fix(region): filesystem sharable (#21377)

pkg/apis/compute/filesystem.go

@@ -44,7 +44,7 @@ const (
 )
 
 type FileSystemListInput struct {
-	apis.VirtualResourceListInput
+	apis.SharableVirtualResourceListInput
 	apis.ExternalizedResourceBaseListInput
 	ManagedResourceListInput
 
@@ -52,7 +52,7 @@ type FileSystemListInput struct {
 }
 
 type FileSystemCreateInput struct {
-	apis.VirtualResourceCreateInput
+	apis.SharableVirtualResourceCreateInput
 	// 协议类型
 	// enum: ["NFS", "SMB", "CPFS"]
 	Protocol string `json:"protocol"`
@@ -101,7 +101,7 @@ type FileSystemSyncstatusInput struct {
 }
 
 type FileSystemDetails struct {
-	apis.VirtualResourceDetails
+	apis.SharableVirtualResourceDetails
 	ManagedResourceInfo
 	CloudregionResourceInfo
 

pkg/compute/container_drivers/volume_mount/cephfs.go

@@ -18,9 +18,11 @@ import (
 	"context"
 
 	"yunion.io/x/pkg/gotypes"
+	"yunion.io/x/pkg/util/rbacscope"
 
 	"yunion.io/x/onecloud/pkg/apis"
 	api "yunion.io/x/onecloud/pkg/apis/compute"
+	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/cloudcommon/validators"
 	"yunion.io/x/onecloud/pkg/compute/models"
 	"yunion.io/x/onecloud/pkg/httperrors"
@@ -66,6 +68,9 @@ func (h cephFS) ValidatePodCreateData(ctx context.Context, userCred mcclient.Tok
 	if gotypes.IsNil(account) {
 		return httperrors.NewInputParameterError("invalid cephfs %s", filesystem.Name)
 	}
+	if !db.IsAllowUpdate(ctx, rbacscope.ScopeProject, userCred, filesystem) {
+		vm.ReadOnly = true
+	}
 	if account.Provider != api.CLOUD_PROVIDER_CEPHFS {
 		return httperrors.NewInputParameterError("invalid cephfs type %s", account.Provider)
 	}

pkg/compute/models/filesystem.go

@@ -42,7 +42,7 @@ import (
 )
 
 type SFileSystemManager struct {
-	db.SVirtualResourceBaseManager
+	db.SSharableVirtualResourceBaseManager
 	db.SExternalizedResourceBaseManager
 	SManagedResourceBaseManager
 	SCloudregionResourceBaseManager
@@ -55,7 +55,7 @@ var FileSystemManager *SFileSystemManager
 
 func init() {
 	FileSystemManager = &SFileSystemManager{
-		SVirtualResourceBaseManager: db.NewVirtualResourceBaseManager(
+		SSharableVirtualResourceBaseManager: db.NewSharableVirtualResourceBaseManager(
 			SFileSystem{},
 			"file_systems_tbl",
 			"file_system",
@@ -66,7 +66,7 @@ func init() {
 }
 
 type SFileSystem struct {
-	db.SVirtualResourceBase
+	db.SSharableVirtualResourceBase
 	db.SExternalizedResourceBase
 	SManagedResourceBase
 	SBillingResourceBase
@@ -111,9 +111,9 @@ func (manager *SFileSystemManager) ListItemFilter(
 	query api.FileSystemListInput,
 ) (*sqlchemy.SQuery, error) {
 	var err error
-	q, err = manager.SVirtualResourceBaseManager.ListItemFilter(ctx, q, userCred, query.VirtualResourceListInput)
+	q, err = manager.SSharableVirtualResourceBaseManager.ListItemFilter(ctx, q, userCred, query.SharableVirtualResourceListInput)
 	if err != nil {
-		return nil, errors.Wrapf(err, "SVirtualResourceBaseManager.ListItemFilter")
+		return nil, errors.Wrapf(err, "SSharableVirtualResourceBaseManager.ListItemFilter")
 	}
 	q, err = manager.SExternalizedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ExternalizedResourceBaseListInput)
 	if err != nil {
@@ -192,7 +192,7 @@ func (man *SFileSystemManager) ValidateCreateData(ctx context.Context, userCred
 		input.ExpiredAt = billingCycle.EndAt(tm)
 	}
 
-	input.VirtualResourceCreateInput, err = man.SVirtualResourceBaseManager.ValidateCreateData(ctx, userCred, ownerId, query, input.VirtualResourceCreateInput)
+	input.SharableVirtualResourceCreateInput, err = man.SSharableVirtualResourceBaseManager.ValidateCreateData(ctx, userCred, ownerId, query, input.SharableVirtualResourceCreateInput)
 	if err != nil {
 		return input, err
 	}
@@ -200,7 +200,7 @@ func (man *SFileSystemManager) ValidateCreateData(ctx context.Context, userCred
 }
 
 func (fileSystem *SFileSystem) PostCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, data jsonutils.JSONObject) {
-	fileSystem.SVirtualResourceBase.PostCreate(ctx, userCred, ownerId, query, data)
+	fileSystem.SSharableVirtualResourceBase.PostCreate(ctx, userCred, ownerId, query, data)
 	fileSystem.StartCreateTask(ctx, userCred, jsonutils.GetAnyString(data, []string{"network_id"}), "")
 }
 
