Skip to content

Commit

Permalink
Merge pull request #8284 from sseago/selinux-readonly
Browse files Browse the repository at this point in the history
only set spec.volumes readonly if PVC is readonly for datamover
  • Loading branch information
Lyndon-Li authored Oct 11, 2024
2 parents b34e011 + de7a414 commit f02613d
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 2 deletions.
1 change: 1 addition & 0 deletions changelogs/unreleased/8284-sseago
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
only set spec.volumes readonly if PVC is readonly for datamover
10 changes: 8 additions & 2 deletions pkg/exposer/csi_snapshot.go
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,7 @@ func (e *csiSnapshotExposer) Expose(ctx context.Context, ownerObject corev1.Obje
csiExposeParam.HostingPodLabels,
csiExposeParam.Affinity,
csiExposeParam.Resources,
backupPVCReadOnly,
)
if err != nil {
return errors.Wrap(err, "error to create backup pod")
Expand Down Expand Up @@ -442,6 +443,7 @@ func (e *csiSnapshotExposer) createBackupPod(
label map[string]string,
affinity *kube.LoadAffinity,
resources corev1.ResourceRequirements,
backupPVCReadOnly bool,
) (*corev1.Pod, error) {
podName := ownerObject.Name

Expand All @@ -454,18 +456,22 @@ func (e *csiSnapshotExposer) createBackupPod(
}

var gracePeriod int64 = 0
volumeMounts, volumeDevices, volumePath := kube.MakePodPVCAttachment(volumeName, backupPVC.Spec.VolumeMode, true)
volumeMounts, volumeDevices, volumePath := kube.MakePodPVCAttachment(volumeName, backupPVC.Spec.VolumeMode, backupPVCReadOnly)
volumeMounts = append(volumeMounts, podInfo.volumeMounts...)

volumes := []corev1.Volume{{
Name: volumeName,
VolumeSource: corev1.VolumeSource{
PersistentVolumeClaim: &corev1.PersistentVolumeClaimVolumeSource{
ClaimName: backupPVC.Name,
ReadOnly: true,
},
},
}}

if backupPVCReadOnly {
volumes[0].VolumeSource.PersistentVolumeClaim.ReadOnly = true
}

volumes = append(volumes, podInfo.volumes...)

if label == nil {
Expand Down

0 comments on commit f02613d

Please sign in to comment.