CephFS driver must stop using DBUS to communicate with nfs-ganesha
The CephFS driver in manila currently uses "dbus-send" to send signals to nfs-ganesha in order to create, update and delete NFS exports. This approach has some pitfalls:
1) Service deployment is constrained: the manila-share service (where the cephfs driver runs) has to be able to have access to the dbus socket that the nfs-ganesha service listens on. When they're running on the same host, this isn't a problem. However, when these services are containerized or when they're running on different hosts, the driver requires (a) the dbus socket file to be shared between two containers on the same host; or (b) root access to the host where the nfs-ganesha service is running (because the driver doesn't request elevated privileges when issuing dbus-send over ssh)*
2) Ceph config file cannot be customized. This is a bug in nfs-ganesha: https:/
3) Mutiple instances of nfs-ganesha cannot be updated simultaneously - this limits using nfs-ganesha in an active/active configuration. We could send separate dbus-send commands however, the manila driver would have to own the synchronization, error handling and retries-on-failure.
So better direction here would be to use the "watch_url" mechanism where any number of ganesha instances (and others too!) can be made to watch a rados url, and sending a notification would signal ganesha daemon/s to reload configuration and apply exports.
1) (b) can be resolved by creating a user that has SSH access and permissions to use dbus-send via switching the policy context, however, the nfs-ganesha team had turned down this request: https:/
Blueprint information
- Status:
- Started
- Approver:
- Goutham Pacha Ravi
- Priority:
- Medium
- Drafter:
- Goutham Pacha Ravi
- Direction:
- Approved
- Assignee:
- Victoria Martinez de la Cruz
- Definition:
- Discussion
- Series goal:
- Accepted for zed
- Implementation:
- Started
- Milestone target:
- zed-3
- Started by
- Goutham Pacha Ravi
- Completed by