Skip to content

Commit b9a26e3

Browse files
aravipraaravipra
committed
OSDOCS-12154: Modularizing multiple pods on same node with RWO access
1 parent e4742fc commit b9a26e3

File tree

4 files changed

+117
-92
lines changed

4 files changed

+117
-92
lines changed

‎microshift_storage/understanding-persistent-storage-microshift.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ include::modules/microshift-pv-rwo-access-mode-permission.adoc[leveloffset=+1]
2929

3030
include::modules/microshift-checking-pods-mismatch.adoc[leveloffset=+1]
3131

32+
include::modules/microshift-updating-pods-mismatch.adoc[leveloffset=+1]
33+
34+
include::modules/microshift-verifying-pods-mismatch.adoc[leveloffset=+1]
35+
3236
[role="_additional-resources"]
3337
.Additional resources
3438
* link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/managing_file_systems/mounting-file-systems_managing-file-systems#common-mount-options_mounting-file-systems[Common mount options]

‎modules/microshift-checking-pods-mismatch.adoc

Lines changed: 13 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,13 @@
66
[id="microshift-checking-pods-mismatch_{context}"]
77
= Checking the pods for mismatch
88

9-
Check if the pods have a mismatch. Update the SELinux context if a mismatch is found by using the following procedure.
9+
Check if the pods have a mismatch by using the following procedure.
1010

1111
[IMPORTANT]
1212
====
13-
* Replace `_<pod_name_A>_` with the name of the first pod in the following procedure.
14-
* Replace `_<pod_name_B>_` with the name of the second pod in the following procedure.
15-
* Replace `_<PVC_mountpoint>_` with the mount point within the pods.
13+
* Replace `_<pod_name_a>_` with the name of the first pod in the following procedure.
14+
* Replace `_<pod_name_b>_` with the name of the second pod in the following procedure.
15+
* Replace `_<pvc_mountpoint>_` with the mount point within the pods.
1616
====
1717

