[v2,00/11] Make iscsid-kernel communications namespace-aware

Message

Chris Leech May 6, 2023, 11:29 p.m. UTC

This set of patches modifies the kernel iSCSI initiator communications
so that they are namespace-aware. The goal is to allow multiple iSCSI
daemon (iscsid) to run at once as long as they are in separate
namespaces, and so that iscsid can run in containers.

Container runtime environments seem to want to containerize their own
components, and there have been complaints about the need to run iscsid
from the host network namespace. There are still priviledged
capabilities needed for iscsid, but these changes address the namespace
issue.

I've tested with iscsi_tcp and iser over rxe with an unmodified iscsid
running in a podman container.

Note that with iscsi_tcp, the connected socket will keep the network
namespace alive after container exit. The namespace will exit once the
connection terminates, and I'd recommend running with a iSCSI
noop_out_timeout set to error out the connection after the routing has
been removed.

v2: Changes from Lee's last RFC posting
- Minor changes to patches 2 & 3 to not break iSER

- Large changes in patch 6, merging in patches posted to the previous
  discussion. Use of current when setting the netns on an iscsi_tcp
  session has been removed, instead an unbound (from a host) session
  creation with an explicit netns interface has been added. Similar
  changes for iSER endpoints have been added, and iSER support for
  non-default network namespaces was enabled.

- The addition of patches 10 & 11 from the previous discussions to force
  removal of sessions on namespace exit.

Chris Leech, Lee Duncan (11):
  iscsi: create per-net iscsi netlink kernel sockets
  iscsi: associate endpoints with a host
  iscsi: sysfs filtering by network namespace
  iscsi: make all iSCSI netlink multicast namespace aware
  iscsi: check net namespace for all iscsi lookup
  iscsi: set netns for tcp and iser hosts
  iscsi: convert flashnode devices from bus to class
  iscsi: rename iscsi_bus_flash_* to iscsi_flash_*
  iscsi: filter flashnode sysfs by net namespace
  iscsi: make session and connection lists per-net
  iscsi: force destroy sesions when a network namespace exits

 drivers/infiniband/ulp/iser/iscsi_iser.c |  61 +-
 drivers/scsi/be2iscsi/be_iscsi.c         |   6 +-
 drivers/scsi/bnx2i/bnx2i_iscsi.c         |   6 +-
 drivers/scsi/cxgbi/libcxgbi.c            |   6 +-
 drivers/scsi/iscsi_tcp.c                 |  15 +-
 drivers/scsi/libiscsi.c                  |  16 +
 drivers/scsi/qedi/qedi_iscsi.c           |   6 +-
 drivers/scsi/qla4xxx/ql4_os.c            |  64 +-
 drivers/scsi/scsi_transport_iscsi.c      | 790 ++++++++++++++++-------
 include/scsi/libiscsi.h                  |   4 +
 include/scsi/scsi_transport_iscsi.h      |  75 ++-
 11 files changed, 725 insertions(+), 324 deletions(-)

Comments

Mike Christie May 10, 2023, 7:54 p.m. UTC | #1

On 5/6/23 4:29 PM, Chris Leech wrote:
> Note that with iscsi_tcp, the connected socket will keep the network
> namespace alive after container exit. The namespace will exit once the

What happens for iser? Is it the same?