aws-efs-csi-driver
aws-efs-csi-driver copied to clipboard
kubernetes-sigs
Set `fips_mode_enabled` in `efs-utils.conf`
if env var FIPS_ENABLED is set: https://github.com/kubernetes-sigs/aws-efs-csi-driver/issues/1325 .
Is this a bug fix or adding new feature?
This is a bug: if the driver is run in FIPS-enabled environment, stunnel fails with "Failed to override system-wide FIPS mode" (see src/options.c from stunnel-5.72).
What is this PR about? / Why do we need it?
The PR ensures that if FIPS_ENABLED=true as env var for aws-efs csi driver, it creates efs-utils.conf with fips_mode_enabled = true.
What testing is done?
In the environment where stunnel fails with "Failed to override system-wide FIPS mode", re-create the Pod with aws-efs csi driver adding FIPS_ENABLED=true env var. Made sure that fips_mode_enabled = true is present in config and stunnel succeeds.
Fixes https://github.com/kubernetes-sigs/aws-efs-csi-driver/issues/1325
Hey we'll look at this on Monday and try to get this out. Does the bug still arise in the latest (2.0+) versions of the driver which don't use stunnel?
@seanzatzdev-amazon ,
Hey we'll look at this on Monday and try to get this out. Does the bug still arise in the latest (2.0+) versions of the driver which don't use stunnel?
Thank you for expediting this. I tested the bug on a latest upstream version a couple of months ago and it didn't arise by default, when rust efs-porxy is being run instead of stunnel. However, it still can bite any customer who try to put stunnel as mountOption to StorageClass:
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
name: efs-sc
provisioner: efs.csi.aws.com
mountOptions:
- stunnel
[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: mpatlasov, mskanth972
The full list of commands accepted by this bot can be found here.
The pull request process is described here
- ~~OWNERS~~ [mskanth972]
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
Build is failing with the following errors
error: package `tokio-macros v2.4.0` cannot be built because it requires rustc 1.70 or newer, while the currently active rustc version is 1.68.2
#12 237.8 Either upgrade to rustc 1.70 or newer, or use
#12 237.8 cargo update -p [email protected] --precise ver
#12 237.8 where `ver` is the latest version of `tokio-macros` supporting rustc 1.68.2
#12 237.8
#12 237.8
#12 237.8 RPM build errors:
#12 237.8 error: Bad exit status from /var/tmp/rpm-tmp.WsVTpk (%build)
#12 237.8 bogus date in %changelog: Mon Apr 23 2024 Ryan Stankiewicz <[email protected]> - 2.0.1
#12 237.8 bogus date in %changelog: Wed Jan 1 2023 Ryan Stankiewicz <[email protected]> - 1.34.5
#12 237.8 Bad exit status from /var/tmp/rpm-tmp.WsVTpk (%build)
We released the above error fix to Amazon Linux but not to efs-utils GitHub. Driver pull efs-utils from GitHub, will fix that and will trigger the tests.