Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Manila CSI unnecessarily picky about openstack creds #2757

Open
mandre opened this issue Jan 13, 2025 · 0 comments · May be fixed by #2758
Open

Manila CSI unnecessarily picky about openstack creds #2757

mandre opened this issue Jan 13, 2025 · 0 comments · May be fixed by #2758

Comments

@mandre
Copy link
Contributor

mandre commented Jan 13, 2025

While testing a Manila change on an OpenStack environment with application credentials, I got a successful install however Manila CSI was reporting issues when trying to provision a volume:

E1119 16:11:03.280195       1 controller.go:957] error syncing claim "e5eda1ee-29c2-4aef-bfd5-146c0da60439": failed to provision volume with StorageClass "csi-manila-ceph": rpc error: code = InvalidArgument desc = invalid OpenStack secrets: parameter 'os-userName' requires 'os-password'

And

E1119 16:12:28.492969       1 controller.go:957] error syncing claim "e5eda1ee-29c2-4aef-bfd5-146c0da60439": failed to provision volume with StorageClass "csi-manila-ceph": rpc error: code = InvalidArgument desc = invalid OpenStack secrets: parameter 'os-domainName' requires exactly one of [os-password os-clientCertPath] parameters

It turns out, I had unneeded attributes in my clouds.yaml that caused Manila-CSI to fail.

openstack:
  auth:
    application_credential_id: xxx
    application_credential_secret: xxx
    auth_url: xxx
    user_domain_name: xxx # Not necessary
    username: xxx # Not necessary
  auth_type: v3applicationcredential
  endpoint_type: public
  identity_api_version: "3"
  region_name: regionOne

Removing user_domain_name and username from my clouds.yaml allowed Manila to provision volumes.

Manila-CSI should be able to ignore these extra attributes, like the CLI openstack client does.
mandre added a commit to shiftstack/cloud-provider-openstack that referenced this issue Jan 13, 2025
@mandre
[manila-csi-plugin]: be more tolerant about openstack auth
c0ab03f 
Remove the dependency on `os-password` for a couple of fields. These
fields do not necessarily depend on a password being set, as we could be
using application credentials for example. The logic was wrong.

This prevents manila driver from entering an error state when it finds
unnecessary fields in the clouds.yaml. It now simply ignores them.

Fixes kubernetes#2757.
mandre added a commit to shiftstack/cloud-provider-openstack that referenced this issue Jan 13, 2025
@mandre
[manila-csi-plugin] make auth more tolerant
38b428f 
Remove dependency on a couple of fields where the logic was wrong. For
example, these fields do not necessarily depend on a password being set,
as we could be using application credentials.

This prevents manila driver from entering an error state when it finds
unnecessary fields in the clouds.yaml. It now simply ignores them.

Fixes kubernetes#2757.
@mandre mandre linked a pull request Jan 13, 2025 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[manila-csi-plugin] make auth more tolerant shiftstack/cloud-provider-openstack
1 participant
@mandre