Skip to content

Commit

Permalink
Merge pull request kubernetes#49502 from rootfs/cephfs-pv-ns
Browse files Browse the repository at this point in the history 
Automatic merge from submit-queue (batch tested with PRs 50213, 50707, 49502, 51230, 50848)

Refactor CephFS PV spec

**What this PR does / why we need it**:
refactor CephFS Volume Persistent Volume Spec so CephFS PV's SecretRef allows referencing a secret from a persistent volume in any namespace. This allows locating credentials for persistent volumes in namespaces other than the one containing the PVC.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes kubernetes-retired/external-storage#309

**Special notes for your reviewer**:
@kubernetes/sig-storage-api-reviews 

**Release note**:

```release-note
Allow CephFS PV to specify a namespace for secret
```
  • Loading branch information
Kubernetes Submit Queue authored Aug 25, 2017
2 parents b9425de + 9f0aad3 commit ed6efbc
Show file tree
Hide file tree
Showing 19 changed files with 3,396 additions and 1,488 deletions.
50 changes: 49 additions & 1 deletion api/openapi-spec/swagger.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -58230,6 +58230,41 @@
}
}
},
"io.k8s.api.core.v1.CephFSPersistentVolumeSource": {
"description": "Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.",
"required": [
"monitors"
],
"properties": {
"monitors": {
"description": "Required: Monitors is a collection of Ceph monitors More info: https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it",
"type": "array",
"items": {
"type": "string"
}
},
"path": {
"description": "Optional: Used as the mounted root, rather than the full Ceph tree, default is /",
"type": "string"
},
"readOnly": {
"description": "Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it",
"type": "boolean"
},
"secretFile": {
"description": "Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret More info: https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it",
"type": "string"
},
"secretRef": {
"description": "Optional: SecretRef is reference to the authentication secret for User, default is empty. More info: https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it",
"$ref": "#/definitions/io.k8s.api.core.v1.SecretReference"
},
"user": {
"description": "Optional: User is the rados user name, default is admin More info: https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it",
"type": "string"
}
}
},
"io.k8s.api.core.v1.CephFSVolumeSource": {
"description": "Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.",
"required": [
Expand Down Expand Up @@ -60465,7 +60500,7 @@
},
"cephfs": {
"description": "CephFS represents a Ceph FS mount on the host that shares a pod's lifetime",
"$ref": "#/definitions/io.k8s.api.core.v1.CephFSVolumeSource"
"$ref": "#/definitions/io.k8s.api.core.v1.CephFSPersistentVolumeSource"
},
"cinder": {
"description": "Cinder represents a cinder volume attached and mounted on kubelets host machine More info: https://releases.k8s.io/HEAD/examples/mysql-cinder-pd/README.md",
Expand Down Expand Up @@ -61723,6 +61758,19 @@
}
}
},
"io.k8s.api.core.v1.SecretReference": {
"description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret in any namespace",
"properties": {
"name": {
"description": "Name is unique within a namespace to reference a secret resource.",
"type": "string"
},
"namespace": {
"description": "Namespace defines the space within which the secret name must be unique.",
"type": "string"
}
}
},
"io.k8s.api.core.v1.SecretVolumeSource": {
"description": "Adapts a Secret into a volume.\n\nThe contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names. Secret volumes support ownership management and SELinux relabeling.",
"properties": {
Expand Down
58 changes: 54 additions & 4 deletions api/swagger-spec/v1.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18865,7 +18865,7 @@
"description": "Cinder represents a cinder volume attached and mounted on kubelets host machine More info: https://releases.k8s.io/HEAD/examples/mysql-cinder-pd/README.md"
},
"cephfs": {
"$ref": "v1.CephFSVolumeSource",
"$ref": "v1.CephFSPersistentVolumeSource",
"description": "CephFS represents a Ceph FS mount on the host that shares a pod's lifetime"
},
"fc": {
Expand Down Expand Up @@ -19189,8 +19189,8 @@
}
}
},
"v1.CephFSVolumeSource": {
"id": "v1.CephFSVolumeSource",
"v1.CephFSPersistentVolumeSource": {
"id": "v1.CephFSPersistentVolumeSource",
"description": "Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.",
"required": [
"monitors"
Expand All @@ -19216,7 +19216,7 @@
"description": "Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret More info: https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it"
},
"secretRef": {
"$ref": "v1.LocalObjectReference",
"$ref": "v1.SecretReference",
"description": "Optional: SecretRef is reference to the authentication secret for User, default is empty. More info: https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it"
},
"readOnly": {
Expand All @@ -19225,6 +19225,20 @@
}
}
},
"v1.SecretReference": {
"id": "v1.SecretReference",
"description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret in any namespace",
"properties": {
"name": {
"type": "string",
"description": "Name is unique within a namespace to reference a secret resource."
},
"namespace": {
"type": "string",
"description": "Namespace defines the space within which the secret name must be unique."
}
}
},
"v1.FCVolumeSource": {
"id": "v1.FCVolumeSource",
"description": "Represents a Fibre Channel volume. Fibre Channel volumes can only be mounted as read/write once. Fibre Channel volumes support ownership management and SELinux relabeling.",
Expand Down Expand Up @@ -19977,6 +19991,42 @@
}
}
},
"v1.CephFSVolumeSource": {
"id": "v1.CephFSVolumeSource",
"description": "Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.",
"required": [
"monitors"
],
"properties": {
"monitors": {
"type": "array",
"items": {
"type": "string"
},
"description": "Required: Monitors is a collection of Ceph monitors More info: https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it"
},
"path": {
"type": "string",
"description": "Optional: Used as the mounted root, rather than the full Ceph tree, default is /"
},
"user": {
"type": "string",
"description": "Optional: User is the rados user name, default is admin More info: https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it"
},
"secretFile": {
"type": "string",
"description": "Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret More info: https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it"
},
"secretRef": {
"$ref": "v1.LocalObjectReference",
"description": "Optional: SecretRef is reference to the authentication secret for User, default is empty. More info: https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it"
},
"readOnly": {
"type": "boolean",
"description": "Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it"
}
}
},
"v1.DownwardAPIVolumeSource": {
"id": "v1.DownwardAPIVolumeSource",
"description": "DownwardAPIVolumeSource represents a volume containing downward API info. Downward API volumes support ownership management and SELinux relabeling.",
Expand Down
25 changes: 24 additions & 1 deletion build/root/BUILD.root
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@

