Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Compatibility with Secret Store CSI Driver? #11069

Open
rileyhun opened this issue Mar 30, 2021 · 12 comments · May be fixed by #15815
Open

Compatibility with Secret Store CSI Driver? #11069

rileyhun opened this issue Mar 30, 2021 · 12 comments · May be fixed by #15815
Labels
kind/feature Well-understood/specified features, ready for coding. kind/good-first-issue Denotes an issue ready for a new contributor. lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.

Comments

@rileyhun
Copy link

rileyhun commented Mar 30, 2021 •
edited
Loading

Hello all,

I need to pull in a secret from a vault (a.k.a. GoogleSecretManager), but KNative doesn't let me me create the necessary volume to facilitate that through CSI. Any ideas on how to do this?

For example, it should look something like this:

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: seldon-request-logger
  metadata:
    labels:
    fluentd: "true"
spec:
  template:
    metadata:
      annotations:
        autoscaling.knative.dev/minScale: "1"
    spec:
      serviceAccountName: "secretsinvoker"
      containers:
      - image: docker.io/seldonio/seldon-request-logger:1.5.1
        imagePullPolicy: Always
        env:
          - name: ELASTICSEARCH_HOST
            value: "elasticsearch-opendistro-elasticsearch.logging.svc.cluster.local"
          - name: ELASTICSEARCH_PORT
            value: "9200"
          - name: ELASTICSEARCH_PROTOCOL
            value: "http"
          - name: ELASTICSEARCH_USER
            value: "admin"
          - name: ELASTICSEARCH_PASS
            valueFrom:
              secretKeyRef:
                name: elasticsecret
                key: pwd
        volumeMounts:
          - mountPath: "/var/secrets"
            name: mysecret
      volumes:
        - name: mysecret
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: "app-secrets"

Error:

Error from server (BadRequest): error when creating "logging/seldon-request-logger.yaml": admission webhook "validation.webhook.serving.knative.dev" denied the request: validation failed: expected exactly one, got neither: spec.template.spec.volumes[0].configMap, spec.template.spec.volumes[0].projected, spec.template.spec.volumes[0].secret
must not set the field(s): spec.template.spec.volumes[0].csi
@rileyhun rileyhun added the kind/feature Well-understood/specified features, ready for coding. label Mar 30, 2021
@eftugahan
Copy link

Got the same error here. Have you got any solution?

@rileyhun
Copy link
Author

rileyhun commented Jun 9, 2021

Got the same error here. Have you got any solution?

I don't think there is a solution because knative doesn't allow you to mount custom volumes. I ended up using berglas instead. K8s external secrets should work as well.

@github-actions
Copy link

github-actions bot commented Sep 8, 2021

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Sep 8, 2021
@github-actions github-actions bot closed this as completed Oct 8, 2021
@jjayabal23
Copy link

Does knative have any plans to support csi drivers in the future?

@paulorpdlmillicom
Copy link

paulorpdlmillicom commented Nov 2, 2022 •
edited
Loading

Why there is no support for CSI? Maybe this is a bug, because looking the API reference (https://knative.dev/docs/serving/reference/serving-api/#serving.knative.dev/v1.RevisionTemplateSpec), the RevisionTemplateSpec uses Kubernetes Core v1.PodSpec. This support multiple kinds of VolumeSource (https://pkg.go.dev/k8s.io/[email protected]/core/v1#VolumeSource)

Looking the code, maybe is an error at OAPI CRD spec.

@amccague amccague mentioned this issue Jan 6, 2023
Open
@erictg
Copy link

erictg commented May 8, 2023 •
edited
Loading

What would it take to actually support CSI? Since this is being passed off to the pods/kubernetes itself, why would knative explicitly block this functionality?

I'd be happy to look into supporting this

@knative-prow
Copy link

knative-prow bot commented May 8, 2023

@erictg: You can't reopen an issue/PR unless you authored it or you are a collaborator.

In response to this:

/reopen
/remove-lifecycle stale

What would it take to actually support CSI? Since this is being passed off to the pods/kubernetes itself, why would knative explicitly block this functionality?

I'd be happy to look into supporting this

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@knative-prow knative-prow bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 8, 2023
@zzuchen
Copy link

zzuchen commented Jan 10, 2024

Got the same error here. Have you got any solution?

I don't think there is a solution because knative doesn't allow you to mount custom volumes. I ended up using berglas instead. K8s external secrets should work as well.

hello, could you please tell me how to solve the problem through berglas?

@GuitaristForEver
Copy link

Hi,
this would be very helpful.
we had some disucssion about this. (https://cloud-native.slack.com/archives/C04LGHDR9K7/p1733673567372039)

@skonto
Copy link
Contributor

skonto commented Dec 20, 2024

/reopen

@knative-prow Knative Prow
Copy link

knative-prow bot commented Dec 20, 2024

@skonto: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@knative-prow knative-prow bot reopened this Dec 20, 2024
@skonto skonto added the kind/good-first-issue Denotes an issue ready for a new contributor. label Dec 20, 2024
@github-actions GitHub Actions
Copy link

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 21, 2025
@mwritescode mwritescode linked a pull request Mar 21, 2025 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/feature Well-understood/specified features, ready for coding. kind/good-first-issue Denotes an issue ready for a new contributor. lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: add support for CSI volumes mwritescode/serving
8 participants
@erictg @skonto @rileyhun @GuitaristForEver @zzuchen @eftugahan @jjayabal23 @paulorpdlmillicom