This article is more than one year old. Older articles may contain outdated content. Check that the information in the page has not become incorrect since its publication.
Kubernetes 1.20: Pod Impersonation and Short-lived Volumes in CSI Drivers
Author: Shihang Zhang (Google)
Typically when a CSI driver mounts credentials such as secrets and certificates, it has to authenticate against storage providers to access the credentials. However, the access to those credentials are controlled on the basis of the pods' identities rather than the CSI driver's identity. CSI drivers, therefore, need some way to retrieve pod's service account token.
Currently there are two suboptimal approaches to achieve this, either by granting CSI drivers the permission to use TokenRequest API or by reading tokens directly from the host filesystem.
Both of them exhibit the following drawbacks:
- Violating the principle of least privilege
- Every CSI driver needs to re-implement the logic of getting the pod’s service account token
The second approach is more problematic due to:
- The audience of the token defaults to the kube-apiserver
- The token is not guaranteed to be available (e.g.
- The approach does not work for CSI drivers that run as a different (non-root) user from the pods. See file permission section for service account token
- The token might be legacy Kubernetes service account token which doesn’t expire if
Kubernetes 1.20 introduces an alpha feature,
CSIServiceAccountToken, to improve the security posture. The new feature allows CSI drivers to receive pods' bound service account tokens.
This feature also provides a knob to re-publish volumes so that short-lived volumes can be refreshed.
Using GCP APIs
Using Workload Identity, a Kubernetes service account can authenticate as a Google service account when accessing Google Cloud APIs. If a CSI driver needs to access GCP APIs on behalf of the pods that it is mounting volumes for, it can use the pod's service account token to exchange for GCP tokens. The pod's service account token is plumbed through the volume context in
NodePublishVolume RPC calls when the feature
CSIServiceAccountToken is enabled. For example: accessing Google Secret Manager via a secret store CSI driver.
If users configure Kubernetes as an auth method, Vault uses the
TokenReview API to validate the Kubernetes service account token. For CSI drivers using Vault as resources provider, they need to present the pod's service account to Vault. For example, secrets store CSI driver and cert manager CSI driver.
To keep short-lived volumes such as certificates effective, CSI drivers can specify
RequiresRepublish=true in their
CSIDriver object to have the kubelet periodically call
NodePublishVolume on mounted volumes. These republishes allow CSI drivers to ensure that the volume content is up-to-date.
This feature is alpha and projected to move to beta in 1.21. See more in the following KEP and CSI documentation:
Your feedback is always welcome!
- SIG-Auth meets regularly and can be reached via Slack and the mailing list
- SIG-Storage meets regularly and can be reached via Slack and the mailing list.