package(default_visibility = ["//visibility:public"])

load("@io_bazel_rules_go//go:def.bzl", "go_prefix")
load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_prefix")
load("@io_kubernetes_build//defs:build.bzl", "gcs_upload")

go_prefix("k8s.io/kubernetes")
Expand Down Expand Up @@ -457,3 +457,26 @@ genrule(
cmd = "grep ^STABLE_BUILD_SCM_REVISION bazel-out/stable-status.txt | awk '{print $$2}' >$@",
stamp = 1,
)

go_library(
name = "go_default_library",
srcs = [
"generated.pb.go",
"types.go",
],
deps = [
"//vendor/github.com/gogo/protobuf/proto:go_default_library",
"//vendor/github.com/gogo/protobuf/sortkeys:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/api/resource:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/util/intstr:go_default_library",
],
)

filegroup(
name = "go_default_library_protos",
srcs = ["generated.proto"],
visibility = ["//visibility:public"],
)
112 changes: 111 additions & 1 deletion docs/api-reference/v1/definitions.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2378,6 +2378,47 @@ <h3 id="_v1_execaction">v1.ExecAction</h3>
</tbody>
</table>

</div>
<div class="sect2">
<h3 id="_v1_secretreference">v1.SecretReference</h3>
<div class="paragraph">
<p>SecretReference represents a Secret Reference. It has enough information to retrieve secret in any namespace</p>
</div>
<table class="tableblock frame-all grid-all" style="width:100%; ">
<colgroup>
<col style="width:20%;">
<col style="width:20%;">
<col style="width:20%;">
<col style="width:20%;">
<col style="width:20%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Name</th>
<th class="tableblock halign-left valign-top">Description</th>
<th class="tableblock halign-left valign-top">Required</th>
<th class="tableblock halign-left valign-top">Schema</th>
<th class="tableblock halign-left valign-top">Default</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Name is unique within a namespace to reference a secret resource.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Namespace defines the space within which the secret name must be unique.</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
</tbody>
</table>

</div>
<div class="sect2">
<h3 id="_v1_objectmeta">v1.ObjectMeta</h3>
Expand Down Expand Up @@ -4847,6 +4888,75 @@ <h3 id="_v1_probe">v1.Probe</h3>
</tbody>
</table>

</div>
<div class="sect2">
<h3 id="_v1_cephfspersistentvolumesource">v1.CephFSPersistentVolumeSource</h3>
<div class="paragraph">
<p>Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.</p>
</div>
<table class="tableblock frame-all grid-all" style="width:100%; ">
<colgroup>
<col style="width:20%;">
<col style="width:20%;">
<col style="width:20%;">
<col style="width:20%;">
<col style="width:20%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Name</th>
<th class="tableblock halign-left valign-top">Description</th>
<th class="tableblock halign-left valign-top">Required</th>
<th class="tableblock halign-left valign-top">Schema</th>
<th class="tableblock halign-left valign-top">Default</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">monitors</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Required: Monitors is a collection of Ceph monitors More info: <a href="https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it">https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it</a></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string array</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">path</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Optional: Used as the mounted root, rather than the full Ceph tree, default is /</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">user</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Optional: User is the rados user name, default is admin More info: <a href="https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it">https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it</a></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">secretFile</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret More info: <a href="https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it">https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it</a></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">secretRef</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Optional: SecretRef is reference to the authentication secret for User, default is empty. More info: <a href="https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it">https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it</a></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_secretreference">v1.SecretReference</a></p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">readOnly</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: <a href="https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it">https://releases.k8s.io/HEAD/examples/volumes/cephfs/README.md#how-to-use-it</a></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">boolean</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
</tr>
</tbody>
</table>

