mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-31 15:25:57 +00:00
Merge pull request #50843 from TerraTech/fvs-selinuxRelabel-init-1.8.x
Automatic merge from submit-queue (batch tested with PRs 51105, 51097, 51110, 50843, 51107) FlexVolume: Add ability to control 'SupportsSELinux' during driver's init phase **What this PR does / why we need it**: Adds the ability to disable FlexVolume SELinux relabeling for filesystems that don't support it, e.g. fuse **Which issue this PR fixes**: This was reported in: https://github.com/lizardfs/lizardfs/issues/581 This is a reworked solution as per feedback from #50548 https://github.com/kubernetes/kubernetes/pull/50548#issuecomment-322328679 **Special notes for your reviewer**: /assign @thockin /cc @chakri-nelluri @verult @saad-ali **Release note**: ```release-note NONE ```
This commit is contained in:
commit
4fb6c2891c
@ -59,7 +59,8 @@ const (
|
||||
|
||||
optionKeyServiceAccountName = "kubernetes.io/serviceAccount.name"
|
||||
|
||||
attachCapability = "attach"
|
||||
attachCapability = "attach"
|
||||
selinuxRelabelCapability = "selinuxRelabel"
|
||||
)
|
||||
|
||||
const (
|
||||
@ -82,6 +83,11 @@ type DriverCall struct {
|
||||
args []string
|
||||
}
|
||||
|
||||
type driverCapabilities struct {
|
||||
attach bool
|
||||
selinuxRelabel bool
|
||||
}
|
||||
|
||||
func (plugin *flexVolumePlugin) NewDriverCall(command string) *DriverCall {
|
||||
return plugin.NewDriverCallWithTimeout(command, 0)
|
||||
}
|
||||
@ -235,3 +241,23 @@ func handleCmdResponse(cmd string, output []byte) (*DriverStatus, error) {
|
||||
|
||||
return &status, nil
|
||||
}
|
||||
|
||||
// getDriverCapabilities returns the reported capabilities as returned by driver's init() function
|
||||
func (ds *DriverStatus) getDriverCapabilities() *driverCapabilities {
|
||||
driverCaps := &driverCapabilities{
|
||||
attach: true,
|
||||
selinuxRelabel: true,
|
||||
}
|
||||
|
||||
// Check if driver supports SELinux Relabeling of mounted volume
|
||||
if dcap, ok := ds.Capabilities[selinuxRelabelCapability]; ok {
|
||||
driverCaps.selinuxRelabel = dcap
|
||||
}
|
||||
|
||||
// Check whether the plugin is attachable.
|
||||
if dcap, ok := ds.Capabilities[attachCapability]; ok {
|
||||
driverCaps.attach = dcap
|
||||
}
|
||||
|
||||
return driverCaps
|
||||
}
|
||||
|
@ -47,7 +47,7 @@ func (f *mounterDefaults) GetAttributes() volume.Attributes {
|
||||
return volume.Attributes{
|
||||
ReadOnly: f.readOnly,
|
||||
Managed: !f.readOnly,
|
||||
SupportsSELinux: true,
|
||||
SupportsSELinux: f.flexVolume.plugin.capabilities.selinuxRelabel,
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -42,6 +42,7 @@ type flexVolumePlugin struct {
|
||||
runner exec.Interface
|
||||
|
||||
sync.Mutex
|
||||
capabilities *driverCapabilities
|
||||
unsupportedCommands []string
|
||||
}
|
||||
|
||||
@ -64,44 +65,29 @@ func NewFlexVolumePlugin(pluginDir, name string) (volume.VolumePlugin, error) {
|
||||
unsupportedCommands: []string{},
|
||||
}
|
||||
|
||||
// Check whether the plugin is attachable.
|
||||
ok, err := isAttachable(flexPlugin)
|
||||
// Retrieve driver reported capabilities
|
||||
call := flexPlugin.NewDriverCall(initCmd)
|
||||
ds, err := call.Run()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if ok {
|
||||
// Plugin supports attach/detach, so return flexVolumeAttachablePlugin
|
||||
driverCaps := ds.getDriverCapabilities()
|
||||
flexPlugin.capabilities = driverCaps
|
||||
|
||||
// Check whether the plugin is attachable.
|
||||
if driverCaps.attach {
|
||||
// Plugin supports attach/detach by default, so return flexVolumeAttachablePlugin
|
||||
return &flexVolumeAttachablePlugin{flexVolumePlugin: flexPlugin}, nil
|
||||
} else {
|
||||
return flexPlugin, nil
|
||||
}
|
||||
}
|
||||
|
||||
func isAttachable(plugin *flexVolumePlugin) (bool, error) {
|
||||
call := plugin.NewDriverCall(initCmd)
|
||||
res, err := call.Run()
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
|
||||
// By default all plugins are attachable, unless they report otherwise.
|
||||
cap, ok := res.Capabilities[attachCapability]
|
||||
if ok {
|
||||
// cap is false, so plugin does not support attach/detach calls.
|
||||
return cap, nil
|
||||
}
|
||||
|
||||
return true, nil
|
||||
}
|
||||
|
||||
// Init is part of the volume.VolumePlugin interface.
|
||||
func (plugin *flexVolumePlugin) Init(host volume.VolumeHost) error {
|
||||
plugin.host = host
|
||||
// call the init script
|
||||
call := plugin.NewDriverCall(initCmd)
|
||||
_, err := call.Run()
|
||||
return err
|
||||
// Hardwired 'success' as any errors from calling init() will be caught by NewFlexVolumePlugin()
|
||||
return nil
|
||||
}
|
||||
|
||||
func (plugin *flexVolumePlugin) getExecutable() string {
|
||||
|
Loading…
Reference in New Issue
Block a user