diff --git a/controllers/object_controls.go b/controllers/object_controls.go index e8f243e516..6679cf028c 100644 --- a/controllers/object_controls.go +++ b/controllers/object_controls.go @@ -263,19 +263,27 @@ var SubscriptionPathMap = map[string](MountPathToVolumeSource){ "/run/secrets/etc-pki-entitlement": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/pki/entitlement", - Type: ptr.To(corev1.HostPathDirectory), + Type: new(corev1.HostPathDirectoryOrCreate), }, }, "/run/secrets/redhat.repo": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/yum.repos.d/redhat.repo", - Type: ptr.To(corev1.HostPathFile), + Type: new(corev1.HostPathFileOrCreate), }, }, "/run/secrets/rhsm": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/rhsm", - Type: ptr.To(corev1.HostPathDirectory), + Type: new(corev1.HostPathDirectoryOrCreate), + }, + }, + // FileOrCreate does not create parents. A separate directory volume + // lets kubelet create the repo directory and retry file setup if needed. + "/run/secrets/yum.repos.d": corev1.VolumeSource{ + HostPath: &corev1.HostPathVolumeSource{ + Path: "/etc/yum.repos.d", + Type: new(corev1.HostPathDirectoryOrCreate), }, }, }, @@ -283,19 +291,19 @@ var SubscriptionPathMap = map[string](MountPathToVolumeSource){ "/run/secrets/etc-pki-entitlement": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/pki/entitlement", - Type: ptr.To(corev1.HostPathDirectory), + Type: new(corev1.HostPathDirectory), }, }, "/run/secrets/redhat.repo": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/yum.repos.d/redhat.repo", - Type: ptr.To(corev1.HostPathFile), + Type: new(corev1.HostPathFile), }, }, "/run/secrets/rhsm": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/rhsm", - Type: ptr.To(corev1.HostPathDirectory), + Type: new(corev1.HostPathDirectory), }, }, }, @@ -303,13 +311,13 @@ var SubscriptionPathMap = map[string](MountPathToVolumeSource){ "/etc/zypp/credentials.d": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/zypp/credentials.d", - Type: ptr.To(corev1.HostPathDirectory), + Type: new(corev1.HostPathDirectoryOrCreate), }, }, "/etc/SUSEConnect": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/SUSEConnect", - Type: ptr.To(corev1.HostPathFileOrCreate), + Type: new(corev1.HostPathFileOrCreate), }, }, }, @@ -317,13 +325,13 @@ var SubscriptionPathMap = map[string](MountPathToVolumeSource){ "/etc/zypp/credentials.d": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/zypp/credentials.d", - Type: ptr.To(corev1.HostPathDirectory), + Type: new(corev1.HostPathDirectoryOrCreate), }, }, "/etc/SUSEConnect": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/SUSEConnect", - Type: ptr.To(corev1.HostPathFileOrCreate), + Type: new(corev1.HostPathFileOrCreate), }, }, }, @@ -3777,15 +3785,10 @@ func transformDriverContainer(obj *appsv1.DaemonSet, config *gpuv1.ClusterPolicy // set up subscription entitlements for RHEL(using K8s with a non-CRIO runtime) and SLES if (osID == "rhel" && n.openshift == "" && n.runtime != gpuv1.CRIO) || osID == "sles" || osID == "sl-micro" { - pathToVolumeSource := MountPathToVolumeSource{} - if config.Driver.RepoConfig != nil && config.Driver.RepoConfig.ConfigMapName != "" && osID == "rhel" { - n.logger.Info("Skipping host subscription mounts because repoConfig is enabled", "OS", osID) - } else { - n.logger.Info("Mounting subscriptions into the driver container", "OS", osID) - pathToVolumeSource, err = n.getSubscriptionPathsToVolumeSources() - if err != nil { - return fmt.Errorf("ERROR: failed to get path items for subscription entitlements: %w", err) - } + n.logger.Info("Mounting subscriptions into the driver container", "OS", osID) + pathToVolumeSource, err := n.getSubscriptionPathsToVolumeSources() + if err != nil { + return fmt.Errorf("ERROR: failed to get path items for subscription entitlements: %w", err) } // sort host path volumes to ensure ordering is preserved when adding to pod spec @@ -3803,7 +3806,16 @@ func transformDriverContainer(obj *appsv1.DaemonSet, config *gpuv1.ClusterPolicy MountPath: mountPath, ReadOnly: true, } - driverContainer.VolumeMounts = append(driverContainer.VolumeMounts, volMountSubscription) + if mountPath == "/run/secrets/yum.repos.d" { + // The parent directory is needed only for kubelet's file creation. + manager := findContainerByName(podSpec.InitContainers, "k8s-driver-manager") + if manager == nil { + return fmt.Errorf("k8s-driver-manager initContainer is missing from the driver daemonset manifest") + } + manager.VolumeMounts = append(manager.VolumeMounts, volMountSubscription) + } else { + driverContainer.VolumeMounts = append(driverContainer.VolumeMounts, volMountSubscription) + } subscriptionVol := corev1.Volume{Name: volMountSubscriptionName, VolumeSource: pathToVolumeSource[mountPath]} podSpec.Volumes = append(podSpec.Volumes, subscriptionVol) diff --git a/controllers/transforms_test.go b/controllers/transforms_test.go index 23b99aa3cc..cc4a36dfe1 100644 --- a/controllers/transforms_test.go +++ b/controllers/transforms_test.go @@ -4711,41 +4711,72 @@ func TestTransformDriverSubscriptionMounts(t *testing.T) { Namespace: "test-ns", }, Data: map[string]string{ - "redhat.repo": "[test-repo]", + "custom.repo": "[test-repo]", }, } mockClient := fake.NewFakeClient(repoConfigMap) - testCases := []struct { - description string + rhelHostPaths := map[string]corev1.HostPathType{ + "/etc/pki/entitlement": corev1.HostPathDirectoryOrCreate, + "/etc/yum.repos.d/redhat.repo": corev1.HostPathFileOrCreate, + "/etc/rhsm": corev1.HostPathDirectoryOrCreate, + "/etc/yum.repos.d": corev1.HostPathDirectoryOrCreate, + } + rhelDriverMounts := []corev1.VolumeMount{ + {Name: "subscription-config-0", MountPath: "/run/secrets/etc-pki-entitlement", ReadOnly: true}, + {Name: "subscription-config-1", MountPath: "/run/secrets/redhat.repo", ReadOnly: true}, + {Name: "subscription-config-2", MountPath: "/run/secrets/rhsm", ReadOnly: true}, + } + suseDriverMounts := []corev1.VolumeMount{ + {Name: "subscription-config-0", MountPath: "/etc/SUSEConnect", ReadOnly: true}, + {Name: "subscription-config-1", MountPath: "/etc/zypp/credentials.d", ReadOnly: true}, + } + testCases := map[string]struct { osRelease string osTag string + runtime string repoConfigEnabled bool - expectSubscriptionMounts bool expectedSubscriptionHostMap map[string]corev1.HostPathType + expectedSubscriptionMounts []corev1.VolumeMount }{ - { - description: "rhel with repo config skips host subscription mounts", - osRelease: "rhel", - osTag: "rhel8.10", - repoConfigEnabled: true, - expectSubscriptionMounts: false, + "rhel with custom repositories retains subscription mounts": { + osRelease: "rhel", osTag: "rhel8.10", runtime: "containerd", + repoConfigEnabled: true, expectedSubscriptionHostMap: rhelHostPaths, expectedSubscriptionMounts: rhelDriverMounts, }, - { - description: "rhel without repo config mounts host subscription paths", - osRelease: "rhel", - osTag: "rhel8.10", - expectSubscriptionMounts: true, + "rhel without custom repositories mounts subscription paths": { + osRelease: "rhel", osTag: "rhel8.10", runtime: "containerd", + expectedSubscriptionHostMap: rhelHostPaths, expectedSubscriptionMounts: rhelDriverMounts, + }, + "rhel with docker mounts subscription paths": { + osRelease: "rhel", osTag: "rhel8.10", runtime: "docker", + repoConfigEnabled: true, expectedSubscriptionHostMap: rhelHostPaths, expectedSubscriptionMounts: rhelDriverMounts, + }, + "rhel with crio skips subscription mounts": { + osRelease: "rhel", osTag: "rhel8.10", runtime: "crio", repoConfigEnabled: true, + }, + "ubuntu skips subscription mounts": { + osRelease: "ubuntu", osTag: "ubuntu22.04", runtime: "containerd", repoConfigEnabled: true, + }, + "sles creates missing subscription paths": { + osRelease: "sles", osTag: "sles15.6", runtime: "containerd", repoConfigEnabled: true, + expectedSubscriptionMounts: suseDriverMounts, + expectedSubscriptionHostMap: map[string]corev1.HostPathType{ + "/etc/zypp/credentials.d": corev1.HostPathDirectoryOrCreate, + "/etc/SUSEConnect": corev1.HostPathFileOrCreate, + }, + }, + "sl-micro creates missing subscription paths": { + osRelease: "sl-micro", osTag: "sl-micro6.1", runtime: "containerd", repoConfigEnabled: true, + expectedSubscriptionMounts: suseDriverMounts, expectedSubscriptionHostMap: map[string]corev1.HostPathType{ - "/etc/pki/entitlement": corev1.HostPathDirectory, - "/etc/yum.repos.d/redhat.repo": corev1.HostPathFile, - "/etc/rhsm": corev1.HostPathDirectory, + "/etc/zypp/credentials.d": corev1.HostPathDirectoryOrCreate, + "/etc/SUSEConnect": corev1.HostPathFileOrCreate, }, }, } - for _, tc := range testCases { - t.Run(tc.description, func(t *testing.T) { + for name, tc := range testCases { + t.Run(name, func(t *testing.T) { ds := NewDaemonset().WithContainer(corev1.Container{Name: "nvidia-driver-ctr"}). WithInitContainer(corev1.Container{Name: "k8s-driver-manager"}) cpSpec := &gpuv1.ClusterPolicySpec{ @@ -4768,7 +4799,7 @@ func TestTransformDriverSubscriptionMounts(t *testing.T) { err := TransformDriver(ds.DaemonSet, cpSpec, ClusterPolicyController{ client: mockClient, - runtime: gpuv1.Containerd, + runtime: gpuv1.Runtime(tc.runtime), operatorNamespace: "test-ns", logger: ctrl.Log.WithName("test"), gpuNodeOSRelease: tc.osRelease, @@ -4779,7 +4810,32 @@ func TestTransformDriverSubscriptionMounts(t *testing.T) { driverContainer := findContainerByName(ds.Spec.Template.Spec.Containers, "nvidia-driver-ctr") require.NotNil(t, driverContainer) assertSubscriptionHostPathVolumesForTransform(t, ds.Spec.Template.Spec.Volumes, tc.expectedSubscriptionHostMap) - assert.Equal(t, tc.expectSubscriptionMounts, hasSubscriptionVolumeMountForTransform(driverContainer.VolumeMounts)) + expectedAdditionalMounts := append([]corev1.VolumeMount{}, tc.expectedSubscriptionMounts...) + if tc.repoConfigEnabled { + repoPaths := map[string]string{ + "rhel": "/etc/yum.repos.d/custom.repo", + "ubuntu": "/etc/apt/sources.list.d/custom.repo", + "sles": "/etc/zypp/repos.d/custom.repo", + "sl-micro": "/etc/zypp/repos.d/custom.repo", + } + expectedAdditionalMounts = append(expectedAdditionalMounts, corev1.VolumeMount{ + Name: "test-repo-config", MountPath: repoPaths[tc.osRelease], + SubPath: "custom.repo", ReadOnly: true, + }) + } + assert.ElementsMatch(t, expectedAdditionalMounts, driverContainer.VolumeMounts) + expectedManagerMounts := []corev1.VolumeMount{} + if tc.osRelease == "rhel" && len(tc.expectedSubscriptionMounts) > 0 { + expectedManagerMounts = append(expectedManagerMounts, corev1.VolumeMount{ + Name: "subscription-config-3", MountPath: "/run/secrets/yum.repos.d", ReadOnly: true, + }) + } + + manager := findContainerByName(ds.Spec.Template.Spec.InitContainers, "k8s-driver-manager") + require.NotNil(t, manager) + assert.ElementsMatch(t, expectedManagerMounts, manager.VolumeMounts) + + assert.Equal(t, len(tc.expectedSubscriptionHostMap) > 0, hasSubscriptionVolumeMountForTransform(driverContainer.VolumeMounts)) }) } } diff --git a/internal/state/driver.go b/internal/state/driver.go index 2046bbf815..03e416d0ef 100644 --- a/internal/state/driver.go +++ b/internal/state/driver.go @@ -84,8 +84,9 @@ type precompiledSpec struct { } type additionalConfigs struct { - VolumeMounts []corev1.VolumeMount - Volumes []corev1.Volume + DriverManagerVolumeMounts []corev1.VolumeMount + VolumeMounts []corev1.VolumeMount + Volumes []corev1.Volume } type driverRenderData struct { diff --git a/internal/state/driver_test.go b/internal/state/driver_test.go index 92907fb62c..0328193902 100644 --- a/internal/state/driver_test.go +++ b/internal/state/driver_test.go @@ -31,6 +31,7 @@ import ( "k8s.io/apimachinery/pkg/api/resource" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apimachinery/pkg/runtime/serializer/json" apitypes "k8s.io/apimachinery/pkg/types" @@ -628,37 +629,74 @@ func TestDriverAdditionalConfigsSubscriptionMounts(t *testing.T) { Namespace: "test-ns", }, Data: map[string]string{ - "redhat.repo": "[test-repo]", + "custom.repo": "[test-repo]", }, } - testCases := []struct { - description string + rhelHostPaths := map[string]corev1.HostPathType{ + "/etc/pki/entitlement": corev1.HostPathDirectoryOrCreate, + "/etc/yum.repos.d/redhat.repo": corev1.HostPathFileOrCreate, + "/etc/rhsm": corev1.HostPathDirectoryOrCreate, + "/etc/yum.repos.d": corev1.HostPathDirectoryOrCreate, + } + rhelDriverMounts := []corev1.VolumeMount{ + {Name: "subscription-config-0", MountPath: "/run/secrets/etc-pki-entitlement", ReadOnly: true}, + {Name: "subscription-config-1", MountPath: "/run/secrets/redhat.repo", ReadOnly: true}, + {Name: "subscription-config-2", MountPath: "/run/secrets/rhsm", ReadOnly: true}, + } + suseDriverMounts := []corev1.VolumeMount{ + {Name: "subscription-config-0", MountPath: "/etc/SUSEConnect", ReadOnly: true}, + {Name: "subscription-config-1", MountPath: "/etc/zypp/credentials.d", ReadOnly: true}, + } + testCases := map[string]struct { osRelease string + runtime string + openshift string repoConfigEnabled bool - expectSubscriptionMounts bool expectedSubscriptionHostMap map[string]corev1.HostPathType + expectedSubscriptionMounts []corev1.VolumeMount }{ - { - description: "rhel with repo config skips host subscription mounts", - osRelease: "rhel", - repoConfigEnabled: true, - expectSubscriptionMounts: false, + "rhel with custom repositories retains subscription mounts": { + osRelease: "rhel", runtime: "containerd", + repoConfigEnabled: true, expectedSubscriptionHostMap: rhelHostPaths, expectedSubscriptionMounts: rhelDriverMounts, }, - { - description: "rhel without repo config mounts host subscription paths", - osRelease: "rhel", - expectSubscriptionMounts: true, + "rhel without custom repositories mounts subscription paths": { + osRelease: "rhel", runtime: "containerd", + expectedSubscriptionHostMap: rhelHostPaths, expectedSubscriptionMounts: rhelDriverMounts, + }, + "rhel with docker mounts subscription paths": { + osRelease: "rhel", runtime: "docker", + repoConfigEnabled: true, expectedSubscriptionHostMap: rhelHostPaths, expectedSubscriptionMounts: rhelDriverMounts, + }, + "rhel with crio skips subscription mounts": { + osRelease: "rhel", runtime: "crio", repoConfigEnabled: true, + }, + "ubuntu skips subscription mounts": { + osRelease: "ubuntu", runtime: "containerd", repoConfigEnabled: true, + }, + "sles creates missing subscription paths": { + osRelease: "sles", runtime: "containerd", repoConfigEnabled: true, + expectedSubscriptionMounts: suseDriverMounts, expectedSubscriptionHostMap: map[string]corev1.HostPathType{ - "/etc/pki/entitlement": corev1.HostPathDirectory, - "/etc/yum.repos.d/redhat.repo": corev1.HostPathFile, - "/etc/rhsm": corev1.HostPathDirectory, + "/etc/zypp/credentials.d": corev1.HostPathDirectoryOrCreate, + "/etc/SUSEConnect": corev1.HostPathFileOrCreate, }, }, + "sl-micro creates missing subscription paths": { + osRelease: "sl-micro", runtime: "containerd", repoConfigEnabled: true, + expectedSubscriptionMounts: suseDriverMounts, + expectedSubscriptionHostMap: map[string]corev1.HostPathType{ + "/etc/zypp/credentials.d": corev1.HostPathDirectoryOrCreate, + "/etc/SUSEConnect": corev1.HostPathFileOrCreate, + }, + }, + "openshift skips explicit rhel subscription mounts": { + osRelease: "rhel", runtime: "containerd", openshift: "4.18", repoConfigEnabled: true, + }, } - for _, tc := range testCases { - t.Run(tc.description, func(t *testing.T) { + for name, tc := range testCases { + t.Run(name, func(t *testing.T) { stateDriver := &stateDriver{ stateSkel: stateSkel{ client: fake.NewClientBuilder().WithScheme(scheme.Scheme).WithObjects(repoConfigMap).Build(), @@ -673,13 +711,65 @@ func TestDriverAdditionalConfigsSubscriptionMounts(t *testing.T) { configs, err := stateDriver.getDriverAdditionalConfigs( context.Background(), driver, - testClusterInfo{runtime: consts.Containerd}, + testClusterInfo{runtime: tc.runtime, openshiftVersion: tc.openshift}, nodePool{osRelease: tc.osRelease, osVersion: tc.osRelease}, ) require.NoError(t, err) assertSubscriptionHostPathVolumes(t, configs.Volumes, tc.expectedSubscriptionHostMap) - assert.Equal(t, tc.expectSubscriptionMounts, hasSubscriptionVolumeMount(configs.VolumeMounts)) + expectedAdditionalMounts := append([]corev1.VolumeMount{}, tc.expectedSubscriptionMounts...) + if tc.repoConfigEnabled { + repoPaths := map[string]string{ + "rhel": "/etc/yum.repos.d/custom.repo", + "ubuntu": "/etc/apt/sources.list.d/custom.repo", + "sles": "/etc/zypp/repos.d/custom.repo", + "sl-micro": "/etc/zypp/repos.d/custom.repo", + } + expectedAdditionalMounts = append(expectedAdditionalMounts, corev1.VolumeMount{ + Name: "test-repo-config", MountPath: repoPaths[tc.osRelease], + SubPath: "custom.repo", ReadOnly: true, + }) + } + assert.ElementsMatch(t, expectedAdditionalMounts, configs.VolumeMounts) + expectedManagerMounts := []corev1.VolumeMount{} + if tc.osRelease == "rhel" && len(tc.expectedSubscriptionMounts) > 0 { + expectedManagerMounts = append(expectedManagerMounts, corev1.VolumeMount{ + Name: "subscription-config-3", MountPath: "/run/secrets/yum.repos.d", ReadOnly: true, + }) + } + + assert.ElementsMatch(t, expectedManagerMounts, configs.DriverManagerVolumeMounts) + + renderData := getMinimalDriverRenderData() + renderData.AdditionalConfigs = configs + objects := renderDriverObjects(t, scheme.Scheme, renderData) + ds, err := getDaemonsetFromObjects(objects) + require.NoError(t, err) + renderedDriver := findContainerByName(ds.Spec.Template.Spec.Containers, "nvidia-driver-ctr") + require.NotNil(t, renderedDriver) + for _, mount := range expectedAdditionalMounts { + assert.Contains(t, renderedDriver.VolumeMounts, mount) + } + var renderedSubscriptionMounts []corev1.VolumeMount + for _, mount := range renderedDriver.VolumeMounts { + if strings.HasPrefix(mount.Name, "subscription-config-") { + renderedSubscriptionMounts = append(renderedSubscriptionMounts, mount) + } + } + assert.ElementsMatch(t, tc.expectedSubscriptionMounts, renderedSubscriptionMounts) + + manager := findContainerByName(ds.Spec.Template.Spec.InitContainers, "k8s-driver-manager") + require.NotNil(t, manager) + for _, mount := range expectedManagerMounts { + assert.Contains(t, manager.VolumeMounts, mount) + } + for _, container := range ds.Spec.Template.Spec.Containers { + for _, mount := range container.VolumeMounts { + assert.NotEqual(t, "/run/secrets/yum.repos.d", mount.MountPath) + } + } + + assert.Equal(t, len(tc.expectedSubscriptionHostMap) > 0, hasSubscriptionVolumeMount(configs.VolumeMounts)) }) } } @@ -1089,6 +1179,17 @@ func TestVGPUHostManagerDaemonsetOpenShift(t *testing.T) { require.Equal(t, string(o), actual) } +func renderDriverObjects(t *testing.T, scheme *runtime.Scheme, renderData *driverRenderData) []*unstructured.Unstructured { + t.Helper() + state, err := NewStateDriver(nil, "test-operator", scheme, manifestDir) + require.NoError(t, err) + driverState, ok := state.(*stateDriver) + require.True(t, ok) + objects, err := driverState.renderManifestObjects(t.Context(), renderData) + require.NoError(t, err) + return objects +} + func getMinimalDriverRenderData() *driverRenderData { return &driverRenderData{ Driver: &driverSpec{ diff --git a/internal/state/driver_volumes.go b/internal/state/driver_volumes.go index 34f60ea609..1363f99b77 100644 --- a/internal/state/driver_volumes.go +++ b/internal/state/driver_volumes.go @@ -71,19 +71,27 @@ var SubscriptionPathMap = map[string]MountPathToVolumeSource{ "/run/secrets/etc-pki-entitlement": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/pki/entitlement", - Type: ptr.To(corev1.HostPathDirectory), + Type: new(corev1.HostPathDirectoryOrCreate), }, }, "/run/secrets/redhat.repo": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/yum.repos.d/redhat.repo", - Type: ptr.To(corev1.HostPathFile), + Type: new(corev1.HostPathFileOrCreate), }, }, "/run/secrets/rhsm": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/rhsm", - Type: ptr.To(corev1.HostPathDirectory), + Type: new(corev1.HostPathDirectoryOrCreate), + }, + }, + // FileOrCreate does not create parents. A separate directory volume + // lets kubelet create the repo directory and retry file setup if needed. + "/run/secrets/yum.repos.d": corev1.VolumeSource{ + HostPath: &corev1.HostPathVolumeSource{ + Path: "/etc/yum.repos.d", + Type: new(corev1.HostPathDirectoryOrCreate), }, }, }, @@ -91,19 +99,19 @@ var SubscriptionPathMap = map[string]MountPathToVolumeSource{ "/run/secrets/etc-pki-entitlement": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/pki/entitlement", - Type: ptr.To(corev1.HostPathDirectory), + Type: new(corev1.HostPathDirectory), }, }, "/run/secrets/redhat.repo": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/yum.repos.d/redhat.repo", - Type: ptr.To(corev1.HostPathFile), + Type: new(corev1.HostPathFile), }, }, "/run/secrets/rhsm": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/rhsm", - Type: ptr.To(corev1.HostPathDirectory), + Type: new(corev1.HostPathDirectory), }, }, }, @@ -111,13 +119,13 @@ var SubscriptionPathMap = map[string]MountPathToVolumeSource{ "/etc/zypp/credentials.d": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/zypp/credentials.d", - Type: ptr.To(corev1.HostPathDirectory), + Type: new(corev1.HostPathDirectoryOrCreate), }, }, "/etc/SUSEConnect": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/SUSEConnect", - Type: ptr.To(corev1.HostPathFileOrCreate), + Type: new(corev1.HostPathFileOrCreate), }, }, }, @@ -125,13 +133,13 @@ var SubscriptionPathMap = map[string]MountPathToVolumeSource{ "/etc/zypp/credentials.d": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/zypp/credentials.d", - Type: ptr.To(corev1.HostPathDirectory), + Type: new(corev1.HostPathDirectoryOrCreate), }, }, "/etc/SUSEConnect": corev1.VolumeSource{ HostPath: &corev1.HostPathVolumeSource{ Path: "/etc/SUSEConnect", - Type: ptr.To(corev1.HostPathFileOrCreate), + Type: new(corev1.HostPathFileOrCreate), }, }, }, @@ -184,19 +192,10 @@ func (s *stateDriver) getDriverAdditionalConfigs(ctx context.Context, cr *v1alph // set up subscription entitlements for RHEL(using K8s with a non-CRIO runtime) and SLES if (pool.osRelease == "rhel" && openshiftVersion == "" && runtime != consts.CRIO) || pool.osRelease == "sles" || pool.osRelease == "sl-micro" { - pathToVolumeSource := MountPathToVolumeSource{} - // Custom repo ConfigMap supplies yum repos in offline/air-gapped installs. Skip - // mounting host RHSM paths (/etc/pki/entitlement, redhat.repo, /etc/rhsm): they may - // be missing or not directories on minimal nodes, and are not needed when packages - // come only from the mounted repo ConfigMap. - if cr.Spec.IsRepoConfigEnabled() && pool.osRelease == "rhel" { - logger.Info("Skipping host subscription mounts because repoConfig is enabled", "OS", pool.osVersion) - } else { - logger.Info("Mounting subscriptions into the driver container", "OS", pool.osVersion) - pathToVolumeSource, err = getSubscriptionPathsToVolumeSources(pool.osRelease) - if err != nil { - return nil, fmt.Errorf("ERROR: failed to get path items for subscription entitlements: %w", err) - } + logger.Info("Mounting subscriptions into the driver container", "OS", pool.osVersion) + pathToVolumeSource, err := getSubscriptionPathsToVolumeSources(pool.osRelease) + if err != nil { + return nil, fmt.Errorf("ERROR: failed to get path items for subscription entitlements: %w", err) } // sort host path volumes to ensure ordering is preserved when adding to pod spec @@ -214,7 +213,12 @@ func (s *stateDriver) getDriverAdditionalConfigs(ctx context.Context, cr *v1alph MountPath: mountPath, ReadOnly: true, } - additionalCfgs.VolumeMounts = append(additionalCfgs.VolumeMounts, volMountSubscription) + if mountPath == "/run/secrets/yum.repos.d" { + // Keep the parent directory out of the driver containers. + additionalCfgs.DriverManagerVolumeMounts = append(additionalCfgs.DriverManagerVolumeMounts, volMountSubscription) + } else { + additionalCfgs.VolumeMounts = append(additionalCfgs.VolumeMounts, volMountSubscription) + } subscriptionVol := corev1.Volume{Name: volMountSubscriptionName, VolumeSource: pathToVolumeSource[mountPath]} additionalCfgs.Volumes = append(additionalCfgs.Volumes, subscriptionVol) diff --git a/manifests/state-driver/0500_daemonset.yaml b/manifests/state-driver/0500_daemonset.yaml index 65e1eb74a5..1532a5ceae 100644 --- a/manifests/state-driver/0500_daemonset.yaml +++ b/manifests/state-driver/0500_daemonset.yaml @@ -196,6 +196,13 @@ spec: - name: run-mellanox-drivers mountPath: /run/mellanox/drivers mountPropagation: HostToContainer + {{- if and .AdditionalConfigs .AdditionalConfigs.DriverManagerVolumeMounts }} + {{- range .AdditionalConfigs.DriverManagerVolumeMounts }} + - name: {{ .Name }} + mountPath: {{ .MountPath }} + readOnly: {{ .ReadOnly }} + {{- end }} + {{- end }} containers: - image: {{ .Driver.ImagePath }} imagePullPolicy: {{ default "IfNotPresent" .Driver.Spec.ImagePullPolicy }}