nvmf: targeted per-version connect (rd.nvmf.nqn) instead of connect-all
Hosts connected with 'nvme connect-all', which attaches EVERY subsystem in the discovery log. Each host then mounts only its own by-UUID verity namespaces but leaves a live controller on every other served version's subsystem. Observed via spdk-release list: more controllers than workstations, each box on every version (1/3/3/1/3 across 5 versions for ~3 boxes). Beyond wasted connections (O(hosts x versions)), it defeated the rolling-update drain/reap: no version ever reached 0 connections while any host was up, so spdk-loader's auto-reap could never fire and old versions accumulated without bound. Fix — targeted connect to this build's subsystem only: - extract-artifacts.sh bakes the per-version SUBNQN (already in verity.json .subnqn, matched by the serving side) into the signed UKI cmdline as rd.nvmf.nqn=. NQN is version identity, not per-host state, and the cmdline is already per-version + immutable-per-signed-UKI, so invariant #1 holds. - nvmf-connect.sh (test path) uses 'nvme connect -n <nqn>'; legacy UKIs without rd.nvmf.nqn fall back to connect-all with a warning so they still boot. - dot1x-macsec-up.sh (secure path) gains an explicit step-6 targeted connect over macsec0 (after it's addressed, per invariant #2), replacing the delegation to the dracut nvmf module's discovery connect-all. Now each host = 1 controller on its own subsystem; versions drain to 0 when their hosts migrate, so auto-reap works and connections scale O(hosts). Requires a rebuild + re-sign (cmdline change, invariant #6). BENCH-VERIFY both paths; confirm the dracut nvmf module isn't also connect-all-ing on the secure path. CLAUDE.md invariant #2 + TODO #6 updated.
This commit is contained in:
Audiobuzz
@@ -5,8 +5,9 @@
|
||||
# 2. start wpa_supplicant (argv[0]=@wpa_supplicant => survives switch-root)
|
||||
# 3. wait for EAP success + macsec0
|
||||
# 4. DHCP on macsec0 (the pre-auth lease, if any, is invalid post-auth/VLAN)
|
||||
# 5. derive hostnqn/hostid from the cert so dracut's nvmf module can
|
||||
# connect the NVMe/TCP root namespace over macsec0
|
||||
# 5. derive hostnqn/hostid from the cert
|
||||
# 6. TARGETED NVMe/TCP connect over macsec0 (rd.nvmf.nqn -> this version's
|
||||
# subsystem only, not a discovery connect-all of every served version)
|
||||
# Idempotent: guarded by a stamp file because initqueue may re-run hooks.
|
||||
|
||||
type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
|
||||
@@ -159,5 +160,44 @@ if [ ! -s /etc/nvme/hostnqn ]; then
|
||||
info "dot1x-macsec: hostnqn $(cat /etc/nvme/hostnqn)"
|
||||
fi
|
||||
|
||||
# --- 6. connect the NVMe/TCP root over macsec0 (TARGETED to this version) ----
|
||||
# Explicit targeted connect. This hook used to only set /etc/nvme/hostnqn and
|
||||
# leave the connect to the dracut nvmf module's discovery mechanism — a
|
||||
# `connect-all` that attaches EVERY served version's subsystem to this host,
|
||||
# inflating target controllers to O(hosts x versions) and keeping old versions
|
||||
# pinned above zero connections so the per-version drain/reap gate never fires
|
||||
# (see TODO #6). rd.nvmf.nqn pins THIS build's subsystem (baked per-version into
|
||||
# the signed cmdline by extract-artifacts.sh, matching verity.json .subnqn on the
|
||||
# target); nvme uses the hostnqn/hostid written in step 5. Load-bearing order
|
||||
# (invariant #2): this runs AFTER macsec0 is addressed — never connect NVMe
|
||||
# before macsec0 has an IP. Keep-alive tuning matches the test path (-k 30 long
|
||||
# KATO, -l -1 retry forever, -c 10) so the root link survives kiosk CPU pressure
|
||||
# and blips. BENCH-VERIFY: the secure path is not yet confirmed end-to-end.
|
||||
_disc=$(getarg rd.nvmf.discover=)
|
||||
_nqn=$(getarg rd.nvmf.nqn=)
|
||||
if [ -n "$_disc" ] && [ -n "$_nqn" ] && [ ! -e /run/dot1x/.nvmf-connected ]; then
|
||||
_trtype=${_disc%%,*}; _rest=${_disc#*,}
|
||||
_traddr=${_rest%%,*}; _trsvcid=${_rest##*,}
|
||||
modprobe nvme_tcp 2>/dev/null
|
||||
ply nvme-active
|
||||
i=0
|
||||
while [ "$i" -lt "$TIMEOUT" ]; do
|
||||
nvme connect -t "$_trtype" -a "$_traddr" -s "$_trsvcid" -n "$_nqn" \
|
||||
-k 30 -l -1 -c 10 2>/dev/null
|
||||
for _ns in /dev/nvme[0-9]*n[0-9]*; do
|
||||
if [ -b "$_ns" ]; then
|
||||
: > /run/dot1x/.nvmf-connected
|
||||
ply nvme-done
|
||||
info "dot1x-macsec: NVMe root connected over macsec0 ($_ns)"
|
||||
break 2
|
||||
fi
|
||||
done
|
||||
sleep 1; i=$((i + 1))
|
||||
done
|
||||
[ -e /run/dot1x/.nvmf-connected ] || warn "dot1x-macsec: NVMe/TCP connect to $_nqn timed out after ${TIMEOUT}s"
|
||||
elif [ -z "$_nqn" ]; then
|
||||
warn "dot1x-macsec: rd.nvmf.nqn not set (legacy UKI) — leaving NVMe connect to the dracut nvmf module (connect-all)"
|
||||
fi
|
||||
|
||||
: > "$STAMP"
|
||||
exit 0
|
||||
|
||||
@@ -26,6 +26,15 @@ _rest=${_disc#*,}
|
||||
_traddr=${_rest%%,*}
|
||||
_trsvcid=${_rest##*,}
|
||||
|
||||
# Targeted connect: rd.nvmf.nqn pins THIS build's subsystem (baked per-version
|
||||
# into the signed cmdline by extract-artifacts.sh, matching verity.json .subnqn
|
||||
# on the target). This replaces a discovery `connect-all`, which attached EVERY
|
||||
# served version's subsystem to every host — inflating target controllers and
|
||||
# keeping old versions pinned above zero connections so they never drained/reaped
|
||||
# (see TODO #6). If rd.nvmf.nqn is absent (a legacy UKI), fall back to connect-all
|
||||
# so the host still boots — with a warning.
|
||||
_nqn=$(getarg rd.nvmf.nqn=)
|
||||
|
||||
# nvme_tcp is usually auto-loaded; ensure it so /dev/nvme-fabrics exists.
|
||||
modprobe nvme_tcp 2>/dev/null
|
||||
|
||||
@@ -50,11 +59,19 @@ _ctrl_loss_tmo=-1
|
||||
_reconnect_delay=10
|
||||
|
||||
# Networking (ip=dhcp) is brought up in parallel, so poll-and-connect until a
|
||||
# fabrics namespace appears or we time out. connect-all is idempotent.
|
||||
# fabrics namespace appears or we time out. Both connect forms are idempotent
|
||||
# (re-connecting an already-attached subsystem just errors, harmlessly).
|
||||
[ -n "$_nqn" ] || echo "nvmf-connect: rd.nvmf.nqn not set — falling back to connect-all (legacy UKI; attaches every served version)" >&2
|
||||
_i=0
|
||||
while [ "$_i" -lt 60 ]; do
|
||||
nvme connect-all -t "$_trtype" -a "$_traddr" -s "$_trsvcid" \
|
||||
-k "$_kato" -l "$_ctrl_loss_tmo" -c "$_reconnect_delay" 2>/dev/null
|
||||
if [ -n "$_nqn" ]; then
|
||||
# TARGETED: attach only this build's subsystem (its data + hash namespaces).
|
||||
nvme connect -t "$_trtype" -a "$_traddr" -s "$_trsvcid" -n "$_nqn" \
|
||||
-k "$_kato" -l "$_ctrl_loss_tmo" -c "$_reconnect_delay" 2>/dev/null
|
||||
else
|
||||
nvme connect-all -t "$_trtype" -a "$_traddr" -s "$_trsvcid" \
|
||||
-k "$_kato" -l "$_ctrl_loss_tmo" -c "$_reconnect_delay" 2>/dev/null
|
||||
fi
|
||||
for _ns in /dev/nvme[0-9]*n[0-9]*; do
|
||||
if [ -b "$_ns" ]; then
|
||||
mkdir -p /run/dot1x
|
||||
|
||||
Reference in New Issue
Block a user