-
Notifications
You must be signed in to change notification settings - Fork 537
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Allow encryptInTransit to be specfied on the StorageClass #687
Allow encryptInTransit to be specfied on the StorageClass #687
Conversation
Hi @jonathanrainer. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
35b335a
to
40bdc22
Compare
639941a
to
5e01e8f
Compare
Have spun up this new code on my own EKS cluster with the following StorageClass
Which then led to the following PV being created
So am happy to say that this does now all encryptInTransit to be specified on the StorageClass itself |
5e01e8f
to
470fc89
Compare
Hi, when do you expect this feature to be merged? |
This means that encryption can be turned off per StorageClass without resorting to static provisioning. README's and documentation also updated.
470fc89
to
ed5fd0b
Compare
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: jonathanrainer The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
So, been trying to understand this stuff myself. This change will never be merged, as use of EFS AP endpoints REQUIRES TLS. The source starting at https://github.com/kubernetes-sigs/aws-efs-csi-driver/blob/master/pkg/driver/node.go#L114 indicates this, and adds the So, while it would seem convenient to elevate this setting, StorageClasses are generally used by PVCs, which in the case of this driver generally implies dynamic provisioning, which this drivers does only via EFS APs that it creates, where TLS is required and the setting is therefore moot. |
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs. This bot triages issues and PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale |
Is this a bug fix or adding new feature?
This PR adds a new parameter to the StorageClass parameters so encryptInTransit can be toggled on and off on a per StorageClass basis under DynamicProvisioning.
What is this PR about? / Why do we need it?
In response to #586. This means that those wanting to use Dynamic Provisioning to create their PVs have the same level of control as those who use static provisioning.
What testing is done?
Have extended the unit tests to ensure the defaulting is done properly etc. Don't think this needs extra E2E test coverage as the external_provisioner should deal with translating it onto the PersistentVolume and the actual ability to set this flag is already well covered by existing test suites, though I'm more than willing to take advice on this!
fixes #586