Drop privileged from manila-share StatefulSet#597
Conversation
Unlike some valid use cases for glance and cinder, we never require a privileged Pod for manila-share. It can be run (even kolla) using Manila user and kolla group, which is sufficient to distribute config files and start the service. Signed-off-by: Francesco Pantano <fpantano@redhat.com>
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 5m 37s |
|
recheck |
|
/lgtm thank you @fmount! Agree. beyond the init actions, the operational parts for the share manager service (reading/writing files) doesn't need to be privileged on the host because the users have access. we might need to run privileged if we ever introduce a driver that needs to operate on a filesystem/device on the host (this could include dbus for instance). Currently, we don't support such drivers with this operator. If/when we do, we can make this conditional on the fact that someone is deploying with such a storage backend driver. |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 05m 22s |
@gouthampacha Not sure why this worked for me in unidelta but not in crc. I guess I have to redeploy it manually and check what's going on because I do not see logs here. Holding the patch until I reproduce and figure out the reason of the failure. |
This patch removes the var-lib-manila hostPath mount from manila-share. This is not required, especially from the host where the pod is scheduled. Signed-off-by: Francesco Pantano <fpantano@redhat.com>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fmount, gouthampacha The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
Bot
merged commit d389f08
into
openstack-k8s-operators:main
2 participants
Unlike some valid use cases for
glanceandcinder, we never require aprivilegedPodformanila-share.It can be always run using
Manilauserandkollagroup, which is sufficient to distribute config files and start the service.Jira: OSPRH-32347