Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(nfs-server): change shared filesystem ownership and mode #125

Merged
merged 20 commits into from
Dec 14, 2021

Conversation

niladrih
Copy link
Member

@niladrih niladrih commented Nov 9, 2021

Why is this PR required? What issue does it fix?:
Resolves: #122
This PR allows a user to change the ownership and file mode parameters of the filesystem shared using NFS.

What this PR does?:
This PR introduces the FilePermissions cas.openebs.io/config PersistentVolumeClaim key. The data keys included within this config key are UID, GID and mode. The openebs-nfs-provisioner process sets the values from these PersistentVolumeClaim keys into the ENVs FILEPERMISSIONS_UID, FILEPERMISSIONS_GID and FILEPERMISSIONS_MODE.

The /nfs-server-container/nfsd.sh script issues chmod and chown commands to change the ownership and file mode of the shared filesystem directory (backend volume at /nfsshare). The checking criteria is similar to the Kubernetes fsGroupChangePolicy OnRootMismatch.

NOTE: This also generates logs which announce the deprecation of the FSGID cas.openebs.io/config option in future releases. FSGID-like changes can be accomplished with FilePermissions. Instructions for this have been furnished in the user documentation(#128).

If 'FSGID' is specified, and 'GID' and/or 'mode' FilePermissions keys are also specified, this is treated as an invalid input and provisioning fails. This is done to keep the file permissions strictly declarative.

Sample PersistentVolumeClaim:

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: secure-vol
  annotations:   
    cas.openebs.io/config: |
      - name: FilePermissions
        data:
          UID: "1000"
          GID: "2000"
          mode: "0744"
spec:
  storageClassName: openebs-kernel-nfs
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Gi

Does this PR require any upgrade changes?:
No.

@codecov-commenter
Copy link

codecov-commenter commented Nov 9, 2021

Codecov Report

Merging #125 (dc70a26) into develop (3ce5a7d) will increase coverage by 0.32%.
The diff coverage is 52.68%.

Impacted file tree graph

@@             Coverage Diff             @@
##           develop     #125      +/-   ##
===========================================
+ Coverage    49.79%   50.12%   +0.32%     
===========================================
  Files           38       38              
  Lines         2705     2789      +84     
===========================================
+ Hits          1347     1398      +51     
- Misses        1255     1285      +30     
- Partials       103      106       +3     
Impacted Files Coverage Δ
provisioner/provisioner_kernel_nfs_server.go 0.00% <0.00%> (ø)
provisioner/config.go 31.51% <54.79%> (+21.61%) ⬆️
provisioner/helper_kernel_nfs_server.go 72.23% <100.00%> (+0.81%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3ce5a7d...dc70a26. Read the comment docs.

@niladrih niladrih force-pushed the permissions branch 2 times, most recently from 3b6b082 to bee14ca Compare November 19, 2021 16:28
Copy link
Contributor

@mittachaitu mittachaitu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good but good to have the following things:

  • Integration test for a new feature
  • Documentation and helm changes as separate PR(also update vanilla YAML's about new feature with comments). If we have a document along with this PR then users may assume feature exists in a released version which don't want to happen, so good to have different PR for release related work.

provisioner/config.go Show resolved Hide resolved
provisioner/config.go Outdated Show resolved Hide resolved
provisioner/config.go Outdated Show resolved Hide resolved
provisioner/config.go Show resolved Hide resolved
provisioner/config.go Outdated Show resolved Hide resolved
provisioner/config.go Show resolved Hide resolved
Copy link
Contributor

@mittachaitu mittachaitu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Provided few minnor comments

deploy/kubectl/busybox-openebs-rwx.yaml Outdated Show resolved Hide resolved
tests/k8s_utils.go Outdated Show resolved Hide resolved
tests/nfs_server_file_permissions_test.go Outdated Show resolved Hide resolved
tests/nfs_server_file_permissions_test.go Outdated Show resolved Hide resolved
provisioner/config.go Outdated Show resolved Hide resolved
provisioner/config.go Outdated Show resolved Hide resolved
tests/utils.go Outdated Show resolved Hide resolved
tests/nfs_server_file_permissions_test.go Show resolved Hide resolved
tests/nfs_server_file_permissions_test.go Show resolved Hide resolved
tests/utils.go Outdated Show resolved Hide resolved
@niladrih
Copy link
Member Author

niladrih commented Dec 9, 2021

This PR depends on #129 .

@niladrih niladrih force-pushed the permissions branch 5 times, most recently from 2b6c514 to 8b2aa83 Compare December 10, 2021 08:30
Signed-off-by: Niladri Halder <[email protected]>
Signed-off-by: Niladri Halder <[email protected]>
…unnecessary comparisons, add unit tests

Signed-off-by: Niladri Halder <[email protected]>
Signed-off-by: Niladri Halder <[email protected]>
Signed-off-by: Niladri Halder <[email protected]>
Signed-off-by: Niladri Halder <[email protected]>
…imize logic in dataConfigToMap() method, log message in GetFsMode() and GetFsGID() methods, nil pointer check in BDD test, remove unused method

Signed-off-by: Niladri Halder <[email protected]>
Signed-off-by: Niladri Halder <[email protected]>
@niladrih niladrih force-pushed the permissions branch 2 times, most recently from a239356 to 6d4c330 Compare December 13, 2021 08:18
@niladrih niladrih requested a review from mittachaitu December 13, 2021 09:28
Copy link
Contributor

@mittachaitu mittachaitu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Allow setting UID for a OpenEBS NFS PVC
3 participants