525b8e5cd6
The field in fact says that the container runtime should relabel a volume when running a container with it, it does not say that the volume supports SELinux. For example, NFS can support SELinux, but we don't want NFS volumes relabeled, because they can be shared among several Pods.
519 lines
15 KiB
Go
519 lines
15 KiB
Go
/*
|
|
Copyright 2016 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package quobyte
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
gostrings "strings"
|
|
|
|
"github.com/google/uuid"
|
|
"k8s.io/klog/v2"
|
|
"k8s.io/mount-utils"
|
|
utilstrings "k8s.io/utils/strings"
|
|
|
|
v1 "k8s.io/api/core/v1"
|
|
"k8s.io/apimachinery/pkg/api/resource"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/types"
|
|
proxyutil "k8s.io/kubernetes/pkg/proxy/util"
|
|
"k8s.io/kubernetes/pkg/volume"
|
|
"k8s.io/kubernetes/pkg/volume/util"
|
|
)
|
|
|
|
// ProbeVolumePlugins is the primary entrypoint for volume plugins.
|
|
func ProbeVolumePlugins() []volume.VolumePlugin {
|
|
return []volume.VolumePlugin{&quobytePlugin{nil}}
|
|
}
|
|
|
|
type quobytePlugin struct {
|
|
host volume.VolumeHost
|
|
}
|
|
|
|
// This user is used to authenticate against the
|
|
// Quobyte API server and holds all information
|
|
type quobyteAPIConfig struct {
|
|
quobyteUser string
|
|
quobytePassword string `datapolicy:"password"`
|
|
quobyteAPIServer string
|
|
}
|
|
|
|
var _ volume.VolumePlugin = &quobytePlugin{}
|
|
var _ volume.PersistentVolumePlugin = &quobytePlugin{}
|
|
var _ volume.DeletableVolumePlugin = &quobytePlugin{}
|
|
var _ volume.ProvisionableVolumePlugin = &quobytePlugin{}
|
|
var _ volume.Provisioner = &quobyteVolumeProvisioner{}
|
|
var _ volume.Deleter = &quobyteVolumeDeleter{}
|
|
|
|
const (
|
|
quobytePluginName = "kubernetes.io/quobyte"
|
|
)
|
|
|
|
func (plugin *quobytePlugin) Init(host volume.VolumeHost) error {
|
|
if host == nil {
|
|
return errors.New("host must not be nil")
|
|
}
|
|
plugin.host = host
|
|
return nil
|
|
}
|
|
|
|
func (plugin *quobytePlugin) GetPluginName() string {
|
|
return quobytePluginName
|
|
}
|
|
|
|
func (plugin *quobytePlugin) GetVolumeName(spec *volume.Spec) (string, error) {
|
|
volumeSource, _, err := getVolumeSource(spec)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
return fmt.Sprintf(
|
|
"%v:%v",
|
|
volumeSource.Registry,
|
|
volumeSource.Volume), nil
|
|
}
|
|
|
|
func (plugin *quobytePlugin) CanSupport(spec *volume.Spec) bool {
|
|
if (spec.PersistentVolume != nil && spec.PersistentVolume.Spec.Quobyte == nil) ||
|
|
(spec.Volume != nil && spec.Volume.Quobyte == nil) {
|
|
return false
|
|
}
|
|
|
|
// If Quobyte is already mounted we don't need to check if the binary is installed
|
|
if mounter, err := plugin.newMounterInternal(spec, nil, plugin.host.GetMounter(plugin.GetPluginName())); err == nil {
|
|
qm, _ := mounter.(*quobyteMounter)
|
|
pluginDir := plugin.host.GetPluginDir(utilstrings.EscapeQualifiedName(quobytePluginName))
|
|
if mounted, err := qm.pluginDirIsMounted(pluginDir); mounted && err == nil {
|
|
klog.V(4).Infof("quobyte: can support")
|
|
return true
|
|
}
|
|
} else {
|
|
klog.V(4).Infof("quobyte: Error: %v", err)
|
|
}
|
|
|
|
exec := plugin.host.GetExec(plugin.GetPluginName())
|
|
if out, err := exec.Command("ls", "/sbin/mount.quobyte").CombinedOutput(); err == nil {
|
|
klog.V(4).Infof("quobyte: can support: %s", string(out))
|
|
return true
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
