com>
2019-09-04 11:48:37 +00:00
Daniel-Pivonka
01a78cace5 switch to cephfs, utils, and csicommon to new loging system
Signed-off-by: Daniel-Pivonka <dpivonka@redhat.com>
2019-08-29 14:04:31 +00:00
Madhu Rajanna
f4c80dec9a Implement NodeStage and NodeUnstage for rbd
in NodeStage RPC call  we  have to map the
device to the node plugin and make  sure  the
the device will be mounted to  the global path

in  nodeUnstage request unmount the device from
global path and unmap the device

if the volume mode is block  we will be creating
a file inside a stageTargetPath  and it will be
considered  as the global path

Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
2019-07-24 12:49:21 +00:00
Poornima G
0d566ee30c Backward compatibility for deleting and mounting old volumes
Signed-off-by: Poornima G <pgurusid@redhat.com>
2019-07-12 05:42:41 +00:00
Poornima G
32ea550e3a Modify CephFs provisioner to use the ceph mgr commands
Currently CephFs provisioner mounts the ceph filesystem
and creates a subdirectory as a part of provisioning the
volume. Ceph now supports commands to provision fs subvolumes,
hance modify the provisioner to use ceph mgr commands to
(de)provision fs subvolumes.

Signed-off-by: Poornima G <pgurusid@redhat.com>
2019-07-12 05:42:41 +00:00
Madhu Rajanna
09f126691c Add nil check for process
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
2019-07-08 12:11:53 +00:00
ShyamsundarR
c4a3675cec Move locks to more granular locking than CPU count based
As detailed in issue #279, current lock scheme has hash
buckets that are count of CPUs. This causes a lot of contention
when parallel requests are made to the CSI plugin. To reduce
lock contention, this commit introduces granular locks per
identifier.

The commit also changes the timeout for gRPC requests to Create
and Delete volumes, as the current timeout is 10s (kubernetes
documentation says 15s but code defaults are 10s). A virtual
setup takes about 12-15s to complete a request at times, that leads
to unwanted retries of the same request, hence the increased
timeout to enable operation completion with minimal retries.

Tests to create PVCs before and after these changes look like so,

Before:
Default master code + sidecar provisioner --timeout option set
to 30 seconds

20 PVCs
Creation: 3 runs, 396/391/400 seconds
Deletion: 3 runs, 218/271/118 seconds
  - Once was stalled for more than 8 minutes and cancelled the run

After:
Current commit + sidecar provisioner --timeout option set to 30 sec
20 PVCs
Creation: 3 runs, 42/59/65 seconds
Deletion: 3 runs, 32/32/31 seconds

Fixes: #279
Signed-off-by: ShyamsundarR <srangana@redhat.com>
2019-07-01 14:10:14 +00:00
Madhu Rajanna
74c1a75828 Fix error string as per golang standard
Error string should not be capatalized
https://github.com/golang/go/wiki/CodeReviewComments#error-strings

Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
2019-06-10 11:10:35 +05:30
Humble Devassy Chirammal
e16f246f83
Merge pull request #408 from humblec/validate-paths
Add staging target path validation to nodeserver
2019-06-07 11:37:37 +05:30
Humble Chirammal
3e2d2787b6 Add staging target path validation to nodeserver
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
2019-06-06 20:38:53 +05:30
ShyamsundarR
b9cd0e18ad Make CephFS plugin stateless reusing RADOS based journal scheme
This is a part of the stateless set of commits for CephCSI.

This commit removes the dependency on config maps to store cephFS provisioned
volumes, and instead relies on RADOS based objects and keys, and required
CSI VolumeID encoding to detect the provisioned volumes.

Changes:
- Provide backward compatibility to provisioned volumes by older plugin versions (1.0.0 or older)
- Remove Create/Delete support for statically provisioned volumes (fixes #382)
- Added namespace support to RADOS OMaps and used the same to store RADOS CSI objects and keys in the CephFS metadata pool
- Added support to mention fsname for CephFS provisioning (fixes #359)
- Changed field name in CSI Identifier to 'location', to denote a pool or fscid
- Updated mounter cache to use new scheme
- Required Helm manifests are updated
- Required documentation and other manifests are updated
- Made driver option 'metadatastorage' as optional, as fresh installs do not need to specify the same

Testing done:
- Create/Mount/Delete PVC
- Create/Delete 5 PVCs
- Mount version 1.0.0 PVC
- Delete version 1.0.0 PV
- Mount Statically defined PV/PVC/Pod
- Mount Statically defined version 1.0.0 PV/PVC/Pod
- Delete Statically defined version 1.0.0 PV/PVC/Pod
- Node restart when mounted to test mountcache
- Use InstanceID other than 'default'
- RBD basic round of tests, as namespace is added to OMaps
- csitest against ceph-fs plugin
  - NOTE: CephFS plugin still does not detect and address already created
  volumes but of a different size
- Test not providing any value to the metadata storage parameter

Signed-off-by: ShyamsundarR <srangana@redhat.com>
2019-05-30 06:20:35 -04:00
Madhu Rajanna
f60a07ae82 update vendor to latest kubernetes 1.14.0
some of the kubernetes independent
packages are moved out of the tree to
new projects.

Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
2019-05-14 06:56:56 +00:00
wilmardo
891daa9375 Replaces the references to the Kubernete Authors with the Ceph-CSI authors 2019-04-03 11:14:08 +02:00
gman
60588d8968 cephfs/volume: create/delete-volume idempotency checks 2019-02-26 11:06:16 +01:00
Madhu Rajanna
68e69502e8 remove secret and key from logging
Signed-off-by: Madhu Rajanna <madhupr007@gmail.com>
2019-02-21 17:05:24 +05:30
Madhu Rajanna
6fbde110cd skip redundant error check
correct misspelled  word

Signed-off-by: Madhu Rajanna <mrajanna@redhat.com>
2019-02-18 17:16:59 +05:30
gman
b3944f3121 cephfs exec: read stdout and stderr separately 2019-02-14 13:55:51 +00:00
Humble Chirammal
c9da8469ad migrate cephfs code to use klog instead of glog
Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
2019-02-05 12:09:04 +00:00
Madhu Rajanna
ca2e475296 Fix gometalinter issues
Signed-off-by: Madhu Rajanna <mrajanna@redhat.com>
2019-01-29 11:23:50 +05:30
Madhu Rajanna
1a246f7bf3 simplify the error check
Signed-off-by: Madhu Rajanna <mrajanna@redhat.com>
2019-01-25 14:16:03 +05:30
Madhu Rajanna
36f99e36ca Fix unparam issues
Signed-off-by: Madhu Rajanna <mrajanna@redhat.com>
2019-01-25 14:16:03 +05:30
Madhu Rajanna
284c5801c3 Fix golint issue
pkg/rbd/rbd.go:67:65⚠️ exported func NewNodeServer
returns unexported type *rbd.nodeServer, which can be
annoying to use (golint)

Signed-off-by: Madhu Rajanna <mrajanna@redhat.com>
2019-01-25 14:16:03 +05:30
Madhu Rajanna
1d11d0acc3 Fix lint issues
Signed-off-by: Madhu Rajanna <mrajanna@redhat.com>
2019-01-25 14:15:25 +05:30
Madhu Rajanna
15b5b0112e rename Id to ID to fix lint issue
Signed-off-by: Madhu Rajanna <mrajanna@redhat.com>
2019-01-25 14:14:48 +05:30
Madhu Rajanna
e42e66ff30 user errors.New if error formatting is not required
Signed-off-by: Madhu Rajanna <mrajanna@redhat.com>
2019-01-16 18:54:13 +05:30
Madhu Rajanna
9ddc265c10 reject block volume creation in cephfs
Signed-off-by: Madhu Rajanna <mrajanna@redhat.com>
2019-01-16 18:17:14 +05:30
Mike Cronce
d9fbdeb517 pkg/cephfs: Use request name to generate deterministic volume names 2018-12-04 21:39:00 -05:00
Mike Cronce
41b30eb6c2 pkg/cephfs: Updated for new versions of CSI/Kubernetes dependencies 2018-11-24 13:48:36 -05:00
gman
9c3389d784 cephfs/util: log execCommandJson; cache mount.New() instance 2018-08-28 10:19:28 +02:00
gman
c515a013d3 cephfs: volumemounter probe
The driver will now probe for either ceph fuse/kernel every time
it's about to mount a cephfs volume.

This also affects CreateVolume/DeleteVolume where the mounting
was hard-coded to ceph kernel client till now - mounter configuration
and probing are now honored.
2018-08-14 11:19:41 +02:00
Róbert Vašek
069140e74a
Merge pull request #65 from clkao/execCommandJson-error
Log error output for execCommandJson as well.
2018-08-08 17:58:52 +02:00
Chia-liang Kao
a1de128a81 Log error output for execCommandJson as well. 2018-08-08 23:39:19 +08:00
gman
1c38412e39 cephfs: CSI 0.3.0; NodeStageVolume/NodeUnstageVolume; refactoring 2018-08-08 14:47:25 +02:00
Kenjiro Nakayama
e8784ec094 Logging command and options for debug friendly
Some commands were executed in ceph-csi, but users do not know what
commands with what options were executed. Hence, it is difficult to
debug once the command did not work fine.

This patch adds logging what commmand and options are executed.
2018-07-31 15:31:11 +09:00
gman
2fcc252f5c cephfs: pass volume UUIDs where needed 2018-06-12 17:05:42 +02:00
gman
58eb8d1de7 updated cephfs/util 2018-04-13 14:34:48 +02:00
gman
cb36c9e4c8 cephfs: code cleaning 2018-03-26 15:00:28 +02:00
gman
aa4130865c cephfs/nodeserver: read credentials from Secret 2018-03-20 16:40:30 +01:00
gman
1c1b0eab1e WIP cephfs CSI plugin 2018-03-05 13:21:30 +01:00