Skip to content

Add anonymous volume backend for /var/lib/kubelet mount to enable idmap support #135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ggiguash merged 1 commit into from
Nov 24, 2025
Merged

Add anonymous volume backend for /var/lib/kubelet mount to enable idmap support #135

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 0 additions & 6 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,12 +108,6 @@ image:
--env EMBED_CONTAINER_IMAGES="${EMBED_CONTAINER_IMAGES}" \
-f packaging/microshift-runner.Containerfile .

# Notes:
# - An isolated network is created if the ISOLATED_NETWORK environment variable is set
# - The /dev directory is shared with the container to enable TopoLVM CSI driver,
# masking the devices that may conflict with the host
# - The containers storage is mounted on a tmpfs to avoid usage of fuse-overlayfs,
# which is less efficient than the default driver
.PHONY: run
run:
@USHIFT_IMAGE=${USHIFT_IMAGE} ISOLATED_NETWORK=${ISOLATED_NETWORK} LVM_DISK=${LVM_DISK} LVM_VOLSIZE=${LVM_VOLSIZE} VG_NAME=${VG_NAME} ./src/cluster_manager.sh create
Expand Down
4 changes: 4 additions & 0 deletions packaging/microshift-runner.Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,3 +58,7 @@ RUN if [ "${EMBED_CONTAINER_IMAGES}" = "1" ] ; then \
# shared as required by OVN images
COPY --from=builder ${BUILDER_RSHARED_SERVICE} /usr/lib/systemd/system/microshift-make-rshared.service
RUN systemctl enable microshift-make-rshared.service

# The /var directory is shared with the container as an anonymous volume to enable
# idmap mounts under /var/lib/kubelet for containers using 'hostUsers: false'
VOLUME ["/var"]
10 changes: 9 additions & 1 deletion src/cluster_manager.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,13 @@ _get_ip_address() {
echo "$subnet" | awk -F. -v new="$node_id" 'NF==4{$4=new+10; printf "%s.%s.%s.%s", $1,$2,$3,$4} NF!=4{print $0}'
}

# Notes:
# - The container joins the cluster network and gets the cluster network IP
# address when the ISOLATED_NETWORK environment variable is set to 0.
# - The /dev directory is shared with the container to enable TopoLVM CSI driver,
# masking the devices that may conflict with the host
# - The containers storage is mounted on a tmpfs to avoid usage of fuse-overlayfs,
# which is less efficient than the default driver
_add_node() {
local -r name="${1}"
local -r network_name="${2}"
Expand Down Expand Up @@ -256,7 +263,8 @@ cluster_destroy() {
echo "Stopping container: ${container}"
sudo podman stop --time 0 "${container}" || true
echo "Removing container: ${container}"
sudo podman rm -f "${container}" || true
# Remove the container and its anonymous volumes
sudo podman rm -f --volumes "${container}" || true
done

if sudo podman network exists "${USHIFT_MULTINODE_CLUSTER}"; then
Expand Down
Loading