Skip to content

Commit

Permalink
Merge branch 'main' into KRV-23551-SYNC
Browse files Browse the repository at this point in the history
  • Loading branch information
karthikk92 authored Oct 16, 2024
2 parents 4f41e0a + afa5749 commit 46e0fa6
Show file tree
Hide file tree
Showing 66 changed files with 2,532 additions and 847 deletions.
4 changes: 2 additions & 2 deletions content/docs/authorization/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,12 @@ Description: >
Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization
---

[Container Storage Modules](https://github.com/dell/csm) (CSM) for Authorization is part of the open-source suite of Kubernetes storage enablers for Dell products.
[Container Storage Modules](https://github.com/dell/csm) (CSM) for Authorization is part of the open-source suite of Kubernetes storage enablers for Dell products.

CSM for Authorization provides storage and Kubernetes administrators the ability to apply RBAC for Dell CSI Drivers. It does this by deploying a proxy between the CSI driver and the storage system to enforce role-based access and usage rules.

Storage administrators of compatible storage platforms will be able to apply quota and RBAC rules that instantly and automatically restrict cluster tenants usage of storage resources. Users of storage through CSM for Authorization do not need to have storage admin root credentials to access the storage system.

Kubernetes administrators will have an interface to create, delete, and manage roles/groups that storage rules may be applied. Administrators and/or users may then generate authentication tokens that may be used by tenants to use storage with proper access policies being automatically enforced.

Currently, we have two versions of Authorization, **v1.x GA** and **v2.0 Tech Preview**.
Currently, we have two versions of Authorization, **v1.x** and **v2.x**. **v2.x is not backward compatible with v1.x versions**.
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
---
title: Authorization - v1.x GA
linktitle: v1.x GA
title: Authorization - v1.x
linktitle: v1.x
weight: 4
Description: >
Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization v1.x GA.
tags:
Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization v1.x.
tags:
- csm-authorization
---

Expand Down
File renamed without changes.
File renamed without changes.

This file was deleted.

This file was deleted.

Original file line number Diff line number Diff line change
@@ -1,15 +1,13 @@
---
title: Authorization - v2.0 Tech Preview
linktitle: v2.0 Tech Preview
title: Authorization - v2.x
linktitle: v2.x
weight: 4
Description: >
Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization v2.0 Tech Preview.
Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization v2.x.
tags:
- csm-authorization
---

>> NOTE: This tech-preview release is not intended for use in production environment.
The following diagram shows a high-level overview of CSM for Authorization with a `tenant-app` that is using a CSI driver to perform storage operations through the CSM for Authorization `proxy-server` to access the a Dell storage system. All requests from the CSI driver will contain the token for the given tenant that was granted by the Storage Administrator.

![Alt text](image.png)
Expand All @@ -19,11 +17,11 @@ This is the introduction to a Stateless Architecture for Authorization. The crea
## CSM for Authorization Capabilities
{{<table "table table-striped table-bordered table-sm">}}
| Feature | PowerFlex | PowerMax | PowerScale |
| ----------------------------------------------------------------------------------------------------------------------------- | --------- | -------- | ---------- |
| ------------------------------------------------------------------------------------------------------------------------------ | --------- | -------- | ---------- |
| Ability to set storage quota limits to ensure k8s tenants are not overconsuming storage | Yes | Yes | No |
| Ability to create access control policies to ensure k8s tenant clusters are not accessing storage that does not belong to them | Yes | Yes | No |
| Ability to shield storage credentials from Kubernetes administrators by storing them in vault | Yes | Yes | No |
| Ability to create snapshots from owned volumes that consume the storage quota | Yes | Yes | No |
| Ability to shield storage credentials from Kubernetes administrators by storing them in vault | Yes | Yes | Yes |
| Ability to create snapshots from owned volumes that consume the storage quota | Yes | Yes | Yes |
| Ability to periodically query storage array to keep quota consumption in sync | Yes | Yes | No |
{{</table>}}

Expand All @@ -46,7 +44,7 @@ This will take a snapshot of the `persistent volume claim` named `vol1`. CSM Aut

### Backend Storage Polling

A configurable polling mechanism has been introduced to ensure that the tenant and Redis are always in sync with the backend storage configured. This is determined by the [volumePrefix](configuration/proxy-server/#configuring-tenants) specified for the `tenant`. During polling, for each of the tenants and roles, the storage service will ensure that nothing has been removed or added by the storage admin which would lead to Redis being out of sync.
A configurable polling mechanism has been introduced to ensure that the tenant and Redis are always in sync with the backend storage configured. This is determined by the [volumePrefix](configuration#configuring-tenants) specified for the `tenant`. During polling, for each of the tenants and roles, the storage service will ensure that nothing has been removed or added by the storage admin which would lead to Redis being out of sync.

If a volume is created with the matching `volumePrefix`, the new entry will be added to Redis and the available quota will be consumed accordingly. Similarly, if a snapshot is created from a volume that is owned by the tenant in the backend storage array, that will be added to Redis.

Expand All @@ -67,10 +65,10 @@ Storage Administrators perform the following:
- Tenant Management (create, get, delete)
- Token Management (create, revoke)

For more information on the configuration of the above, see the configuration of the [Proxy Server](../v2.0-tech-preview/configuration/proxy-server/#configuring-storage).
For more information on the configuration of the above, see the configuration of the [Proxy Server](../v2.x/configuration/#configuring-storage).

### Tenant Administrators

Tenants of CSM for Authorization can use the token provided by the Storage Administrators in their storage requests.

For more information on how to use the token and configuration, see configuration for the [PowerFlex driver](../v2.0-tech-preview/configuration/powerflex) or the [PowerMax driver](../v2.0-tech-preview/configuration/powermax).
For more information on how to use the token and configuration, see configuration for the [PowerFlex driver](../v2.x/configuration/powerflex), [PowerMax driver](../v2.x/configuration/powermax), or the [PowerScale driver](../v2.x/configuration/powerscale).
Loading

0 comments on commit 46e0fa6

Please sign in to comment.