@@ -231,15 +231,15 @@ func (manager SFileSystemManager) FetchCustomizeColumns(
 	isList bool,
 ) []api.FileSystemDetails {
 	rows := make([]api.FileSystemDetails, len(objs))
-	virtRows := manager.SVirtualResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
+	virtRows := manager.SSharableVirtualResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
 	regionRows := manager.SCloudregionResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
 	mRows := manager.SManagedResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
 	zoneIds := make([]string, len(objs))
 	for i := range rows {
 		rows[i] = api.FileSystemDetails{
-			VirtualResourceDetails:  virtRows[i],
-			CloudregionResourceInfo: regionRows[i],
-			ManagedResourceInfo:     mRows[i],
+			SharableVirtualResourceDetails: virtRows[i],
+			CloudregionResourceInfo:        regionRows[i],
+			ManagedResourceInfo:            mRows[i],
 		}
 		nas := objs[i].(*SFileSystem)
 		zoneIds[i] = nas.ZoneId
@@ -261,9 +261,9 @@ func (manager *SFileSystemManager) ListItemExportKeys(ctx context.Context,
 	keys stringutils2.SSortedStrings,
 ) (*sqlchemy.SQuery, error) {
 	var err error
-	q, err = manager.SVirtualResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys)
+	q, err = manager.SSharableVirtualResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys)
 	if err != nil {
-		return nil, errors.Wrap(err, "SVirtualResourceBaseManager.ListItemExportKeys")
+		return nil, errors.Wrap(err, "SSharableVirtualResourceBaseManager.ListItemExportKeys")
 	}
 	q, err = manager.SCloudregionResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys)
 	if err != nil {
@@ -275,7 +275,7 @@ func (manager *SFileSystemManager) ListItemExportKeys(ctx context.Context,
 func (manager *SFileSystemManager) QueryDistinctExtraField(q *sqlchemy.SQuery, field string) (*sqlchemy.SQuery, error) {
 	var err error
 
-	q, err = manager.SVirtualResourceBaseManager.QueryDistinctExtraField(q, field)
+	q, err = manager.SSharableVirtualResourceBaseManager.QueryDistinctExtraField(q, field)
 	if err == nil {
 		return q, nil
 	}
@@ -299,9 +299,9 @@ func (manager *SFileSystemManager) OrderByExtraFields(
 ) (*sqlchemy.SQuery, error) {
 	var err error
 
-	q, err = manager.SVirtualResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.VirtualResourceListInput)
+	q, err = manager.SSharableVirtualResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.SharableVirtualResourceListInput)
 	if err != nil {
-		return nil, errors.Wrap(err, "SVirtualResourceBaseManager.OrderByExtraFields")
+		return nil, errors.Wrap(err, "SSharableVirtualResourceBaseManager.OrderByExtraFields")
 	}
 	q, err = manager.SManagedResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.ManagedResourceListInput)
 	if err != nil {
@@ -452,14 +452,14 @@ func (fileSystem *SFileSystem) RealDelete(ctx context.Context, userCred mcclient
 			return errors.Wrapf(err, "mount target %s real delete", mts[i].DomainName)
 		}
 	}
-	return fileSystem.SVirtualResourceBase.Delete(ctx, userCred)
+	return fileSystem.SSharableVirtualResourceBase.Delete(ctx, userCred)
 }
 
 func (fileSystem *SFileSystem) ValidateDeleteCondition(ctx context.Context, info jsonutils.JSONObject) error {
 	if fileSystem.DisableDelete.IsTrue() {
 		return httperrors.NewInvalidStatusError("FileSystem is locked, cannot delete")
 	}
-	return fileSystem.SVirtualResourceBase.ValidateDeleteCondition(ctx, nil)
+	return fileSystem.SSharableVirtualResourceBase.ValidateDeleteCondition(ctx, nil)
 }
 
 func (fileSystem *SFileSystem) SyncAllWithCloudFileSystem(ctx context.Context, userCred mcclient.TokenCredential, fs cloudprovider.ICloudFileSystem) error {
@@ -684,7 +684,7 @@ func (fileSystem *SFileSystem) OnMetadataUpdated(ctx context.Context, userCred m
 }
 
 func (fileSystem *SFileSystem) GetShortDesc(ctx context.Context) *jsonutils.JSONDict {
-	desc := fileSystem.SVirtualResourceBase.GetShortDesc(ctx)
+	desc := fileSystem.SSharableVirtualResourceBase.GetShortDesc(ctx)
 	region, _ := fileSystem.GetRegion()
 	provider := fileSystem.GetCloudprovider()
 	info := MakeCloudProviderInfo(region, nil, provider)

pkg/hostman/container/volume_mount/cephfs.go

@@ -38,10 +38,14 @@ func (h cephFS) Mount(pod IPodInfo, ctrId string, vm *hostapi.ContainerVolumeMou
 		return err
 	}
 	procutils.NewRemoteCommandAsFarAsPossible("mkdir", "-p", dir).Output()
+	options := fmt.Sprintf("name=%s,secret=%s", vm.CephFS.Name, vm.CephFS.Secret)
+	if vm.ReadOnly {
+		options += ",ro"
+	}
 	args := []string{
 		"-t", "ceph",
 		fmt.Sprintf("%s:%s", vm.CephFS.MonHost, vm.CephFS.Path), dir,
-		"-o", fmt.Sprintf("name=%s,secret=%s", vm.CephFS.Name, vm.CephFS.Secret),
+		"-o", options,
 	}
 	out, err := procutils.NewRemoteCommandAsFarAsPossible("mount", args...).Output()
 	if err != nil {