kubevirt / containerized-data-importer / #6308

50%

Build Type

push

travis-ci

Committed by web-flow

Commit Message

CNV-97937 | Add external NBD support for VDDK imports (#4321)

* CNV-97937 | Add external NBD support for VDDK imports

Allow connecting to an external nbdkit via the
cdi.kubevirt.io/storage.import.vddk.nbdConnection annotation.

Signed-off-by: Martin Necas <mnecas@redhat.com>

* Add mutual TLS for external NBD VDDK imports

Mount the import secret at /nbd-certs for nbds:// URIs and configure
libnbd to require TLS with peer verification.

Resolves: None
Signed-off-by: Martin Necas <mnecas@redhat.com>

* vddk: switch base:allocation to libnbd.CONTEXT_BASE_ALLOCATION

Signed-off-by: Martin Necas <mnecas@redhat.com>

* vddk: add nbd and nbds validations

Signed-off-by: Martin Necas <mnecas@redhat.com>

* vddk: Harden nbds TLS secret mount and hostname verify

Use AnnVddkNbdTlsSecret to mount only PEM keys for nbds://, require that
annotation for VDDK NBD imports, verify TLS hostname, and ConnectUri for
both schemes. Surface invalid NBD config on Running with a warning event.
Drop SetTlsPriority and the importer crypto_policies_tar.

Signed-off-by: Martin Necas <mnecas@redhat.com>

* vddk: Disable SetTlsVerifyPeer for external nbd connection

Signed-off-by: Martin Necas <mnecas@redhat.com>

* vddk: Restore crypto-policies for nbds:// GnuTLS priority

el9 libnbd stubs SetTlsPriority as missing, so ignore that call and
ship crypto_policies_tar again so the default @SYSTEM GnuTLS priority
works in the importer image.

Signed-off-by: Martin Necas <mnecas@redhat.com>

* vddk: Keep peer verify for external nbds:// on el9

Drop SetTlsVerifyPeer(false) and SetTlsPriority (missing on libnbd 1.20);
require a SAN matching the nbds:// URI host. Document warm retargeting of
AnnVddkNbdConnection, check export size vs VMware capacity, and limit the
crypto-policies gnutls.config symlink to amd64 importer images.

Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Martin Necas <mnecas@redhat.com>

* vddk: add VDDK external nbd import tests

Signed-off-by: Mart... (continued)

Coverage Stats

72 of 132 new or added lines in 4 files covered. (54.55%)

5 existing lines in 2 files now uncovered.

15543 of 30909 relevant lines covered (50.29%)

0.56 hits per line