Skip to content

Commit dbe24dc

Browse files
niladrihniladrih
authored
feat(nfs-server): change shared filesystem ownership and mode (#125)
This PR introduces the FilePermissions `cas.openebs.io/config` PersistentVolumeClaim key. The data keys included within this config key are UID, GID, and mode. The openebs-nfs-provisioner process sets the values from these PersistentVolumeClaim keys into the ENVs FILEPERMISSIONS_UID, FILEPERMISSIONS_GID and FILEPERMISSIONS_MODE. The /nfs-server-container/nfsd.sh script issues chmod and chown commands to change the ownership and file mode of the shared filesystem directory (backend volume at /nfsshare). The checking criteria is similar to the Kubernetes fsGroupChangePolicy OnRootMismatch. NOTE: This also generates logs that announce the deprecation of the FSGID cas.openebs.io/config option in future releases. FSGID-like changes can be accomplished with file permissions. Instructions for this have been furnished in the user documentation(#128). If 'FSGID' is specified, and 'GID' and/or 'mode' FilePermissions keys are also specified, this is treated as an invalid input and provisioning fail. This is done to keep the file permissions strictly declarative. Signed-off-by: Niladri Halder <niladri.halder@mayadata.io>
1 parent 3ce5a7d commit dbe24dc

18 files changed

+844
-31
lines changed

‎Makefile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -193,9 +193,9 @@ license-check:
193193
@echo
194194

195195
.PHONY: sanity-test
196-
sanity-test: sanity-test
196+
sanity-test:
197197
@echo "--> Running sanity test";
198-
go test -v -timeout 60m ./tests/...
198+
go test -v -timeout 120m ./tests/...
199199

200200
.PHONY: push
201201
push:

‎deploy/kubectl/busybox-openebs-rwx.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,15 @@ apiVersion: v1
33
kind: PersistentVolumeClaim
44
metadata:
55
name: openebs-rwx-pvc
6+
#annotaions:
7+
# cas.openebs.io/config: |
8+
# FilePermissions can be used to modify the owner, group
9+
# and file modes of the shared NFS filesystem.
10+
# - name: FilePermissions
11+
# data:
12+
# UID: "1000"
13+
# GID: "2000"
14+
# mode: "0744"
615
spec:
716
accessModes:
817
- ReadWriteMany

‎deploy/kubectl/openebs-nfs-provisioner.yaml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,9 @@ metadata:
220220
# value: 30
221221
# FSGID defines the group permissions of NFS Volume. If it is set
222222
# then non-root applications should add FSGID value under pod
223-
# Suplemental groups
223+
# Suplemental groups.
224+
# The FSGID config key is being deprecated. Please use the
225+
# FilePermissions config key on the PersistentVolumeClaim instead.
224226
#- name: FSGID
225227
# value: "120"
226228
provisioner: openebs.io/nfsrwx

‎go.sum

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,7 @@ github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1
187187
github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
188188
github.com/edsrzf/mmap-go v1.0.0/go.mod h1:YO35OhQPt3KJa3ryjFM5Bs14WD66h8eGKpfaBNrHW5M=
189189
github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
190+
github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153 h1:yUdfgN0XgIJw7foRItutHYUIhlcKzcSf5vDpdhQAKTc=
190191
github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
191192
github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
192193
github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
@@ -206,6 +207,7 @@ github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoD
206207
github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
207208
github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
208209
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
210+
github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
209211
github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
210212
github.com/fvbommel/sortorder v1.0.1/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0=
211213
github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -300,6 +302,7 @@ github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zV
300302
github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
301303
github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
302304
github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
305+
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
303306
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
304307
github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
305308
github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -472,10 +475,12 @@ github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxv
472475
github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
473476
github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
474477
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
478+
github.com/kr/pretty v0.2.0 h1:s5hAObm+yFO5uHYt5dYjxi2rXrsnmRpJx4OYvIWUaQs=
475479
github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
476480
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
477481
github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
478482
github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
483+
github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
479484
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
480485
github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
481486
github.com/libopenstorage/openstorage v1.0.0/go.mod h1:Sp1sIObHjat1BeXhfMqLZ14wnOzEhNx2YQedreMcUyc=
@@ -886,6 +891,7 @@ golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJ
886891
golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
887892
golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
888893
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
894+
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e h1:vcxGaoTs7kV8m5Np9uUNQin4BrLOthgV7252N8V+FwY=
889895
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
890896
golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
891897
golang.org/x/sys v0.0.0-20171026204733-164713f0dfce/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1093,6 +1099,7 @@ gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4
10931099
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
10941100
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
10951101
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
1102+
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
10961103
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
10971104
gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
10981105
gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=

‎nfs-server-container/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ FROM alpine:latest
1515
#LABEL branch "master"
1616
COPY Dockerfile README.md /
1717