1818
.Procedure
@@ -22,9 +22,9 @@ Check if the pods have a mismatch. Update the SELinux context if a mismatch is f
2222
[source,terminal]
2323
[subs="+quotes"]
2424
----
25-
$ oc get pods -n _<pod_name_A>_ -ojsonpath='{.spec.containers[*].volumeMounts[*].mountPath}' <1>
25+
$ oc get pods -n _<pod_name_a>_ -ojsonpath='{.spec.containers[*].volumeMounts[*].mountPath}' <1>
2626
----
27-
<1> Replace `_<pod_name_A>_` with the name of the first pod.
27+
<1> Replace `_<pod_name_a>_` with the name of the first pod.
2828
+
2929
.Example output
3030
[source,terminal]
@@ -36,9 +36,9 @@ $ oc get pods -n _<pod_name_A>_ -ojsonpath='{.spec.containers[*].volumeMounts[*]
3636
[source,terminal]
3737
[subs="+quotes"]
3838
----
39-
$ oc get pods -n _<pod_name_B>_ -ojsonpath='{.spec.containers[*].volumeMounts[*].mountPath}' <1>
39+
$ oc get pods -n _<pod_name_b>_ -ojsonpath='{.spec.containers[*].volumeMounts[*].mountPath}' <1>
4040
----
41-
<1> Replace `_<pod_name_B>_` with the name of the second pod.
41+
<1> Replace `_<pod_name_b>_` with the name of the second pod.
4242
+
4343
.Example output
4444
[source,terminal]
@@ -50,9 +50,9 @@ $ oc get pods -n _<pod_name_B>_ -ojsonpath='{.spec.containers[*].volumeMounts[*]
5050
[source,terminal]
5151
[subs="+quotes"]
5252
----
53-
$ oc rsh _<pod_name_A>_ ls -lZah _<PVC_mountpoint>_ <1>
53+
$ oc rsh _<pod_name_a>_ ls -lZah _<pvc_mountpoint>_ <1>
5454
----
55-
<1> Replace `_<pod_name_A>_` with the name of the first pod and replace `_<PVC_mountpoint>_` with the mount point within the first pod.
55+
<1> Replace `_<pod_name_a>_` with the name of the first pod and replace `_<pvc_mountpoint>_` with the mount point within the first pod.
5656
+
5757
.Example output
5858
[source,terminal]
@@ -67,9 +67,9 @@ dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c398,c806 40 F
6767
[source,terminal]
6868
[subs="+quotes"]
6969
----
70-
$ oc rsh _<pod_name_B>_ ls -lZah _<PVC_mountpoint>_ <1>
70+
$ oc rsh _<pod_name_b>_ ls -lZah _<pvc_mountpoint>_ <1>
7171
----
72-
<1> Replace `_<pod_name_B>_` with the name of the second pod and replace `_<PVC_mountpoint>_` with the mount point within the second pod.
72+
<1> Replace `_<pod_name_b>_` with the name of the second pod and replace `_<pvc_mountpoint>_` with the mount point within the second pod.
7373
+
7474
.Example output
7575
[source,terminal]
@@ -79,83 +79,4 @@ dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c15,c25 40 Feb
7979
dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c15,c25 40 Feb 17 13:34 ..
8080
[...]
8181
----
82-
. Compare both the outputs to check if there is a mismatch of SELinux context.
83-
. When there is a mismatch of the SELinux content, create a new SCC and assign it to both PODs. To create a SCC see link: https://docs.openshift.com/container-platform/4.15/authentication/managing-security-context-constraints.html#security-context-constraints-creating_configuring-internal-oauth[Creating security context constraints].
84-
. Update the SELinuxContext as shown in the following example:
85-
+
86-
.Example output
87-
[source,terminal]
88-
----
89-
[...]
90-
securityContext:privileged
91-
seLinuxOptions:MustRunAs
92-
level: "s0:cXX,cYY"
93-
[...]
94-
----
95-
96-
.Verification
97-
98-
. Verify that the same SCC is assigned to the first pod by running the following command:
99-
+
100-
[source,terminal]
101-
[subs="+quotes"]
102-
----
103-
$ oc describe pod _<pod_name_A>_ |grep -i scc <1>
104-
----
105-
<1> Replace `_<pod_name_A>_` with the name of the first pod.
106-
+
107-
.Example output
108-
[source,terminal]
109-
----
110-
openshift.io/scc: restricted
111-
----
112-
. Verify that the same SCC is assigned to first second pod by running the following command:
113-
+
114-
[source,terminal]
115-
[subs="+quotes"]
116-
----
117-
$ oc describe pod _<pod_name_B>_ |grep -i scc <1>
118-
----
119-
<1> Replace `_<pod_name_B>_` with the name of the second pod.
120-
+
121-
.Example output
122-
[source,terminal]
123-
----
124-
openshift.io/scc: restricted
125-
----
126-
. Verify that the same SELinux label is applied to first pod by running the following command:
127-
+
128-
[source,terminal]
129-
[subs="+quotes"]
130-
----
131-
$ oc exec _<pod_name_A>_ -- ls -laZ _<PVC_mountpoint>_ <1>
132-
----
133-
<1> Replace `_<pod_name_A>_` with the name of the first pod and replace `_<PVC_mountpoint>_` with the mount point within the first pod.
134-
+
135-
.Example output
136-
[source,terminal]
137-
----
138-
total 4
139-
drwxrwsrwx. 2 root 1000670000 system_u:object_r:container_file_t:s0:c10,c26 19 Aug 29 18:17 .
140-
dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c10,c26 61 Aug 29 18:16 ..
141-
-rw-rw-rw-. 1 1000670000 1000670000 system_u:object_r:container_file_t:s0:c10,c26 29 Aug 29 18:17 test1
142-
[...]
143-
----
144-
. Verify that the same SELinux label is applied to second pod by running the following command:
145-
+
146-
[source,terminal]
147-
[subs="+quotes"]
148-
----
149-
$ oc exec _<pod_name_B>_ -- ls -laZ _<PVC_mountpoint>_ <1>
150-
----
151-
<1> Replace `_<pod_name_B>_` with the name of the second pod and replace `_<PVC_mountpoint>_` with the mount point within the second pod.
152-
+
153-
.Example output
154-
[source,terminal]
155-
----
156-
total 4
157-
drwxrwsrwx. 2 root 1000670000 system_u:object_r:container_file_t:s0:c10,c26 19 Aug 29 18:17 .
158-
dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c10,c26 61 Aug 29 18:16 ..
159-
-rw-rw-rw-. 1 1000670000 1000670000 system_u:object_r:container_file_t:s0:c10,c26 29 Aug 29 18:17 test1
160-
[...]
161-
----
82+
. Compare both the outputs to check if there is a mismatch of SELinux context.

