Skip to content

Commit 0f4fd70

Browse files
ShaunaDiazShaunaDiaz
authored
Merge pull request #81957 from aravipra/OSDOCS-4200
OSDOCS-4200: permission modified for multiple pods on same node with…
2 parents 0c9ef95 + 8f5ea6c commit 0f4fd70

4 files changed

+194
-0
lines changed

‎microshift_storage/understanding-persistent-storage-microshift.adoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ toc::[]
88

99
Managing storage is a distinct problem from managing compute resources. {microshift-short} uses the Kubernetes persistent volume (PV) framework to allow cluster administrators to provision persistent storage for a cluster. Developers can use persistent volume claims (PVCs) to request PV resources without having specific knowledge of the underlying storage infrastructure.
1010

11+
include::modules/microshift-control-permissions-security-context-constraints.adoc[leveloffset=+1]
12+
1113
include::modules/storage-persistent-storage-overview.adoc[leveloffset=+1]
1214

1315
[id="additional-resources_understanding-persistent-storage-microshift_{context}"]
@@ -23,6 +25,10 @@ include::modules/storage-persistent-storage-reclaim.adoc[leveloffset=+2]
2325

2426
include::modules/storage-persistent-storage-pv.adoc[leveloffset=+1]
2527

28+
include::modules/microshift-pv-rwo-access-mode-permission.adoc[leveloffset=+1]
29+
30+
include::modules/microshift-checking-pods-mismatch.adoc[leveloffset=+1]
31+
2632
[role="_additional-resources"]
2733
.Additional resources
2834
* link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/managing_file_systems/mounting-file-systems_managing-file-systems#common-mount-options_mounting-file-systems[Common mount options]

