cephfs: dont set explicit permissions on the volume #2847
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
humblec
force-pushed
the
cephfs-fsgroup
branch
from
00db59d
to
3456746
Compare
|
@Mergifyio rebase |
✅ Branch has been successfully rebased |
humblec
force-pushed
the
cephfs-fsgroup
branch
from
3456746
to
2fa4642
Compare
Madhu-1
reviewed
Feb 3, 2022
nixpanic
requested changes
Feb 3, 2022
humblec
force-pushed
the
cephfs-fsgroup
branch
from
2fa4642
to
2301987
Compare
|
Again ? @nixpanic @Rakshith-R https://jenkins-ceph-csi.apps.ocp.ci.centos.org/blue/organizations/jenkins/k8s-e2e-external-storage-1.21/detail/k8s-e2e-external-storage-1.21/2658/pipeline |
humblec
force-pushed
the
cephfs-fsgroup
branch
from
2301987
to
c7dd4c6
Compare
|
/retest ci/centos/mini-e2e-helm/k8s-1.22 |
|
/retest ci/centos/upgrade-tests-rbd |
|
Cool.. Tests are passing after rebase.. so please discard the previous comment :) @nixpanic @Rakshith-R ptal.. thanks ! |
Madhu-1
approved these changes
Feb 9, 2022
Rakshith-R
reviewed
Feb 9, 2022
|
@nixpanic ptal.. thanks. |
nixpanic
approved these changes
Feb 9, 2022
humblec
force-pushed
the
cephfs-fsgroup
branch
from
c7dd4c6
to
e86e474
Compare
|
/retest ci/centos/upgrade-tests-cephfs |
|
|
@Mergifyio refresh |
✅ Pull request refreshed |
At present we are node staging with worldwide permissions which is not correct. We should allow the CO to take care of it and make the decision. This commit also remove `fuseMountOptions` and `KernelMountOptions` as they are no longer needed Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
humblec
force-pushed
the
cephfs-fsgroup
branch
from
e86e474
to
b79209a
Compare
humblec
added a commit
to humblec/rook
that referenced
this pull request
Feb 11, 2022
``` ReadWriteOnceWithFSType: Indicates that volumes will be examined to determine if volume ownership and permissions should be modified to match the pod's security policy. Changes will only occur if the fsType is defined and the persistent volume's accessModes contains ReadWriteOnce. ``` In between considering we are giving 0777 permission on nodestage of cephfs shares, we defaulted to NONE. However giving worldwide permission to the volume is not the right thing and it has been fixed in cephfs via ceph/ceph-csi#2847 This commit brings it back to the value which is also in parity with RBD driver. Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
10 tasks
humblec
added a commit
to humblec/rook
that referenced
this pull request
Feb 11, 2022
``` ReadWriteOnceWithFSType: Indicates that volumes will be examined to determine if volume ownership and permissions should be modified to match the pod's security policy. Changes will only occur if the fsType is defined and the persistent volume's accessModes contains ReadWriteOnce. ``` In between considering we are giving 0777 permission on nodestage of cephfs shares, we defaulted to NONE. However giving worldwide permission to the volume is not the right thing and it has been fixed in cephfs via ceph/ceph-csi#2847 This commit brings it back to the value which is also in parity with RBD driver. Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
Expected to be addressed with #2880 |
mergify bot
pushed a commit
to rook/rook
that referenced
this pull request
Feb 28, 2022
``` ReadWriteOnceWithFSType: Indicates that volumes will be examined to determine if volume ownership and permissions should be modified to match the pod's security policy. Changes will only occur if the fsType is defined and the persistent volume's accessModes contains ReadWriteOnce. ``` In between considering we are giving 0777 permission on nodestage of cephfs shares, we defaulted to NONE. However giving worldwide permission to the volume is not the right thing and it has been fixed in cephfs via ceph/ceph-csi#2847 This commit brings it back to the value which is also in parity with RBD driver. Signed-off-by: Humble Chirammal <hchiramm@redhat.com> (cherry picked from commit 6561bda)
humblec
added a commit
to humblec/rook
that referenced
this pull request
Mar 1, 2022
``` ReadWriteOnceWithFSType: Indicates that volumes will be examined to determine if volume ownership and permissions should be modified to match the pod's security policy. Changes will only occur if the fsType is defined and the persistent volume's accessModes contains ReadWriteOnce. ``` In between considering we are giving 0777 permission on nodestage of cephfs shares, we defaulted to NONE. However giving worldwide permission to the volume is not the right thing and it has been fixed in cephfs via ceph/ceph-csi#2847 This commit brings it back to the value which is also in parity with RBD driver. Signed-off-by: Humble Chirammal <hchiramm@redhat.com> (cherry picked from commit 6561bda) (cherry picked from commit e324059)
10 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
At present we are node staging with worldwide permissions which is
not correct. We should allow the CO to take care of it and make
the decision
Considering we have set to worldwide permission, we are defaulting to
fsgroup = Nonefor CephFS atm, once this is in, we can change toFSGroupChangePolicytoReadWriteOnceWithFSTpefor CephFS too.Fixes #2356
Signed-off-by: Humble Chirammal hchiramm@redhat.com