[manila-csi-plugin] support muilple share rules #2915

silvacarloss · 2025-06-26T13:15:50Z

What this PR does / why we need it:
Manila currently supports only setting a single access rule, making it difficult to have multiple access rules to a shared file system, which is a common scenario in a cloud where we need to have multiple clients being able to mount the shares simultaneously. This PR introduces support for multiple share access rules by accepting a list of IPs/Cephx users instead of a single string.

Which issue this PR fixes(if applicable):
fixes #2725

Special notes for reviewers:

Author of the change stated that they didn't have a CephFS environment, so could not test it with CephFS.
Another pull request was proposed for this issue [1], but due to maintainers not being able to update and rebase the original author's PR, we opened a new PR.
[1] #2727

Release note:

[manila-csi-plugin] Added support for configuring multiple share access rules to a shared filesystem.

k8s-ci-robot · 2025-06-26T13:16:01Z

Welcome @silvacarloss!

It looks like this is your first PR to kubernetes/cloud-provider-openstack 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/cloud-provider-openstack has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2025-06-26T13:16:02Z

Hi @silvacarloss. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

kayrus · 2025-06-26T14:39:27Z

/ok-to-test

I'll make a review a bit later

k8s-ci-robot · 2025-07-23T21:28:53Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign zetaab for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

gouthampacha

Hi @silvacarloss

Thanks for updating this change. Please see comments inline

examples/manila-csi-plugin/nfs/static-provisioning/preprovisioned-pvc.yaml

pkg/csi/manila/nodeserver.go

pkg/csi/manila/shareadapters/cephfs.go

pkg/csi/manila/shareadapters/nfs.go

linux-foundation-easycla · 2025-08-14T14:28:01Z

The committers listed above are authorized under a signed CLA.

✅ login: moonek / name: Mason Choi (6f5d44e)

silvacarloss · 2025-08-18T19:10:27Z

/retest

gouthampacha

Hi, a comment inline regarding backwards compatibility; I think you've demonstrated that it works well with NFS, and it'd be nice to test with CephFS as well to be sure. Thanks @silvacarloss

docs/manila-csi-plugin/using-manila-csi-plugin.md

mandre

I believe we need to polish the options for cleanliness and more importantly to avoid breaking backward compatibility. I'm also surprised that it's working at all since we seems to be using a deprecated API call to list accesses which is supposed to return 404.

docs/manila-csi-plugin/using-manila-csi-plugin.md

pkg/csi/manila/shareadapters/shareadapter.go

mandre · 2025-08-21T07:01:54Z

pkg/csi/manila/nodeserver.go

 	// Build volume context for fwd plugin

 	sa := getShareAdapter(ns.d.shareProto)
+	accessRight = getAccessRightBasedOnShareAdapter(sa, accessRights, shareOpts.ShareAccessIDs)


If we're not using the returned value, perhaps replace the variable with _ ?

good question... accessRight was defined in the function signature, so it's empty. When we get to this getAccessRightBasedOnShareAdapter function, it might (or might not) return an access right, which should populate the accessRight value that will be returned, so it's part of assigning a value so it will work with the naked return behavior. I'm kinda new to go and not sure if the naked return is a good practice, so please let me know if this is okay :)

pkg/csi/manila/shareadapters/nfs.go

mandre · 2025-08-21T08:29:36Z

pkg/csi/manila/shareadapters/cephfs.go

-				klog.V(4).Infof("cephx access right for share %s already exists", args.Share.Name)
+	accessToList := []string{args.Share.Name}
+	if args.Options.CephfsClientID != "" {
+		accessToList = strings.Split(args.Options.CephfsClientID, ",")


Same comment as for NFS, we should document that cephfs-clientID takes a list of comma-separated IDs.

That being said, we probably need a new option in plural form, deprecating cephfs-clientID. Same goes for nfs-shareClient.

Changed the doc. Can we keep the current options for now and follow-up on this later? We should also introduce one of the things I mentioned in the todos: get the node's context and simplify the nodeserver code by only looking up for the access rule that will be used for that given node.

pkg/csi/manila/shareadapters/cephfs.go

silvacarloss

Thank you very much for the feedback. Please take a look at the changes and replies inline :)

docs/manila-csi-plugin/using-manila-csi-plugin.md

silvacarloss · 2025-08-21T13:04:32Z

pkg/csi/manila/nodeserver.go

 	// Build volume context for fwd plugin

 	sa := getShareAdapter(ns.d.shareProto)
+	accessRight = getAccessRightBasedOnShareAdapter(sa, accessRights, shareOpts.ShareAccessIDs)


good question... accessRight was defined in the function signature, so it's empty. When we get to this getAccessRightBasedOnShareAdapter function, it might (or might not) return an access right, which should populate the accessRight value that will be returned, so it's part of assigning a value so it will work with the naked return behavior. I'm kinda new to go and not sure if the naked return is a good practice, so please let me know if this is okay :)

silvacarloss · 2025-08-21T13:31:07Z

pkg/csi/manila/shareadapters/cephfs.go

-				klog.V(4).Infof("cephx access right for share %s already exists", args.Share.Name)
+	accessToList := []string{args.Share.Name}
+	if args.Options.CephfsClientID != "" {
+		accessToList = strings.Split(args.Options.CephfsClientID, ",")


Changed the doc. Can we keep the current options for now and follow-up on this later? We should also introduce one of the things I mentioned in the todos: get the node's context and simplify the nodeserver code by only looking up for the access rule that will be used for that given node.

pkg/csi/manila/shareadapters/nfs.go

pkg/csi/manila/shareadapters/shareadapter.go

pkg/csi/manila/shareadapters/cephfs.go

pkg/csi/manila/shareadapters/nfs.go

gouthampacha

Thank you @silvacarloss ; this looks good to me hoping CI passes.

pkg/csi/manila/shareadapters/shareadapter.go

silvacarloss · 2025-09-25T21:22:51Z

Hello, as we mentioned a couple of weeks ago we were testing further with CephFS. We can confirm that all tests passed.

gouthampacha · 2025-09-25T21:55:02Z

/lgtm

thank you @silvacarloss

kayrus · 2025-10-02T12:19:51Z

docs/manila-csi-plugin/using-manila-csi-plugin.md

 `shareID` | if `shareName` is not given | The UUID of the share
 `shareName` | if `shareID` is not given | The name of the share
-`shareAccessID` | _yes_ | The UUID of the access rule for the share
+`shareAccessIDs` | _yes_ | Comma separated UUIDs of access rules for the share


This breaks backward compatibility with the old schema. Can you rework the PR and add an ability to use both shareAccessIDs (prioritized) and shareAccessID (failover)?

The code does that: https://github.com/kubernetes/cloud-provider-openstack/pull/2915/files#diff-b8c02436df6d507c2e4c14d7e8ae1380ff392de803e3778f2ba187a9ffd24cb2R41-R49

I didn't insist that in the documentation though; should be okay? I don't know if we need another line below here that states shareAccessID is also possible to be used.

Hey, good point and thanks for the feedback! So the share adapter file in this PR is handling that situation in this function: getAccessIDs. So we first check if there is a value for shareAccessIDs and then we attempt with shareAccessID. If you prefer, we can keep the shareAccessID in this part of the documentation and add a note mentioning that multiple access IDS field is encouraged, as we did in the shareoptions.go. Is there some other place I'm missing this though?

Hey, I have just updated the documentation to keep the shareAccessID parameter as well. We are doing the handling in the code and I was also able to test it and ensure this is working just fine.

kayrus · 2025-10-02T12:21:17Z

/hold

kayrus

see also the #3000

silvacarloss · 2025-10-14T20:26:09Z

see also the #3000

@kayrus thank you for the heads-up and for the review. Can we keep #3000 as a separate issue and deal with it in another pull request? The current pull request is addressing an RFE we heard from a couple of deployments, so would be nice if we don't need to hold because of the access rule state issue. We can fix the other issue as soon as we have the cycles to.

gouthampacha · 2025-10-14T20:56:38Z

/retest-required

silvacarloss · 2025-10-14T22:32:01Z

/retest-required

Apparently hitting an image pull issue

Signed-off-by: moonek <[email protected]> Signed-off-by: Carlos da Silva <[email protected]>

silvacarloss · 2025-10-15T11:52:38Z

Rebased on top of master to pick up the image pull fix.