‎modules/microshift-checking-pods-mismatch.adoc

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_storage/understanding-persistent-storage-microshift.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="microshift-checking-pods-mismatch_{context}"]
7+
= Checking the pods for mismatch
8+
9+
Check if the pods have a mismatch. Update the SELinux context if a mismatch is found by using the following procedure.
10+
11+
[IMPORTANT]
12+
====
13+
* Replace `_<pod_name_A>_` with the name of the first pod in the following procedure.
14+
* Replace `_<pod_name_B>_` with the name of the second pod in the following procedure.
15+
* Replace `_<PVC_mountpoint>_` with the mount point within the pods.
16+
====
17+
18+
.Procedure
19+
20+
. List the mount point within the first pod by running the following command:
21+
+
22+
[source,terminal]
23+
[subs="+quotes"]
24+
----
25+
$ oc get pods -n _<pod_name_A>_ -ojsonpath='{.spec.containers[*].volumeMounts[*].mountPath}' <1>
26+
----
27+
<1> Replace `_<pod_name_A>_` with the name of the first pod.
28+
+
29+
.Example output
30+
[source,terminal]
31+
----
32+
/files /var/run/secrets/kubernetes.io/serviceaccount
33+
----
34+
. List the mount point within the second pod by running the following command:
35+
+
36+
[source,terminal]
37+
[subs="+quotes"]
38+
----
39+
$ oc get pods -n _<pod_name_B>_ -ojsonpath='{.spec.containers[*].volumeMounts[*].mountPath}' <1>
40+
----
41+
<1> Replace `_<pod_name_B>_` with the name of the second pod.
42+
+
43+
.Example output
44+
[source,terminal]
45+
----
46+
/files /var/run/secrets/kubernetes.io/serviceaccount
47+
----
48+
. Check the context and permissions inside the first pod by running the following command:
49+
+
50+
[source,terminal]
51+
[subs="+quotes"]
52+
----
53+
$ oc rsh _<pod_name_A>_ ls -lZah _<PVC_mountpoint>_ <1>
54+
----
55+
<1> Replace `_<pod_name_A>_` with the name of the first pod and replace `_<PVC_mountpoint>_` with the mount point within the first pod.
56+
+
57+
.Example output
58+
[source,terminal]
59+
----
60+
total 12K
61+
dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c398,c806 40 Feb 17 13:36 .
62+
dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c398,c806 40 Feb 17 13:36 ..
63+
[...]
64+
----
65+
. Check the context and permissions inside the second pod by running the following command:
66+
+
67+
[source,terminal]
68+
[subs="+quotes"]
69+
----
70+
$ oc rsh _<pod_name_B>_ ls -lZah _<PVC_mountpoint>_ <1>
71+
----
72+
<1> Replace `_<pod_name_B>_` with the name of the second pod and replace `_<PVC_mountpoint>_` with the mount point within the second pod.
73+
+
74+
.Example output
75+
[source,terminal]
76+
----
77+
total 12K
78+
dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c15,c25 40 Feb 17 13:34 .
79+
dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c15,c25 40 Feb 17 13:34 ..
80+
[...]
81+
----
82+
. Compare both the outputs to check if there is a mismatch of SELinux context.
83+
. When there is a mismatch of the SELinux content, create a new SCC and assign it to both PODs. To create a SCC see link: https://docs.openshift.com/container-platform/4.15/authentication/managing-security-context-constraints.html#security-context-constraints-creating_configuring-internal-oauth[Creating security context constraints].
84+
. Update the SELinuxContext as shown in the following example:
85+
+
86+
.Example output
87+
[source,terminal]
88+
----
89+
[...]
90+
securityContext:privileged
91+
seLinuxOptions:MustRunAs
92+
level: "s0:cXX,cYY"
93+
[...]
94+
----
95+
96+
.Verification
97+
98+
. Verify that the same SCC is assigned to the first pod by running the following command:
99+
+
100+
[source,terminal]
101+
[subs="+quotes"]
102+
----
103+
$ oc describe pod _<pod_name_A>_ |grep -i scc <1>
104+
----
105+
<1> Replace `_<pod_name_A>_` with the name of the first pod.
106+
+
107+
.Example output
108+
[source,terminal]
109+
----
110+
openshift.io/scc: restricted
111+
----
112+
. Verify that the same SCC is assigned to first second pod by running the following command:
113+
+
114+
[source,terminal]
115+
[subs="+quotes"]
116+
----
117+
$ oc describe pod _<pod_name_B>_ |grep -i scc <1>
118+
----
119+
<1> Replace `_<pod_name_B>_` with the name of the second pod.
120+
+
121+
.Example output
122+
[source,terminal]
123+
----
124+
openshift.io/scc: restricted
125+
----
126+
. Verify that the same SELinux label is applied to first pod by running the following command:
127+
+
128+
[source,terminal]
129+
[subs="+quotes"]
130+
----
131+
$ oc exec _<pod_name_A>_ -- ls -laZ _<PVC_mountpoint>_ <1>
132+
----
133+
<1> Replace `_<pod_name_A>_` with the name of the first pod and replace `_<PVC_mountpoint>_` with the mount point within the first pod.
134+
+
135+
.Example output
136+
[source,terminal]
137+
----
138+
total 4
139+
drwxrwsrwx. 2 root 1000670000 system_u:object_r:container_file_t:s0:c10,c26 19 Aug 29 18:17 .
140+
dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c10,c26 61 Aug 29 18:16 ..
141+
-rw-rw-rw-. 1 1000670000 1000670000 system_u:object_r:container_file_t:s0:c10,c26 29 Aug 29 18:17 test1
142+
[...]
143+
----
144+
. Verify that the same SELinux label is applied to second pod by running the following command:
145+
+
146+
[source,terminal]
147+
[subs="+quotes"]
148+
----
149+
$ oc exec _<pod_name_B>_ -- ls -laZ _<PVC_mountpoint>_ <1>
150+
----
151+
<1> Replace `_<pod_name_B>_` with the name of the second pod and replace `_<PVC_mountpoint>_` with the mount point within the second pod.
152+
+
153+
.Example output
154+
[source,terminal]
155+
----
156+
total 4
157+
drwxrwsrwx. 2 root 1000670000 system_u:object_r:container_file_t:s0:c10,c26 19 Aug 29 18:17 .
158+
dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c10,c26 61 Aug 29 18:16 ..
159+
-rw-rw-rw-. 1 1000670000 1000670000 system_u:object_r:container_file_t:s0:c10,c26 29 Aug 29 18:17 test1
160+
[...]
161+
----

‎modules/microshift-control-permissions-security-context-constraints.adoc

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_storage/understanding-persistent-storage-microshift.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id=microshift-control-permissions-security-context-constraints_{context}]
7+
= Control permissions with security context constraints
8+
9+
You can use security context constraints (SCCs) to control permissions for the pods in your cluster. These permissions determine the actions that a pod can perform and what resources it can access. You can use SCCs to define a set of conditions that a pod must run with to be accepted into the system.
10+
11+
For more information see link:https://docs.openshift.com/container-platform/4.16/authentication/managing-security-context-constraints.html[Managing security context constraints].
12+
13+
[IMPORTANT]
14+
====
15+
Only RWO volume mounts are supported. SCC could be blocked if pods are not operating with the SCC contexts.
16+
====

‎modules/microshift-pv-rwo-access-mode-permission.adoc

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_storage/understanding-persistent-storage-microshift.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id=microshift-pv-rwo-access-mode-permission_{context}]
7+
= Persistent volumes with RWO access mode permissions
8+
9+
Persistent volume claims (PVCs) can be created with different access modes. A PVC with the `ReadWriteOnce` (RWO) access mode set allows multiple pods on the same node to read or write into the same PV at once.
10+
11+
There are instances when the pods of the same node are not able to read or write into the same PV. This happens when the pods in the node do not have the same SELinux context. Persistent volumes can be mounted, then later claimed by PVCs, with the RWO access mode.

0 commit comments

Comments
 (0)