search

kubernetes-sigs / azurefile-csi-driver

Azure File CSI Driver
Apache License 2.0
154 stars 141 forks source link

POSIX compliant and secure mounting option #1417

Closed KenADev closed 2 months ago

KenADev commented 1 year ago

Is your feature request related to a problem?/Why is this needed Currently, the only option to mount an Azure Fileshare in a POSIX compliant way is to use the NFS protocol. However, the security implications when NFS is used are devastating: Insecure connections have to be enabled on the Storage Account, there is no encryption in transit, and no authentication (access is only limited by network restrictions). The only other POSIX compliant storage option is to use Azure Disks, which however have the disadvantage that every AKS node can only mount a kind of small number of disks (e.g., 16 disks.) and only ReadWriteOnce is supported.

Describe the solution you'd like in detail A POSIX compliant mounting option with proper authentication, encryption in transit, and support for ReadWriteMany.

Describe alternatives you've considered Azure Disks, but have ReadWriteOnly and disks/node limitations.

Additional context We require this feature for complying with PCI DSS.

andyzhangx commented 1 year ago

azure file team is already working on encryption in transit support on azure file nfs service, stay tuned.

k8s-triage-robot commented 8 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 4 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 3 months ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot commented 2 months ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

k8s-ci-robot commented 2 months ago

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to [this](https://github.com/kubernetes-sigs/azurefile-csi-driver/issues/1417#issuecomment-2243259972): >The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. > >This bot triages issues according to the following rules: >- After 90d of inactivity, `lifecycle/stale` is applied >- After 30d of inactivity since `lifecycle/stale` was applied, `lifecycle/rotten` is applied >- After 30d of inactivity since `lifecycle/rotten` was applied, the issue is closed > >You can: >- Reopen this issue with `/reopen` >- Mark this issue as fresh with `/remove-lifecycle rotten` >- Offer to help out with [Issue Triage][1] > >Please send feedback to sig-contributor-experience at [kubernetes/community](https://github.com/kubernetes/community). > >/close not-planned > >[1]: https://www.kubernetes.dev/docs/guide/issue-triage/ Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.