Skip to content

Commit 1dfa384

Browse files
andyzhangxandyzhangx
committed
feat: provide a flag to access key using Azure api with inline volume
refine fix
1 parent c3fb352 commit 1dfa384

File tree

7 files changed

+82
-72
lines changed

7 files changed

+82
-72
lines changed

‎charts/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ The following table lists the configurable parameters of the latest Azure Blob S
117117
| `node.cloudConfigSecretName` | cloud config secret name of node driver | `azure-cloud-provider`
118118
| `node.cloudConfigSecretNamespace` | cloud config secret namespace of node driver | `kube-system`
119119
| `node.allowEmptyCloudConfig` | Whether allow running node driver without cloud config | `true`
120+
| `node.allowInlineVolumeKeyAccessWithIdentity` | Whether allow accessing storage account key using cluster identity for inline volume | `false`
120121
| `node.maxUnavailable` | `maxUnavailable` value of driver node daemonset | `1`
121122
| `node.metricsPort` | metrics port of csi-blob-node | `29635` |
122123
| `node.livenessProbe.healthPort ` | health check port for liveness probe | `29633` |

‎charts/latest/blob-csi-driver-v1.10.0.tgz‎

57 Bytes
Binary file not shown.

‎charts/latest/blob-csi-driver/templates/csi-blob-node.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ spec:
125125
- "--enable-get-volume-stats={{ .Values.feature.enableGetVolumeStats }}"
126126
- "--append-timestamp-cache-dir={{ .Values.node.appendTimeStampInCacheDir }}"
127127
- "--mount-permissions={{ .Values.node.mountPermissions }}"
128+
- "--allow-inline-volume-key-access-with-idenitity={{ .Values.node.allowInlineVolumeKeyAccessWithIdentity }}"
128129
ports:
129130
- containerPort: {{ .Values.node.livenessProbe.healthPort }}
130131
name: healthz

‎charts/latest/blob-csi-driver/values.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,7 @@ node:
108108
cloudConfigSecretName: azure-cloud-provider
109109
cloudConfigSecretNamespace: kube-system
110110
allowEmptyCloudConfig: true
111+
allowInlineVolumeKeyAccessWithIdentity: false
111112
maxUnavailable: 1
112113
metricsPort: 29635
113114
livenessProbe:

‎pkg/blob/blob.go‎

Lines changed: 40 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -113,20 +113,21 @@ var (
113113

114114
// DriverOptions defines driver parameters specified in driver deployment
115115
type DriverOptions struct {
116-
NodeID string
117-
DriverName string
118-
CloudConfigSecretName string
119-
CloudConfigSecretNamespace string
120-
CustomUserAgent string
121-
UserAgentSuffix string
122-
BlobfuseProxyEndpoint string
123-
EnableBlobfuseProxy bool
124-
BlobfuseProxyConnTimout int
125-
EnableBlobMockMount bool
126-
AllowEmptyCloudConfig bool
127-
EnableGetVolumeStats bool
128-
AppendTimeStampInCacheDir bool
129-
MountPermissions uint64
116+
NodeID string
117+
DriverName string
118+
CloudConfigSecretName string
119+
CloudConfigSecretNamespace string
120+
CustomUserAgent string
121+
UserAgentSuffix string
122+
BlobfuseProxyEndpoint string
123+
EnableBlobfuseProxy bool
124+
BlobfuseProxyConnTimout int
125+
EnableBlobMockMount bool
126+
AllowEmptyCloudConfig bool
127+
AllowInlineVolumeKeyAccessWithIdentity bool
128+
EnableGetVolumeStats bool
129+
AppendTimeStampInCacheDir bool
130+
MountPermissions uint64
130131
}
131132

