deploy: work around read-only /sys

Depending on the cluster configuration (seen on OpenShift 4.5, Kubernetes 1.18.3, cri-o 1.18.3), /sys is mounted read-only although a read/write mount gets requested. The theory is that some component does something special for /sys, so hopefully asking for it to be mounted also under /host-sys and then bind-mounting inside the container will work around that. We need /host-sys because the special sysfs that normally can be mounted directly does not exist inside the container. An attempt to do that simpler approach failed: pmem-csi-intel-com-node-n992g/pmem-driver@pmem..ker2: Mounting command: mount pmem-csi-intel-com-node-n992g/pmem-driver@pmem..ker2: Mounting arguments: -o rw,seclabel,nosuid,nodev,noexec,relatime sysfs /sys pmem-csi-intel-com-node-n992g/pmem-driver@pmem..ker2: Output: mount: /sys: special device sysfs does not exist.
intel · Mar 1, 2021 · 7a5b879 · 7a5b879
1 parent 0d74110
commit 7a5b879
Show file tree

Hide file tree

Showing 44 changed files with 166 additions and 30 deletions.
diff --git a/deploy/bindata_generated.go b/deploy/bindata_generated.go
diff --git a/deploy/kubernetes-1.17/direct/pmem-csi.yaml b/deploy/kubernetes-1.17/direct/pmem-csi.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.17/direct/testing/pmem-csi.yaml b/deploy/kubernetes-1.17/direct/testing/pmem-csi.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.17/lvm/pmem-csi.yaml b/deploy/kubernetes-1.17/lvm/pmem-csi.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.17/lvm/testing/pmem-csi.yaml b/deploy/kubernetes-1.17/lvm/testing/pmem-csi.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.17/pmem-csi-direct-testing.yaml b/deploy/kubernetes-1.17/pmem-csi-direct-testing.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.17/pmem-csi-direct.yaml b/deploy/kubernetes-1.17/pmem-csi-direct.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.17/pmem-csi-lvm-testing.yaml b/deploy/kubernetes-1.17/pmem-csi-lvm-testing.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.17/pmem-csi-lvm.yaml b/deploy/kubernetes-1.17/pmem-csi-lvm.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.18/direct/pmem-csi.yaml b/deploy/kubernetes-1.18/direct/pmem-csi.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.18/direct/testing/pmem-csi.yaml b/deploy/kubernetes-1.18/direct/testing/pmem-csi.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.18/lvm/pmem-csi.yaml b/deploy/kubernetes-1.18/lvm/pmem-csi.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.18/lvm/testing/pmem-csi.yaml b/deploy/kubernetes-1.18/lvm/testing/pmem-csi.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.18/pmem-csi-direct-testing.yaml b/deploy/kubernetes-1.18/pmem-csi-direct-testing.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.18/pmem-csi-direct.yaml b/deploy/kubernetes-1.18/pmem-csi-direct.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.18/pmem-csi-lvm-testing.yaml b/deploy/kubernetes-1.18/pmem-csi-lvm-testing.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.18/pmem-csi-lvm.yaml b/deploy/kubernetes-1.18/pmem-csi-lvm.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19-alpha/direct/pmem-csi.yaml b/deploy/kubernetes-1.19-alpha/direct/pmem-csi.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19-alpha/direct/testing/pmem-csi.yaml b/deploy/kubernetes-1.19-alpha/direct/testing/pmem-csi.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19-alpha/lvm/pmem-csi.yaml b/deploy/kubernetes-1.19-alpha/lvm/pmem-csi.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19-alpha/lvm/testing/pmem-csi.yaml b/deploy/kubernetes-1.19-alpha/lvm/testing/pmem-csi.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19-alpha/pmem-csi-direct-testing.yaml b/deploy/kubernetes-1.19-alpha/pmem-csi-direct-testing.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19-alpha/pmem-csi-direct.yaml b/deploy/kubernetes-1.19-alpha/pmem-csi-direct.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19-alpha/pmem-csi-lvm-testing.yaml b/deploy/kubernetes-1.19-alpha/pmem-csi-lvm-testing.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19-alpha/pmem-csi-lvm.yaml b/deploy/kubernetes-1.19-alpha/pmem-csi-lvm.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19/direct/pmem-csi.yaml b/deploy/kubernetes-1.19/direct/pmem-csi.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19/direct/testing/pmem-csi.yaml b/deploy/kubernetes-1.19/direct/testing/pmem-csi.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19/lvm/pmem-csi.yaml b/deploy/kubernetes-1.19/lvm/pmem-csi.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19/lvm/testing/pmem-csi.yaml b/deploy/kubernetes-1.19/lvm/testing/pmem-csi.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19/pmem-csi-direct-testing.yaml b/deploy/kubernetes-1.19/pmem-csi-direct-testing.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19/pmem-csi-direct.yaml b/deploy/kubernetes-1.19/pmem-csi-direct.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19/pmem-csi-lvm-testing.yaml b/deploy/kubernetes-1.19/pmem-csi-lvm-testing.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.19/pmem-csi-lvm.yaml b/deploy/kubernetes-1.19/pmem-csi-lvm.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.20/direct/pmem-csi.yaml b/deploy/kubernetes-1.20/direct/pmem-csi.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.20/direct/testing/pmem-csi.yaml b/deploy/kubernetes-1.20/direct/testing/pmem-csi.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.20/lvm/pmem-csi.yaml b/deploy/kubernetes-1.20/lvm/pmem-csi.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.20/lvm/testing/pmem-csi.yaml b/deploy/kubernetes-1.20/lvm/testing/pmem-csi.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.20/pmem-csi-direct-testing.yaml b/deploy/kubernetes-1.20/pmem-csi-direct-testing.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.20/pmem-csi-direct.yaml b/deploy/kubernetes-1.20/pmem-csi-direct.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.20/pmem-csi-lvm-testing.yaml b/deploy/kubernetes-1.20/pmem-csi-lvm-testing.yaml
@@ -495,6 +495,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kubernetes-1.20/pmem-csi-lvm.yaml b/deploy/kubernetes-1.20/pmem-csi-lvm.yaml
@@ -455,6 +455,8 @@ spec:
           name: dev-dir
         - mountPath: /sys
           name: sys-dir
+        - mountPath: /host-sys
+          name: sys-dir
         - mountPath: /csi
           name: socket-dir
         - mountPath: /var/lib/pmem-csi.intel.com

