search

kubernetes / cloud-provider-openstack

Apache License 2.0
619 stars 611 forks source link

[manila-csi-plugin] Support for `cloud-config` secret #2532

Open GlassOfWhiskey opened 9 months ago

GlassOfWhiskey commented 9 months ago

/kind feature

What happened: All the other OpenStack-related plugins support a cloud-config secret that contains credentials for authentication with the keystone. Conversely, Manila CSI Plugin wants its own format for auth secrets, making it difficult to integrate it with existing Kubernetes-on-Openstack environments (e.g., the Charmed Kubernetes Distribution.

What you expected to happen: it would be easier to mount the same cloud-config secret in all the OpenStack plugins ecosystem, instead of having a different integration path just for Manila. Is it something feasible?

jichenjc commented 9 months ago

I don't know detail of Manila about its secret mgmt if what you said apply to it I agree it's reasonable to update and Manila used to be done by @gman0 before @GlassOfWhiskey do you want to work on this by submit PR ?

k8s-triage-robot commented 6 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

GlassOfWhiskey commented 6 months ago

/remove-lifecycle stale

k8s-triage-robot commented 5 months ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

gouthampacha commented 5 months ago

/remove-lifecycle rotten

mkjpryor commented 4 months ago

+1 for this.

When we deploy Kubernetes, we create one secret containing a clouds.yaml with an application credential inside, then mount that into the Cinder CSI and OCCM pods. I was hoping to do the same for Manila, but this has scuppered me.

It would be less of a problem if Manila didn't require the region to be specified, which should be implicit in the application credential (it is for the other components), although still irritating.

mdbooth commented 4 months ago

I'm also interested in this feature. Without having looked, I doubt Manila genuinely needs Region, btw.

k8s-triage-robot commented 1 month ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 4 weeks ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

GlassOfWhiskey commented 4 weeks ago

/remove-lifecycle rotten

kayrus commented 4 weeks ago

@GlassOfWhiskey at first glance it looks like manila has its own specific set of secrets because csi-controller dynamically passes them to the node controller using CSI spec request.