From 2702bae09e3b6a35d85f4db5f6aee3347fb132e9 Mon Sep 17 00:00:00 2001 From: Cheng Pan Date: Thu, 29 Nov 2018 00:31:02 +0000 Subject: Add KEP for AWS EBS CSI Driver --- keps/NEXT_KEP_NUMBER | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/keps/NEXT_KEP_NUMBER b/keps/NEXT_KEP_NUMBER index f04c001f..8f92bfdd 100644 --- a/keps/NEXT_KEP_NUMBER +++ b/keps/NEXT_KEP_NUMBER @@ -1 +1 @@ -29 +35 -- cgit v1.2.3 From 7bff318811e47e89b2a2be306f8978acc9bea786 Mon Sep 17 00:00:00 2001 From: Cheng Pan Date: Thu, 29 Nov 2018 00:32:10 +0000 Subject: add missing file --- keps/sig-aws/0035-20181127-aws-ebs-csi-driver.md | 68 ++++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 keps/sig-aws/0035-20181127-aws-ebs-csi-driver.md diff --git a/keps/sig-aws/0035-20181127-aws-ebs-csi-driver.md b/keps/sig-aws/0035-20181127-aws-ebs-csi-driver.md new file mode 100644 index 00000000..2c0e6ad3 --- /dev/null +++ b/keps/sig-aws/0035-20181127-aws-ebs-csi-driver.md @@ -0,0 +1,68 @@ +--- +kep-number: 34 +title: aws-ebs-csi-driver +authors: + - "@leakingtapan" +owning-sig: sig-aws +reviewers: + - "@d-nishi" + - "@jsafrane" +approvers: + - "@d-nishi" + - "@jsafrane" +editor: TBD +creation-date: 2018-11-27 +last-updated: 2018-11-27 +status: provisional +--- + +# AWS Elastic Block Store (EBS) CSI Driver + +## Table of Contents + +* [Table of Contents](#table-of-contents) +* [Summary](#summary) +* [Motivation](#motivation) + * [Goals](#goals) + * [Non-Goals](#non-goals) +* [Proposal](#proposal) + * [User Stories](#user-stories) + +* [Graduation Criteria](#graduation-criteria) +* [Implementation History](#implementation-history) + +## Summary +AWS EBS CSI Driver implements [Container Storage Interface](https://github.com/container-storage-interface/spec/tree/master) which is the standard of storage interface for container. It provides the same in-tree AWS EBS plugin features including volume creation, volume attachment, volume mounting and volume scheduling. It is also configurable on what is the EBS volume type to create, what is the file system file should be formatted, which KMS key to use to create encrpyted volume, etc. + +## Motivation +Similar to CNI plugins, AWS EBS CSI driver will be a stand alone plugin that lives out-of-tree of kuberenetes. Being out-of-tree, it will be benefit from being modularized, maintained and optimized without affecting kubernetes core code base. Aside from those benefits, it could also be consumed by other container orchestrators such as ECS. + +### Goals +AWS EBS CSI driver will provide similar user experience as in-tree EBS plugin: +* As an application developer, he will not even notice any difference between EBS CSI driver and in-tree plugin. His workflow will stay the same as current. +* As an infrastructure operator, he just need to create/update storage class to use CSI driver to manage underlying storage backend. + +List of driver features include volume creation/deletion, volume attach/detach, volume mount/unmount, volume scheduling, create volume configurations, volume snapshotting, mount options, raw block volume, etc. + +### Non-Goals +* Supporting non AWS block storage +* Supporting other AWS storage serivces such as Dynamodb, S3, etc. + +## Proposal + +### User Stories + +#### Static Provisioning +Operator creates a pre-created EBS volume on AWS and a PV that refer the EBS volume on cluster. Developer creates PVC and a Pod that uses the PVC. Then developer deploys the Pod during which time the PV will be attached to container inside Pod after PVC bonds to PV successfully. + +#### Dyanmic Provisiong with Volume Scheduling +Operation creates StorageClass with volumeBindingMode = WaitForFirstConsumer. When developer deploys a Pod that has PVC that is trying to claim for a PV, a new PV will be created, attached, formatted and mounted inside Pod's container by the EBS CSI driver. Topology information provided by EBS CSI driver will be used during Pod scheduling to guarantee that both Pod and volume are collocated in the same availability zone. + +## Graduation Criteria +AWS EBS CSI driver provides the same features as in-tree plugin. + +## Implementation History +* 2018-11-26 Initial proposal to SIG +* 2018-11-26 Initial KEP draft +* 2018-12-03 Alpha release with kuberentes 1.13 + -- cgit v1.2.3 From f2f5131c1e0b5a09709a0de4b0b91f4d91a18ed7 Mon Sep 17 00:00:00 2001 From: Cheng Pan Date: Thu, 29 Nov 2018 00:58:05 +0000 Subject: Add risk and mitigations --- keps/sig-aws/0035-20181127-aws-ebs-csi-driver.