18-
RUN apk add --no-cache --update --verbose nfs-utils bash iproute2 && \
18+
RUN apk add --no-cache --update --verbose nfs-utils bash iproute2 coreutils && \
1919
rm -rf /var/cache/apk /tmp /sbin/halt /sbin/poweroff /sbin/reboot && \
2020
mkdir -p /var/lib/nfs/rpc_pipefs /var/lib/nfs/v4recovery && \
2121
echo "rpc_pipefs /var/lib/nfs/rpc_pipefs rpc_pipefs defaults 0 0" >> /etc/fstab && \

‎nfs-server-container/nfsd.sh

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,94 @@ fi
122122
set -uo pipefail
123123
IFS=$'\n\t'
124124

125+
# Modify the shared directory (${SHARED_DIRECTORY}) file user owner
126+
# Does not support more than one shared directory
127+
if [ -n "${FILEPERMISSIONS_UID}" ]; then
128+
# These variables will be used to handle errors
129+
UID_ERROR=""
130+
CHOWN_UID_ERROR=""
131+
# Validating input UID value
132+
# Errors if UID is not a decimal number
133+
targetUID=$(printf %d ${FILEPERMISSIONS_UID}) || UID_ERROR=$?
134+
if [ -n "${UID_ERROR}" ]; then
135+
echo "user change error: Invalid UID ${FILEPERMISSIONS_UID}"
136+
exit 1
137+
fi
138+
139+
presentUID=$(stat ${SHARED_DIRECTORY} --printf=%u)
140+
141+
# OnRootMismatch-like check
142+
if [ "$presentUID" -ne "$targetUID" ]; then
143+
chown -R $targetUID ${SHARED_DIRECTORY} || CHOWN_UID_ERROR=$?
144+
if [ -n "${CHOWN_UID_ERROR}" ]; then
145+
echo "user change error: Failed to change user owner of ${SHARED_DIRECTORY}"
146+
exit 1
147+
fi
148+
149+
echo "chown user command succeeded"
150+
fi
151+
fi
152+
153+
# Modify the shared directory (${SHARED_DIRECTORY}) file group owner
154+
# Does not support more than one shared directory
155+
if [ -n "${FILEPERMISSIONS_GID}" ]; then
156+
# These variables will be used to handle errors
157+
GID_ERROR=""
158+
CHOWN_GID_ERROR=""
159+
# Validating input GID value
160+
# Errors if GID is not a decimal number
161+
targetGID=$(printf %d ${FILEPERMISSIONS_GID}) || GID_ERROR=$?
162+
if [ -n "${GID_ERROR}" ]; then
163+
echo "group change error: Invalid GID ${FILEPERMISSIONS_GID}"
164+
exit 1
165+
fi
166+
167+
presentGID=$(stat ${SHARED_DIRECTORY} --printf=%g)
168+
169+
# OnRootMismatch-like check
170+
if [ "$presentGID" -ne "$targetGID" ]; then
171+
chown -R :${targetGID} ${SHARED_DIRECTORY} || CHOWN_GID_ERROR=$?
172+
if [ -n "${CHOWN_GID_ERROR}" ]; then
173+
echo "group change error: Failed to change group owner of ${SHARED_DIRECTORY}"
174+
exit 1
175+
fi
176+
177+
echo "chown group command succeeded"
178+
fi
179+
fi
180+
181+
# Modify the shared directory (${SHARED_DIRECTORY}) file permissions
182+
# Does not support more than one shared directory
183+
if [ -n "${FILEPERMISSIONS_MODE}" ]; then
184+
# These variables will be used to handle errors
185+
TEST_CHMOD_ERROR=""
186+
CHMOD_ERROR=""
187+
188+
# 'chmod -c' output is a non-empty string if the file mode changes
189+
# The TEST_CHMOD_OUT variable is used to capture this string
190+
TEST_CHMOD_OUT=$(chmod ${FILEPERMISSIONS_MODE} ${SHARED_DIRECTORY} -c) || TEST_CHMOD_ERROR=$?
191+
# If the command fails, the specified mode is invalid
192+
if [ -n "${TEST_CHMOD_ERROR}" ]; then
193+
echo "mode change error: chmod test command failed. 'mode' value ${FILEPERMISSIONS_MODE} might be invalid"
194+
exit 1
195+
fi
196+
197+
# If the TEST_CHMOD_OUT is not empty, then there is a root mismatch
198+
# (Similar to OnRootMismatch)
199+
# Thus a recursive chmod is issued if there is root mismatch
200+
# NOTE: This test won't work if we want to handle root mismatch in
201+
# any other way than the execution of the recursive chmod
202+
if [ -n "${TEST_CHMOD_OUT}" ]; then
203+
chmod -R ${FILEPERMISSIONS_MODE} ${SHARED_DIRECTORY} || CHMOD_ERROR=$?
204+
if [ -n "${CHMOD_ERROR}" ]; then
205+
echo "mode change error: Failed to change file mode of ${SHARED_DIRECTORY}"
206+
exit 1
207+
fi
208+
209+
echo "chmod command succeeded"
210+
fi
211+
fi
212+
125213
# This loop runs till until we've started up successfully
126214
while true; do
127215

0 commit comments

Comments
 (0)