Seems certain characters in smb credentials break authentication. #573
Open
Description
What happened:
It seems mounting of the volume fails when using $ in base64 encoded password in kubernetes secret.
Mount fails with the following errors:
dmesg
[10671.918745] CIFS: Attempting to mount //some/mount/
[10671.934408] Status code returned 0xc000006d STATUS_LOGON_FAILURE
[10671.934415] CIFS VFS: \\some.mount Send error in SessSetup = -13
[10671.934639] CIFS VFS: cifs_mount failed w/return code = -13
syslog (kubelet)
7-2bl92" (UID: "ac426042-e91d-4999-805e-fd43d7a4c518") : rpc error: code = Internal desc = volume(NewsDropMedia) mount "//some/mount/" on "/var/lib/kubelet/plugins/kubernetes.io/csi/pv/pv-smb/globalmount" failed with mount failed: exit status 32
Jan 13 10:24:22 k8s02usr-sbx-alpha05 kubelet[684]: Mounting command: mount
Jan 13 10:24:22 k8s02usr-sbx-alpha05 kubelet[684]: Mounting arguments: -t cifs -o dir_mode=0777,file_mode=0777,noperm,mfsymlinks,cache=strict,noserverino,vers=3.0,domain=some.domain,<masked> //some/mount/ /var/lib/kubelet/plugins/kubernetes.io/csi/pv/pv-smb/globalmount
Jan 13 10:24:22 k8s02usr-sbx-alpha05 kubelet[684]: Output: mount error(13): Permission denied
Jan 13 10:24:22 k8s02usr-sbx-alpha05 kubelet[684]: Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)
What you expected to happen:
Correct mounting of volume
How to reproduce it:
Use $ character in password.
Anything else we need to know?:
Upon removing $ from the password both in AD as well as the kubernetes secret the share mounted as intended.
Physical Volume:
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv-smb
spec:
capacity:
storage: 100Gi
accessModes:
- ReadWriteMany
persistentVolumeReclaimPolicy: Retain
mountOptions:
- dir_mode=0777
- file_mode=0777
- noperm
- mfsymlinks
- cache=strict
- noserverino # required to prevent data corruption
- vers=3.0
csi:
driver: smb.csi.k8s.io
readOnly: false
volumeHandle: somemountid
volumeAttributes:
source: "//some/mount/"
nodeStageSecretRef:
name: smbcreds
namespace: smb-app
Secret:
apiVersion: v1
data:
domain: b64-domain
password: b64-password
username: b64-username
kind: Secret
metadata:
name: smbcreds
namespace: smb-app
type: Opaque
Environment:
- CSI Driver version: 1.9.0
- Kubernetes version (use
kubectl version): v1.23.8-gke.1900 - OS (e.g. from /etc/os-release): Ubuntu 20.04.5 LTS (Focal Fossa)
- Kernel (e.g.
uname -a): Linux 5.4.0-1054-gkeop - Install tools:
curl -skSL https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/v1.9.0/deploy/install-driver.sh | bash -s v1.9.0 -- - Others:
Metadata
Assignees
Labels
No labels