Date: 2026-02-02
Verify NFSv4 + Kerberos mounts and Kubernetes access for single-node cluster storage.
kryptovisor.auth.home.lan./etc/fstab.mount | rg -n "/mnt/(fastdata|bigdata)"
Expected: both /mnt/fastdata and /mnt/bigdata mounted as nfs4 with sec=krb5p.
ls -la /mnt/fastdata
ls -la /mnt/bigdata
For per-UID access (pods running as IPA users), rpc.gssd must use gssproxy.
Confirm these files/paths exist:
/etc/nfs.conf includes:[gssd]
use-gss-proxy = 1
keytab-file = /etc/krb5.keytab
/etc/gssproxy/99-nfs-client.conf includes:[service/nfs-client]
mechs = krb5
cred_store = keytab:/etc/krb5.keytabs/k8s-nfs-access.keytab
cred_store = ccache:FILE:/var/lib/gssproxy/clients/krb5cc_nfs_%U
cred_usage = initiate
euid = 0
allow_any_uid = yes
trusted = yes
kernel_nfsd = no
rpc_pipefs exists and is mounted:mount | rg -n "/var/lib/nfs/rpc_pipefs"
Restart after changes:
systemctl restart gssproxy rpc-gssd
k8s-nfs-access.securityContext.runAsUser to the IPA user UID and runAsGroup/fsGroup to the group GID.Example (pod spec snippet):
securityContext:
runAsUser: 1240000012
runAsGroup: 1240000009
fsGroup: 1240000009
/mnt/fastdata and /mnt/bigdata mounted with sec=krb5p.use-gss-proxy = 1 in /etc/nfs.conf./etc/gssproxy/99-nfs-client.conf points to the keytab and per-UID cache.gssproxy and rpc-gssd active.Simulate pod identity before testing in Kubernetes:
sudo -u '#1240000012' -g '#1240000009' bash -lc \
'id; ls -la /mnt/bigdata | head; touch /mnt/bigdata/.uid1240000012_test && echo OK || echo FAIL'
sudo rm -f /mnt/bigdata/.uid1240000012_test 2>/dev/null || true
nfs-common installed and Kerberos credentials are valid.use-gss-proxy = 1 and gssproxy keytab/ccache paths.