Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Authorization v2.0 Updates #1276

Merged
merged 29 commits into from
Oct 15, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
f2ce97c
auth GA changes and additions
shaynafinocchiaro Oct 8, 2024
e333315
fix broken links and additional edits
shaynafinocchiaro Oct 9, 2024
94e31fc
fix broken links
shaynafinocchiaro Oct 9, 2024
7bb8737
Remove trailing space in file name
shaynafinocchiaro Oct 9, 2024
c6983ee
remove GA references
shaynafinocchiaro Oct 9, 2024
19c1a6d
put operator steps before helm
shaynafinocchiaro Oct 11, 2024
ec42ed7
show proxy server page as first page on configuration
shaynafinocchiaro Oct 11, 2024
4ec40da
addition PR edits
shaynafinocchiaro Oct 11, 2024
35a83ef
add release notes
shaynafinocchiaro Oct 11, 2024
bcc15ef
PR edits
shaynafinocchiaro Oct 11, 2024
db01a18
fix broken links
shaynafinocchiaro Oct 11, 2024
721f87d
fix broken links
shaynafinocchiaro Oct 11, 2024
63b2b93
fix broken links
shaynafinocchiaro Oct 11, 2024
5ef6f11
fix broken links
shaynafinocchiaro Oct 11, 2024
1716cd9
fix broken links
shaynafinocchiaro Oct 11, 2024
bb50438
update action
shaynafinocchiaro Oct 14, 2024
97224cc
rebased branch
shaynafinocchiaro Oct 14, 2024
4acd4e3
remove hugo cache
shaynafinocchiaro Oct 14, 2024
ba4293d
update action
shaynafinocchiaro Oct 14, 2024
9eedf47
remove public dir where hugo is serving from
shaynafinocchiaro Oct 14, 2024
c855d67
revert actions file changes
shaynafinocchiaro Oct 14, 2024
24355dd
fix broken links
shaynafinocchiaro Oct 14, 2024
e8c4da0
PR feedback
shaynafinocchiaro Oct 15, 2024
270663c
fix broken links
shaynafinocchiaro Oct 15, 2024
0c9085a
Merge branch 'main' into KRV-22364-auth
shaynafinocchiaro Oct 15, 2024
7551ab7
Merge branch 'main' into KRV-22364-auth
shaynafinocchiaro Oct 15, 2024
956affb
add uninstall steps for v2
shaynafinocchiaro Oct 15, 2024
e2f824d
uninstall sidecar
shaynafinocchiaro Oct 15, 2024
91c639f
Merge branch 'main' into KRV-22364-auth
shaynafinocchiaro Oct 15, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions content/docs/authorization/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,12 @@ Description: >
Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization
---

[Container Storage Modules](https://github.com/dell/csm) (CSM) for Authorization is part of the open-source suite of Kubernetes storage enablers for Dell products.
[Container Storage Modules](https://github.com/dell/csm) (CSM) for Authorization is part of the open-source suite of Kubernetes storage enablers for Dell products.

CSM for Authorization provides storage and Kubernetes administrators the ability to apply RBAC for Dell CSI Drivers. It does this by deploying a proxy between the CSI driver and the storage system to enforce role-based access and usage rules.

Storage administrators of compatible storage platforms will be able to apply quota and RBAC rules that instantly and automatically restrict cluster tenants usage of storage resources. Users of storage through CSM for Authorization do not need to have storage admin root credentials to access the storage system.

Kubernetes administrators will have an interface to create, delete, and manage roles/groups that storage rules may be applied. Administrators and/or users may then generate authentication tokens that may be used by tenants to use storage with proper access policies being automatically enforced.

Currently, we have two versions of Authorization, **v1.x GA** and **v2.0 Tech Preview**.
Currently, we have two versions of Authorization, **v1.x** and **v2.x**. **v2.x is not backward compatible with v1.x versions**.
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
---
title: Authorization - v1.x GA
linktitle: v1.x GA
title: Authorization - v1.x
linktitle: v1.x
weight: 4
Description: >
Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization v1.x GA.
tags:
Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization v1.x.
tags:
- csm-authorization
---

Expand Down

This file was deleted.