</div>
<div class="sect2">
<h3 id="_v1_secretkeyselector">v1.SecretKeySelector</h3>
Expand Down Expand Up @@ -7419,7 +7529,7 @@ <h3 id="_v1_persistentvolumespec">v1.PersistentVolumeSpec</h3>
<td class="tableblock halign-left valign-top"><p class="tableblock">cephfs</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">CephFS represents a Ceph FS mount on the host that shares a pod&#8217;s lifetime</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_cephfsvolumesource">v1.CephFSVolumeSource</a></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_cephfspersistentvolumesource">v1.CephFSPersistentVolumeSource</a></p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
Expand Down
12 changes: 10 additions & 2 deletions pkg/api/persistentvolume/util.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,16 @@ func VisitPVSecretNames(pv *api.PersistentVolume, visitor Visitor) bool {
}
return true
case source.CephFS != nil:
if source.CephFS.SecretRef != nil && !visitor(getClaimRefNamespace(pv), source.CephFS.SecretRef.Name) {
return false
if source.CephFS.SecretRef != nil {
// previously persisted PV objects use claimRef namespace
ns := getClaimRefNamespace(pv)
if len(source.CephFS.SecretRef.Namespace) > 0 {
// use the secret namespace if namespace is set
ns = source.CephFS.SecretRef.Namespace
}
if !visitor(ns, source.CephFS.SecretRef.Name) {
return false
}
}
case source.FlexVolume != nil:
if source.FlexVolume.SecretRef != nil && !visitor(getClaimRefNamespace(pv), source.FlexVolume.SecretRef.Name) {
Expand Down
13 changes: 10 additions & 3 deletions pkg/api/persistentvolume/util_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -46,8 +46,15 @@ func TestPVSecrets(t *testing.T) {
{Spec: api.PersistentVolumeSpec{
ClaimRef: &api.ObjectReference{Namespace: "claimrefns", Name: "claimrefname"},
PersistentVolumeSource: api.PersistentVolumeSource{
CephFS: &api.CephFSVolumeSource{
SecretRef: &api.LocalObjectReference{
CephFS: &api.CephFSPersistentVolumeSource{
SecretRef: &api.SecretReference{
Name: "Spec.PersistentVolumeSource.CephFS.SecretRef",
Namespace: "cephfs"}}}}},
{Spec: api.PersistentVolumeSpec{
ClaimRef: &api.ObjectReference{Namespace: "claimrefns", Name: "claimrefname"},
PersistentVolumeSource: api.PersistentVolumeSource{
CephFS: &api.CephFSPersistentVolumeSource{
SecretRef: &api.SecretReference{
Name: "Spec.PersistentVolumeSource.CephFS.SecretRef"}}}}},
{Spec: api.PersistentVolumeSpec{
ClaimRef: &api.ObjectReference{Namespace: "claimrefns", Name: "claimrefname"},
Expand Down Expand Up @@ -81,7 +88,6 @@ func TestPVSecrets(t *testing.T) {
Name: "Spec.PersistentVolumeSource.StorageOS.SecretRef",
Namespace: "storageosns"}}}}},
}

extractedNames := sets.NewString()
extractedNamesWithNamespace := sets.NewString()
for _, pv := range pvs {
Expand Down Expand Up @@ -132,6 +138,7 @@ func TestPVSecrets(t *testing.T) {
"claimrefns/Spec.PersistentVolumeSource.AzureFile.SecretName",
"Spec.PersistentVolumeSource.AzureFile.SecretNamespace/Spec.PersistentVolumeSource.AzureFile.SecretName",
"claimrefns/Spec.PersistentVolumeSource.CephFS.SecretRef",
"cephfs/Spec.PersistentVolumeSource.CephFS.SecretRef",
"claimrefns/Spec.PersistentVolumeSource.FlexVolume.SecretRef",
"claimrefns/Spec.PersistentVolumeSource.RBD.SecretRef",
"claimrefns/Spec.PersistentVolumeSource.ScaleIO.SecretRef",
Expand Down
Loading

0 comments on commit ed6efbc

Please sign in to comment.