Skip to content

Commit 1f86359

Browse files
AlbeeSoAlbeeSo
committed
token-republish(oss): oss proxy-mounter support RotateToken API
1 parent 576836c commit 1f86359

26 files changed

+1126
-169
lines changed

‎pkg/mounter/cmd_mounter.go‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,11 @@ import (
55
"fmt"
66
"os"
77
"os/exec"
8+
"path/filepath"
89
"time"
910

1011
"github.com/kubernetes-sigs/alibaba-cloud-csi-driver/pkg/mounter/utils"
12+
"k8s.io/klog/v2"
1113
"k8s.io/mount-utils"
1214
)
1315

@@ -27,11 +29,19 @@ func NewOssCmdMounter(execPath, volumeId string, inner mount.Interface) Mounter
2729
}
2830
}
2931

32+
func (m *OssCmdMounter) Name() string {
33+
return "cmd-mounter"
34+
}
35+
36+
func (m *OssCmdMounter) RotateToken(target, fstype string, secrets map[string]string) error {
37+
return ErrNotImplemented(m.Name(), fstype, "rotateToken")
38+
}
39+
3040
func (m *OssCmdMounter) MountWithSecrets(source, target, fstype string, options []string, secrets map[string]string) error {
3141
ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(timeout))
3242
defer cancel()
3343

34-
passwd, err := utils.SaveOssSecretsToFile(secrets)
44+
passwd, err := saveOssSecretsToFile(secrets)
3545
if err != nil {
3646
return err
3747
}
@@ -47,3 +57,27 @@ func (m *OssCmdMounter) MountWithSecrets(source, target, fstype string, options
4757
}
4858
return nil
4959
}
60+
func saveOssSecretsToFileIfNeeded(authCfg *utils.AuthConfig) (string, error) {
61+
if authCfg == nil || authCfg.Secrets == nil {
62+
return "", nil
63+
}
64+
return saveOssSecretsToFile(authCfg.Secrets)
65+
}
66+
67+
func saveOssSecretsToFile(secrets map[string]string) (filePath string, err error) {
68+
passwd := secrets["passwd-ossfs"]
69+
if passwd == "" {
70+
return
71+
}
72+
73+
tmpDir, err := os.MkdirTemp("", "ossfs-")
74+
if err != nil {
75+
return "", err
76+
}
77+
filePath = filepath.Join(tmpDir, "passwd")
78+
if err = os.WriteFile(filePath, []byte(passwd), 0o600); err != nil {
79+
return "", err
80+
}
81+
klog.V(4).InfoS("created ossfs passwd file", "path", filePath)
82+
return
83+
}

‎pkg/mounter/mounter.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,18 @@
11
package mounter
22

33
import (
4+
"fmt"
5+
46
mountutils "k8s.io/mount-utils"
57
)
68

79
type Mounter interface {
810
mountutils.Interface
11+
Name() string
912
MountWithSecrets(source, target, fstype string, options []string, secrets map[string]string) error
13+
RotateToken(target, fstype string, secrets map[string]string) error
14+
}
15+
16+
func ErrNotImplemented(driver, mounterType, method string) error {
17+
return fmt.Errorf("%s(%s): %s not implemented", mounterType, driver, method)
1018
}

‎pkg/mounter/oss/oss_fuse_manager.go‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,17 @@ const (
4848
AuthTypePublic = "public"
4949
)
5050

51+
type AccessKey struct {
52+
AkID string `json:"akId"`
53+
AkSecret string `json:"akSecret"`
54+
}
55+
type TokenSecret struct {
56+
AccessKeyId string `json:"AccessKeyId"`
57+
AccessKeySecret string `json:"AccessKeySecret"`
58+
Expiration string `json:"Expiration"`
59+
SecurityToken string `json:"SecurityToken"`
60+
}
61+
5162
// Options contains options for target oss
5263
type Options struct {
5364
DirectAssigned bool
@@ -60,9 +71,10 @@ type Options struct {
6071

