NFSv3 Mounts fail unless the --nolock mount option is specified

[hughdanliu]

/kind bug

What happened?
I attempted to mount an FSx for OpenZFS file system on an application pod using NFSv3 and received this error:

Output: mount.nfs: rpc.statd is not running but is required for remote locking. mount.nfs: Either use '-o nolock' to keep locks local, or start statd. mount.nfs: mounting ___ failed, reason given by server: No such file or directory

Even though the rpc-statd service was running on the node.
What you expected to happen?
NFSv3 mounts succeed without needing to provide the nolock mount option.

How to reproduce it (as minimally and precisely as possible)?
Attempt to mount a file system using NFSv3

Anything else we need to know?:
Nope

Environment

• Kubernetes version (use kubectl version): 1.24
• Driver version: v1.1.0

[hughdanliu]

This is likely an issue with the node daemonset pod permissions. This could possibly be fixed by making the communication policies between the node pods and the host more lenient, allowing for the node daemonset pods to interact with the rpcbind and rpc-statd services running on the node.

I tried setting

• hostNetwork: true
• hostIPC: true
• hostPID: true
• dnsPolicy: ClusterFirstWithHostNet

on the node daemonset pods
This got me around the rpc.statd missing error, but produced this error:

mount.nfs: access denied by server while mounting

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[hughdanliu]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale