Use token from CSI TokenRequests #163
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tvoran
approved these changes
Jun 16, 2022
swenson
reviewed
Jun 17, 2022
Co-authored-by: Christopher Swenson <christopher.swenson@hashicorp.com>
|
Hey, wondering when/if this will make it to a release of the CSI driver. To my understanding these changes do not break any existing behaviours, they only allow using a new upstream feature. Are there any plans to get this merged? |
|
Sorry for the long delay on this PR. I've backed out the changelog notice that token generation will be deprecated, as I think that may still be useful longer term in some scenarios, but otherwise just merged in main. |
tomhjp
added a commit
that referenced
this pull request
Mar 20, 2023
tomhjp
added a commit
that referenced
this pull request
Mar 21, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The Secrets Store CSI driver supports sending a token as part of the mount request as of 1.1.0 (relevant issue with rollout timeline), which is based on this feature from this KEP.
TL;DR is you use
--set tokenRequests[0].audience="vault"when installing the CSI driver, and then it will populate a"csi.storage.k8s.io/serviceAccount.tokens"field in the mount parameters which contains a token generated for the audience "vault". That way,vault-csi-providerdoesn't have to generate its own token for the requesting pod, and we can remove those Kubernetes permissions once we're ready to deprecate that way of doing things. However, I don't think we should deprecate immediately, as it still relies on Kubernetes 1.21+ and a pretty recent CSI driver version.A really nice feature is that it will cache the token per-pod, so each pod will get the same JWT on each mount request until it expires. This will make it much easier to add Vault Agent as a sidecar in a way that caching will work (i.e. issue #90).