Base changes for aznfs/azfiles-nfs package split#316
Draft
sprasad-microsoft wants to merge 1 commit into
Draft
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR lays the groundwork for splitting the existing aznfs package into two coordinated packages: aznfs (Blob/NFSv3-focused) and azfiles-nfs (Files/NFSv4.1 + TLS/stunnel/watchdogv4-focused), while keeping the mount.aznfs entrypoint working across transition scenarios.
Changes:
- Introduces the new
azfiles-nfspackaging (DEB/RPM) and wiring (installer wrapper, dependency links, upgrade/transition behaviors). - Redirects mount-helper execution to
/opt/microsoft/azfiles-nfs/*and adds logic to block Blob mounts when onlyazfiles-nfsis installed. - Expands CI validation to cover split/upgrade/uninstall scenarios and adds local-install support for matrix runs.
Reviewed changes
Copilot reviewed 20 out of 20 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| testing/testscript.sh | Expands test matrix to validate aznfs/azfiles-nfs split transitions and mount behavior. |
| src/mountscript.sh | Points common helpers at azfiles-nfs and adds “azfiles-only” Blob mount blocking logic. |
| src/mount.aznfs.c | Updates mount helper to exec the azfiles-nfs mountscript path. |
| src/aznfswatchdogv4 | Makes watchdog path configurable via APPNAME/OPTDIR for split packaging. |
| src/aznfswatchdog | Makes watchdog path configurable via APPNAME/OPTDIR for split packaging. |
| scripts/aznfs_install.sh | Generalizes installer/autoupdate script via exported env keys/names for reuse. |
| scripts/azfiles_install.sh | Adds azfiles-nfs installer wrapper that sets env and delegates to aznfs_install.sh. |
| packaging/aznfs/RPM/aznfs.spec | Makes aznfs require azfiles-nfs at the same version; removes moved files. |
| packaging/aznfs/DEBIAN/prerm | Removes aznfswatchdogv4 stop/disable from aznfs removal path. |
| packaging/aznfs/DEBIAN/postinst | Removes aznfswatchdogv4 startup and moves common.sh ownership to azfiles-nfs. |
| packaging/aznfs/DEBIAN/control | Adds azfiles-nfs dependency for Debian packaging. |
| packaging/azfiles-nfs/RPM/aznfs.spec | Introduces RPM spec for azfiles-nfs package contents and scripts. |
| packaging/azfiles-nfs/DEBIAN/prerm | Adds Debian removal checks + service shutdown for azfiles-nfs. |
| packaging/azfiles-nfs/DEBIAN/preinst | Adds Debian preinstall transition detection for moved-file ownership. |
| packaging/azfiles-nfs/DEBIAN/postrm | Adds Debian post-removal cleanup for azfiles-nfs state/config. |
| packaging/azfiles-nfs/DEBIAN/postinst | Adds Debian postinstall permissions/config + service enablement for azfiles-nfs. |
| packaging/azfiles-nfs/DEBIAN/control | Introduces Debian control file for azfiles-nfs package metadata. |
| package.sh | Updates package build pipeline to emit azfiles-nfs RPM/DEB and adjust aznfs contents. |
| lib/common.sh | Makes APPNAME/OPTDIR/INSTALLSCRIPT configurable to support split packages. |
| generate_package.sh | Updates packaging pipeline similarly to generate azfiles-nfs artifacts. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+200
to
+220
| is_package_installed() | ||
| { | ||
| local package_name="$1" | ||
|
|
||
| if command -v dpkg-query >/dev/null 2>&1; then | ||
| dpkg-query -W -f='${Status}' "$package_name" 2>/dev/null | grep -q 'install ok installed' | ||
| elif command -v rpm >/dev/null 2>&1; then | ||
| rpm -q "$package_name" >/dev/null 2>&1 | ||
| else | ||
| return 1 | ||
| fi | ||
| } | ||
|
|
||
| is_azfiles_only_install() | ||
| { | ||
| if is_package_installed azfiles-nfs && ! is_package_installed aznfs; then | ||
| return 0 | ||
| fi | ||
|
|
||
| return 1 | ||
| } |
Comment on lines
253
to
257
| if [ "$nfs_vers" == "4.1" ]; then | ||
| if [ "$USING_AZNFSCLIENT" == true ]; then | ||
| eecho "Turbo nfs client does not support NFS version: $nfs_vers!" | ||
| exit 1 | ||
| fi |
Comment on lines
+1
to
+14
| #!/bin/bash | ||
| # -------------------------------------------------------------------------------------------- | ||
| # Copyright (c) Microsoft Corporation. All rights reserved. | ||
| # Licensed under the MIT License. See License.txt in the project root for license information. | ||
| # -------------------------------------------------------------------------------------------- | ||
|
|
||
| export APPNAME="azfiles-nfs" | ||
| export PKG_NAME="azfiles-nfs" | ||
| export AUTO_UPDATE_KEY="AUTO_UPDATE_AZFILES_NFS" | ||
| export WATCHDOG_PROC="aznfswatchdogv4" | ||
| export WATCHDOG_SERVICE="aznfswatchdogv4" | ||
| export WATCHDOG_SERVICE_V4="aznfswatchdogv4" | ||
|
|
||
| exec /opt/microsoft/azfiles-nfs/aznfs_install.sh "$@" |
Comment on lines
+73
to
+92
| # Set appropriate permissions. | ||
| chmod 0755 /opt/microsoft/azfiles-nfs/ | ||
| chmod 0755 /usr/sbin/aznfswatchdogv4 | ||
| chmod 0755 /opt/microsoft/azfiles-nfs/mountscript.sh | ||
| chmod 0755 /opt/microsoft/azfiles-nfs/nfsv4mountscript.sh | ||
| chmod 0755 /opt/microsoft/azfiles-nfs/aznfs_install.sh | ||
| chmod 0755 /opt/microsoft/azfiles-nfs/azfiles_install.sh | ||
| chmod 0644 /opt/microsoft/azfiles-nfs/common.sh | ||
| chmod 0644 /lib/systemd/system/aznfswatchdogv4.service | ||
|
|
||
| # Set suid bit for mount.aznfs to allow mount for non-super user. | ||
| chmod 4755 /sbin/mount.aznfs | ||
|
|
||
| # Create data directory for holding mountmap and log file. | ||
| mkdir -p /opt/microsoft/azfiles-nfs/data | ||
| chmod 0755 /opt/microsoft/azfiles-nfs/data | ||
|
|
||
| # Create log directory under /etc/stunnel to store stunnel logs | ||
| mkdir -p /etc/stunnel/microsoft/azfiles-nfs/nfsv4_fileShare/logs | ||
| chmod 0644 /etc/stunnel/microsoft/azfiles-nfs/nfsv4_fileShare/logs |
Comment on lines
+201
to
+213
| chmod 0755 /opt/microsoft/azfiles-nfs/ | ||
| chmod 0755 /usr/sbin/aznfswatchdogv4 | ||
| chmod 0755 /opt/microsoft/azfiles-nfs/nfsv4mountscript.sh | ||
| chmod 0755 /opt/microsoft/azfiles-nfs/aznfs_install.sh | ||
| chmod 0755 /opt/microsoft/azfiles-nfs/azfiles_install.sh | ||
| chmod 0644 /opt/microsoft/azfiles-nfs/common.sh | ||
| chmod 0644 /lib/systemd/system/aznfswatchdogv4.service | ||
|
|
||
| mkdir -p /opt/microsoft/azfiles-nfs/data | ||
| chmod 0755 /opt/microsoft/azfiles-nfs/data | ||
|
|
||
| mkdir -p /etc/stunnel/microsoft/azfiles-nfs/nfsv4_fileShare/logs | ||
| chmod 0644 /etc/stunnel/microsoft/azfiles-nfs/nfsv4_fileShare/logs |
Comment on lines
+16
to
+26
| if [ $existing_mounts_v4 -ne 0 ]; then | ||
| echo | ||
| echo -e "${RED}There are existing Azure Files NFS mounts using azfiles-nfs mount helper, they will not be tracked!" | ||
| echo -n -e "Are you sure you want to continue? [y/N]${NORMAL} " | ||
| read -n 1 result | ||
| echo | ||
| if [ "$result" != "y" -a "$result" != "Y" ]; then | ||
| echo "Removal aborted!" | ||
| exit 1 | ||
| fi | ||
| fi |
Comment on lines
733
to
+737
| # Load common aznfs helpers. | ||
| APPNAME="${APPNAME:-aznfs}" | ||
| OPTDIR="${OPTDIR:-/opt/microsoft/${APPNAME}}" | ||
| AZNFS_VERSION=4 | ||
| . /opt/microsoft/aznfs/common.sh | ||
| . ${OPTDIR}/common.sh |
Comment on lines
+755
to
+763
| if [ "$return_code" -eq 0 ]; then | ||
| echo "[ERROR] Blob NFS mount unexpectedly succeeded while only azfiles-nfs was installed." | ||
| echo "[ERROR] mount target: $blob_export" | ||
| echo "$mount_output" | ||
| fail "Blob NFS mount unexpectedly succeeded while only azfiles-nfs was installed" | ||
| fi | ||
|
|
||
| echo "Blob NFS mount blocked as expected after aznfs removal." | ||
| } |
| #include <sys/types.h> | ||
|
|
||
| #define MOUNTSCRIPT "/opt/microsoft/aznfs/mountscript.sh" | ||
| #define MOUNTSCRIPT "/opt/microsoft/azfiles-nfs/mountscript.sh" |
| APPNAME="aznfs" | ||
| OPTDIR="/opt/microsoft/${APPNAME}" | ||
| APPNAME="${APPNAME:-aznfs}" | ||
| OPTDIR="${OPTDIR:-/opt/microsoft/${APPNAME}}" |
Collaborator
There was a problem hiding this comment.
An unprivileged user can set OPTDIR to a writable directory containing an executable nfsv4mountscript.sh, invoke /sbin/mount.aznfs with v4.1 arguments, and execute that script as root. we've got one issue on similar lines in past I remember.
since earlier it was, it was not prone to it:
APPNAME="aznfs"
OPTDIR="/opt/microsoft/${APPNAME}"
if we're using this-
In mount.aznfs.c, unset at least APPNAME, OPTDIR, INSTALLSCRIPT.
Collaborator
There was a problem hiding this comment.
all release/signing/publication paths still enumerate only aznfs artifacts. None references azfiles-nfs
| rpmbuild --define "custom_stunnel $custom_stunnel_required" --define "_topdir ${STG_DIR}/${rpm_dir}${rpmbuild_dir}" -v -bb ${STG_DIR}/${rpm_dir}/tmp/azfiles.spec | ||
| } | ||
|
|
||
| generate_tarball_package() |
Collaborator
There was a problem hiding this comment.
The tarball still installs mountscript.sh and both NFS scripts only under /opt/microsoft/aznfs.
| chmod 0755 /opt/microsoft/aznfs/aznfs_install.sh | ||
| chmod 0644 /opt/microsoft/aznfs/common.sh | ||
|
|
||
| # Set suid bit for mount.aznfs to allow mount for non-super user. |
| chmod 0755 /opt/microsoft/aznfs/aznfs_install.sh | ||
| chmod 0644 /opt/microsoft/aznfs/common.sh | ||
|
|
||
| # Set suid bit for mount.aznfs to allow mount for non-super user. |
Collaborator
There was a problem hiding this comment.
same as postinst, why removed? did we observe some issue?
| %else | ||
| Requires: bash, PROCPS_PACKAGE_NAME, conntrack-tools, iptables, bind-utils, iproute, util-linux, nfs-utils, NETCAT_PACKAGE_NAME, newt, stunnel, net-tools | ||
| %endif | ||
| Obsoletes: aznfs < x.y.z |
Collaborator
There was a problem hiding this comment.
The build replaces only Version: x.y.z only?
maybe use:
Obsoletes: aznfs < %{version} ?
Collaborator
Author
There was a problem hiding this comment.
I plan to replace with the latest aznfs version before the split. From that point onwards, obsoletes should not be required.
Collaborator
There was a problem hiding this comment.
aznfs removal scripts still run: rm -rf /etc/stunnel/microsoft
Let's not remove the shared parent.
Removing aznfs deletes azfiles-nfs stunnel state
we can add this as a scenario
|
|
||
| export APPNAME="azfiles-nfs" | ||
| export PKG_NAME="azfiles-nfs" | ||
| export AUTO_UPDATE_KEY="AUTO_UPDATE_AZFILES_NFS" |
Collaborator
There was a problem hiding this comment.
AUTO_UPDATE_AZFILES_NFS=true has no execution path. Standalone installation enables or prompts for azfiles auto-update, but only the v3 watchdog invokes an install script. The v4 watchdog loop never checks for updates.
I might be missing something here. can you confirm.
| if [ "$rpm_dir" == "stunnel" ]; then | ||
| azfiles_rpm_pkg_dir="${azfiles_pkg_name}_stunnel_custom-${RELEASE_NUMBER}-1.$arch" | ||
| custom_stunnel_required=1 | ||
| fi |
Collaborator
There was a problem hiding this comment.
let's verify these custom cases too as part of validation once in the end.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.