Skip to content

Commit 2fc5038

Browse files
pbuskomodulo11
pbusko
and
modulo11
authored
Support NFS volumes with nfsbroker (#8)
* Add support for NFS volumes Co-authored-by: Pavel Busko <pavel.busko@sap.com> * add codeowners Co-authored-by: Johannes Dillmann <j.dillmann@sap.com> * do not install nfs broker by default --------- Co-authored-by: Johannes Dillmann <j.dillmann@sap.com>
1 parent edfd800 commit 2fc5038

File tree

13 files changed

+301
-3
lines changed

13 files changed

+301
-3
lines changed

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @cloudfoundry/wg-app-runtime-deployments-kind-deployment-approvers

‎docker-bake.hcl‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ variable "REGISTRY_PREFIX" {
33
}
44

55
group "all" {
6-
targets = ["routing", "cf-networking", "capi", "diego", "loggregator", "loggregator-agent", "log-cache", "fileserver", "bosh-dns", "uaa", "cflinuxfs4", "misc"]
6+
targets = ["routing", "cf-networking", "capi", "diego", "loggregator", "loggregator-agent", "log-cache", "fileserver", "bosh-dns", "uaa", "cflinuxfs4", "nfs-volume", "misc"]
77
}
88

99
group "default" {
@@ -228,6 +228,25 @@ target "cflinuxfs4" {
228228
}
229229
}
230230

231+
variable "NFS_VOLUME_RELEASE_VERSION" {
232+
# renovate: depName=cloudfoundry/nfs-volume-release
233+
default = "7.47.0"
234+
}
235+
236+
target "nfs-volume" {
237+
dockerfile = "releases/nfs-volume-release/${component}.Dockerfile"
238+
tags = [ "${REGISTRY_PREFIX}${component}:latest", "${REGISTRY_PREFIX}${component}:${NFS_VOLUME_RELEASE_VERSION}" ]
239+
name = component
240+
241+
matrix = {
242+
"component" = [ "nfsv3driver", "nfsbroker" ]
243+
}
244+
245+
contexts = {
246+
"src" = "https://github.com/cloudfoundry/nfs-volume-release.git#v${NFS_VOLUME_RELEASE_VERSION}:src"
247+
}
248+
}
249+
231250
target "misc" {
232251
dockerfile = "releases/capi/${component}.Dockerfile"
233252
tags = [ "${REGISTRY_PREFIX}${component}:latest" ]

‎releases/credhub/helm/files/credhub.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,15 @@ security:
2929
operations:
3030
- read
3131
path: "/*"
32+
- actors:
33+
- uaa-client:nfs-broker-credhub-client
34+
operations:
35+
- read
36+
- write
37+
- delete
38+
- read_acl
39+
- write_acl
40+
path: /nfsbroker/*
3241
oauth2:
3342
enabled: true
3443
server:

‎releases/diego/helm/templates/bbs.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,6 @@ spec:
9393
- name: bbs
9494
image: {{ .Values.bbs.image.repository }}:{{ default .Chart.AppVersion .Values.bbs.image.tag }}
9595
imagePullPolicy: {{ .Values.bbs.image.imagePullPolicy }}
96-
imagePullPolicy: IfNotPresent
9796
ports:
9897
- containerPort: 8889
9998
{{- if .Values.bbs.resources }}

‎releases/nfs-volume-release/helm/Chart.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: nfs-volume-release
2+
apiVersion: v2
3+
version: 0.1.0
4+
description: A Helm chart for deploying NFS Volume Release components
5+
# renovate: depName=nfs-volume-release image=ghcr.io/cloudfoundry/k8s/nfsbroker
6+
appVersion: 7.47.0

