Skip to content
This repository has been archived by the owner on Feb 22, 2022. It is now read-only.

[stable/minio] k8s mountPath and minio server root DIR should be decoupled #19939

Closed
gzur opened this issue Jan 8, 2020 · 0 comments · Fixed by #19949
Closed

[stable/minio] k8s mountPath and minio server root DIR should be decoupled #19939

gzur opened this issue Jan 8, 2020 · 0 comments · Fixed by #19949

Comments

@gzur
Copy link
Contributor

gzur commented Jan 8, 2020

Problem statement
The minio Pod to only mounts the exact path that's passed to the minio executable, making it impossible to point to symlinks that lie outside of the minio bucket root.

It would be nice if the minio helm chart could show the symlink targets without exposing/traversing their location directly.

I was unable to achieve this using the current helm chart, since it uses a single variable ( .Values.mountPath ) for both the volumeMount and the DIR argument for the minio executable in deployment.yaml:

# simplified yaml
command:
   - minio server {{ .Values.mountPath }}" 
and
volumeMounts:
  {{- if and .Values.persistence.enabled [...] }}
  - name: export
    mountPath: {{ .Values.mountPath }}

Describe the solution you'd like
Unless I'm missing something obvious, I propose adding a variable named .Values.bucketRoot that defaults to the value of .Values.mountPath unless explicitly overridden.

  • .Values.bucketRoot is passed to the minio executable as the DIR argument
  • .Values.mountPath still being used to control the volumeMount

This will allow this behaviour to be configured without breaking backwards compatibility.

I also volunteer to create the PR.

Additional context
I was able to get this working by manually overriding templates/deployment.yaml so that it mounted /export/mnt into the pod while passing /export/mnt/data/ to the executable, which resulted in something like this:

mnt  <--- This gets mounted into the minio pod under `/export/mnt`
│
├── data  <--- This gets passed to the minio executable as `/export/mnt/data/`
│   ├── bucket1 ( contains symlinks to /mnt/volumes/ )
│   └── bucket2 ( contains symlinks to /mnt/volumes/ )
│
└── volumes <--- This is not accessible directly via minio, 
                 only indirectly through symlinks.

which worked like a charm.

gzur added a commit to gzur/charts that referenced this issue Jan 8, 2020
Introduce a new variable named `.Values.bucketRoot` which defaults to
`.Values.mountPath` if unset.

This allows the Helm chart to serve only a subset of the mounted drive,
which can be useful if the mounted data contains symlinks to locations
that should not be accessible directly through minio.

Addresses helm#19939

Signed-off-by: gzur <gzur@gzur.org>
k8s-ci-robot pushed a commit that referenced this issue Jan 8, 2020
* [stable/minio] Decouple directory root from the mountPath

Introduce a new variable named `.Values.bucketRoot` which defaults to
`.Values.mountPath` if unset.

This allows the Helm chart to serve only a subset of the mounted drive,
which can be useful if the mounted data contains symlinks to locations
that should not be accessible directly through minio.

Addresses #19939

Signed-off-by: gzur <gzur@gzur.org>

* Remove extra spaces

Signed-off-by: gzur <gzur@gzur.org>
dargolith pushed a commit to dargolith/charts that referenced this issue Jan 10, 2020
* [stable/minio] Decouple directory root from the mountPath

Introduce a new variable named `.Values.bucketRoot` which defaults to
`.Values.mountPath` if unset.

This allows the Helm chart to serve only a subset of the mounted drive,
which can be useful if the mounted data contains symlinks to locations
that should not be accessible directly through minio.

Addresses helm#19939

Signed-off-by: gzur <gzur@gzur.org>

* Remove extra spaces

Signed-off-by: gzur <gzur@gzur.org>
arturrez pushed a commit to arturrez/stable-charts that referenced this issue Jan 28, 2020
* [stable/minio] Decouple directory root from the mountPath

Introduce a new variable named `.Values.bucketRoot` which defaults to
`.Values.mountPath` if unset.

This allows the Helm chart to serve only a subset of the mounted drive,
which can be useful if the mounted data contains symlinks to locations
that should not be accessible directly through minio.

Addresses helm#19939

Signed-off-by: gzur <gzur@gzur.org>

* Remove extra spaces

Signed-off-by: gzur <gzur@gzur.org>
Signed-off-by: Artur <artur@upbound.io>
arturrez pushed a commit to arturrez/stable-charts that referenced this issue Jan 28, 2020
* [stable/minio] Decouple directory root from the mountPath

Introduce a new variable named `.Values.bucketRoot` which defaults to
`.Values.mountPath` if unset.

This allows the Helm chart to serve only a subset of the mounted drive,
which can be useful if the mounted data contains symlinks to locations
that should not be accessible directly through minio.

Addresses helm#19939

Signed-off-by: gzur <gzur@gzur.org>

* Remove extra spaces

Signed-off-by: gzur <gzur@gzur.org>
Signed-off-by: Artur <artur@upbound.io>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant