sambaXP 2023 - SINK Demo 1

[phlogistonjohn]

The SINK Team's 2023 sambaXP presentation contains two demonstrations. This year the theme was how SINK projects are more then just for use on Kubernetes and that samba-container images can be used without a Kubernetes cluster.

Our first demo runs a simple standalone container under Podman and systemd, while exporting a CephFS subvolume using the Samba VFS module for Ceph. The idea is to show how the samba-container offers a full range of Samba features while at the same time using the most minimal set of orchestration tools that are enough to manually set up a service that will persist across reboots on a single node.

Video Recording

The original demo recording

Introduction Text

Running a Single Samba Server container instance

• Under podman
• Using systemd
• Exporting a CephFS sub-volume

The current setup:

A previously configured 3 node Ceph cluster (managed with cephadm).
A Fedora VM preinstalled with podman (and quadlet).

I've also preinstalled smbclient locally for quick testing
and enabled the firewall to permit smb trafic.

Reference Links

SINK:

• samba-container: https://github.com/samba-in-kubernetes/samba-container
• sambacc: https://github.com/samba-in-kubernetes/sambacc

Podman:

• Podman: https://podman.io/
• Quadlet: https://www.redhat.com/sysadmin/quadlet-podman

Ceph:

• https://ceph.io
• https://docs.ceph.com/en/latest/

Configuration Files and Commands Used

This demo assumes that cephfs has been created already. We will need an admin (that could be you) to create a client "user" for us called client.fs. If you have admin access to your cluster this can be done using sudo ceph fs authorize cephfs client.fs1 / rw. See the Ceph docs (linked above) for more details on how to access CephFS.

On a ceph (admin) node:

# to get a auth token for our client user
sudo ceph auth get-or-create client.fs1
# -- Example output --
# [client.fs1] 
#        key = AQDDHlFkAwgiJxAAwHwhMZV8vC3PwYp41XtI9A==

# to get a minimal client configuration for the smb host
sudo ceph config generate-minimal-conf
# -- Example output --
# [global]
#        fsid = a22a2446-e8f5-11ed-bd1d-525400220000
#        mon_host = [v2:192.168.76.200:3300/0,v1:192.168.76.200:6789/0] [v2:192.168.76.201:3300/0,v1:192.168.76.201:6789/0]

# create a subvolume
sudo ceph fs subvolume create cephfs smb1 --mode=777
# get the absolute path to the subvolume
sudo ceph fs subvolume getpath cephfs smb1
# -- Example output --
# /volumes/_nogroup/smb1/ad8ac4b2-3094-4bda-a559-1260e2333e87

On the node we'll be running our samba-container (smb1):

sudo mkdir -p /etc/ceph
vim fs1.ceph.conf  # copy ceph config command output above
vim fs1.ceph.keyring # copy ceph auth command above
sudo cp fs1.ceph.conf /etc/ceph
sudo cp fs1.ceph.keyring /etc/ceph

Create container .tom with the following content:

samba-container-config = "v0"

[configs.sambaxp]
shares = ["sambaxp"]
globals = ["default"]
instance_name = "SAMBA"

[shares.sambaxp.options]
"vfs objects" = "ceph"
path = "/volumes/_nogroup/smb1/ad8ac4b2-3094-4bda-a559-1260e2333e87"
"ceph:config_file" = "/etc/ceph/fs1.ceph.conf"
"ceph:user_id" = "fs1"
"kernel share modes" = "no"
"read only" = "no"
"browseable" = "yes"

[globals.default.options]
"security" = "user"
"server min protocol" = "SMB2"
"load printers" = "no"
"printing" = "bsd"
"printcap name" = "/dev/null"
"disable spoolss" = "yes"
"guest ok" = "no"

[users]
all_entries = [
    {name="sambauser", password="samba"},
    {name="user2", password="samba"},
]

Create sambaxp.container with the following content:

[Unit]
Description=Samba Container with CephFS VFS

[Container]
Image=quay.io/samba.org/samba-server:nightly
ContainerName=samba
Network=host
Volume=/var/lib/samba-container/lib:/var/lib/samba:z
Volume=/var/lib/samba-container/etc:/etc/samba-container:z
Volume=/etc/ceph:/etc/ceph
Environment=SAMBACC_CONFIG=/etc/samba-container/container.toml
Environment=SAMBA_CONTAINER_ID=sambaxp
Exec=run --setup=config --setup=users --setup=users_passdb --setup=nsswitch smbd

Continuing on smb1, run:

# create config and metadata dirs for samba-container
sudo mkdir -p /var/lib/samba-container/{etc,lib}
# copy our configuration files to the final locations
sudo cp container.toml /var/lib/samba-container/etc
sudo cp sambaxp.container /etc/containers/systemd

# proactively pull the container image
sudo podman pull quay.io/samba.org/samba-server:nightly

# reload systemd
sudo systemctl daemon-reload
# start the service that will launch our container
sudo systemctl start sambaxp.service

If all goes well, you'll have a service running and a container visible using sudo podman ps.
Try connecting to the host over port 445 using smbclient or Windows. Note that you may need to allow port 445 if the host you are using enables a firewall by default.