[LU-7845] Support namespace in credentials retrieval

• Status: Resolved
• Project: Lustre
• Fix Version/s: Lustre 2.10.0
• Type: New Feature
• Priority: Minor
• Reporter: Sebastien Buisson (Inactive)
• Assignee: John Hammond
• Resolution: Fixed
• Labels: patch

Description

We are running Lustre clients from Docker containers, and we try to have Kerberos authentication for them.
We hit an issue when Lustre code (kernel space, so running on the host) calls request_key to get Kerberos credentials. The problem is that the request_key function will call the userland helper function that is on the host, not in the container, because it has no idea that it all started from a container. The consequence is that Lustre cannot get the Kerberos credentials associated with the client in the container.

There are some ongoing discussions in the kernel to find the best way, if any, to address this problem of namespace between request_key and userland helper.
However, I think we cannot afford having a patched kernel on client side. So I started thinking about a way to be able to retrieve credentials stored inside a Docker container when Lustre is mounted from this container.
I will post a patch with my proposal.

Thanks,
Sebastien.

Issue Links

• is related to: LU-16557 don't skip add_conn with -o network m...
• is related to: LU-8392 sanity test_27z: soft lockup - CPU#0 ...

Comments

[Gerrit Updater]

Sebastien Buisson ([e-mail]) uploaded a new patch: http://review.whamcloud.com/18781
Subject: LU-7845 gss: support namespace in lgss_keyring
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 97a147b3c1103191251d8a63308c7428dc230d27

[Gerrit Updater]

Sebastien Buisson ([e-mail]) uploaded a new patch: http://review.whamcloud.com/18782
Subject: LU-7845 lnet: check if address is visible
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: a7a4ffe03eea7f6f17ccaad86c52d0f9e3717a0f

[Gerrit Updater]

Sebastien Buisson ([e-mail]) uploaded a new patch: http://review.whamcloud.com/19792
Subject: LU-7845 obd: add 'network' client mount option
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: c58fa1a8da4c43b26abefda54dbe46ec79cadc3f

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/18782/
Subject: LU-7845 lnet: check if address is visible
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 57b80581e8f13b9f7ddb4c1135390de1ec22b11d

[Gerrit Updater]

Oleg Drokin ([e-mail]) uploaded a new patch: http://review.whamcloud.com/21631
Subject: Revert "LU-7845 lnet: check if address is visible"
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 70a9b59ff792834bd540370cf7fd1fa91609deb3

[Sebastien Buisson (Inactive)]

Oleg,

I guess you reverted patch http://review.whamcloud.com/18782 to solve the issue described in LU-8392. But as the issue was still hit with patch http://review.whamcloud.com/21437 (patch that avoids calling lnet_ipif_query() while holding the lnet_net_lock), there is no clue that this patch is responsible for this soft lockup.

If you anyway think that patch http://review.whamcloud.com/21437 is necessary, let's work to have it merged.

Sebastien.

[John Hammond]

> But as the issue was still hit with patch http://review.whamcloud.com/21437 (patch that avoids calling lnet_ipif_query() while holding the lnet_net_lock), there is no clue that this patch is responsible for this soft lockup.

This patch calls LIBCFS_ALLOC() while holding the lock so it's also subject to soft lockup.

[Sebastien Buisson (Inactive)]

I pushed a new version of the patch at http://review.whamcloud.com/21437, that avoids calling LIBCFS_ALLOC() while holding the lock.

[Sebastien Buisson (Inactive)]

FYI, patch http://review.whamcloud.com/21437 successfully passed Maloo tests.
I have just retriggered them with:
Test-Parameters: fortestonly testlist=sanity,sanity,sanity,sanity
to see if it passes sanity consistently.

[Sebastien Buisson (Inactive)]

Hi,

Confirmed that http://review.whamcloud.com/21437 passes sanity tests consistently.

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/21631/
Subject: Revert "LU-7845 lnet: check if address is visible"
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 0f9fa5180fb015af656b8eea06f04b02abc02232

[Gerrit Updater]

Sebastien Buisson ([e-mail]) uploaded a new patch: http://review.whamcloud.com/21884
Subject: LU-7845 lnet: check if ni is in current net namespace
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 17aecba54686ec1ed45fd62944d3d61b48b547b6

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/21884/
Subject: LU-7845 lnet: check if ni is in current net namespace
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 9a7c0e1207becd10fb70672193ca39cbfabdcf84

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch https://review.whamcloud.com/18781/
Subject: LU-7845 gss: support namespace in lgss_keyring
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 94c44c62dea2cf1f2174569524721ded1bbd1ce7

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch https://review.whamcloud.com/19792/
Subject: LU-7845 obd: add 'network' client mount option
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 1cf11e1cf9a55fa71c873a5f485be4b63e3a5e39

[Peter Jones]

Landed for 2.10