feat(manila): add CephFS backend support

This patch add support for the Ceph File System (CephFS) backend
in the manila.

Change-Id: Idb82764635d5896841a173fecd3e39fd202b13ec
Signed-off-by: Dong Ma <dong.ma@vexxhost.com>

manila/templates/bin/_ceph-keyring.sh.tpl

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+{{/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+set -ex
+export HOME=/tmp
+
+cat > /etc/ceph/ceph.client.manila.keyring <<EOF
+[client.manila]
+    key = $(cat /tmp/client-keyring)
+EOF

manila/templates/configmap-bin.yaml

@@ -55,4 +55,6 @@ data:
 {{ tuple "bin/_manila-scheduler.sh.tpl" . | include "helm-toolkit.utils.template" | indent 4 }}
   manila-share.sh: |
 {{ tuple "bin/_manila-share.sh.tpl" . | include "helm-toolkit.utils.template" | indent 4 }}
+  ceph-keyring.sh: |
+{{ tuple "bin/_ceph-keyring.sh.tpl" . | include "helm-toolkit.utils.template" | indent 4 }}
 {{- end }}

manila/templates/deployment-share.yaml

@@ -20,6 +20,9 @@ limitations under the License.
 
 {{- $serviceAccountName := "manila-share" }}
 {{ tuple $envAll "share" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
+
+{{- $enabledBackends := default "" .Values.conf.manila.DEFAULT.enabled_share_backends }}
+{{- $isCephfsEnabled := (contains "cephfs" $enabledBackends) }}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -77,6 +80,26 @@ spec:
             - name: pod-shared
               mountPath: /tmp/pod-shared
 {{ if $mounts_manila_share.volumeMounts }}{{ toYaml $mounts_manila_share.volumeMounts | indent 12 }}{{ end }}
+        {{ if $isCephfsEnabled }}
+        - name: ceph-keyring-placement
+{{ tuple $envAll "manila_share" | include "helm-toolkit.snippets.image" | indent 10 }}
+{{ dict "envAll" $envAll "application" "manila" "container" "ceph_keyring_placement" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
+          command:
+            - /tmp/ceph-keyring.sh
+          volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
+            - name: etcceph
+              mountPath: /etc/ceph
+            - name: manila-bin
+              mountPath: /tmp/ceph-keyring.sh
+              subPath: ceph-keyring.sh
+              readOnly: true
+            - name: ceph-keyring
+              mountPath: /tmp/client-keyring
+              subPath: key
+              readOnly: true
+        {{ end }}
       containers:
         - name: manila-share
 {{ tuple $envAll "manila_share" | include "helm-toolkit.snippets.image" | indent 10 }}
@@ -140,6 +163,18 @@ spec:
               mountPath: /tmp/manila-share.sh
               subPath: manila-share.sh
               readOnly: true
+{{- if $isCephfsEnabled }}
+            - name: etcceph
+              mountPath: /etc/ceph
+            - name: ceph-etc
+              mountPath: /etc/ceph/ceph.conf
+              subPath: ceph.conf
+              readOnly: true
+            - name: ceph-keyring
+              mountPath: /tmp/client-keyring
+              subPath: key
+              readOnly: true
+{{- end }}
 {{- dict "enabled" .Values.manifests.certificates "name" .Values.endpoints.oslo_db.auth.admin.secret.tls.internal "path" "/etc/mysql/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
 {{- dict "enabled" (or .Values.manifests.certificates .Values.tls.identity) "name" .Values.secrets.tls.share.api.internal "path" "/etc/manila/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
 {{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_messaging.auth.admin.secret.tls.internal "path" "/etc/rabbitmq/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
@@ -166,6 +201,17 @@ spec:
           configMap:
             name: manila-bin
             defaultMode: 0555
+{{- if $isCephfsEnabled }}
+        - name: etcceph
+          emptyDir: {}
+        - name: ceph-etc
+          configMap:
+            name: ceph-etc
+            defaultMode: 0444
+        - name: ceph-keyring
+          secret:
+            secretName: manila-keyring
+{{- end }}
 {{- dict "enabled" .Values.manifests.certificates "name" .Values.endpoints.oslo_db.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
 {{- dict "enabled" (or .Values.manifests.certificates .Values.tls.identity) "name" .Values.secrets.tls.share.api.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
 {{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_messaging.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}

releasenotes/notes/manila-3a767553950629bd.yaml

@@ -0,0 +1,5 @@
+---
+manila:
+  - |
+    Add support for the Ceph File System (CephFS) backend in the manila.
+...