bind mounts, rpc_pipefs, file install from datastore key seeded from source with optional templating#1037
Merged
Merged
Conversation
- Add Source field to KeyMeta struct in core/datarecv/keymeta.go - Add Source field to KVInstall struct in core/object/datastore_key_install.go - Update ParseKeyMetaRel to parse source <uri> syntax - Update parseFile in getInstallMetadata to parse source <uri> - Implement seedKeyFromSource function to fetch data from URI and seed datastore key - Add seeding logic in install() and InstallFromDatastore() functions - Update keyword example and documentation to include source syntax The source URI is used to seed datastore key data only during the provision action if the key doesn't already exist. This allows for automatic fetching and seeding of configuration scripts/templates from remote sources.
On instance start, if a install source key must be seeded in a datastore in the same namespace as the service, create the datastore. Example: $ om testnfs instance start 12:14:26.020 INF testnfs: >>> do start [bin/om testnfs instance start] (origin user, sid 22c28c14-9afd-4978-bfb1-5d4bca0154de) 12:14:26.057 INF testnfs: ip#1: 10.29.0.21 is already up on br-prd 12:14:26.063 INF testnfs: fs#1: /dev/mapper/36001405ded28414e2ea4c248008e6af1 already mounted on /srv/testnfs.root.svc.reliable-leopard 12:14:26.064 INF testnfs: fs#1: created datastore cfg/testnfs for seeding 12:14:26.064 INF testnfs: fs#1: seeding key init/nfs from source https://raw.githubusercontent.com/opensvc/opensvc_templates/refs/heads/main/nfs/script 12:14:26.204 INF cfg/testnfs: set key init/nfs 12:14:26.386 INF testnfs: fs#1: seeded key init/nfs from source https://raw.githubusercontent.com/opensvc/opensvc_templates/refs/heads/main/nfs/script
This "none" value permits simpler definitions for virtual
filesystems.
e.g
[fs#1]
type = tmpfs
mnt = /srv/{fqdn}/tmp
Previously the label was stuttering the driver id.
This feature allows this kind of setup in a `svc1` service deployed in
a cluster named `cluster1`:
[fs#1]
install = /init/nfsd from ./cfg/{name} source {env.templates}/nfs/init.nfsd template mode 755
...
[env]
a = {fqdn}
b = c
In this case, if the source contains:
#!/usr/bin/bash
echo {{.a}}
echo {{.b}}
The seeded `./cfg/{name}` key `init/nfsd` will contain:
#!/usr/bin/bash
echo svc1.root.svc.cluster1
echo c
The implicit key name support highlighted in this example is also
added by this patch:
/init/nfsd path => init/nfsd key name
* Move ResourceHandlingFile and ResourceHandlingDevice to the actor type and expose via the Actor interface. * Replace the duplicate implementation in container.kvm, container.vbox and container.lxc drivers * Use ResourceHandlingFile in resapp CommonStop to skip the stopper exec if the resouce where the stopper script is stored is not up.
Use the datarecv.T embed directly. And apply to the mountpoint the datarecv default RootDirPerm() if available, or default to 0755 as it was the permission hardcoded previously.
Previously we only verified any kind of virtual fs was mounted in /var/lib/opensvc/certs.
* When dev is a regular file, create the parent mnt file dir and touch the mnt file before mount * Fix a panic in `device.T.Slaves()` caused by file bind mounts. * Also fix `device.T.Holders()` preventively. * Add a specific `isBindMounted()` for bind mounts * Add the `file.VerifySameMajorMinorAndInode(p1, p2 string) error` util func to back the fs.host driver's `isBindMounted()` * Mangle the mount command for bind mounts (no `-t <type>`, add `-o bind`) * Add a `findmnt.HasMnt(ctx, mntpt) (bool, error)` helper for the fs.host driver's `isBindMounted` * Add a `findmnt.HasDev(ctx, dev) (bool, error)` helper for the fs.host driver's fsck codepath. * Adapt the `findmnt.List` for the case the device is a regular file (same format as directories) * Skip fs.host fsck if the device is already mounted somewhere, because fsck would fail and the fact that the device is already mounted once proves it is mountable.
* Stricter rules on driver groups * Forbid install from local source to non-root * Forbid run_args to non-root * Forbid pre_monitor_action to non-root * Forbid monitor_action values expect "switch", "freezestop", "none" * Apply rbac to POST PUT object config file (only PATCH was done) * Fix the trigger deny rbac (trigger kws don't end with "_triggger") * Fix scoping circumventing the rbac rules
* allow fs.flag * allow ip.cni * env section * log rbac errors from the api handler * do the obj config rbac validation in volatile mode
Instead of just the changed parts. So if a root user injected a svc in a namespace, the admins of this namespace are not allowed to modify it if it contains any root-only settings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request introduces multiple updates to the fs.host driver and other related components:
Added support for bind mounts:
Enhanced tmpfs validation:
Removed redundant imports and streamlined permissions logic:
resfshostandresfszfs.Improved app resource handling:
Introduced Go templating for installable files:
Updated keywords and defaults:
app.desckeyword for labeling app resources more intuitively.fs.host devset to "none" for easier virtual filesystem configuration.rpc_pipefsfilesystem.Enhanced datastore seeding:
Minor UI/UX improvement: