m/node/kubernetes: remove local-strict storage class
It turns out that the local-strict storage class did not have an effect
on readonly volumes, or on gVisor. And after updating runc to 1.2.0, it
no longer has an effect anywhere. It appears that setting noexec and
similar flags in the CSI server, using a storage class, is the wrong
approach and just happened to work by accident. Instead, this should
probably be implemented as a Kubernetes feature to set per-mount-point
flags on the VolumeMount.
This commit thus removes the local-strict storage class and the mount
options processing in the provisioner and CSI server. This will allow
updating runc.
Additionally, the StatefulSet end-to-end test is extended to also run
tests with gVisor. gVisor apparently does not support block volumes.
See: https://github.com/monogon-dev/monogon/issues/361
Change-Id: Ic2f50aa3bc9442ca1dbb9e8742d5b8fecbfc3614
Reviewed-on: https://review.monogon.dev/c/monogon/+/3658
Tested-by: Jenkins CI
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
diff --git a/metropolis/test/e2e/suites/kubernetes/kubernetes_helpers.go b/metropolis/test/e2e/suites/kubernetes/kubernetes_helpers.go
index 25a785d..9c67117 100644
--- a/metropolis/test/e2e/suites/kubernetes/kubernetes_helpers.go
+++ b/metropolis/test/e2e/suites/kubernetes/kubernetes_helpers.go
@@ -156,7 +156,7 @@
}
// makeTestStatefulSet generates a StatefulSet spec
-func makeTestStatefulSet(name string) *appsv1.StatefulSet {
+func makeTestStatefulSet(name string, runtimeClass string) *appsv1.StatefulSet {
return &appsv1.StatefulSet{
ObjectMeta: metav1.ObjectMeta{Name: name},
Spec: appsv1.StatefulSetSpec{
@@ -175,17 +175,6 @@
},
},
{
- ObjectMeta: metav1.ObjectMeta{Name: "vol-local-strict"},
- Spec: corev1.PersistentVolumeClaimSpec{
- AccessModes: []corev1.PersistentVolumeAccessMode{corev1.ReadWriteOnce},
- Resources: corev1.VolumeResourceRequirements{
- Requests: map[corev1.ResourceName]resource.Quantity{corev1.ResourceStorage: resource.MustParse("5Mi")},
- },
- StorageClassName: ptr.To("local-strict"),
- VolumeMode: ptr.To(corev1.PersistentVolumeFilesystem),
- },
- },
- {
ObjectMeta: metav1.ObjectMeta{Name: "vol-readonly"},
Spec: corev1.PersistentVolumeClaimSpec{
AccessModes: []corev1.PersistentVolumeAccessMode{corev1.ReadWriteOnce},
@@ -218,16 +207,13 @@
Name: "test",
ImagePullPolicy: corev1.PullIfNotPresent,
Image: "test.monogon.internal/metropolis/test/e2e/persistentvolume/persistentvolume_image",
+ Args: []string{"-runtimeclass", runtimeClass},
VolumeMounts: []corev1.VolumeMount{
{
Name: "vol-default",
MountPath: "/vol/default",
},
{
- Name: "vol-local-strict",
- MountPath: "/vol/local-strict",
- },
- {
Name: "vol-readonly",
ReadOnly: true,
MountPath: "/vol/readonly",
@@ -241,6 +227,7 @@
},
},
},
+ RuntimeClassName: ptr.To(runtimeClass),
},
},
},