CF Volume Services - Building for Failure, Security and Performance
summary
Describes a working CF volume services stack that mounts user-specified NFS or SMB shares into app containers using a cell-side volume manager and drivers, with a user-mapping FUSE called mapfs to translate UIDs and optional LDAP auth stored in CredHub for binds. Kernel mounts default to caching-off for safety but allow read-only or no-mapper modes for better performance; fixes include cancelling mount process groups and using lazy unmounts to avoid orphan mounts. SMB with SMBv3 gets recommended; a CF-on-Kubernetes POC shows block devices for a 3-node DB cluster.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:39Cloud Foundry
- 3:31How does it work
- 5:34BBS
- 9:00Kerberos
- 9:59LDAP
- 13:21App Placement
- 14:41Unreliable Maps
- 15:52Lazy Unmount
- 20:27Locking
- 22:50Summary
- 23:30Looking Forward
- 24:27Immediate Future
related talks
23mSMB Keeping - Clients, Clusters & Clouds
21mCSI Volume Attacks – The SRE Strikes Back
32mThe Route To Rootless Containers
39mCeph in Scientific Computing and Large Clusters BoF
38mCTF as a Service
31mThe SMB Report Card
36mPaving the Way for Uninterrupted Car Operations
42mSecuring Filesystem Images for Unprivileged Containers