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/keps/sig-aws/0035-20181127-aws-ebs-csi-driver.md b/keps/sig-aws/0035-20181127-aws-ebs-csi-driver.md index 2c0e6ad3..b4b0c7fe 100644 --- a/keps/sig-aws/0035-20181127-aws-ebs-csi-driver.md +++ b/keps/sig-aws/0035-20181127-aws-ebs-csi-driver.md @@ -27,7 +27,9 @@ status: provisional * [Non-Goals](#non-goals) * [Proposal](#proposal) * [User Stories](#user-stories) - + * [Static Provisioning](#static-provisioning) + * [Volume Schduling](#volume-scheduling) + * [Risks and Mitigations](#risks-and-mitigations) * [Graduation Criteria](#graduation-criteria) * [Implementation History](#implementation-history) @@ -55,9 +57,13 @@ List of driver features include volume creation/deletion, volume attach/detach, #### Static Provisioning Operator creates a pre-created EBS volume on AWS and a PV that refer the EBS volume on cluster. Developer creates PVC and a Pod that uses the PVC. Then developer deploys the Pod during which time the PV will be attached to container inside Pod after PVC bonds to PV successfully. -#### Dyanmic Provisiong with Volume Scheduling +#### Volume Scheduling Operation creates StorageClass with volumeBindingMode = WaitForFirstConsumer. When developer deploys a Pod that has PVC that is trying to claim for a PV, a new PV will be created, attached, formatted and mounted inside Pod's container by the EBS CSI driver. Topology information provided by EBS CSI driver will be used during Pod scheduling to guarantee that both Pod and volume are collocated in the same availability zone. +### Risks and Mitigations +* *Information disclosure* - AWS EBS CSI driver requires permission to perform AWS operation on users' behave. EBS CSI driver will make sure non of credentials are logged. And we will instruct user to grant only required permission to driver as best securtiy practise. +* *Escalation of Privileges* - Since EBS CSI driver is formatting and mounting volumes, it requires root privilege to permform the operations. So that driver will have higher privilege than other containers in the cluster. The driver will not execute random command provided by untrusted user. All of its interfaces are only provided for kuberenetes system components to interact with. The driver will also validate requests to make sure it aligns with its assumption. + ## Graduation Criteria AWS EBS CSI driver provides the same features as in-tree plugin. -- cgit v1.2.3 From f9b13c3f121d566b8db00846f5a89c6c694b98ad Mon Sep 17 00:00:00 2001 From: Cheng Pan Date: Thu, 29 Nov 2018 06:09:34 +0000 Subject: minor fixes --- keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md b/keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md index b4b0c7fe..eda85e5b 100644 --- a/keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md +++ b/keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md @@ -16,7 +16,7 @@ last-updated: 2018-11-27 status: provisional --- -# AWS Elastic Block Store (EBS) CSI Driver +# AWS Elastic Block Store (EBS) CSI Driver ## Table of Contents @@ -41,14 +41,14 @@ Similar to CNI plugins, AWS EBS CSI driver will be a stand alone plugin that liv ### Goals AWS EBS CSI driver will provide similar user experience as in-tree EBS plugin: -* As an application developer, he will not even notice any difference between EBS CSI driver and in-tree plugin. His workflow will stay the same as current. +* As an application developer, he will not even notice any difference between EBS CSI driver and in-tree plugin. His