6172
// authorization options
6273
// accesskey
63-
AkID string `json:"akId"`
64-
AkSecret string `json:"akSecret"`
65-
SecretRef string `json:"secretRef"`
74+
AccessKey `json:",inline"`
75+
TokenSecret `json:",inline"`
76+
SecretRef string `json:"secretRef"`
77+
6678
// RRSA
6779
RoleName string `json:"roleName"` // also for STS
6880
RoleArn string `json:"roleArn"`

‎pkg/mounter/oss/ossfs.go‎

Lines changed: 35 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,15 @@ func (f *fuseOssfs) PrecheckAuthConfig(o *Options, onNode bool) error {
8787
if features.FunctionalMutableFeatureGate.Enabled(features.RundCSIProtocol3) {
8888
return nil
8989
}
90-
if o.SecretRef != "" {
90+
// Token authentication:
91+
// For runc scenarios, set the SecretRef parameter.
92+
runc := o.SecretRef != ""
93+
// For rund or eci scenarios, configure Token in nodePublishSecretRef or nodeStageSecretRef.
94+
rund := o.AccessKeyId != "" && o.AccessKeySecret != "" && o.Expiration != "" && o.SecurityToken != ""
95+
if runc && rund {
96+
return fmt.Errorf("Token and secretRef cannot be set at the same time")
97+
}
98+
if rund || runc {
9199
if o.AkID != "" || o.AkSecret != "" {
92100
return fmt.Errorf("AK and secretRef cannot be set at the same time")
93101
}
@@ -119,13 +127,27 @@ func (f *fuseOssfs) MakeAuthConfig(o *Options, m metadata.MetadataProvider) (*ut
119127
case AuthTypeSTS:
120128
authCfg.RoleName = o.RoleName
121129
default:
122-
if o.SecretRef != "" {
123-
authCfg.SecretRef = o.SecretRef
124-
} else {
130+
// fixed AKSK
131+
passwdFile := utils.GetPasswdFileName(f.Name())
132+
if o.AkID != "" && o.AkSecret != "" {
125133
authCfg.Secrets = map[string]string{
126-
utils.GetPasswdFileName(f.Name()): fmt.Sprintf("%s:%s:%s", o.Bucket, o.AkID, o.AkSecret),
134+
passwdFile: fmt.Sprintf("%s:%s:%s", o.Bucket, o.AkID, o.AkSecret),
127135
}
136+
return authCfg, nil
137+
}
138+
// secretRef for RunC
139+
if o.SecretRef != "" {
140+
authCfg.SecretRef = o.SecretRef
141+
return authCfg, nil
142+
}
143+
// token secret for RunD
144+
authCfg.Secrets = map[string]string{
145+
filepath.Join(passwdFile, KeyAccessKeyId): o.AccessKeyId,
146+
filepath.Join(passwdFile, KeyAccessKeySecret): o.AccessKeySecret,
147+
filepath.Join(passwdFile, KeySecurityToken): o.SecurityToken,
148+
filepath.Join(passwdFile, KeyExpiration): o.Expiration,
128149
}
150+
129151
}
130152
return authCfg, nil
131153
}
@@ -289,11 +311,17 @@ func (f *fuseOssfs) getAuthOptions(o *Options, region string) (mountOptions []st
289311
mountOptions = append(mountOptions, "ram_role="+o.RoleName)
290312
}
291313
default:
314+
// fixed AKSK
315+
if o.AkID != "" && o.AkSecret != "" {
316+
// for aksk in secret, it will make passwd_file option in mount-proxy server as it's under a tempdir
317+
return
318+
}
319+
// secretRef for runC or token secret for runD
292320
if o.SecretRef != "" {
293321
mountOptions = append(mountOptions, fmt.Sprintf("passwd_file=%s", filepath.Join(utils.GetConfigDir(o.FuseType), utils.GetPasswdFileName(o.FuseType))))
294-
mountOptions = append(mountOptions, "use_session_token")
295322
}
296-
// publishSecretRef will make option in mount-proxy server
323+
// for token in secret, it will make passwd_file option in mount-proxy server as it's under a tempdir
324+
mountOptions = append(mountOptions, "use_session_token")
297325
}
298326
return
299327
}

