add doc for TokenRequests and RequiresRepublish fields #383

zshihang · 2020-11-12T22:16:58Z

CSIServiceAccountToken is Alpha in 1.20 with two additional fields in CSIDriver spec: `TokenRequests` and `RequiresRepublish`.

k8s-ci-robot · 2020-11-12T22:17:06Z

Welcome @zshihang!

It looks like this is your first PR to kubernetes-csi/docs 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-csi/docs has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

zshihang · 2020-11-12T22:17:07Z

/cc @msau42

msau42 · 2020-11-12T22:26:41Z

book/src/csi-driver-object.md

@@ -70,6 +75,19 @@ There are four important fields:
    The default is `Persistent`, which is the normal PVC/PV mechanism. `Ephemeral` enables
    [inline ephemeral volumes](ephemeral-local-volumes.md) in addition (when both
    are listed) or instead of normal volumes (when it is the only entry in the list).
+* `tokenRequests`
+  * This field was added in Kubernetes 1.20 and cannot be set when using an older Kubernetes release.
+  * This field is alpha.


Can you specify the feature gate that is required as well?

msau42 · 2020-11-12T22:28:10Z

book/src/csi-driver-object.md

+  * If this field is specified, Kubelet will plumb down the bound service acocunt tokens of the pod as `volume_context` in the `NodePublishVolume`:
+    * `"csi.storage.k8s.io/serviceAccount.tokens": {"gcp":{"token":"<token>","expirationTimestamp":"<expiration timestamp in RFC3339>"}}`
+    * If CSI driver doesn't find token recorded in the `volume_context`, it should return error in `NodePublishVolume` to inform Kubelet to retry.
+    * Audiences should be distinct, otherwise the validation will fail. If the audience is "", it means the issued token has the same audience as kube-apiserver.


Is there some general documentation on tokens and audiences that we can point to from here? It may be good to specify what kinds of drivers/use cases this would be used for

Actually this kind of information might be useful under a feature page: https://kubernetes-csi.github.io/docs/features.html, rather than hidden inside this object page, wdyt?

yes, https://tools.ietf.org/html/rfc7519#section-4.1.3. i'll include this in the feature page.

msau42 · 2020-11-12T22:28:33Z

book/src/csi-driver-object.md

+    * Audiences should be distinct, otherwise the validation will fail. If the audience is "", it means the issued token has the same audience as kube-apiserver.
+* `requiresRepublish`
+  * This field was added in Kubernetes 1.20 and cannot be set when using an older Kubernetes release.
+  * This field is alpha.


mention the feature gate

msau42 · 2020-11-12T22:29:11Z

book/src/csi-driver-object.md

+  * This field is alpha.
+  * If this field is `true`, Kubelet will periodically call `NodePublishVolume`. This is useful in the following scenarios:
+    * If the volume mounted by CSI driver is short-lived.
+    * If CSI driver requires valid service account tokens (enabled by the field `tokenRequests`) repeatedly.


Can you add that note about how the republish should only update data, and not remount?

msau42 · 2020-11-12T22:32:37Z

cc @mikedanese

msau42 · 2020-11-16T21:24:27Z

book/src/token-requests.md

+- **`RequiresRepublish`**:
+
+  - This field is optional.
+  - If this is true, `NodePublishVolume` will be periodically called.


Also mention that when used with TokenRequest, the token will be updated when it expires

msau42 · 2020-11-16T21:26:55Z

book/src/token-requests.md

+
+```go
+"csi.storage.k8s.io/serviceAccount.tokens": {
+  'audience': {


Is the value actually "audience" or is it something like "gcp", "vault"?

right. change it to <audience>

msau42 · 2020-11-16T21:37:39Z

/lgtm
/approve

k8s-ci-robot · 2020-11-16T21:37:44Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: msau42, zshihang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [msau42]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

zshihang · 2020-11-16T22:53:32Z

/retest

mdbook hash matched locally. re-run in case transient failure.

