-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CSI RPC Token #8626
CSI RPC Token #8626
Conversation
00aa5e4
to
0951e8d
Compare
0951e8d
to
057a096
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
This item was completed in #8626
This item was completed in #8626
This item was completed in hashicorp#8626
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
CSI Nodes call RPCs through the server that forward to other client nodes. They should do so with an authorization token that's permitted to execute those RPCs. This PR sends the
Node.SecretID
, which when provided to the endpoints returns the nilaclObj
. All namespace and policy ACL check funcs treat nil as the flag that ACLs are disabled. The ACL checker returns an error if ACLs are active and an appropriate token isn't provided.The other alternative is to thread the user token through from job submission. I believe that the
Node.SecretID
is correct since the job could not have been allocated without user permissions at the time of submission, and we don't want an errorUnpublishing
a volume belonging to a job that was started with an expired or revoked token.Fixes #8373