Skip to content

Commit 0a0fef9

Browse files
lpettyjolpettyjo
authored
Merge pull request #99429 from lpettyjo/OSDOCS-16211
OSDOCS-16211# For Manila, allow multiple CDIRs when creating NFS vols
2 parents 83d6181 + 1daa7b9 commit 0a0fef9

File tree

3 files changed

+112
-1
lines changed

3 files changed

+112
-1
lines changed

‎modules/persistent-storage-csi-manila-dynamic-provisioning.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ You can use the same pod and persistent volume claim (PVC) definitions on-premis
1414

1515
[IMPORTANT]
1616
====
17-
By default the access-rule assigned to a volume is set to 0.0.0.0/0. To limit the clients that can mount the persistent volume (PV), create a new storage class with an IP or a subnet mask in the `nfs-shareClient` storage class parameter.
17+
By default, the access rule that is assigned to a volume is `0.0.0.0/0`, which allows access from all IPv4 clients. To limit client access, create custom storage classes that use specific client IP addresses or subnets. For more information, see Section _Customizing Manila share access rules_.
1818
====
1919

2020
[NOTE]

‎modules/persistent-storage-csi-manila-share-access-rules.adoc‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * storage/container_storage_interface/persistent-storage-csi-manila.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="persistent-storage-csi-manila-share-access-rules_{context}"]
7+
= Customizing Manila share access rules
8+
9+
By default, {product-title} creates Manila storage classes that provide access to all IPv4 clients. To limit client access, you can define custom storage classes that use specific client IP addresses or subnets by using the `nfs-ShareClient` parameter.
10+
11+
[IMPORTANT]
12+
====
13+
When using custom storage classes with restricted access rules, ensure that:
14+
15+
* The specified IP addresses or subnets include all {product-title} nodes that need to access the storage.
16+
17+
* The Manila service in {rh-openstack} supports the share type specified in the storage class.
18+
19+
* Network connectivity exists between the allowed clients and the Manila share servers.
20+
====
21+
22+
.Prerequisites
23+
24+
* {rh-openstack-first} is deployed with appropriate Manila share infrastructure.
25+
* Access to a cluster with administrator privileges.
26+
27+
.Procedure
28+
29+
. Create a YAML file for your custom storage class based on the following example:
30+
+
31+
.Example custom storage class file
32+
[source,yaml]
33+
----
34+
apiVersion: storage.k8s.io/v1
35+
kind: StorageClass
36+
metadata:
37+
name: csi-manila-gold-restricted <1>
38+
provisioner: manila.csi.openstack.org
39+
parameters:
40+
type: gold <2>
41+
nfs-ShareClient: "10.0.0.0/24,192.168.1.100" <3>
42+
csi.storage.k8s.io/provisioner-secret-name: manila-csi-secret
43+
csi.storage.k8s.io/provisioner-secret-namespace: openshift-manila-csi-driver
44+
csi.storage.k8s.io/controller-expand-secret-name: manila-csi-secret
45+
csi.storage.k8s.io/controller-expand-secret-namespace: openshift-manila-csi-driver
46+
csi.storage.k8s.io/node-stage-secret-name: manila-csi-secret
47+
csi.storage.k8s.io/node-stage-secret-namespace: openshift-manila-csi-driver
48+
csi.storage.k8s.io/node-publish-secret-name: manila-csi-secret
49+
csi.storage.k8s.io/node-publish-secret-namespace: openshift-manila-csi-driver
50+
allowVolumeExpansion: true
51+
----
52+
<1> Descriptive name for your custom storage class.
53+
<2> The Manila share type. This type must match an existing share type in your {rh-openstack} environment.
54+
<3> Comma-separated list of IP addresses or CIDR subnets allowed to access the NFS shares. The `nfs-ShareClient` parameter accepts various formats:
55+
+
56+
** Single IP address: `192.168.1.100`
57+
** CIDR subnet: `10.0.0.0/24`
58+
** Multiple entries: `10.0.0.0/24,192.168.1.100,172.16.0.0/16`
59+
+
60+
Ensure that the specified IP addresses or subnets include the {product-title} cluster nodes to allow proper mounting of the persistent volumes.
61+
+
62+
In this example, access is restricted to the `10.0.0.0/24` subnet, and the specific IP address is `192.168.1.100`.
63+
64+
. Apply the storage class from the file by running the following command:
65+
+
66+
[source,terminal]
67+
----
68+
$ oc apply -f custom-manila-storageclass.yaml
69+
----
70+
71+
. Verify that the storage class was created by running the following command:
72+
+
73+
[source,terminal]
74+
----
75+
$ oc get storageclass csi-manila-gold-restricted
76+
----
77+
+
78+
.Example output
79+
[source,terminal]
80+
----
81+
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
82+
csi-manila-gold-restricted manila.csi.openstack.org Delete Immediate true 43m
83+
----
84+
85+
. Create a persistent volume claim (PVC) that uses the custom storage class based on the following example:
86+
+
87+
.Example PVC file
88+
[source,yaml]
89+
----
90+
apiVersion: v1
91+
kind: PersistentVolumeClaim
92+
metadata:
93+
name: pvc-manila-restricted
94+
spec:
95+
accessModes:
96+
- ReadWriteMany
97+
resources:
98+
requests:
99+
storage: 10Gi
100+
storageClassName: csi-manila-gold-restricted <1>
101+
----
102+
<1> The name of your custom storage class that has restricted access. In this example, the name is `csi-manila-gold-restricted`.
103+
104+
. Apply the PVC from the file by running the following command:
105+
+
106+
[source,terminal]
107+
----
108+
$ oc apply -f pvc-manila-restricted.yaml
109+
----

‎storage/container_storage_interface/persistent-storage-csi-manila.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ include::modules/persistent-storage-csi-manila-limitations.adoc[leveloffset=+1]
2424

2525
include::modules/persistent-storage-csi-manila-dynamic-provisioning.adoc[leveloffset=+1]
2626

27+
include::modules/persistent-storage-csi-manila-share-access-rules.adoc[leveloffset=+1]
28+
2729
[role="_additional-resources"]
2830
.Additional resources
2931
* xref:../../storage/container_storage_interface/persistent-storage-csi.adoc#persistent-storage-csi[Configuring CSI volumes]

0 commit comments

Comments
 (0)