Skip to content

nfs: add support for modifying clients parameter via VolumeAttributesClass - #6219

Merged
mergify[bot] merged 5 commits into
ceph:develfrom
nixpanic:ai/bob/nfs/ControllerModifyVolume/clients
Jul 30, 2026
Merged

nfs: add support for modifying clients parameter via VolumeAttributesClass#6219
mergify[bot] merged 5 commits into
ceph:develfrom
nixpanic:ai/bob/nfs/ControllerModifyVolume/clients

Conversation

@nixpanic

@nixpanic nixpanic commented Apr 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Describe what this PR does

This PR adds support for modifying the NFS clients parameter using VolumeAttributesClass. This allows administrators to update the list of hostnames, networks, or IP addresses that are allowed to access an NFS export after the volume has been created, without needing to recreate the volume.

The implementation includes:

  • Support for the clients parameter in ControllerModifyVolume CSI method
  • Helper method SetClients() in the NFSVolume type to persist the clients list in the export configuration
  • Comprehensive E2E test that validates the functionality by:
    • Creating a volume with restrictive clients (1.1.1.1)
    • Verifying that an app fails to mount with restrictive settings
    • Updating the clients parameter via VolumeAttributesClass to allow all clients (0.0.0.0/0)
    • Verifying that the app successfully mounts after the update
  • Updated documentation in example YAML files

Is there anything that requires special attention

Kubernetes Version Requirement: This feature requires Kubernetes >= 1.34, as VolumeAttributesClass is a newer Kubernetes feature. The E2E test includes a version check to skip on older clusters.

Backward Compatibility: This change is fully backward compatible. The clients parameter remains optional and existing volumes continue to work without modification. The feature only activates when a VolumeAttributesClass is applied to update the parameter.

Security Consideration: Administrators should be aware that updating the clients parameter can expand or restrict access to NFS exports. The E2E test demonstrates both restrictive and permissive configurations to validate proper behavior.

Related issues

This PR implements support for modifying NFS export access controls dynamically, which is useful for scenarios where access requirements change after volume provisioning.

Depends-on: ceph/go-ceph#1261

Future concerns

  • Additional mutable parameters could be supported in future PRs (e.g., secType)
  • Consider adding validation for the clients parameter format to catch configuration errors early
Show available bot commands

These commands are normally not required, but in case of issues, leave any of
the following bot commands in an otherwise empty comment in this PR:

  • /retest ci/centos/<job-name>: retest the <job-name> after unrelated
    failure (please report the failure too!)

@mergify mergify Bot added the component/nfs Issues related to NFS label Apr 2, 2026
@nixpanic

nixpanic commented Apr 2, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/k8s-e2e-external-storage/1.35/cephfs

nixpanic
nixpanic commented Apr 2, 2026
View reviewed changes
Comment thread internal/nfs/types/volume.go Outdated
@nixpanic
nixpanic force-pushed the ai/bob/nfs/ControllerModifyVolume/clients branch 6 times, most recently from 100405b to c27e00a Compare April 3, 2026 08:28
@nixpanic

nixpanic commented Apr 3, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/k8s-e2e-external-storage/1.35/cephfs

@nixpanic

nixpanic commented Apr 3, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/mini-e2e-helm/k8s-1.35/cephfs

@nixpanic

nixpanic commented Apr 3, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/mini-e2e-helm/k8s-1.35/nfs

@nixpanic

nixpanic commented Apr 3, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/mini-e2e-helm/k8s-1.35

@nixpanic

nixpanic commented Apr 7, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/mini-e2e/k8s-1.35/cephfs

@nixpanic

nixpanic commented Apr 8, 2026

Copy link
Copy Markdown
Member Author

from the logs:

  [FAIL] nfs Test NFS CSI [It] create a storageclass with clients restriction and modify it with VolumeAttributesClass

Still investigating why this happened.

