Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

only set spec.volumes readonly if PVC is readonly for datamover #8284

Merged
merged 1 commit into from
Oct 11, 2024

Conversation

sseago
Copy link
Collaborator

@sseago sseago commented Oct 9, 2024

Thank you for contributing to Velero!

Please add a summary of your change

Only set pod.spec.volumes entry readOnly if backup PVC is configured to be read-only

Does your change fix a particular issue?

Fixes #(issue)

Please indicate you've done the following:

Copy link

codecov bot commented Oct 9, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 59.21%. Comparing base (ba0dbb9) to head (de7a414).
Report is 4 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #8284   +/-   ##
=======================================
  Coverage   59.20%   59.21%           
=======================================
  Files         367      367           
  Lines       30838    30840    +2     
=======================================
+ Hits        18259    18261    +2     
  Misses      11119    11119           
  Partials     1460     1460           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Collaborator

@shubham-pampattiwar shubham-pampattiwar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't we make the pod-pvc attachment also configurable i.e. based on the value of readOnly flag ?

@sseago
Copy link
Collaborator Author

sseago commented Oct 9, 2024

@shubham-pampattiwar I'm not 100% certain here. I was going for minimal change to make this work, and in my testing, what is required for SELinux relabeling to work is for PVC AccessMode and pod.spec.volumes entry to be read-write, but it's fine if pod's volumeMounts entry is readOnly. Backup succeeds. The effect of this combination is volume relabeling prior to mount works, but mounted filesystem is readonly by the pod user -- so velero can't accidentally modify the filesystem. If we set volumeMount readwrite when PVC is not readonly, then velero could modify it.

Are there cases where having volumeMounts readonly for non-shallow-copy will break? I can't think of any, but I'm not 100% sure. My inclination is to leave as-is until we see a problem, but I'm open to suggestion here. What do others think?

Signed-off-by: Scott Seago <sseago@redhat.com>
@Lyndon-Li Lyndon-Li merged commit f02613d into vmware-tanzu:main Oct 11, 2024
45 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants