Open lknite opened 1 month ago
This use case is probably better supported by trust-manager csi-driver, @ThatsMrTalbot? 😉
In its current implementation the POC CSI driver loads the bundle from the secret/configmap so would have the same issue.
However I would not want to implement syncing to a PVC as targeting a PVC brings in more complications, for example:
Other implementation options:
I have put a bunch of thought into the implementation details, and I really don't think writing to PVCs is a feasible option.
If the CSI only supports ReadWriteOnce (EBS for example):
If the CSI supports ReadWriteMany (EFS for example):
Using PVCs creates a massive dependency on a specific feature set that CSI must implement.
In regards to some of your comments:
emptydir's are not always allowed cause they use space on a worknode hard drive, but generally pvcs are
EmptyDir can be used to create a in-memory FS with a size limit, not writing anything to hosts disk. The limit would not even need to be that big, 5mb can hold a lot of certificates.
i don't know about zonal restrictions, but would you say that's so common as to really be an issue?
The AWS EBS CSI driver has zonal restrictions. The AWS EFS driver may have zonal limits, it depends on configuration.
Honestly I think the perfect solution is writing our own CSI driver, this would have the following benefits:
Do you already have project for CSI driver for this purpose? I can try to contribute.
Do you already have project for CSI driver for this purpose? I can try to contribute.
No, not yet. @ThatsMrTalbot has create a POC for it, but not yet anything official. :-)
After a demo at the last community meeting the POC was moved into the cert-manager org: https://github.com/cert-manager/trust-manager-csi-driver
Currently it loads the secret/configmap that trust-manager created, but that can be changed so it can perform the aggregation itself and thus remove the 1mb limit.
This is still very much in the early stages, but if you want to contribute to the design/build then feel free to get involved, a good place to start is our daily stand-ups or bi-weekly community meetings. See https://cert-manager.io/docs/contributing.
I have encountered the situation where the size of a ca-bundle exceeds the allowed size of a configmap and/or secret.
Options:
Reference: