Use who am i and other improvements (#98)

* Update test cluster to k8s v1.32.0

* Update Quobyte go api to v1.4.0

* Improve shared volume access permissions

Shared volume(s) is/are supposed to be accessed by all the pods
for creation and deletion of pvc inside it. Therefore, should
have open access (1777), and each pvc is created with (700).
These default permissions ensure access to shared volume and
limited access to PVC inside it.

These shared volume permissions only apply, if user does not
create shared volume by themselves (and do not change permissions
via client). For, PVC that is created inside shared volume, the default
permissions can be overridden by storage class "accessMode:".
However, it is advised to set sticky bit and user:group (1xx0) permissions
only and leave out others permissions (set to 0).

* Resolve user/group from API

..get user/group from the current user using Quobyte API

* Add shared volume user/group to node image

* Mount host users and groups into container

* Mount host user/groups into client

* Add sticky bit clarification

* update local test config

* Update shared volume example

* Update helm test snapshot

* Update storage class examples

.. and add comment about optional user/group.

Author: venkatsc

Diff for: csi-driver-templates/templates/pods/containers/_quobyte_csi_controller_container.tpl

@@ -9,8 +9,8 @@
   securityContext:
     privileged: true
     capabilities:
-      add: ["SYS_ADMIN"]
-    allowPrivilegeEscalation: true
+      # For shared volume PVCs, ownership change is required      
+      add: ["SYS_ADMIN", "CHOWN"]
   image: {{ .Values.quobyte.dev.csiImage }}
   imagePullPolicy: "IfNotPresent"
   args:
@@ -53,4 +53,10 @@
     - name: certs
       mountPath: /etc/ssl/certs/
     {{- end }}
+    - name: users
+      mountPath: /etc/passwd
+      mountPropagation: "HostToContainer"
+    - name: groups
+      mountPath: /etc/group
+      mountPropagation: "HostToContainer"
 {{- end }}

Diff for: csi-driver-templates/templates/pods/containers/_quobyte_csi_node_driver_container.tpl

@@ -56,4 +56,10 @@
     - name: certs
       mountPath: /etc/ssl/certs/
     {{- end }}
+    - name: users
+      mountPath: /etc/passwd
+      mountPropagation: "HostToContainer"
+    - name: groups
+      mountPath: /etc/group
+      mountPropagation: "HostToContainer"
 {{- end}}

Diff for: csi-driver-templates/templates/pods/volumes/_quobyte_csi_controller_volume_attachments.tpl

@@ -17,4 +17,12 @@ volumes:
       path: /etc/ssl/certs/
       type: Directory
   {{- end }}
+  - name: users
+    hostPath:
+      path: /etc/passwd
+      type: File
+  - name: groups
+    hostPath:
+      path: /etc/group
+      type: File
 {{- end }}

Diff for: csi-driver-templates/templates/pods/volumes/_quobyte_csi_node_plugin_volume_attachments.tpl

@@ -28,4 +28,12 @@ volumes:
       path: /etc/ssl/certs/
       type: Directory
   {{- end }}
+  - name: users
+    hostPath:
+      path: /etc/passwd
+      type: File
+  - name: groups
+    hostPath:
+      path: /etc/group
+      type: File
 {{- end }}

Diff for: csi-driver-templates/tests/__snapshot__/csi_driver_test.yaml.snap

@@ -396,10 +396,10 @@ should render when resource limits are provided:
                   cpu: 50m
                   memory: 50Mi
               securityContext:
-                allowPrivilegeEscalation: true
                 capabilities:
                   add:
                     - SYS_ADMIN
+                    - CHOWN
                 privileged: true
               volumeMounts:
                 - mountPath: /var/lib/csi/sockets/pluginproxy/
@@ -411,6 +411,12 @@ should render when resource limits are provided:
                   name: quobyte-mounts
                 - mountPath: /etc/ssl/certs/
                   name: certs
+                - mountPath: /etc/passwd
+                  mountPropagation: HostToContainer
+                  name: users
+                - mountPath: /etc/group
+                  mountPropagation: HostToContainer
+                  name: groups
           priorityClassName: system-cluster-critical
           serviceAccount: quobyte-csi-controller-sa-csi-quobyte-com
           volumes:
@@ -428,6 +434,14 @@ should render when resource limits are provided:
                 path: /etc/ssl/certs/
                 type: Directory
               name: certs
+            - hostPath:
+                path: /etc/passwd
+                type: File
+              name: users
+            - hostPath:
+                path: /etc/group
+                type: File
+              name: groups
   12: |
     apiVersion: v1
     kind: ServiceAccount
@@ -573,6 +587,12 @@ should render when resource limits are provided:
                   name: log-dir
                 - mountPath: /etc/ssl/certs/
                   name: certs
+                - mountPath: /etc/passwd
+                  mountPropagation: HostToContainer
+                  name: users
+                - mountPath: /etc/group
+                  mountPropagation: HostToContainer
+                  name: groups
             - args:
                 - --node_name=$(KUBE_NODE_NAME)
                 - --driver_name=csi.quobyte.com
@@ -633,6 +653,14 @@ should render when resource limits are provided:
                 path: /etc/ssl/certs/
                 type: Directory
               name: certs
+            - hostPath:
+                path: /etc/passwd
+                type: File
+              name: users
+            - hostPath:
+                path: /etc/group
+                type: File
+              name: groups
   16: |
     apiVersion: v1
     kind: ServiceAccount
@@ -1022,10 +1050,10 @@ should render when tolerations are provided:
               imagePullPolicy: IfNotPresent
               name: quobyte-csi-driver
               securityContext:
-                allowPrivilegeEscalation: true
                 capabilities:
                   add:
                     - SYS_ADMIN
+                    - CHOWN
                 privileged: true
               volumeMounts:
                 - mountPath: /var/lib/csi/sockets/pluginproxy/
@@ -1037,6 +1065,12 @@ should render when tolerations are provided:
                   name: quobyte-mounts
                 - mountPath: /etc/ssl/certs/
                   name: certs
+                - mountPath: /etc/passwd
+                  mountPropagation: HostToContainer
+                  name: users
+                - mountPath: /etc/group
+                  mountPropagation: HostToContainer
+                  name: groups
           priorityClassName: system-cluster-critical
           serviceAccount: quobyte-csi-controller-sa-csi-quobyte-com
           tolerations:
@@ -1058,6 +1092,14 @@ should render when tolerations are provided:
                 path: /etc/ssl/certs/
                 type: Directory
               name: certs
+            - hostPath:
+                path: /etc/passwd
+                type: File
+              name: users
+            - hostPath:
+                path: /etc/group
+                type: File
+              name: groups
   10: |
     apiVersion: v1
     kind: ServiceAccount
@@ -1195,6 +1237,12 @@ should render when tolerations are provided:
                   name: log-dir
                 - mountPath: /etc/ssl/certs/
                   name: certs
+                - mountPath: /etc/passwd
+                  mountPropagation: HostToContainer
+                  name: users
+                - mountPath: /etc/group
+                  mountPropagation: HostToContainer
+                  name: groups
             - args:
                 - --node_name=$(KUBE_NODE_NAME)
                 - --driver_name=csi.quobyte.com
@@ -1255,6 +1303,14 @@ should render when tolerations are provided:
                 path: /etc/ssl/certs/
                 type: Directory
               name: certs
+            - hostPath:
+                path: /etc/passwd
+                type: File
+              name: users
+            - hostPath:
+                path: /etc/group
+                type: File
+              name: groups
   14: |
     apiVersion: v1
     kind: ServiceAccount
@@ -1644,10 +1700,10 @@ should render with default values:
               imagePullPolicy: IfNotPresent
               name: quobyte-csi-driver
               securityContext:
-                allowPrivilegeEscalation: true
                 capabilities:
                   add:
                     - SYS_ADMIN
+                    - CHOWN
                 privileged: true
               volumeMounts:
                 - mountPath: /var/lib/csi/sockets/pluginproxy/
@@ -1659,6 +1715,12 @@ should render with default values:
                   name: quobyte-mounts
                 - mountPath: /etc/ssl/certs/
                   name: certs
+                - mountPath: /etc/passwd
+                  mountPropagation: HostToContainer
+                  name: users
+                - mountPath: /etc/group
+                  mountPropagation: HostToContainer
+                  name: groups
           priorityClassName: system-cluster-critical
           serviceAccount: quobyte-csi-controller-sa-csi-quobyte-com
           volumes:
@@ -1676,6 +1738,14 @@ should render with default values:
                 path: /etc/ssl/certs/
                 type: Directory
               name: certs
+            - hostPath:
+                path: /etc/passwd
+                type: File
+              name: users
+            - hostPath:
+                path: /etc/group
+                type: File
+              name: groups
   10: |
     apiVersion: v1
     kind: ServiceAccount
@@ -1813,6 +1883,12 @@ should render with default values:
                   name: log-dir
                 - mountPath: /etc/ssl/certs/
                   name: certs
+                - mountPath: /etc/passwd
+                  mountPropagation: HostToContainer
+                  name: users
+                - mountPath: /etc/group
+                  mountPropagation: HostToContainer
+                  name: groups
             - args:
                 - --node_name=$(KUBE_NODE_NAME)
                 - --driver_name=csi.quobyte.com
@@ -1869,6 +1945,14 @@ should render with default values:
                 path: /etc/ssl/certs/
                 type: Directory
               name: certs
+            - hostPath:
+                path: /etc/passwd
+                type: File
+              name: users
+            - hostPath:
+                path: /etc/group
+                type: File
+              name: groups
   14: |
     apiVersion: v1
     kind: ServiceAccount