func (plugin *quobytePlugin) RequiresRemount(spec *volume.Spec) bool {
|
|
return false
|
|
}
|
|
|
|
func (plugin *quobytePlugin) SupportsMountOption() bool {
|
|
return true
|
|
}
|
|
|
|
func (plugin *quobytePlugin) SupportsBulkVolumeVerification() bool {
|
|
return false
|
|
}
|
|
|
|
func (plugin *quobytePlugin) GetAccessModes() []v1.PersistentVolumeAccessMode {
|
|
return []v1.PersistentVolumeAccessMode{
|
|
v1.ReadWriteOnce,
|
|
v1.ReadOnlyMany,
|
|
v1.ReadWriteMany,
|
|
}
|
|
}
|
|
|
|
func getVolumeSource(spec *volume.Spec) (*v1.QuobyteVolumeSource, bool, error) {
|
|
if spec.Volume != nil && spec.Volume.Quobyte != nil {
|
|
return spec.Volume.Quobyte, spec.Volume.Quobyte.ReadOnly, nil
|
|
} else if spec.PersistentVolume != nil &&
|
|
spec.PersistentVolume.Spec.Quobyte != nil {
|
|
return spec.PersistentVolume.Spec.Quobyte, spec.ReadOnly, nil
|
|
}
|
|
|
|
return nil, false, fmt.Errorf("Spec does not reference a Quobyte volume type")
|
|
}
|
|
|
|
func (plugin *quobytePlugin) ConstructVolumeSpec(volumeName, mountPath string) (*volume.Spec, error) {
|
|
quobyteVolume := &v1.Volume{
|
|
Name: volumeName,
|
|
VolumeSource: v1.VolumeSource{
|
|
Quobyte: &v1.QuobyteVolumeSource{
|
|
Volume: volumeName,
|
|
},
|
|
},
|
|
}
|
|
return volume.NewSpecFromVolume(quobyteVolume), nil
|
|
}
|
|
|
|
func (plugin *quobytePlugin) NewMounter(spec *volume.Spec, pod *v1.Pod, _ volume.VolumeOptions) (volume.Mounter, error) {
|
|
return plugin.newMounterInternal(spec, pod, plugin.host.GetMounter(plugin.GetPluginName()))
|
|
}
|
|
|
|
func (plugin *quobytePlugin) newMounterInternal(spec *volume.Spec, pod *v1.Pod, mounter mount.Interface) (volume.Mounter, error) {
|
|
source, readOnly, err := getVolumeSource(spec)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &quobyteMounter{
|
|
quobyte: &quobyte{
|
|
volName: spec.Name(),
|
|
user: source.User,
|
|
group: source.Group,
|
|
mounter: mounter,
|
|
pod: pod,
|
|
volume: source.Volume,
|
|
plugin: plugin,
|
|
},
|
|
registry: source.Registry,
|
|
readOnly: readOnly,
|
|
mountOptions: util.MountOptionFromSpec(spec),
|
|
}, nil
|
|
}
|
|
|
|
func (plugin *quobytePlugin) NewUnmounter(volName string, podUID types.UID) (volume.Unmounter, error) {
|
|
return plugin.newUnmounterInternal(volName, podUID, plugin.host.GetMounter(plugin.GetPluginName()))
|
|
}
|
|
|
|
func (plugin *quobytePlugin) newUnmounterInternal(volName string, podUID types.UID, mounter mount.Interface) (volume.Unmounter, error) {
|
|
return &quobyteUnmounter{
|
|
&quobyte{
|
|
volName: volName,
|
|
mounter: mounter,
|
|
pod: &v1.Pod{ObjectMeta: metav1.ObjectMeta{UID: podUID}},
|
|
plugin: plugin,
|
|
},
|
|
}, nil
|
|
}
|
|
|
|
// Quobyte volumes represent a bare host directory mount of an quobyte export.
|
|
type quobyte struct {
|
|
volName string
|
|
pod *v1.Pod
|
|
user string
|
|
group string
|
|
volume string
|
|
tenant string
|
|
config string
|
|
mounter mount.Interface
|
|
plugin *quobytePlugin
|
|
volume.MetricsNil
|
|
}
|
|
|
|
type quobyteMounter struct {
|
|
*quobyte
|
|
registry string
|
|
readOnly bool
|
|
mountOptions []string
|
|
}
|
|
|
|
var _ volume.Mounter = &quobyteMounter{}
|
|
|
|
func (mounter *quobyteMounter) GetAttributes() volume.Attributes {
|
|
return volume.Attributes{
|
|
ReadOnly: mounter.readOnly,
|
|
Managed: false,
|
|
SELinuxRelabel: false,
|
|
}
|
|
}
|
|
|
|
// Checks prior to mount operations to verify that the required components (binaries, etc.)