‎pkg/mounter/oss/ossfs2.go‎

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,16 @@ func (f *fuseOssfs2) PrecheckAuthConfig(o *Options, onNode bool) error {
6464
if features.FunctionalMutableFeatureGate.Enabled(features.RundCSIProtocol3) {
6565
return nil
6666
}
67-
if o.SecretRef != "" {
67+
// Token authentication:
68+
// For runc scenarios, set the SecretRef parameter.
69+
runc := o.SecretRef != ""
70+
// For rund or eci scenarios, configure Token in nodePublishSecretRef or nodeStageSecretRef.
71+
// Expiration is not required for ossfs2.0
72+
rund := o.AccessKeyId != "" && o.AccessKeySecret != "" && o.SecurityToken != ""
73+
if runc && rund {
74+
return fmt.Errorf("Token and secretRef cannot be set at the same time")
75+
}
76+
if rund || runc {
6877
if o.AkID != "" || o.AkSecret != "" {
6978
return fmt.Errorf("AK and secretRef cannot be set at the same time")
7079
}
@@ -95,13 +104,26 @@ func (f *fuseOssfs2) MakeAuthConfig(o *Options, m metadata.MetadataProvider) (au
95104
case AuthTypeSTS:
96105
authCfg.RoleName = o.RoleName
97106
case "":
107+
// fixed AKSK
108+
passwdFile := utils.GetPasswdFileName(f.Name())
109+
if o.AkID != "" && o.AkSecret != "" {
110+
authCfg.Secrets = map[string]string{
111+
utils.GetPasswdFileName(f.Name()): fmt.Sprintf("--oss_access_key_id=%s\n--oss_access_key_secret=%s", o.AkID, o.AkSecret),
112+
}
113+
return
114+
}
115+
// secretRef for RunC
98116
if o.SecretRef != "" {
99117
authCfg.SecretRef = o.SecretRef
100118
return
101119
}
120+
// token secret for RunD
102121
authCfg.Secrets = map[string]string{
103-
utils.GetPasswdFileName(f.Name()): fmt.Sprintf("--oss_access_key_id=%s\n--oss_access_key_secret=%s", o.AkID, o.AkSecret),
122+
filepath.Join(passwdFile, KeyAccessKeyId): o.AccessKeyId,
123+
filepath.Join(passwdFile, KeyAccessKeySecret): o.AccessKeySecret,
124+
filepath.Join(passwdFile, KeySecurityToken): o.SecurityToken,
104125
}
126+
105127
default:
106128
return nil, fmt.Errorf("%s do not support authType: %s", f.Name(), o.AuthType)
107129
}
@@ -162,14 +184,19 @@ func (f *fuseOssfs2) getAuthOptions(o *Options, region string) (mountOptions []s
162184
mountOptions = append(mountOptions, "ram_role="+o.RoleName)
163185
}
164186
case "":
187+
// fixed AKSK
188+
if o.AkID != "" && o.AkSecret != "" {
189+
// for aksk in secret, it will make passwd_file option in mount-proxy server as it's under a tempdir
190+
return
191+
}
165192
if o.SecretRef != "" {
166193
mountOptions = append(mountOptions,
167194
fmt.Sprintf("oss_sts_multi_conf_ak_file=%s", filepath.Join(utils.GetConfigDir(o.FuseType), utils.GetPasswdFileName(o.FuseType), KeyAccessKeyId)),
168195
fmt.Sprintf("oss_sts_multi_conf_sk_file=%s", filepath.Join(utils.GetConfigDir(o.FuseType), utils.GetPasswdFileName(o.FuseType), KeyAccessKeySecret)),
169196
fmt.Sprintf("oss_sts_multi_conf_token_file=%s", filepath.Join(utils.GetConfigDir(o.FuseType), utils.GetPasswdFileName(o.FuseType), KeySecurityToken)),
170197
)
171198
}
172-
// publishSecretRef will make option in mount-proxy server
199+
// for token in secret, it will make passwd_file option in mount-proxy server as it's under a tempdir
173200
default:
174201
return nil
175202
}

0 commit comments

Comments
 (0)