ID-mapped mounts [LWN.net]

ID-mapped mounts

Posted Jun 1, 2022 17:18 UTC (Wed) by developer122 (guest, #152928)
In reply to: ID-mapped mounts by jhoblitt
Parent article: ID-mapped mounts

It's been frustrating to no end that you can't do user mapping in NFS without dragging kerberos into the picture. Despite what some documentation would suggest, it's not possible.

Sometimes you just want a simple file of the form:
user1@host1.host1.host1.host1 = localuser1
user2@host2.host2.host2.host2 = localuser1
user3@host3.host3.host3.host3 = localuser2

to post comments

ID-mapped mounts

Posted Jun 1, 2022 18:41 UTC (Wed) by ballombe (subscriber, #9523) [Link] (1 responses)

what happened to rpc.ugidd ?

ID-mapped mounts

Posted Jun 1, 2022 18:45 UTC (Wed) by jhoblitt (subscriber, #77733) [Link]

NFS uid/gid mapping is essentially useless if you expect both reads and writes to be remapped.

ID-mapped mounts

Posted Jun 1, 2022 21:13 UTC (Wed) by jhoblitt (subscriber, #77733) [Link] (1 responses)

I've never gotten idmapping to work with sec=krb5. Not saying it isn't possible... just I couldn't get it to work.

krb5 isn't always practical. I have an application that mounts nfs into k8s pods. krb5 wasn't designed in the era of 100-1000s of "hosts" dynamically coming and going. While it supposedly isn't impossible to get krb5 working in a pod (https://cloud.redhat.com/blog/kerberos-sidecar-container), it doesn't look like much fun either.

ID-mapped mounts

Posted Jun 14, 2022 12:30 UTC (Tue) by cortana (subscriber, #24596) [Link]

If only RHEL would include the excellent kstart (yes I know it's in EPEL) then that would have been so much simpler.

That said, gssproxy is the better option these days, since it only requires an environment variable to be set. But I never figured out how to use it in a pod...