I assume (based on the kerberos) that both systems have the same uid/gids . Can you reproduce it , if you remove the krb5 mount options ?
Any reason not to use the FUSE client ? (BSD/Unix systems ?)
It's far more tested to use NFS Ganesha and Gluster has some scripts to configure HA setup for the NFS.
Another not very common (but working ) setup is to recompile the Gluster aource with the gNFS enabled , so you can use the built-in NFS server.
Best Regards,
Strahil Nikolov
On Mon, Mar 28, 2022 at 12:36, tizo<tizone@xxxxxxxxx> wrote:I have posted this problem exactly in Server Fault and in Linux NFS,but it has not been answered yet. Maybe you can help me.I have a situation with kernel NFS server. I have two exports withexactly the same ACLs, with full permissions for theinformatica@xxxxxxxxxxxxxxx group. One is/exports/directo_informatica/, which is the mount point for an LV withXFS, and the other is /exports/gv0_inf/, which is the mount point fora glusterfs. The first export works right when mounting it remotelywith NFS, and accessing it with a user of the groupinformatica@xxxxxxxxxxxxxxx. The second one doesn't: it can be mountedcorrectly, but when trying to access it with the same user it gives"Permission denied".If I access directly to the NFS server (ssh) with the same user of theprevious tests, I can access both directories inside /exports/ withoutproblems. More details at following:OS: Rocky Linux release 8.5 (Green Obsidian)fstab for the exported directories:/dev/mapper/vg_kvm_sistema-lv_directo_informatica/exports/directo_informatica xfs defaults 0 0glustersrv02.xx.xx.xx:/gv0_inf /exports/gv0_inf/ glusterfs defaults,acl 0 0Mount for the exported directories:/dev/mapper/vg_kvm_sistema-lv_directo_informatica on/exports/directo_informatica type xfs(rw,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota)glustersrv02.xx.xx.xx:/gv0_inf on /exports/gv0_inf type fuse.glusterfs(rw,relatime,user_id=0,group_id=0,allow_other,max_read=131072)exports file:/exports*(sec=krb5p,secure,rw,sync,no_wdelay,no_subtree_check,root_squash,fsid=0)/exports/directo_informatica*(sec=krb5p,secure,rw,sync,no_wdelay,no_subtree_check,root_squash,mountpoint)/exports/gv0_inf*(sec=krb5p,secure,rw,sync,no_wdelay,no_subtree_check,root_squash,mountpoint,fsid=2)Exported directories ACLs:# getfacl /exports/directo_informatica/getfacl: Removing leading '/' from absolute path names# file: exports/directo_informatica/# owner: root# group: rootuser::rwxuser:root:rwxgroup::r-xgroup:root:r-xgroup:informatica@xxxxxxxxxxxxxxx:rwxmask::rwxother::---default:user::rwxdefault:user:root:rwxdefault:group::r-xdefault:group:root:r-xdefault:group:informatica@xxxxxxxxxxxxxxx:rwxdefault:mask::rwxdefault:other::---# getfacl /exports/gv0_inf/getfacl: Removing leading '/' from absolute path names# file: exports/gv0_inf/# owner: root# group: rootuser::rwxuser:root:rwxgroup::r-xgroup:root:r-xgroup:informatica@xxxxxxxxxxxxxxx:rwxmask::rwxother::---default:user::rwxdefault:user:root:rwxdefault:group::r-xdefault:group:root:r-xdefault:group:informatica@xxxxxxxxxxxxxxx:rwxdefault:mask::rwxdefault:other::---Directories mounted remoteley:gluster02.adtest.xx.xx.xx:/directo_informatica on /prueba2 type nfs4(rw,relatime,vers=4.2,rsize=131072,wsize=131072,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=krb5p,clientaddr=10.2.100.8,local_lock=none,addr=10.2.100.8)gluster02.adtest.xx.xx.xx:/gv0_inf on /prueba type nfs4(rw,relatime,vers=4.2,rsize=131072,wsize=131072,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=krb5p,clientaddr=10.2.100.8,local_lock=none,addr=10.2.100.8)NFSv4 ACLs remotely:$ nfs4_getfacl /prueba2# file: /prueba2A::OWNER@:rwaDxtTcCyA::root@xxxxxxxxxxxxxxxxx:rwaDxtcyA::GROUP@:rxtcyA:g:root@xxxxxxxxxxxxxxxxx:rxtcyA:g:informatica@xxxxxxxxxxxxxxx@idmpru.xx.xx.xx:rwaDxtcyA::EVERYONE@:tcyA:fdi:OWNER@:rwaDxtTcCyA:fdi:root@xxxxxxxxxxxxxxx:rwaDxtcyA:fdi:GROUP@:rxtcyA:fdig:root@xxxxxxxxxxxxxxx:rxtcyA:fdig:informatica@xxxxxxxxxxxxxxx@idmpru.xx.xx.xx:rwaDxtcyA:fdi:EVERYONE@:tcy$ nfs4_getfacl /prueba# file: /pruebaA::OWNER@:rwaDxtTcCyA::GROUP@:rwaDxtcyA::EVERYONE@:tcyThe only additional question for this list, is if you think that thisproblem could be avoided with NFS Ganesha.Any help is appreciated. Thanks very much.________Community Meeting Calendar:Schedule -Every 2nd and 4th Tuesday at 14:30 IST / 09:00 UTCGluster-users mailing list
________ Community Meeting Calendar: Schedule - Every 2nd and 4th Tuesday at 14:30 IST / 09:00 UTC Bridge: https://meet.google.com/cpu-eiue-hvk Gluster-users mailing list Gluster-users@xxxxxxxxxxx https://lists.gluster.org/mailman/listinfo/gluster-users
