genpolicy: support dynamic SMB storage class options

src/tools/genpolicy/genpolicy-settings.json

@@ -282,8 +282,18 @@
             "cc-managed-premium-csi"
         ],
         "smb_storage_classes": [
-            "cc-azurefile-csi",
-            "cc-azurefile-premium-csi"
+            {
+                "name": "azurefile-csi-kata-cc",
+                "mount_options": [
+                    "dir_mode=0777",
+                    "file_mode=0777",
+                    "mfsymlinks",
+                    "cache=strict",
+                    "nosharesock",
+                    "actimeo=30",
+                    "nobrl"
+                ]
+            }
         ]
     },
     "kata_config": {
@@ -322,4 +332,4 @@
         "UpdateEphemeralMountsRequest": false,
         "WriteStreamRequest": false
     }
-}
+}

src/tools/genpolicy/rules.rego

@@ -941,15 +941,15 @@ allow_storage_options(p_storage, i_storage, layer_ids, root_hashes) {
     print("allow_storage_options 4: start")
 
     p_storage.driver == "smb"
-    count(i_storage.options) == 8
-    i_storage.options[0] == "dir_mode=0666"
-    i_storage.options[1] == "file_mode=0666"
-    i_storage.options[2] == "mfsymlinks"    
-    i_storage.options[3] == "cache=strict"  
-    i_storage.options[4] == "nosharesock"
-    i_storage.options[5] == "actimeo=30"    
-    startswith(i_storage.options[6], "addr=")
-    creds = split(i_storage.options[7], ",")
+    p_opts_count := count(p_storage.options)
+    i_opts_count := count(i_storage.options)
+    i_opts_count == p_opts_count + 2
+
+    i_opt_matches := [i | i := idx; idx < p_opts_count; p_storage.options[idx] == i_storage.options[idx]]
+    count(i_opt_matches) == p_opts_count
+
+    startswith(i_storage.options[i_opts_count-2], "addr=")
+    creds = split(i_storage.options[i_opts_count-1], ",")
     count(creds) == 2
     startswith(creds[0], "username=")
     startswith(creds[1], "password=")

src/tools/genpolicy/src/mount_and_storage.rs

@@ -100,6 +100,40 @@ fn adjust_termination_path(mount: &mut policy::KataMount, yaml_container: &pod::
     }
 }
 
+pub fn get_mount_info(
+    storage_class: Option<&String>,
+    settings: &settings::Settings,
+) -> (bool, bool, Option<Vec<String>>) {
+    if let Some(storage_class) = storage_class {
+        let is_blk_mount = settings
+            .common
+            .virtio_blk_storage_classes
+            .contains(storage_class);
+
+        let is_smb_mount = settings
+            .common
+            .smb_storage_classes
+            .iter()
+            .any(|smb_class| &smb_class.name == storage_class);
+
+        let smb_mount_options = if is_smb_mount {
+            settings
+                .common
+                .smb_storage_classes
+                .iter()
+                .find(|sc| &sc.name == storage_class)
+                .map(|sc| sc.mount_options.clone())
+        } else {
+            None
+        };
+
+        (is_blk_mount, is_smb_mount, smb_mount_options)
+    } else {
+        warn!("Storage class is None. Defaulting to no mounts.");
+        (false, false, None)
+    }
+}
+
 pub fn get_mount_and_storage(
     settings: &settings::Settings,
     p_mounts: &mut Vec<policy::KataMount>,
@@ -238,13 +272,17 @@ fn get_persistent_volume_claim_mount(
         );
     }
 
-    let is_blk_mount = pvc_resource
-        .and_then(|pvc_resource| pvc_resource.spec.storageClassName.as_ref())
-        .is_some_and(|sc| settings.common.virtio_blk_storage_classes.contains(sc));
+    let storage_class = if let Some(pvc_resource) = pvc_resource {
+        pvc_resource.spec.storageClassName.as_ref()
+    } else {
+        None
+    };
+
+    if storage_class.is_none() {
+        warn!("Storage class is missing for persistent volume claim '{pvc_name}'.");
+    }
 
-    let is_smb_mount = pvc_resource
-        .and_then(|pvc_resource| pvc_resource.spec.storageClassName.as_ref())
-        .is_some_and(|sc| settings.common.smb_storage_classes.contains(sc));
+    let (is_blk_mount, is_smb_mount, smb_mount_options) = get_mount_info(storage_class, settings);
 
     handle_persistent_volume_claim(
         is_blk_mount,
@@ -253,6 +291,7 @@ fn get_persistent_volume_claim_mount(
         p_mounts,
         storages,
         mount_options,
+        smb_mount_options,
     );
 }
 
@@ -419,22 +458,16 @@ fn get_ephemeral_mount(
     storages: &mut Vec<agent::Storage>,
     mount_options: (&str, &str),
 ) {
-    let storage_class = &yaml_volume
+    let storage_class = yaml_volume
         .ephemeral
         .as_ref()
         .unwrap()
         .volumeClaimTemplate
         .spec
-        .storageClassName;
+        .storageClassName
+        .as_ref();
 
-    let is_blk_mount = storage_class
-        .as_ref()
-        .map(|sc| settings.common.virtio_blk_storage_classes.contains(sc))
-        .unwrap_or(false);
-    let is_smb_mount = storage_class
-        .as_ref()
-        .map(|sc| settings.common.smb_storage_classes.contains(sc))
-        .unwrap_or(false);
+    let (is_blk_mount, is_smb_mount, smb_mount_options) = get_mount_info(storage_class, settings);
 
     handle_persistent_volume_claim(
         is_blk_mount,
@@ -443,6 +476,7 @@ fn get_ephemeral_mount(
         p_mounts,
         storages,
         mount_options,
+        smb_mount_options,
     );
 }
 
@@ -453,6 +487,7 @@ pub fn handle_persistent_volume_claim(
     p_mounts: &mut Vec<policy::KataMount>,
     storages: &mut Vec<agent::Storage>,
     mount_options: (&str, &str),
+    smb_mount_options: Option<Vec<String>>, // Pass SMB mount options
 ) {
     if is_blk_mount || is_smb_mount {
         let source = "$(spath)/$(b64-direct-vol-path)".to_string();
@@ -468,7 +503,15 @@ pub fn handle_persistent_volume_claim(
             source: "$(direct-vol-path)".to_string(),
             mount_point: source.to_string(),
             fstype: "$(fs-type)".to_string(),
-            options: Vec::new(),
+            options: if is_smb_mount {
+                if let Some(mount_options) = smb_mount_options {
+                    mount_options.clone()
+                } else {
+                    Vec::new()
+                }
+            } else {
+                Vec::new()
+            },
         });
 
         let dest = yaml_mount.mountPath.clone();

src/tools/genpolicy/src/policy.rs

@@ -345,6 +345,13 @@ pub struct RequestDefaults {
     pub WriteStreamRequest: bool,
 }
 
+// SMB storage class settings from genpolicy-settings.json.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct SmbStorageClass {
+    pub name: String,
+    pub mount_options: Vec<String>,
+}
+
 /// Struct used to read data from the settings file and copy that data into the policy.
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct CommonData {
@@ -379,7 +386,7 @@ pub struct CommonData {
     pub virtio_blk_storage_classes: Vec<String>,
 
     /// Storage classes which mounts should be handled as smb mounts
-    pub smb_storage_classes: Vec<String>,
+    pub smb_storage_classes: Vec<SmbStorageClass>,
 }
 
 /// Struct used to read data from the settings file and copy that data into the policy.

src/tools/genpolicy/src/stateful_set.rs

@@ -212,23 +212,9 @@ impl StatefulSet {
             for claim in claims {
                 if let Some(claim_name) = &claim.metadata.name {
                     if claim_name.eq(&mount.name) {
-                        // check if a storage class is set and if it is a virtio-blk storage class
-                        let is_blk_mount = if let Some(storage_class) = &claim.spec.storageClassName
-                        {
-                            settings
-                                .common
-                                .virtio_blk_storage_classes
-                                .contains(storage_class)
-                        } else {
-                            false
-                        };
-                        // check if a storage class is set and if it is a smb storage class
-                        let is_smb_mount = if let Some(storage_class) = &claim.spec.storageClassName
-                        {
-                            settings.common.smb_storage_classes.contains(storage_class)
-                        } else {
-                            false
-                        };
+                        let storage_class = claim.spec.storageClassName.as_ref();
+                        let (is_blk_mount, is_smb_mount, smb_mount_options) =
+                            mount_and_storage::get_mount_info(storage_class, settings);
 
                         let propagation = match &mount.mountPropagation {
                             Some(p) if p == "Bidirectional" => "rshared",
@@ -249,6 +235,7 @@ impl StatefulSet {
                             policy_mounts,
                             storages,
                             mount_options,
+                            smb_mount_options,
                         );
                     }
                 }