k8s-ci-robot · 2020-11-16T22:53:45Z

@zshihang: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

/retest

mdbook hash matched locally. re-run in case transient failure.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

zshihang · 2020-11-16T22:54:07Z

/ok-to-test

k8s-ci-robot · 2020-11-16T22:54:20Z

@zshihang: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

/ok-to-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

msau42 · 2020-11-16T23:55:37Z

/ok-to-test

msau42 · 2020-11-16T23:55:46Z

/retest

msau42 · 2020-11-16T23:57:04Z

@zshihang can you try force pushing to retry the ci?

msau42 · 2020-11-17T01:06:14Z

/lgtm

k8s-ci-robot added do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Nov 12, 2020

k8s-ci-robot requested review from lpabon and saad-ali November 12, 2020 22:17

k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Nov 12, 2020

k8s-ci-robot requested a review from msau42 November 12, 2020 22:17

zshihang mentioned this pull request Nov 12, 2020

add doc for CSIServiceAccountToken kubernetes/website#24754

Merged

msau42 reviewed Nov 12, 2020

View reviewed changes

zshihang force-pushed the master branch from 186364a to 0429faf Compare November 13, 2020 22:46

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Nov 13, 2020

zshihang force-pushed the master branch from 0429faf to 65d2271 Compare November 13, 2020 22:50

zshihang mentioned this pull request Nov 16, 2020

add description for CSIServiceAccountToken kubernetes/website#25028

Merged

msau42 reviewed Nov 16, 2020

View reviewed changes

zshihang force-pushed the master branch from 65d2271 to c0dae34 Compare November 16, 2020 21:33

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Nov 16, 2020

k8s-ci-robot assigned msau42 Nov 16, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 16, 2020

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 16, 2020

k8s-ci-robot added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Nov 16, 2020

add doc for TokenRequests and RequiresRepublish fields

ec01f9e

zshihang force-pushed the master branch from c0dae34 to ec01f9e Compare November 16, 2020 23:59

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 16, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 17, 2020

k8s-ci-robot merged commit 9278e2c into kubernetes-csi:master Nov 17, 2020

zshihang mentioned this pull request Sep 15, 2022

release issue for feature CSIServiceAccountToken kubernetes/enhancements#2047

Closed

20 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add doc for TokenRequests and RequiresRepublish fields #383

add doc for TokenRequests and RequiresRepublish fields #383

zshihang commented Nov 12, 2020 •

edited

Loading

k8s-ci-robot commented Nov 12, 2020

zshihang commented Nov 12, 2020

msau42 Nov 12, 2020

zshihang Nov 13, 2020

msau42 Nov 12, 2020

msau42 Nov 12, 2020

zshihang Nov 13, 2020

msau42 Nov 12, 2020

zshihang Nov 13, 2020

msau42 Nov 12, 2020

zshihang Nov 13, 2020

msau42 commented Nov 12, 2020

msau42 Nov 16, 2020

zshihang Nov 16, 2020

msau42 Nov 16, 2020

zshihang Nov 16, 2020 •

edited

Loading

msau42 commented Nov 16, 2020

k8s-ci-robot commented Nov 16, 2020

zshihang commented Nov 16, 2020

k8s-ci-robot commented Nov 16, 2020

zshihang commented Nov 16, 2020

k8s-ci-robot commented Nov 16, 2020

msau42 commented Nov 16, 2020

msau42 commented Nov 16, 2020

msau42 commented Nov 16, 2020

msau42 commented Nov 17, 2020

add doc for TokenRequests and RequiresRepublish fields #383

add doc for TokenRequests and RequiresRepublish fields #383

Conversation

zshihang commented Nov 12, 2020 • edited Loading

k8s-ci-robot commented Nov 12, 2020

zshihang commented Nov 12, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

msau42 commented Nov 12, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zshihang Nov 16, 2020 • edited Loading

Choose a reason for hiding this comment

msau42 commented Nov 16, 2020

k8s-ci-robot commented Nov 16, 2020

zshihang commented Nov 16, 2020

k8s-ci-robot commented Nov 16, 2020

zshihang commented Nov 16, 2020

k8s-ci-robot commented Nov 16, 2020

msau42 commented Nov 16, 2020

msau42 commented Nov 16, 2020

msau42 commented Nov 16, 2020

msau42 commented Nov 17, 2020

zshihang commented Nov 12, 2020 •

edited

Loading

zshihang Nov 16, 2020 •

edited

Loading