You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: Makefile
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@
15
15
SHELL = /bin/bash
16
16
17
17
# MP CSI Driver version
18
-
VERSION=2.0.0
18
+
VERSION=2.0.1
19
19
20
20
# List of allowed licenses in the CSI Driver's dependencies.
21
21
# See https://github.com/google/licenseclassifier/blob/e6a9bb99b5a6f71d5a34336b8245e305f5430f99/license_type.go#L28 for list of canonical names for licenses.
Copy file name to clipboardExpand all lines: charts/scality-mountpoint-s3-csi-driver/Chart.yaml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
apiVersion: v2
2
2
name: scality-mountpoint-s3-csi-driver
3
3
description: A Helm chart for installing the Mountpoint for Scality CSI Driver for S3. This CSI driver allows your Kubernetes applications to access S3 objects through a file system interface.
Review [release notes](release-notes.md) for breaking changes and the [releases page](https://github.com/scality/mountpoint-s3-csi-driver/releases) for complete changelog details.
40
+
Review [release notes](release-notes.md) for overview of changes and the [releases page](https://github.com/scality/mountpoint-s3-csi-driver/releases) for complete changelog details.
Copy file name to clipboardExpand all lines: docs/architecture/ring-s3-credentials-management/dynamic-provisioning-credentials-management.md
+22-1Lines changed: 22 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -126,6 +126,25 @@ For dynamic provisioning, credentials are used at two different stages:
126
126
!!! tip "Security Best Practice"
127
127
Use different credentials for provisioner (admin) and node-publish (user) operations to implement principle of least privilege.
128
128
129
+
!!! important "Secret Configuration Requirement"
130
+
**Both `provisioner-secret` and `node-publish-secret` must be configured together** when using secret-based authentication for dynamic provisioning.
131
+
The controller uses `provisioner-secret` presence to determine if secret-based authentication is enabled
132
+
(it cannot directly detect `node-publish-secret` due to CSI specification limitations).
133
+
134
+
**Technical Background:**
135
+
136
+
The CSI external-provisioner strips all `csi.storage.k8s.io/*` prefixed parameters from `CreateVolumeRequest`:
137
+
138
+
- `provisioner-secret-*`parameters → Resolved and VALUES passed in `req.GetSecrets()`
139
+
- `node-publish-secret-*`parameters → Stored in `PV.Spec.CSI.NodePublishSecretRef` (not visible during CreateVolume)
140
+
141
+
The controller cannot directly detect if only `node-publish-secret` is configured, so it uses `provisioner-secret` presence as a proxy indicator for secret-based authentication.
142
+
143
+
**Workaround for Node-Only Use Case:**
144
+
145
+
If you only need credentials for mounting (not bucket creation), configure both secrets pointing to the same Secret.
146
+
Example: set both `provisioner-secret-name` and `node-publish-secret-name` to "shared-credentials" in the same namespace.
147
+
129
148
### Example 1: Same Credentials for Both Operations
130
149
131
150
```yaml title="StorageClass with fixed secret names for both provisioner and node-publish"
@@ -145,7 +164,9 @@ parameters:
145
164
region: "us-west-2"
146
165
```
147
166
148
-
### Example 2: Separate Admin and User Credentials
167
+
### Example 2: Separate Admin and User Credentials (Recommended)
168
+
169
+
This is the **recommended approach** for production environments, implementing the principle of least privilege with different credentials for controller and node operations.
149
170
150
171
```yaml title="StorageClass with separate admin (provisioner) and user (node-publish) secret names"
|`image.repository`| The container image repository for the CSI driver. |`ghcr.io/scality/mountpoint-s3-csi-driver`| No |
20
20
|`image.pullPolicy`| The image pull policy. |`IfNotPresent`| No |
21
-
|`image.tag`| The image tag for the CSI driver. Overrides the chart's `appVersion` if set. |`2.0.0`| No |
21
+
|`image.tag`| The image tag for the CSI driver. Overrides the chart's `appVersion` if set. |`2.0.1`| No |
22
22
23
23
## S3 Global Configuration
24
24
@@ -116,11 +116,11 @@ These parameters configure the overall behavior of the CSI driver components.
116
116
|`controller.serviceAccount.create`| Specifies whether a ServiceAccount should be created for the controller. |`true`| No |
117
117
|`controller.serviceAccount.name`| Name of the ServiceAccount to use for the controller. |`s3-csi-driver-controller-sa`| No |
118
118
119
-
## Mountpoint Pod Configuration (v2.0.0+)
119
+
## Mountpoint Pod Configuration (v2.0)
120
120
121
121
<!-- markdownlint-disable MD046 -->
122
122
!!! info "Pod Mounter Strategy"
123
-
Version 2.0.0 uses pod-based mounter as the default strategy. Mounter pods are created in the `mount-s3` namespace to handle S3 mount operations with improved isolation and resource management.
123
+
Version 2.0 uses pod-based mounter as the default strategy. Mounter pods are created in the `mount-s3` namespace to handle S3 mount operations with improved isolation and resource management.
124
124
<!-- markdownlint-enable MD046 -->
125
125
126
126
| Parameter | Description | Default | Required |
@@ -133,7 +133,7 @@ These parameters configure the overall behavior of the CSI driver components.
133
133
|`mountpointPod.headroomImage.tag`| Image tag for headroom pods. |`3.10`| No |
134
134
|`mountpointPod.headroomImage.pullPolicy`| Image pull policy for headroom pods. |`IfNotPresent`| No |
kubectl get crd mountpoints3podattachments.s3.csi.scality.com
80
80
```
81
81
82
-
!!! info "v2.0.0 Features"
83
-
Version 2.0.0 introduces the MountpointS3PodAttachment CRD and pod-based mounter. The `mount-s3` namespace will be automatically created when volumes are first mounted.
82
+
!!! info "v2.0 Features"
83
+
Version 2.0 introduces the MountpointS3PodAttachment CRD and pod-based mounter. The `mount-s3` namespace will be automatically created when volumes are first mounted.
0 commit comments