gouthampacha

/lgtm

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jun 26, 2025

k8s-ci-robot requested review from Fedosin and tsmetana June 26, 2025 13:15

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 26, 2025

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jun 26, 2025

silvacarloss mentioned this pull request Jun 26, 2025

[manila-csi-plugin] support muilple share rules #2727

Closed

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 26, 2025

silvacarloss force-pushed the support-multiple-share-rules-manila-csi branch from e100d6b to e7984fb Compare July 23, 2025 21:28

silvacarloss force-pushed the support-multiple-share-rules-manila-csi branch from e7984fb to e1c1dfc Compare July 24, 2025 12:23

silvacarloss force-pushed the support-multiple-share-rules-manila-csi branch from e1c1dfc to a4a50ea Compare August 4, 2025 17:03

gouthampacha reviewed Aug 4, 2025

View reviewed changes

silvacarloss force-pushed the support-multiple-share-rules-manila-csi branch from a4a50ea to 978dd3d Compare August 14, 2025 13:50

silvacarloss force-pushed the support-multiple-share-rules-manila-csi branch from cc098b5 to 7e80d0a Compare August 18, 2025 15:27

silvacarloss force-pushed the support-multiple-share-rules-manila-csi branch from 7e80d0a to bcfd545 Compare August 20, 2025 18:20

gouthampacha reviewed Aug 21, 2025

View reviewed changes

docs/manila-csi-plugin/using-manila-csi-plugin.md Outdated Show resolved Hide resolved

mandre reviewed Aug 21, 2025

View reviewed changes

silvacarloss force-pushed the support-multiple-share-rules-manila-csi branch from bcfd545 to d308dc2 Compare August 21, 2025 17:52

silvacarloss commented Aug 21, 2025

View reviewed changes

gouthampacha approved these changes Aug 21, 2025

View reviewed changes

mandre reviewed Aug 21, 2025

View reviewed changes

pkg/csi/manila/shareadapters/shareadapter.go Outdated Show resolved Hide resolved

silvacarloss force-pushed the support-multiple-share-rules-manila-csi branch from d308dc2 to bf72548 Compare August 21, 2025 19:32

k8s-ci-robot assigned gouthampacha Sep 25, 2025

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 25, 2025

kayrus reviewed Oct 2, 2025

View reviewed changes

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 2, 2025

kayrus reviewed Oct 2, 2025

View reviewed changes

gouthampacha mentioned this pull request Oct 9, 2025

release 1.34.0 #3011

Merged

mandre mentioned this pull request Oct 14, 2025

Rebase main onto release-1.34 openshift/cloud-provider-openstack#354

Open

silvacarloss force-pushed the support-multiple-share-rules-manila-csi branch from bf72548 to e48032d Compare October 14, 2025 20:20

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 14, 2025

silvacarloss requested a review from kayrus October 14, 2025 20:26

[manila-csi-plugin] support muilple share rules

6f5d44e

Signed-off-by: moonek <[email protected]> Signed-off-by: Carlos da Silva <[email protected]>

silvacarloss force-pushed the support-multiple-share-rules-manila-csi branch from e48032d to 6f5d44e Compare October 15, 2025 11:52

silvacarloss requested review from gouthampacha and mandre October 15, 2025 13:29

gouthampacha approved these changes Oct 15, 2025

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 15, 2025

[manila-csi-plugin] support muilple share rules #2915

Are you sure you want to change the base?

[manila-csi-plugin] support muilple share rules #2915

Conversation

silvacarloss commented Jun 26, 2025

Uh oh!

k8s-ci-robot commented Jun 26, 2025

Uh oh!

k8s-ci-robot commented Jun 26, 2025

Uh oh!

kayrus commented Jun 26, 2025

Uh oh!

k8s-ci-robot commented Jul 23, 2025

Uh oh!

gouthampacha left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

linux-foundation-easycla bot commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

silvacarloss commented Aug 18, 2025

Uh oh!

gouthampacha left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mandre left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

silvacarloss left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gouthampacha left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

silvacarloss commented Sep 25, 2025

Uh oh!

gouthampacha commented Sep 25, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kayrus commented Oct 2, 2025

Uh oh!

kayrus left a comment

Choose a reason for hiding this comment

Uh oh!

linux-foundation-easycla bot commented Aug 14, 2025 •

edited

Loading