|
|
// to mount the volume are available on the underlying node.
|
|
// If not, it returns an error
|
|
func (mounter *quobyteMounter) CanMount() error {
|
|
return nil
|
|
}
|
|
|
|
// SetUp attaches the disk and bind mounts to the volume path.
|
|
func (mounter *quobyteMounter) SetUp(mounterArgs volume.MounterArgs) error {
|
|
pluginDir := mounter.plugin.host.GetPluginDir(utilstrings.EscapeQualifiedName(quobytePluginName))
|
|
return mounter.SetUpAt(pluginDir, mounterArgs)
|
|
}
|
|
|
|
func (mounter *quobyteMounter) SetUpAt(dir string, mounterArgs volume.MounterArgs) error {
|
|
// Check if Quobyte is already mounted on the host in the Plugin Dir
|
|
// if so we can use this mountpoint instead of creating a new one
|
|
// IsLikelyNotMountPoint wouldn't check the mount type
|
|
if mounted, err := mounter.pluginDirIsMounted(dir); err != nil {
|
|
return err
|
|
} else if mounted {
|
|
return nil
|
|
}
|
|
|
|
os.MkdirAll(dir, 0750)
|
|
var options []string
|
|
options = append(options, "allow-usermapping-in-volumename")
|
|
if mounter.readOnly {
|
|
options = append(options, "ro")
|
|
}
|
|
|
|
//if a trailing slash is missing we add it here
|
|
mountOptions := util.JoinMountOptions(mounter.mountOptions, options)
|
|
if err := mounter.mounter.MountSensitiveWithoutSystemd(mounter.correctTraillingSlash(mounter.registry), dir, "quobyte", mountOptions, nil); err != nil {
|
|
return fmt.Errorf("quobyte: mount failed: %v", err)
|
|
}
|
|
|
|
klog.V(4).Infof("quobyte: mount set up: %s", dir)
|
|
|
|
return nil
|
|
}
|
|
|
|
// GetPath returns the path to the user specific mount of a Quobyte volume
|
|
// Returns a path in the format ../user#group@volume
|
|
func (quobyteVolume *quobyte) GetPath() string {
|
|
user := quobyteVolume.user
|
|
if len(user) == 0 {
|
|
user = "root"
|
|
}
|
|
|
|
group := quobyteVolume.group
|
|
if len(group) == 0 {
|
|
group = "nfsnobody"
|
|
}
|
|
|
|
// Quobyte has only one mount in the PluginDir where all Volumes are mounted
|
|
// The Quobyte client does a fixed-user mapping
|
|
pluginDir := quobyteVolume.plugin.host.GetPluginDir(utilstrings.EscapeQualifiedName(quobytePluginName))
|
|
return filepath.Join(pluginDir, fmt.Sprintf("%s#%s@%s", user, group, quobyteVolume.volume))
|
|
}
|
|
|
|
type quobyteUnmounter struct {
|
|
*quobyte
|
|
}
|
|
|
|
var _ volume.Unmounter = &quobyteUnmounter{}
|
|
|
|
func (unmounter *quobyteUnmounter) TearDown() error {
|
|
return unmounter.TearDownAt(unmounter.GetPath())
|
|
}
|
|
|
|
// We don't need to unmount on the host because only one mount exists
|
|
func (unmounter *quobyteUnmounter) TearDownAt(dir string) error {
|
|
return nil
|
|
}
|
|
|
|
type quobyteVolumeDeleter struct {
|
|
*quobyteMounter
|
|
pv *v1.PersistentVolume
|
|
dialOptions *proxyutil.FilteredDialOptions
|
|
}
|
|
|
|
func (plugin *quobytePlugin) NewDeleter(spec *volume.Spec) (volume.Deleter, error) {
|
|
if spec.PersistentVolume != nil && spec.PersistentVolume.Spec.Quobyte == nil {
|
|
return nil, fmt.Errorf("spec.PersistentVolume.Spec.Quobyte is nil")
|
|
}
|
|
|
|
return plugin.newDeleterInternal(spec)
|
|
}
|
|
|
|
func (plugin *quobytePlugin) newDeleterInternal(spec *volume.Spec) (volume.Deleter, error) {
|
|