@nixpanic
nixpanic force-pushed the ai/bob/nfs/ControllerModifyVolume/clients branch from c27e00a to 05387b2 Compare April 8, 2026 07:56
@nixpanic

nixpanic commented Apr 8, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/mini-e2e/k8s-1.35/cephfs

@nixpanic
nixpanic force-pushed the ai/bob/nfs/ControllerModifyVolume/clients branch from 05387b2 to d09bc7c Compare April 8, 2026 16:31
@nixpanic

nixpanic commented Apr 8, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/mini-e2e/k8s-1.35/nfs

@nixpanic

nixpanic commented Apr 14, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/mini-e2e/k8s-1.35/cephfs

@nixpanic
nixpanic force-pushed the ai/bob/nfs/ControllerModifyVolume/clients branch from d09bc7c to c98cc9e Compare April 16, 2026 09:25
@nixpanic

nixpanic commented Apr 16, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/mini-e2e/k8s-1.35/cephfs

1 similar comment
@nixpanic

nixpanic commented Apr 16, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/mini-e2e/k8s-1.35/cephfs

@nixpanic
nixpanic force-pushed the ai/bob/nfs/ControllerModifyVolume/clients branch from 1daa523 to 9df6b50 Compare April 17, 2026 08:09
@nixpanic

nixpanic commented Apr 17, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/mini-e2e/k8s-1.35/cephfs

@nixpanic
nixpanic force-pushed the ai/bob/nfs/ControllerModifyVolume/clients branch from 9df6b50 to 67f7e3c Compare April 17, 2026 08:17
@nixpanic

nixpanic commented Apr 17, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/mini-e2e/k8s-1.35/cephfs

@nixpanic
nixpanic force-pushed the ai/bob/nfs/ControllerModifyVolume/clients branch from 67f7e3c to 736d84f Compare April 17, 2026 10:37
@nixpanic

nixpanic commented Apr 17, 2026

Copy link
Copy Markdown
Member Author

/test ci/centos/mini-e2e/k8s-1.35/cephfs

@nixpanic
nixpanic force-pushed the ai/bob/nfs/ControllerModifyVolume/clients branch from 736d84f to b5925aa Compare April 17, 2026 12:03
nixpanic added 5 commits July 29, 2026 10:02
@nixpanic @ceph-csi-bot
nfs: make clients a mutable-parameter
51b5414 
The ControllerModifyVolume CSI procedure can now be used to modify the
`clients` parameter that was originally configured in the StorageClass.

The SetClients() method uses the NFS Admin API to update the export on
the cluster (via ExportInfo + ApplyExportInfo) and stores the value in
the journal for persistence.

Assisted-by: AskBob <askbob@ibm.com>
Signed-off-by: Niels de Vos <ndevos@ibm.com>
@nixpanic @ceph-csi-bot
e2e: add NFS test for modifying clients via VolumeAttributesClass
fadf8e6 
Add comprehensive e2e test that verifies the clients parameter can be
modified using VolumeAttributesClass. The test:
- Creates a volume with restrictive clients (1.1.1.1)
- Verifies that an app fails to mount with restrictive settings
- Updates the clients parameter via VolumeAttributesClass to allow all
  clients (*)
- Verifies that the app successfully mounts after the update

The test runs just before the cleanup phase to ensure proper test
sequencing.

Assisted-by: AskBob <askbob@ibm.com>
Signed-off-by: Niels de Vos <ndevos@ibm.com>
@nixpanic @ceph-csi-bot
e2e: log clients and exports if match is not found
b12269c 
Signed-off-by: Niels de Vos <ndevos@ibm.com>
@nixpanic @ceph-csi-bot
e2e: delete NFS StorageClass in case it already exists
204b782 
Signed-off-by: Niels de Vos <ndevos@ibm.com>
@nixpanic @ceph-csi-bot
util: log stacktrace once on slow operation when tracing is enabled
d42c7bc 
When there is a slow operation, it would be very useful to know where
the operation is blocked. By logging the stacktraces from all
goroutines, it should become easier to identify the cause.

