Kubernetes 1.20: Pod Impersonation and Short-lived Volumes in CSI Drivers
Author: Shihang Zhang (Google)
Typically when a
Currently there are two suboptimal approaches to achieve this, either by granting CSI drivers the permission to use TokenRequest API or by reading tokens directly from the host filesystem. Both of them exhibit the following drawbacks: The second approach is more problematic due to: Kubernetes 1.20 introduces an alpha feature, This feature also provides a knob to re-publish volumes so that short-lived volumes can be refreshed. Using NodePublishVolume RPC calls when the feature If users configure . To keep short-lived volumes such as certificates effective, CSI drivers can specify This feature is alpha and projected to move to beta in 1.21. See more in the following KEP and CSI documentation: Your feedback is always welcome!
AutomountServiceAccountToken=false
)BoundServiceAccountTokenVolume=false
CSIServiceAccountToken
, to improve the security posture. The new feature allows CSI drivers to receive pods' .Pod Impersonation
Using GCP APIs
CSIServiceAccountToken
is enabled. For example: accessing .Using Vault
Short-lived Volumes
RequiresRepublish=true
in theirCSIDriver
object to have the kubelet periodically call NodePublishVolume
on mounted volumes. These republishes allow CSI drivers to ensure that the volume content is up-to-date.Next steps