Skip to content

feat(nfs-server): change shared filesystem ownership and mode#125

Merged
mittachaitu merged 20 commits intoopenebs-archive:developfrom
niladrih:permissions
Dec 14, 2021
Merged

feat(nfs-server): change shared filesystem ownership and mode#125
mittachaitu merged 20 commits intoopenebs-archive:developfrom
niladrih:permissions

Conversation

@niladrih
Copy link
Copy Markdown
Member

@niladrih niladrih commented Nov 9, 2021

Why is this PR required? What issue does it fix?:
Resolves: #122
This PR allows a user to change the ownership and file mode parameters of the filesystem shared using NFS.

What this PR does?:
This PR introduces the FilePermissions cas.openebs.io/config PersistentVolumeClaim key. The data keys included within this config key are UID, GID and mode. The openebs-nfs-provisioner process sets the values from these PersistentVolumeClaim keys into the ENVs FILEPERMISSIONS_UID, FILEPERMISSIONS_GID and FILEPERMISSIONS_MODE.

The /nfs-server-container/nfsd.sh script issues chmod and chown commands to change the ownership and file mode of the shared filesystem directory (backend volume at /nfsshare). The checking criteria is similar to the Kubernetes fsGroupChangePolicy OnRootMismatch.

NOTE: This also generates logs which announce the deprecation of the FSGID cas.openebs.io/config option in future releases. FSGID-like changes can be accomplished with FilePermissions. Instructions for this have been furnished in the user documentation(#128).

If 'FSGID' is specified, and 'GID' and/or 'mode' FilePermissions keys are also specified, this is treated as an invalid input and provisioning fails. This is done to keep the file permissions strictly declarative.

Sample PersistentVolumeClaim:

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: secure-vol
  annotations:   
    cas.openebs.io/config: |
      - name: FilePermissions
        data:
          UID: "1000"
          GID: "2000"
          mode: "0744"
spec:
  storageClassName: openebs-kernel-nfs
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Gi

Does this PR require any upgrade changes?:
No.

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Nov 9, 2021

Codecov Report

Merging #125 (dc70a26) into develop (3ce5a7d) will increase coverage by 0.32%.
The diff coverage is 52.68%.

Impacted file tree graph

@@             Coverage Diff             @@
##           develop     #125      +/-   ##
===========================================
+ Coverage    49.79%   50.12%   +0.32%     
===========================================
  Files           38       38              
  Lines         2705     2789      +84     
===========================================
+ Hits          1347     1398      +51     
- Misses        1255     1285      +30     
- Partials       103      106       +3     
Impacted Files Coverage Δ
provisioner/provisioner_kernel_nfs_server.go 0.00% <0.00%> (ø)
provisioner/config.go 31.51% <54.79%> (+21.61%) ⬆️
provisioner/helper_kernel_nfs_server.go 72.23% <100.00%> (+0.81%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3ce5a7d...dc70a26. Read the comment docs.

@niladrih niladrih force-pushed the permissions branch 2 times, most recently from 3b6b082 to bee14ca Compare November 19, 2021 16:28
Copy link
Copy Markdown
Contributor

@mittachaitu mittachaitu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good but good to have the following things:

  • Integration test for a new feature
  • Documentation and helm changes as separate PR(also update vanilla YAML's about new feature with comments). If we have a document along with this PR then users may assume feature exists in a released version which don't want to happen, so good to have different PR for release related work.

Copy link
Copy Markdown
Contributor

@mittachaitu mittachaitu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Provided few minnor comments

@niladrih
Copy link
Copy Markdown
Member Author

niladrih commented Dec 9, 2021

This PR depends on #129 .

@niladrih niladrih force-pushed the permissions branch 5 times, most recently from 2b6c514 to 8b2aa83 Compare December 10, 2021 08:30
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
…tartup script

Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
…unnecessary comparisons, add unit tests

Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
…imize logic in dataConfigToMap() method, log message in GetFsMode() and GetFsGID() methods, nil pointer check in BDD test, remove unused method

Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
@niladrih niladrih force-pushed the permissions branch 2 times, most recently from a239356 to 6d4c330 Compare December 13, 2021 08:18
@niladrih niladrih requested a review from mittachaitu December 13, 2021 09:28
Copy link
Copy Markdown
Contributor

@mittachaitu mittachaitu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Allow setting UID for a OpenEBS NFS PVC

6 participants