Diff for: example/Storage-class-shared-volume.yaml

@@ -36,6 +36,8 @@ parameters:
   # creates quota for the volume if set to true. The size of the Quota
   # is the storage requested in PVC. If false, creates volume without size limit.
   createQuota: "true"
+  # user/group is optional - if not provided, user/group is retrieved from the Quobyte user
+  # associated with the provisioner-secret provided above.
   user: root
   group: root
   accessMode: "777"

Diff for: example/StorageClass.yaml

@@ -35,6 +35,8 @@ parameters:
   # creates quota for the volume if set to true. The size of the Quota
   # is the storage requested in PVC. If false, creates volume without size limit.
   createQuota: "true"
+  # user/group is optional - if not provided, user/group is retrieved from the Quobyte user
+  # associated with the provisioner-secret provided above.
   user: nginx
   group: nginx
   accessMode: "750"

Diff for: example/access_keys/storage-class-api-and-mount-secret.yaml

@@ -19,7 +19,9 @@ parameters:
   csi.storage.k8s.io/node-publish-secret-name: "quobyte-mount-secret"
   csi.storage.k8s.io/node-publish-secret-namespace: "quobyte"
   createQuota: "true"
+  # user/group is optional - if not provided, user/group is retrieved from the Quobyte user
+  # associated with the provisioner-secret provided above.
   user: root
   group: root
-  accessMode: "777"
+  accessMode: "750"
 reclaimPolicy: Delete

Diff for: example/access_keys/storage-class-generic-secret.yaml

@@ -19,7 +19,9 @@ parameters:
   csi.storage.k8s.io/node-publish-secret-name: "quobyte-generic-secret"
   csi.storage.k8s.io/node-publish-secret-namespace: "quobyte"
   createQuota: "true"
+  # user/group is optional - if not provided, user/group is retrieved from the Quobyte user
+  # associated with the provisioner-secret provided above.
   user: root
   group: root
-  accessMode: "777"
+  accessMode: "750"
 reclaimPolicy: Delete

Diff for: example/client.yaml

@@ -26,7 +26,7 @@ spec:
             value: INFO
           - name: QUOBYTE_REGISTRY
             # Your Quobyte registry endpoint
-            value: venkat.corp.quobyte.com:2169 # Example: hydrogen.quobyte.com:12354
+            value: venkat.corp.quobyte.com:2776 # Example: hydrogen.quobyte.com:12354
           - name: QUOBYTE_MOUNT_POINT
             # Corresponding volume mount must be one directory below this path
             # Example volumeMount is : /home/quobyte and clientMountPoint is /home/quobyte/mounts
@@ -94,6 +94,12 @@ spec:
           - name: quobyte-mount
             mountPath: /home/quobyte
             mountPropagation: Bidirectional
+          - name: users
+            mountPath: /etc/passwd
+            mountPropagation: HostToContainer
+          - name: groups
+            mountPath: /etc/group
+            mountPropagation: HostToContainer
           - name: minidumps-dir
             mountPath: /tmp/minidumps
         lifecycle:
@@ -109,3 +115,11 @@ spec:
       - name: minidumps-dir
         hostPath:
           path: /var/lib/quobyte/.minidumps
+      - name: users
+        hostPath:
+          path: /etc/passwd
+          type: File
+      - name: groups
+        hostPath:
+          path: /etc/group
+          type: File

Diff for: kind-cluster/run_test

@@ -64,10 +64,15 @@ echo "Running script from $(pwd)"
 echo "Creating kind k8s cluster Dockerfile * * * * * * * * *  * * * * * * * * * * * * * * * * *"
 echo ""
 echo ""
+
+# https://github.com/kubernetes-sigs/kind/releases
+# Install the latest kind binary from the releases on testing host
+# and update the kindest/node: image
 tee -a "${TEST_CLUSTER_DIR}"/Dockerfile <<END
-FROM kindest/node:v1.30.6@sha256:b6d08db72079ba5ae1f4a88a09025c0a904af3b52387643c285442afb05ab994
+FROM kindest/node:v1.32.0@sha256:c48c62eac5da28cdadcf560d1d8616cfa6783b58f0d94cf63ad1bf49600cb027
 RUN apt-get -y update 
 RUN apt-get -y install wget && apt-get install -y git && apt install -y nano dnsutils
+RUN groupadd admin && useradd admin -g admin
 END
 
 echo "Building new image using the above Dockerfile. On the local machine: * * *"