‎releases/nfs-volume-release/helm/templates/nfsbroker.yaml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
{{- if .Values.nfsbroker.enabled }}
2+
---
3+
kind: ConfigMap
4+
apiVersion: v1
5+
metadata:
6+
name: nfsbroker-configmap
7+
data:
8+
services.json: |
9+
[
10+
{
11+
"id": "997f8f26-e10c-11e7-80c1-9a214cf093ae",
12+
"name": "nfs",
13+
"description": "Existing NFSv3 and v4 volumes (see: https://code.cloudfoundry.org/nfs-volume-release/)",
14+
"bindable": true,
15+
"plan_updateable": false,
16+
"tags": [
17+
"nfs"
18+
],
19+
"plans": [
20+
{
21+
"id": "09a09260-1df5-4445-9ed7-1ba56dadbbc8",
22+
"name": "Existing",
23+
"description": "A preexisting filesystem",
24+
"metadata": {
25+
"costs": [
26+
{
27+
"amount": {
28+
"usd": 0.0
29+
},
30+
"unit": "MONTHLY"
31+
}
32+
],
33+
"displayName": "Existing Filesystems"
34+
}
35+
}
36+
],
37+
"requires": [
38+
"volume_mount"
39+
],
40+
"metadata": {
41+
"displayName": "NFS V3 / V4 Volume Broker",
42+
"longDescription": "Broker for existing NFSv3 and v4 volumes",
43+
"providerDisplayName": "Dell / Pivotal",
44+
"documentationUrl": "https://docs.cloudfoundry.org/devguide/services/using-vol-services.html"
45+
}
46+
}
47+
]
48+
---
49+
kind: Secret
50+
apiVersion: v1
51+
type: Opaque
52+
metadata:
53+
name: nfsbroker-credentials
54+
stringData:
55+
USERNAME: nfsbroker
56+
PASSWORD: nfsbroker
57+
UAA_CLIENT_ID: "nfsbroker-credhub-client"
58+
UAA_CLIENT_SECRET: {{ .Values.nfsbroker.oauthClientsSecret | quote }}
59+
---
60+
kind: Deployment
61+
apiVersion: apps/v1
62+
metadata:
63+
name: nfsbroker
64+
labels:
65+
app: nfsbroker
66+
spec:
67+
replicas: 1
68+
selector:
69+
matchLabels:
70+
app: nfsbroker
71+
template:
72+
metadata:
73+
labels:
74+
app: nfsbroker
75+
spec:
76+
containers:
77+
- name: nfsbroker
78+
image: {{ .Values.nfsbroker.image.repository }}:{{ default .Chart.AppVersion .Values.nfsbroker.image.tag }}
79+
imagePullPolicy: {{ .Values.nfsbroker.image.imagePullPolicy }}
80+
ports:
81+
- containerPort: 8080
82+
envFrom:
83+
- secretRef:
84+
name: nfsbroker-credentials
85+
args:
86+
- --listenAddr=0.0.0.0:8080
87+
- --servicesConfig=/services.json
88+
- --credhubURL={{ .Values.nfsbroker.credhubURL }}
89+
- --credhubCACertPath=/ssl/ca.crt
90+
- --storeID=nfsbroker
91+
- --logLevel=info
92+
- --timeFormat=rfc3339
93+
- --allowedOptions=source,uid,gid,auto_cache,readonly,version,mount,cache
94+
volumeMounts:
95+
- name: server-certs
96+
mountPath: /ssl
97+
readOnly: true
98+
- name: services-config
99+
mountPath: /services.json
100+
subPath: services.json
101+
nodeSelector:
102+
cloudfoundry.org/workload: "false"
103+
volumes:
104+
- name: services-config
105+
configMap:
106+
name: nfsbroker-configmap
107+
- name: server-certs
108+
secret:
109+
secretName: {{ default .Values.nfsbroker.certificateSecret "nfsbroker" }}
110+
---
111+
kind: Service
112+
apiVersion: v1
113+
metadata:
114+
name: nfsbroker
115+
spec:
116+
ports:
117+
- port: 8080
118+
targetPort: 8080
119+
protocol: TCP
120+
selector:
121+
app: nfsbroker
122+
{{- if not .Values.nfsbroker.certificateSecret }}
123+
---
124+
apiVersion: cert-manager.io/v1
125+
kind: Certificate
126+
metadata:
127+
name: nfsbroker
128+
spec:
129+
secretName: nfsbroker
130+
commonName: client
131+
dnsNames:
132+
- nfsbroker
133+
- nfsbroker.{{ .Release.Namespace }}.svc
134+
- nfsbroker.{{ .Release.Namespace }}.svc.cluster.local
135+
issuerRef:
136+
name: ca-issuer
137+
kind: ClusterIssuer
138+
usages:
139+
- key encipherment
140+
- digital signature
141+
- server auth
142+
- client auth
143+
privateKey:
144+
rotationPolicy: Always
145+
{{- end }}
146+
{{- end }}

‎releases/nfs-volume-release/helm/templates/nfsv3driver.yaml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{{- if .Values.nfsv3driver.enabled }}
2+
kind: DaemonSet
3+
apiVersion: apps/v1
4+
metadata:
5+
name: nfsv3driver
6+
labels:
7+
app: nfsv3driver
8+
spec:
9+
selector:
10+
matchLabels:
11+
app: nfsv3driver
12+
template:
13+
metadata:
14+
labels:
15+
app: nfsv3driver
16+
spec:
17+
containers:
18+
- name: nfsv3driver
19+
image: {{ .Values.nfsv3driver.image.repository }}:{{ default .Chart.AppVersion .Values.nfsv3driver.image.tag }}
20+
imagePullPolicy: {{ .Values.nfsv3driver.image.imagePullPolicy }}
21+
env:
22+
- name: POD_IP
23+
valueFrom:
24+
fieldRef:
25+
fieldPath: status.podIP
26+
ports:
27+
- containerPort: 7589
28+
args:
29+
- --listenAddr=$(POD_IP):7589
30+
- --transport=tcp-json
31+
- --debugAddr=127.0.0.1:7689
32+
- --adminAddr=127.0.0.1:7590
33+
- --driversPath=/var/lib/rep/voldrivers
34+
- --mountDir=/var/lib/rep/volumes/nfs
35+
- --logLevel=info
36+
- --timeFormat=rfc3339
37+
- --mapfsPath=/usr/local/bin/mapfs
38+
volumeMounts:
39+
- name: voldrivers
40+
mountPath: /var/lib/rep/voldrivers
41+
mountPropagation: Bidirectional
42+
- name: nfs-mounts
43+
mountPath: /var/lib/rep/volumes/nfs
44+
mountPropagation: Bidirectional
45+
securityContext:
46+
privileged: true
47+
nodeSelector:
48+
cloudfoundry.org/workload: "true"
49+
volumes:
50+
- name: voldrivers
51+
hostPath:
52+
path: /var/lib/rep/voldrivers
53+
- name: nfs-mounts
54+
hostPath:
55+
path: /var/lib/rep/volumes/nfs
56+
{{- end }}

‎releases/nfs-volume-release/helm/values.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
nfsbroker:
2+
enabled: true
3+
certificateSecret: ~
4+
oauthClientsSecret: ~
5+
credhubURL: https://credhub.default.svc.cluster.local:8844
6+
image:
7+
repository: ghcr.io/cloudfoundry/k8s/nfsbroker
8+
tag: ~
9+
imagePullPolicy: IfNotPresent
10+
11+
12+
nfsv3driver:
13+
enabled: true
14+
image:
15+
repository: ghcr.io/cloudfoundry/k8s/nfsv3driver
16+
tag: ~
17+
imagePullPolicy: IfNotPresent

‎releases/nfs-volume-release/nfsbroker.Dockerfile‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
FROM --platform=$BUILDPLATFORM golang:1-alpine AS builder
2+
3+
ARG TARGETOS TARGETARCH
4+
5+
COPY --from=src . /nfs-volume-release/src
6+
WORKDIR /nfs-volume-release/src/code.cloudfoundry.org/nfsbroker
7+
8+
RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /usr/local/bin/nfsbroker code.cloudfoundry.org/nfsbroker
9+
10+
FROM alpine:latest
11+
12+
COPY --from=builder /usr/local/bin/nfsbroker /usr/local/bin
13+
14+
ENTRYPOINT [ "/usr/local/bin/nfsbroker" ]

‎releases/nfs-volume-release/nfsv3driver.Dockerfile‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
FROM --platform=$BUILDPLATFORM golang:1-alpine AS builder
2+
3+
ARG TARGETOS TARGETARCH
4+
5+
COPY --from=src . /nfs-volume-release/src
6+
7+
WORKDIR /nfs-volume-release/src/code.cloudfoundry.org/nfsv3driver
8+
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /usr/local/bin/nfsv3driver code.cloudfoundry.org/nfsv3driver/cmd/nfsv3driver
9+
10+
WORKDIR /nfs-volume-release/src/code.cloudfoundry.org/mapfs
11+
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /usr/local/bin/mapfs code.cloudfoundry.org/mapfs
12+
13+
FROM ubuntu:latest
14+
15+
COPY --from=builder /usr/local/bin/mapfs /usr/local/bin
16+
COPY --from=builder /usr/local/bin/nfsv3driver /usr/local/bin
17+
ADD --chmod=0755 releases/nfs-volume-release/nfsv3driver.sh /nfsv3driver.sh
18+
19+
RUN apt-get update && apt-get install -y nfs-common fuse
20+
21+
ENTRYPOINT [ "/nfsv3driver.sh" ]

0 commit comments

Comments
 (0)