source, readOnly, err := getVolumeSource(spec)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if plugin.host == nil {
|
|
return nil, errors.New("host must not be nil")
|
|
}
|
|
|
|
return &quobyteVolumeDeleter{
|
|
quobyteMounter: &quobyteMounter{
|
|
quobyte: &quobyte{
|
|
volName: spec.Name(),
|
|
user: source.User,
|
|
group: source.Group,
|
|
volume: source.Volume,
|
|
plugin: plugin,
|
|
tenant: source.Tenant,
|
|
},
|
|
registry: source.Registry,
|
|
readOnly: readOnly,
|
|
},
|
|
pv: spec.PersistentVolume,
|
|
dialOptions: plugin.host.GetFilteredDialOptions(),
|
|
}, nil
|
|
}
|
|
|
|
func (plugin *quobytePlugin) NewProvisioner(options volume.VolumeOptions) (volume.Provisioner, error) {
|
|
return plugin.newProvisionerInternal(options)
|
|
}
|
|
|
|
func (plugin *quobytePlugin) newProvisionerInternal(options volume.VolumeOptions) (volume.Provisioner, error) {
|
|
if plugin.host == nil {
|
|
return nil, errors.New("host must not be nil")
|
|
}
|
|
return &quobyteVolumeProvisioner{
|
|
quobyteMounter: &quobyteMounter{
|
|
quobyte: &quobyte{
|
|
plugin: plugin,
|
|
},
|
|
},
|
|
options: options,
|
|
dialOptions: plugin.host.GetFilteredDialOptions(),
|
|
}, nil
|
|
}
|
|
|
|
type quobyteVolumeProvisioner struct {
|
|
*quobyteMounter
|
|
options volume.VolumeOptions
|
|
dialOptions *proxyutil.FilteredDialOptions
|
|
}
|
|
|
|
func (provisioner *quobyteVolumeProvisioner) Provision(selectedNode *v1.Node, allowedTopologies []v1.TopologySelectorTerm) (*v1.PersistentVolume, error) {
|
|
if !util.ContainsAllAccessModes(provisioner.plugin.GetAccessModes(), provisioner.options.PVC.Spec.AccessModes) {
|
|
return nil, fmt.Errorf("invalid AccessModes %v: only AccessModes %v are supported", provisioner.options.PVC.Spec.AccessModes, provisioner.plugin.GetAccessModes())
|
|
}
|
|
|
|
if util.CheckPersistentVolumeClaimModeBlock(provisioner.options.PVC) {
|
|
return nil, fmt.Errorf("%s does not support block volume provisioning", provisioner.plugin.GetPluginName())
|
|
}
|
|
|
|
if provisioner.options.PVC.Spec.Selector != nil {
|
|
return nil, fmt.Errorf("claim Selector is not supported")
|
|
}
|
|
provisioner.config = "BASE"
|
|
provisioner.tenant = "DEFAULT"
|
|
createQuota := false
|
|
|
|
cfg, err := parseAPIConfig(provisioner.plugin, provisioner.options.Parameters)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
for k, v := range provisioner.options.Parameters {
|
|
switch gostrings.ToLower(k) {
|
|
case "registry":
|
|
provisioner.registry = v
|
|
case "user":
|
|
provisioner.user = v
|
|
case "group":
|
|
provisioner.group = v
|
|
case "quobytetenant":
|
|
provisioner.tenant = v
|
|
case "quobyteconfig":
|
|
provisioner.config = v
|
|
case "createquota":
|
|
createQuota = gostrings.ToLower(v) == "true"
|
|
case "adminsecretname",
|
|
"adminsecretnamespace",
|
|
"quobyteapiserver":
|
|
continue
|
|
default:
|
|
return nil, fmt.Errorf("invalid option %q for volume plugin %s", k, provisioner.plugin.GetPluginName())
|
|
}
|
|
}
|
|
|
|
if !validateRegistry(provisioner.registry) {
|
|
return nil, fmt.Errorf("quobyte registry missing or malformed: must be a host:port pair or multiple pairs separated by commas")
|
|
}
|
|
|
|
// create random image name
|
|
provisioner.volume = fmt.Sprintf("kubernetes-dynamic-pvc-%s", uuid.New().String())
|
|
|
|