132133
// Driver implements all interfaces of CSI drivers
@@ -140,15 +141,16 @@ type Driver struct {
140141
userAgentSuffix string
141142
blobfuseProxyEndpoint string
142143
// enableBlobMockMount is only for testing, DO NOT set as true in non-testing scenario
143-
enableBlobMockMount bool
144-
enableBlobfuseProxy bool
145-
allowEmptyCloudConfig bool
146-
enableGetVolumeStats bool
147-
appendTimeStampInCacheDir bool
148-
blobfuseProxyConnTimout int
149-
mountPermissions uint64
150-
mounter *mount.SafeFormatAndMount
151-
volLockMap *util.LockMap
144+
enableBlobMockMount bool
145+
enableBlobfuseProxy bool
146+
allowEmptyCloudConfig bool
147+
enableGetVolumeStats bool
148+
allowInlineVolumeKeyAccessWithIdentity bool
149+
appendTimeStampInCacheDir bool
150+
blobfuseProxyConnTimout int
151+
mountPermissions uint64
152+
mounter *mount.SafeFormatAndMount
153+
volLockMap *util.LockMap
152154
// A map storing all volumes with ongoing operations so that additional operations
153155
// for that same volume (as defined by VolumeID) return an Aborted error
154156
volumeLocks *volumeLocks
@@ -164,20 +166,21 @@ type Driver struct {
164166
// does not support optional driver plugin info manifest field. Refer to CSI spec for more details.
165167
func NewDriver(options *DriverOptions) *Driver {
166168
d := Driver{
167-
volLockMap: util.NewLockMap(),
168-
subnetLockMap: util.NewLockMap(),
169-
volumeLocks: newVolumeLocks(),
170-
cloudConfigSecretName: options.CloudConfigSecretName,
171-
cloudConfigSecretNamespace: options.CloudConfigSecretNamespace,
172-
customUserAgent: options.CustomUserAgent,
173-
userAgentSuffix: options.UserAgentSuffix,
174-
blobfuseProxyEndpoint: options.BlobfuseProxyEndpoint,
175-
enableBlobfuseProxy: options.EnableBlobfuseProxy,
176-
blobfuseProxyConnTimout: options.BlobfuseProxyConnTimout,
177-
enableBlobMockMount: options.EnableBlobMockMount,
178-
allowEmptyCloudConfig: options.AllowEmptyCloudConfig,
179-
enableGetVolumeStats: options.EnableGetVolumeStats,
180-
mountPermissions: options.MountPermissions,
169+
volLockMap: util.NewLockMap(),
170+
subnetLockMap: util.NewLockMap(),
171+
volumeLocks: newVolumeLocks(),
172+
cloudConfigSecretName: options.CloudConfigSecretName,
173+
cloudConfigSecretNamespace: options.CloudConfigSecretNamespace,
174+
customUserAgent: options.CustomUserAgent,
175+
userAgentSuffix: options.UserAgentSuffix,
176+
blobfuseProxyEndpoint: options.BlobfuseProxyEndpoint,
177+
enableBlobfuseProxy: options.EnableBlobfuseProxy,
178+
allowInlineVolumeKeyAccessWithIdentity: options.AllowInlineVolumeKeyAccessWithIdentity,
179+
blobfuseProxyConnTimout: options.BlobfuseProxyConnTimout,
180+
enableBlobMockMount: options.EnableBlobMockMount,
181+
allowEmptyCloudConfig: options.AllowEmptyCloudConfig,
182+
enableGetVolumeStats: options.EnableGetVolumeStats,
183+
mountPermissions: options.MountPermissions,
181184
}
182185
d.Name = options.DriverName
183186
d.Version = driverVersion

‎pkg/blob/nodeserver.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -77,9 +77,11 @@ func (d *Driver) NodePublishVolume(ctx context.Context, req *csi.NodePublishVolu
7777
if context != nil {
7878
if strings.EqualFold(context[ephemeralField], trueValue) {
7979
context[secretNamespaceField] = context[podNamespaceField]
80-
// only get storage account from secret
81-
context[getAccountKeyFromSecretField] = trueValue
82-
context[storageAccountField] = ""
80+
if !d.allowInlineVolumeKeyAccessWithIdentity {
81+
// only get storage account from secret
82+
context[getAccountKeyFromSecretField] = trueValue
83+
context[storageAccountField] = ""
84+
}
8385
klog.V(2).Infof("NodePublishVolume: ephemeral volume(%s) mount on %s, VolumeContext: %v", volumeID, target, context)
8486
_, err := d.NodeStageVolume(ctx, &csi.NodeStageVolumeRequest{
8587
StagingTargetPath: target,

‎pkg/blobplugin/main.go‎

Lines changed: 34 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -36,24 +36,25 @@ func init() {
3636
}
3737