This file was deleted.

Original file line number Diff line number Diff line change
@@ -1,15 +1,13 @@
---
title: Authorization - v2.0 Tech Preview
linktitle: v2.0 Tech Preview
title: Authorization - v2.x
linktitle: v2.x
weight: 4
Description: >
Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization v2.0 Tech Preview.
Dell Technologies (Dell) Container Storage Modules (CSM) for Authorization v2.x.
tags:
- csm-authorization
---

>> NOTE: This tech-preview release is not intended for use in production environment.

The following diagram shows a high-level overview of CSM for Authorization with a `tenant-app` that is using a CSI driver to perform storage operations through the CSM for Authorization `proxy-server` to access the a Dell storage system. All requests from the CSI driver will contain the token for the given tenant that was granted by the Storage Administrator.

![Alt text](image.png)
Expand All @@ -19,11 +17,11 @@ This is the introduction to a Stateless Architecture for Authorization. The crea
## CSM for Authorization Capabilities
{{<table "table table-striped table-bordered table-sm">}}
| Feature | PowerFlex | PowerMax | PowerScale |
| ----------------------------------------------------------------------------------------------------------------------------- | --------- | -------- | ---------- |
| ------------------------------------------------------------------------------------------------------------------------------ | --------- | -------- | ---------- |
| Ability to set storage quota limits to ensure k8s tenants are not overconsuming storage | Yes | Yes | No |
| Ability to create access control policies to ensure k8s tenant clusters are not accessing storage that does not belong to them | Yes | Yes | No |
| Ability to shield storage credentials from Kubernetes administrators by storing them in vault | Yes | Yes | No |
| Ability to create snapshots from owned volumes that consume the storage quota | Yes | Yes | No |
| Ability to shield storage credentials from Kubernetes administrators by storing them in vault | Yes | Yes | Yes |
| Ability to create snapshots from owned volumes that consume the storage quota | Yes | Yes | Yes |
| Ability to periodically query storage array to keep quota consumption in sync | Yes | Yes | No |
{{</table>}}

Expand All @@ -46,7 +44,7 @@ This will take a snapshot of the `persistent volume claim` named `vol1`. CSM Aut

### Backend Storage Polling

A configurable polling mechanism has been introduced to ensure that the tenant and Redis are always in sync with the backend storage configured. This is determined by the [volumePrefix](configuration/proxy-server/#configuring-tenants) specified for the `tenant`. During polling, for each of the tenants and roles, the storage service will ensure that nothing has been removed or added by the storage admin which would lead to Redis being out of sync.
A configurable polling mechanism has been introduced to ensure that the tenant and Redis are always in sync with the backend storage configured. This is determined by the [volumePrefix](configuration#configuring-tenants) specified for the `tenant`. During polling, for each of the tenants and roles, the storage service will ensure that nothing has been removed or added by the storage admin which would lead to Redis being out of sync.

If a volume is created with the matching `volumePrefix`, the new entry will be added to Redis and the available quota will be consumed accordingly. Similarly, if a snapshot is created from a volume that is owned by the tenant in the backend storage array, that will be added to Redis.

Expand All @@ -67,10 +65,10 @@ Storage Administrators perform the following:
- Tenant Management (create, get, delete)
- Token Management (create, revoke)

For more information on the configuration of the above, see the configuration of the [Proxy Server](../v2.0-tech-preview/configuration/proxy-server/#configuring-storage).
For more information on the configuration of the above, see the configuration of the [Proxy Server](../v2.x/configuration/#configuring-storage).

### Tenant Administrators

Tenants of CSM for Authorization can use the token provided by the Storage Administrators in their storage requests.

For more information on how to use the token and configuration, see configuration for the [PowerFlex driver](../v2.0-tech-preview/configuration/powerflex) or the [PowerMax driver](../v2.0-tech-preview/configuration/powermax).
For more information on how to use the token and configuration, see configuration for the [PowerFlex driver](../v2.x/configuration/powerflex), [PowerMax driver](../v2.x/configuration/powermax), or the [PowerScale driver](../v2.x/configuration/powerscale).
Loading
Loading