Signed-off-by: Niels de Vos <ndevos@ibm.com>
@ceph-csi-bot
ceph-csi-bot force-pushed the ai/bob/nfs/ControllerModifyVolume/clients branch from 699e0bc to d42c7bc Compare July 29, 2026 10:02
@ceph-csi-bot ceph-csi-bot added ok-to-test Label to trigger E2E tests and removed queued/rebase labels Jul 29, 2026
@ceph-csi-bot

ceph-csi-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

/test ci/centos/k8s-e2e-external-storage/1.34

@ceph-csi-bot

ceph-csi-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

/test ci/centos/mini-e2e-helm/k8s-1.34

@ceph-csi-bot

ceph-csi-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

/test ci/centos/k8s-e2e-external-storage/1.36

@ceph-csi-bot

ceph-csi-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

/test ci/centos/mini-e2e/k8s-1.34

@ceph-csi-bot

ceph-csi-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

/test ci/centos/k8s-e2e-external-storage/1.35

@ceph-csi-bot

ceph-csi-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

/test ci/centos/mini-e2e-helm/k8s-1.36

@ceph-csi-bot

ceph-csi-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

/test ci/centos/mini-e2e-helm/k8s-1.35

@ceph-csi-bot

ceph-csi-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

/test ci/centos/mini-e2e/k8s-1.36

@ceph-csi-bot

ceph-csi-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

/test ci/centos/mini-e2e/k8s-1.35

@ceph-csi-bot

ceph-csi-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

/test ci/centos/upgrade-tests-cephfs

@ceph-csi-bot

ceph-csi-bot commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

/test ci/centos/upgrade-tests-rbd

@ceph-csi-bot ceph-csi-bot added ci/in-progress/e2e This label acts like a guard and prevents Mergify from adding the `ok-to-test` label again. and removed ok-to-test Label to trigger E2E tests labels Jul 29, 2026
@mergify mergify Bot removed the ci/in-progress/e2e This label acts like a guard and prevents Mergify from adding the `ok-to-test` label again. label Jul 29, 2026
@nixpanic

nixpanic commented Jul 29, 2026

Copy link
Copy Markdown
Member Author

/retest ci/centos/mini-e2e/k8s-1.35

@nixpanic

nixpanic commented Jul 29, 2026

Copy link
Copy Markdown
Member Author

/retest ci/centos/mini-e2e/k8s-1.35

nfs Test NFS CSI [It] create a PVC clone and bind it to an app

logs

@nixpanic

nixpanic commented Jul 30, 2026

Copy link
Copy Markdown
Member Author

/retest ci/centos/mini-e2e/k8s-1.35

@nixpanic

nixpanic commented Jul 30, 2026

Copy link
Copy Markdown
Member Author

/retest ci/centos/mini-e2e/k8s-1.35

Failed again with

nfs Test NFS CSI [It] test volumeGroupSnapshot

logs

@mergify

mergify Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Merge Protections

🟢 All 2 merge protections satisfied — ready to merge.

Show 2 satisfied protections

🟢 ⛓️ Depends-On Requirements

Requirement based on the presence of Depends-On in the body of the pull request

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

@mergify

mergify Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Deprecation notice: This pull request comes from a fork and was queued with update_method=rebase and update_bot_account impersonation. This capability will be removed on July 1, 2026. After this date, the merge queue will no longer be able to rebase fork pull requests with this configuration. To avoid disruption, switch to update_method=merge in your queue rule.

@mergify

mergify Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Merge Queue Status

  • ✅ Entered queue — 2026-07-30 07:06 UTC · Rule: default · triggered by merge protections
  • ✅ Checks skipped · PR is already up-to-date
  • ✅ Merged — 2026-07-30 07:06 UTC · at d42c7bc6f9fd172dcbf52e9eb511cb27898468a6 · rebase

This pull request spent 9 seconds in the queue, including 1 second running CI.

Required conditions to merge

@mergify
mergify Bot merged commit d67d704 into ceph:devel Jul 30, 2026
43 of 44 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@black-dragon74 black-dragon74 black-dragon74 approved these changes
@Madhu-1 Madhu-1 Madhu-1 approved these changes

Assignees

No one assigned

Labels

component/nfs Issues related to NFS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@nixpanic @iPraveenParihar @ceph-csi-bot @black-dragon74 @Madhu-1