csm icon indicating copy to clipboard operation
csm copied to clipboard

[FEATURE]: Support K8s secrets as credential store in CSM Authorization Proxy v2

Open thikade opened this issue 1 year ago • 1 comments

Describe the solution you'd like CSM for Authorization Proxy v2 (tech preview at this moment) introduces a dependency to Hashicorp Vault, which is quite a heavy requirement for production use when you simply want to install the CSI driver and use the CSM Authorization proxy to manage & provision storage volumes.
If Hashicorp Vault is used for storing credentials, why not additionally provide a much simpler backend based on K8s secrets. As an example, the Apache Kafka operator strimzi uses a similar scheme for managing users via the custom resource KafkaUser:

  • When the KafkaUser CR is created, the user credentials are created in a K8s secret managed by the operator (using K8s ownerReferences).
  • A very similar scheme could be adopted for the management of tenants and their credentials.
  • Storage array credentials could also be stored as K8s secrets.
  • Credentials are managed and protected by standard RBAC mechanism inside the CSM auth proxy namespace.

This would enable a much simpler and faster adoption & setup of CSM authorization proxy and CSI driver.

Additional context Hashicorp Vault is solid option, especially for envs that already use a vault cluster in production.
Building and operating a vault cluster - especially on premise - is no trivial task, and seems a bit heavy-weight when the goal is to setup the CSI driver for dynamic storage provisioning.

thikade avatar Sep 16 '24 13:09 thikade