search

kubernetes-sigs / azurefile-csi-driver

Azure File CSI Driver
Apache License 2.0
154 stars 141 forks source link

Add Support for configuring Storage Account's Firewall Rules through dynamic Provisioning Parameters #1222

Open Taha-cmd opened 1 year ago

Taha-cmd commented 1 year ago

By creating a storage class that uses the file.csi.azure.com provisioner, any PVCs using the storage class will dynamically provision a storage account and a file share to that the persistent volume will be mounted into. By using parameters, we can influence the creation of the underlying storage account, like its location, resource group or sku. Using these parameters, I would like to configure the firewall rules of the storage account as well. This is currently not possible.

Sample:

apiVersion: storage.k8s.io/v1
kind: StorageClass
allowVolumeExpansion: true
provisioner: file.csi.azure.com
reclaimPolicy: Retain
volumeBindingMode: Immediate
metadata:
  name: azurefile-csi-retain
mountOptions:
  - mfsymlinks
  - actimeo=30
  - nosharesock
parameters:
  skuName: Standard_LRS
  location: westeurope
  allowedVnet: myVnet # <- something like this
  allowedIpRange: ... # <- something like this
andyzhangx commented 1 year ago

could you use bring your own account by specifying storageAccount: accountname parameter, and you could configure those settings in your account. @Taha-cmd

Taha-cmd commented 1 year ago

@andyzhangx Thank you for the quick response. I am aware that I can create my own storage account and configure it as I want. But it would be cool if I can leverage the dynamic provisioning feature that takes care of creating the storage account for me. It is already customize-able to a certain extent through parameters. Configuring the firewall rules seems like a missing feature to me.

k8s-triage-robot commented 1 year ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

davidkarlsen commented 1 year ago

/remove-lifecycle stale

k8s-triage-robot commented 7 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

Taha-cmd commented 7 months ago

/remove-lifecycle stale

k8s-triage-robot commented 4 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

Taha-cmd commented 4 months ago

/remove-lifecycle stale

k8s-triage-robot commented 1 month ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 1 week ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten