Storage Export Inventory
The NFS export landscape spans two primary server hosts with different export strategies:
- chonk (10.10.8.60): Exports /mnt/storage1, storage2, and storage3 to the lab subnet `10.10.8.0/21`. The chonk export for /mnt/clusterfs remains pending — scoped to `10.10.8.0/21` but requires physical console access on the host to finalize.
- stargate.research.bitsmasher.net: Runs nfs-kernel-server, exporting its local /mnt/clusterfs2 directory. This export is independent of chonk's storage hierarchy and serves a different consumer group.
Mount Security Review
All NFS client mounts on lab hosts have sec=krb5i in their /etc/fstab entries, but no Kerberos keytabs have been deployed to any client. This means every krb5i mount is silently falling back or failing at the security negotiation layer. The practical impact:
- Mounts may succeed with sys-level fallback (no integrity protection).
- Some kernels reject the mount entirely when the negotiated security level exceeds what's available.
- File ownership and permission mapping can be inconsistent across clients due to UID/GID translation without proper Kerberos identity correlation.
Pending Remediation Paths
Two parallel tracks are viable:
- Kerberos keytab deployment: Requires odroid-c1 KDC availability, principal creation for each NFS client hostname, and keytab distribution via the lab.franklin.common role. This is the correct long-term path.
- Momentary security downgrade: Replace krb5i with sys-level mounts on all clients while the Kerberos infrastructure matures. Loss of integrity protection is acceptable for internal lab traffic but must be documented and time-bounded.
Clusterfs Mount Coordination
chonk's pending /mnt/clusterfs export (scoped to `10.10.8.0/21`) is the bridge between local storage and the cluster filesystem hierarchy. Until this is finalized, hosts in the `10.10.8.x` range accessing /mnt/clusterfs via NFS are hitting inconsistent states depending on their kernel version and mount options. Physical console access to chonk is required to verify the export line and restart the NFS server service.