3838
var (
39-
endpoint = flag.String("endpoint", "unix://tmp/csi.sock", "CSI endpoint")
40-
blobfuseProxyEndpoint = flag.String("blobfuse-proxy-endpoint", "unix://tmp/blobfuse-proxy.sock", "blobfuse-proxy endpoint")
41-
nodeID = flag.String("nodeid", "", "node id")
42-
version = flag.Bool("version", false, "Print the version and exit.")
43-
metricsAddress = flag.String("metrics-address", "0.0.0.0:29634", "export the metrics")
44-
kubeconfig = flag.String("kubeconfig", "", "Absolute path to the kubeconfig file. Required only when running out of cluster.")
45-
driverName = flag.String("drivername", blob.DefaultDriverName, "name of the driver")
46-
enableBlobfuseProxy = flag.Bool("enable-blobfuse-proxy", false, "using blobfuse proxy for mounts")
47-
blobfuseProxyConnTimout = flag.Int("blobfuse-proxy-connect-timeout", 5, "blobfuse proxy connection timeout(seconds)")
48-
enableBlobMockMount = flag.Bool("enable-blob-mock-mount", false, "enable mock mount(only for testing)")
49-
cloudConfigSecretName = flag.String("cloud-config-secret-name", "azure-cloud-provider", "secret name of cloud config")
50-
cloudConfigSecretNamespace = flag.String("cloud-config-secret-namespace", "kube-system", "secret namespace of cloud config")
51-
customUserAgent = flag.String("custom-user-agent", "", "custom userAgent")
52-
userAgentSuffix = flag.String("user-agent-suffix", "", "userAgent suffix")
53-
allowEmptyCloudConfig = flag.Bool("allow-empty-cloud-config", true, "allow running driver without cloud config")
54-
enableGetVolumeStats = flag.Bool("enable-get-volume-stats", false, "allow GET_VOLUME_STATS on agent node")
55-
appendTimeStampInCacheDir = flag.Bool("append-timestamp-cache-dir", false, "append timestamp into cache directory on agent node")
56-
mountPermissions = flag.Uint64("mount-permissions", 0777, "mounted folder permissions")
39+
endpoint = flag.String("endpoint", "unix://tmp/csi.sock", "CSI endpoint")
40+
blobfuseProxyEndpoint = flag.String("blobfuse-proxy-endpoint", "unix://tmp/blobfuse-proxy.sock", "blobfuse-proxy endpoint")
41+
nodeID = flag.String("nodeid", "", "node id")
42+
version = flag.Bool("version", false, "Print the version and exit.")
43+
metricsAddress = flag.String("metrics-address", "0.0.0.0:29634", "export the metrics")
44+
kubeconfig = flag.String("kubeconfig", "", "Absolute path to the kubeconfig file. Required only when running out of cluster.")
45+
driverName = flag.String("drivername", blob.DefaultDriverName, "name of the driver")
46+
enableBlobfuseProxy = flag.Bool("enable-blobfuse-proxy", false, "using blobfuse proxy for mounts")
47+
blobfuseProxyConnTimout = flag.Int("blobfuse-proxy-connect-timeout", 5, "blobfuse proxy connection timeout(seconds)")
48+
enableBlobMockMount = flag.Bool("enable-blob-mock-mount", false, "enable mock mount(only for testing)")
49+
cloudConfigSecretName = flag.String("cloud-config-secret-name", "azure-cloud-provider", "secret name of cloud config")
50+
cloudConfigSecretNamespace = flag.String("cloud-config-secret-namespace", "kube-system", "secret namespace of cloud config")
51+
customUserAgent = flag.String("custom-user-agent", "", "custom userAgent")
52+
userAgentSuffix = flag.String("user-agent-suffix", "", "userAgent suffix")
53+
allowEmptyCloudConfig = flag.Bool("allow-empty-cloud-config", true, "allow running driver without cloud config")
54+
enableGetVolumeStats = flag.Bool("enable-get-volume-stats", false, "allow GET_VOLUME_STATS on agent node")
55+
appendTimeStampInCacheDir = flag.Bool("append-timestamp-cache-dir", false, "append timestamp into cache directory on agent node")
56+
mountPermissions = flag.Uint64("mount-permissions", 0777, "mounted folder permissions")
57+
allowInlineVolumeKeyAccessWithIdentity = flag.Bool("allow-inline-volume-key-access-with-idenitity", false, "allow accessing storage account key using cluster identity for inline volume")
5758
)
5859

5960
func main() {
@@ -75,20 +76,21 @@ func main() {
7576

7677
func handle() {
7778
driverOptions := blob.DriverOptions{
78-
NodeID: *nodeID,
79-
DriverName: *driverName,
80-
CloudConfigSecretName: *cloudConfigSecretName,
81-
CloudConfigSecretNamespace: *cloudConfigSecretNamespace,
82-
BlobfuseProxyEndpoint: *blobfuseProxyEndpoint,
83-
EnableBlobfuseProxy: *enableBlobfuseProxy,
84-
BlobfuseProxyConnTimout: *blobfuseProxyConnTimout,
85-
EnableBlobMockMount: *enableBlobMockMount,
86-
CustomUserAgent: *customUserAgent,
87-
UserAgentSuffix: *userAgentSuffix,
88-
AllowEmptyCloudConfig: *allowEmptyCloudConfig,
89-
EnableGetVolumeStats: *enableGetVolumeStats,
90-
AppendTimeStampInCacheDir: *appendTimeStampInCacheDir,
91-
MountPermissions: *mountPermissions,
79+
NodeID: *nodeID,
80+
DriverName: *driverName,
81+
CloudConfigSecretName: *cloudConfigSecretName,
82+
CloudConfigSecretNamespace: *cloudConfigSecretNamespace,
83+
BlobfuseProxyEndpoint: *blobfuseProxyEndpoint,
84+
EnableBlobfuseProxy: *enableBlobfuseProxy,
85+
BlobfuseProxyConnTimout: *blobfuseProxyConnTimout,
86+
EnableBlobMockMount: *enableBlobMockMount,
87+
CustomUserAgent: *customUserAgent,
88+
UserAgentSuffix: *userAgentSuffix,
89+
AllowEmptyCloudConfig: *allowEmptyCloudConfig,
90+
EnableGetVolumeStats: *enableGetVolumeStats,
91+
AppendTimeStampInCacheDir: *appendTimeStampInCacheDir,
92+
MountPermissions: *mountPermissions,
93+
AllowInlineVolumeKeyAccessWithIdentity: *allowInlineVolumeKeyAccessWithIdentity,
9294
}
9395
driver := blob.NewDriver(&driverOptions)
9496
if driver == nil {

0 commit comments

Comments
 (0)