‎modules/microshift-updating-pods-mismatch.adoc

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_storage/understanding-persistent-storage-microshift.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="microshift-updating-pods-mismatch_{context}"]
7+
= Updating the pods which have mismatch
8+
9+
Update the SELinux context of the pods if a mismatch is found by using the following procedure.
10+
11+
.Procedure
12+
13+
. When there is a mismatch of the SELinux content, create a new security context constraint (SCC) and assign it to both pods. To create a SCC, see link:https://docs.openshift.com/container-platform/4.15/authentication/managing-security-context-constraints.html#security-context-constraints-creating_configuring-internal-oauth[Creating security context constraints].
14+
. Update the SELinux context as shown in the following example:
15+
+
16+
.Example output
17+
[source,terminal]
18+
----
19+
[...]
20+
securityContext:privileged
21+
seLinuxOptions:MustRunAs
22+
level: "s0:cXX,cYY"
23+
[...]
24+
----

‎modules/microshift-verifying-pods-mismatch.adoc

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_storage/understanding-persistent-storage-microshift.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="microshift-verifying-pods-mismatch_{context}"]
7+
= Verifying pods after resolving a mismatch
8+
9+
Verify the security context constraint (SCC) and the SELinux label of both the pods by using the following verification steps.
10+
11+
.Verification
12+
13+
. Verify that the same SCC is assigned to the first pod by running the following command:
14+
+
15+
[source,terminal]
16+
[subs="+quotes"]
17+
----
18+
$ oc describe pod _<pod_name_a>_ |grep -i scc <1>
19+
----
20+
<1> Replace `_<pod_name_a>_` with the name of the first pod.
21+
+
22+
.Example output
23+
[source,terminal]
24+
----
25+
openshift.io/scc: restricted
26+
----
27+
. Verify that the same SCC is assigned to first second pod by running the following command:
28+
+
29+
[source,terminal]
30+
[subs="+quotes"]
31+
----
32+
$ oc describe pod _<pod_name_b>_ |grep -i scc <1>
33+
----
34+
<1> Replace `_<pod_name_b>_` with the name of the second pod.
35+
+
36+
.Example output
37+
[source,terminal]
38+
----
39+
openshift.io/scc: restricted
40+
----
41+
. Verify that the same SELinux label is applied to first pod by running the following command:
42+
+
43+
[source,terminal]
44+
[subs="+quotes"]
45+
----
46+
$ oc exec _<pod_name_a>_ -- ls -laZ _<pvc_mountpoint>_ <1>
47+
----
48+
<1> Replace `_<pod_name_a>_` with the name of the first pod and replace `_<pvc_mountpoint>_` with the mount point within the first pod.
49+
+
50+
.Example output
51+
[source,terminal]
52+
----
53+
total 4
54+
drwxrwsrwx. 2 root 1000670000 system_u:object_r:container_file_t:s0:c10,c26 19 Aug 29 18:17 .
55+
dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c10,c26 61 Aug 29 18:16 ..
56+
-rw-rw-rw-. 1 1000670000 1000670000 system_u:object_r:container_file_t:s0:c10,c26 29 Aug 29 18:17 test1
57+
[...]
58+
----
59+
. Verify that the same SELinux label is applied to second pod by running the following command:
60+
+
61+
[source,terminal]
62+
[subs="+quotes"]
63+
----
64+
$ oc exec _<pod_name_b>_ -- ls -laZ _<pvc_mountpoint>_ <1>
65+
----
66+
<1> Replace `_<pod_name_b>_` with the name of the second pod and replace `_<pvc_mountpoint>_` with the mount point within the second pod.
67+
+
68+
.Example output
69+
[source,terminal]
70+
----
71+
total 4
72+
drwxrwsrwx. 2 root 1000670000 system_u:object_r:container_file_t:s0:c10,c26 19 Aug 29 18:17 .
73+
dr-xr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c10,c26 61 Aug 29 18:16 ..
74+
-rw-rw-rw-. 1 1000670000 1000670000 system_u:object_r:container_file_t:s0:c10,c26 29 Aug 29 18:17 test1
75+
[...]
76+
----

0 commit comments

Comments
 (0)