Support reverse dns on backups

[n0rad]

Hi,

NFS is not very secured and one mechanism to limit access is by filtering who can connect using reverse DNS resolution.
If the NFS server is using the Kubernetes DNS server, access can be filtered by namespace or service.

# cat /etc/exports
/nfsshare *.longhorn-backend.longhorn-system.svc.cluster.local(rw,fsid=0,sync)

This allows managers to connect to NFS but does not allow backups to do so. *.longhorn-system.svc.cluster.local will not work either because backups pod are not on any service and so have no reverse DNS resolution.

Can you please add backups pod to service so they can be identified as endpoints and have reverse DNS resolution?
If not can you at least add a fixed label to those pods so the service can be declared outside of longhorn?

[cclhsu]

Thanks for suggestion! we do plan to add "mananged-by: longhorn" for these pods in future release.

[PhanLe1010]

@n0rad
Just to confirm, #2525 (comment) is what you are looking for, right?

[n0rad]

This look like an annotation and not like a label, but if it's a label, this should be enough to allow creation of a service out of it.

[jenting]

If I remember correctly, the backup happens in the replica manager Pods.
From your use case, we need to add labels to replica manager Pods, is this meet your requirement @n0rad?

Ref to:

• https://github.com/longhorn/longhorn-manager/blob/v1.1.1/controller/instance_manager_controller.go#L937
• https://github.com/longhorn/longhorn-manager/blob/v1.1.1/types/types.go#L272-L283

[joshimoo]

@n0rad can you see if creation of a service against the label longhorn.io/component=instance-manager works for you?
This will match all instance-manager pods for replicas + engine, since replicas/engines are just processes inside of these pods all of the instances/replicas would be covered.

The recurring jobs just trigger api calls against the longhorn-backend, so as long as the backend + replica/engines have access to the nfs server that should be fine.

[n0rad]

Hum ok, I was not aware that jobs was not those accessing the NFS.

it's working.

By adding a service on longhorn.io/component, replica and engines are enlist.

Managers still need to be able to access the NFS to list available backups so longhorn-backend service also have to be allowed on nfs config.