volume mount propagation mode isn't provided to task

[shumin1027]

I have a problem when trying to use cvmfs-csi in nomad , the csi plugin works fine, but it seems that it cannot be automatically mounted in the application container, may be because missing rslave or rshared in the container mount

Here is the issue: cvmfs-contrib/cvmfs-csi#52

The CSI volume mount needs to support "mount propagation" option，such as:

k8s volume mount propagation

docker bind propagation

[tgross]

Hi @shumin1027! I think this was fixed in #15096, which if I'm reading correctly was released in Nomad 1.4.3. Can you confirm which version of Nomad you're running?

[shumin1027]

Hi @shumin1027! I think this was fixed in #15096, which if I'm reading correctly was released in Nomad 1.4.3. Can you confirm which version of Nomad you're running?

@tgross The version is Nomad v1.4.4-dev

I need to set propagation_mode when mounting a CSI volume, such as：

......
volume "cvmfs" {
  type   = "csi"
  source = "cvmfs-volume"
  ......  
}
task "ubuntu" {
  volume_mount {
    volume           = "cvmfs"
    destination      = "/cvmfs"
    read_only        = true
    propagation_mode = "rshared"
  }
}
......

I don't know how to configure, there is also no example configuration given for this in the docs

https://developer.hashicorp.com/nomad/docs/job-specification/volume_mount#volume_mount-parameters
https://developer.hashicorp.com/nomad/docs/other-specifications/volume
https://developer.hashicorp.com/nomad/docs/job-specification/volume

[shumin1027]

@tgross The PropagationMode option is not processed when mounting Host Volume and CSI Volume

func hostVolumeMountConfigurations:

nomad/client/allocrunner/taskrunner/volume_hook.go

Lines 81 to 86 in fc4abf2

	mcfg := &drivers.MountConfig{
	HostPath: hostVolume.Path,
	TaskPath: m.Destination,
	Readonly: hostVolume.ReadOnly || req.ReadOnly || m.ReadOnly,
	}
	mounts = append(mounts, mcfg)

func prepareCSIVolumes:

nomad/client/allocrunner/taskrunner/volume_hook.go

Lines 172 to 179 in fc4abf2

	for _, m := range mountsForAlias {
	mcfg := &drivers.MountConfig{
	HostPath: csiMountPoint.Source,
	TaskPath: m.Destination,
	Readonly: request.ReadOnly || m.ReadOnly,
	}
	mounts = append(mounts, mcfg)
	}

[tgross]

Looking at the code, the example you gave here looks right:

volume_mount {
    volume           = "cvmfs"
    destination      = "/cvmfs"
    read_only        = true
    propagation_mode = "rshared"
  }

See api/tasks.go#L421. So the first problem is that we need to fix our documentation to include that. But you're right it looks like it's missing from those bits in the volume_hook as well. I'll mark this is a bug to fix, but I won't be able to pick this up again until after the new year. We'd also be happy to review a PR if you're like to make one.

I've adjusted the title slightly so that it's a little more obvious what this impacts.

[shumin1027]

@tgross The correct configuration parameters should be like this，:

volume_mount {
    volume           = "cvmfs"
    destination      = "/cvmfs"
    read_only        = true
    propagation_mode = "host-to-task"
  }

propagation_mode should be filled with private ,host-to-task or bidirectional

nomad/nomad/structs/volumes.go

Lines 13 to 17 in f452441

	const (
	VolumeMountPropagationPrivate = "private"
	VolumeMountPropagationHostToTask = "host-to-task"
	VolumeMountPropagationBidirectional = "bidirectional"
	)

nomad/drivers/docker/driver.go

Lines 712 to 719 in f452441

	var userMountToUnixMount = map[string]string{
	// Empty string maps to `rprivate` for backwards compatibility in restored
	// older tasks, where mount propagation will not be present.
	"": "rprivate",
	nstructs.VolumeMountPropagationPrivate: "rprivate",
	nstructs.VolumeMountPropagationHostToTask: "rslave",
	nstructs.VolumeMountPropagationBidirectional: "rshared",
	}

[tgross]

Closed by #15626