Creating SMBShares in different namespaces about samba-operator HOT 3 CLOSED

Hi! First off, thanks a lot for this feedback it helps a lot.

Looking at the code, the operator creates the resources (PVC, Deployment, Service) in the operator's namespace and then sets the SMBShare resource as the owner of these resources (to have K8S garbage collect them).

To be honest, this code has gone back and forth a bit and is quite immature. I am not really shocked to find we're not handling this right.

But, K8S does not allow cross namespace ownership. So, if the SMBShare is created in a different namespace, this operation will fail. Please note that the return value is not checked:

samba-operator/internal/resources/smbshare.go

Line 311 in 878ac25

controllerutil.SetControllerReference(s, pvc, m.scheme)

This is very helpful thanks - it reveals two problems: one is what you point out and the other is that our static checker is not detecting ignored errors!

In the demo showed in SambaXP right after provisioning the operator the context is set to use the namespace of the operator. As a result, all the resources created in the demo are created in that namespace and this issue does not occur.

Is the intention to force the users to create SMBShares only in the operator's namespace?

If you want to try out the samba share's operation it is true that creating the resources in the same namespace as the operator itself is your best bet today. In most of our integration tests this is what's done and it generally works.

What we ultimately want to do is a bit "squishy" as we're still trying to learn how best to deploy the various samba components in k8s and I'm not sure what workflows we want to support. That's where feedback like yours is valuable. If you were deploying this operator in your cluster, how would you like it to work in the ideal case?

I was trying to "clean up" the namespace behavior a few months ago and I probably made things worse. :-) So thank you for pointing this out.

from samba-operator.

I think an admin would like to provision the operator once and then allow the users provision shares. In addition, admins like to dedicate namespaces to different teams in order to separate between them. So, different teams create resources in their own namespace. This also allows the admin to monitor the usage of each team, in the form of their namespace(s).

So, I think you should make sure users can create shares in any namespace

from samba-operator.

I think an admin would like to provision the operator once and then allow the users provision shares. In addition, admins like to dedicate namespaces to different teams in order to separate between them. So, different teams create resources in their own namespace. This also allows the admin to monitor the usage of each team, in the form of their namespace(s).

So, I think you should make sure users can create shares in any namespace

Thanks. That certainly makes sense to me. I guess given the restrictions k8s places on secret access and ownership I guess that the operator must create resources in the same namespace as the SmbShare resource. It was (kind of) doing that before so I guess it shouldn't be too difficult to start doing that again in a cleaner manner.

from samba-operator.