diff --git a/deploy/kustomize/driver/pmem-csi.yaml b/deploy/kustomize/driver/pmem-csi.yaml
@@ -273,6 +273,16 @@ spec:
           mountPath: /dev
         - name: sys-dir
           mountPath: /sys
+        # We also mount the host's /sys into the container under a different path
+        # than /sys because on OpenShift 4.5, the mount at /sys became read-only:
+        # - https://github.com/intel/pmem-csi/issues/786
+        # - https://github.com/containerd/containerd/issues/3221
+        #
+        # The pmem-csi-driver binary will bind-mount /host-sys onto /sys
+        # when it detects that problem to ensure that libndctl works without
+        # modifications.
+        - name: sys-dir
+          mountPath: /host-sys
         - name: socket-dir
           mountPath: /csi
         - name: pmem-state-dir

diff --git a/pkg/pmem-csi-operator/controller/deployment/controller_driver.go b/pkg/pmem-csi-operator/controller/deployment/controller_driver.go
@@ -1287,6 +1287,10 @@ func (d *pmemCSIDeployment) getNodeDriverContainer() corev1.Container {
 				Name:      "sys-dir",
 				MountPath: "/sys",
 			},
+			{
+				Name:      "sys-dir",
+				MountPath: "/host-sys",
+			},
 			{
 				Name:      "socket-dir",
 				MountPath: "/csi",