manager := &quobyteVolumeManager{
|
|
config: cfg,
|
|
dialOptions: provisioner.dialOptions,
|
|
}
|
|
|
|
vol, sizeGB, err := manager.createVolume(provisioner, createQuota)
|
|
if err != nil {
|
|
// don't log error details from client calls in events
|
|
klog.V(4).Infof("CreateVolume failed: %v", err)
|
|
return nil, errors.New("CreateVolume failed: see kube-controller-manager.log for details")
|
|
}
|
|
pv := new(v1.PersistentVolume)
|
|
metav1.SetMetaDataAnnotation(&pv.ObjectMeta, util.VolumeDynamicallyCreatedByKey, "quobyte-dynamic-provisioner")
|
|
pv.Spec.PersistentVolumeSource.Quobyte = vol
|
|
pv.Spec.PersistentVolumeReclaimPolicy = provisioner.options.PersistentVolumeReclaimPolicy
|
|
pv.Spec.AccessModes = provisioner.options.PVC.Spec.AccessModes
|
|
if len(pv.Spec.AccessModes) == 0 {
|
|
pv.Spec.AccessModes = provisioner.plugin.GetAccessModes()
|
|
}
|
|
pv.Spec.Capacity = v1.ResourceList{
|
|
v1.ResourceName(v1.ResourceStorage): resource.MustParse(fmt.Sprintf("%dGi", sizeGB)),
|
|
}
|
|
pv.Spec.MountOptions = provisioner.options.MountOptions
|
|
pv.Spec.PersistentVolumeSource.Quobyte.Tenant = provisioner.tenant
|
|
return pv, nil
|
|
}
|
|
|
|
func (deleter *quobyteVolumeDeleter) GetPath() string {
|
|
return deleter.quobyte.GetPath()
|
|
}
|
|
|
|
func (deleter *quobyteVolumeDeleter) Delete() error {
|
|
class, err := util.GetClassForVolume(deleter.plugin.host.GetKubeClient(), deleter.pv)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
cfg, err := parseAPIConfig(deleter.plugin, class.Parameters)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
manager := &quobyteVolumeManager{
|
|
config: cfg,
|
|
dialOptions: deleter.dialOptions,
|
|
}
|
|
err = manager.deleteVolume(deleter)
|
|
if err != nil {
|
|
// don't log error details from client calls in events
|
|
klog.V(4).Infof("DeleteVolume failed: %v", err)
|
|
return errors.New("DeleteVolume failed: see kube-controller-manager.log for details")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Parse API configuration (url, username and password) out of class.Parameters.
|
|
func parseAPIConfig(plugin *quobytePlugin, params map[string]string) (*quobyteAPIConfig, error) {
|
|
var apiServer, secretName string
|
|
secretNamespace := "default"
|
|
|
|
for k, v := range params {
|
|
switch gostrings.ToLower(k) {
|
|
case "adminsecretname":
|
|
secretName = v
|
|
case "adminsecretnamespace":
|
|
secretNamespace = v
|
|
case "quobyteapiserver":
|
|
apiServer = v
|
|
}
|
|
}
|
|
|
|
if len(apiServer) == 0 {
|
|
return nil, fmt.Errorf("quobyte API server missing or malformed: must be a http(s)://host:port pair or multiple pairs separated by commas")
|
|
}
|
|
|
|
secretMap, err := util.GetSecretForPV(secretNamespace, secretName, quobytePluginName, plugin.host.GetKubeClient())
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
cfg := &quobyteAPIConfig{
|
|
quobyteAPIServer: apiServer,
|
|
}
|
|
|
|
var ok bool
|
|
if cfg.quobyteUser, ok = secretMap["user"]; !ok {
|
|
return nil, fmt.Errorf("missing \"user\" in secret %s/%s", secretNamespace, secretName)
|
|
}
|
|
|
|
if cfg.quobytePassword, ok = secretMap["password"]; !ok {
|
|
return nil, fmt.Errorf("missing \"password\" in secret %s/%s", secretNamespace, secretName)
|
|
}
|
|
|
|
return cfg, nil
|
|
}
|