workflow will stay the same as current. * As an infrastructure operator, he just need to create/update storage class to use CSI driver to manage underlying storage backend. List of driver features include volume creation/deletion, volume attach/detach, volume mount/unmount, volume scheduling, create volume configurations, volume snapshotting, mount options, raw block volume, etc. ### Non-Goals * Supporting non AWS block storage -* Supporting other AWS storage serivces such as Dynamodb, S3, etc. +* Supporting other AWS storage serivces such as Dynamodb, S3, etc. ## Proposal @@ -62,13 +62,13 @@ Operation creates StorageClass with volumeBindingMode = WaitForFirstConsumer. W ### Risks and Mitigations * *Information disclosure* - AWS EBS CSI driver requires permission to perform AWS operation on users' behave. EBS CSI driver will make sure non of credentials are logged. And we will instruct user to grant only required permission to driver as best securtiy practise. -* *Escalation of Privileges* - Since EBS CSI driver is formatting and mounting volumes, it requires root privilege to permform the operations. So that driver will have higher privilege than other containers in the cluster. The driver will not execute random command provided by untrusted user. All of its interfaces are only provided for kuberenetes system components to interact with. The driver will also validate requests to make sure it aligns with its assumption. +* *Escalation of Privileges* - Since EBS CSI driver is formatting and mounting volumes, it requires root privilege to permform the operations. So that driver will have higher privilege than other containers in the cluster. The driver will not execute random command provided by untrusted user. All of its interfaces are only provided for kuberenetes system components to interact with. The driver will also validate requests to make sure it aligns with its assumption. ## Graduation Criteria -AWS EBS CSI driver provides the same features as in-tree plugin. +AWS EBS CSI driver provides the same features as in-tree plugin. ## Implementation History -* 2018-11-26 Initial proposal to SIG -* 2018-11-26 Initial KEP draft +* 2018-11-26 Initial proposal to SIG +* 2018-11-26 Initial KEP draft * 2018-12-03 Alpha release with kuberentes 1.13 -- cgit v1.2.3 From f13bd2428bfee4e5a265793899741a9ce09c3e0f Mon Sep 17 00:00:00 2001 From: Cheng Pan Date: Thu, 29 Nov 2018 06:28:17 +0000 Subject: Fix misspell --- keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md b/keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md index eda85e5b..74d349c7 100644 --- a/keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md +++ b/keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md @@ -34,7 +34,7 @@ status: provisional * [Implementation History](#implementation-history) ## Summary -AWS EBS CSI Driver implements [Container Storage Interface](https://github.com/container-storage-interface/spec/tree/master) which is the standard of storage interface for container. It provides the same in-tree AWS EBS plugin features including volume creation, volume attachment, volume mounting and volume scheduling. It is also configurable on what is the EBS volume type to create, what is the file system file should be formatted, which KMS key to use to create encrpyted volume, etc. +AWS EBS CSI Driver implements [Container Storage Interface](https://github.com/container-storage-interface/spec/tree/master) which is the standard of storage interface for container. It provides the same in-tree AWS EBS plugin features including volume creation, volume attachment, volume mounting and volume scheduling. It is also configurable on what is the EBS volume type to create, what is the file system file should be formatted, which KMS key to use to create encrypted volume, etc. ## Motivation Similar to CNI plugins, AWS EBS CSI driver will be a stand alone plugin that lives out-of-tree of kuberenetes. Being out-of-tree, it will be benefit from being modularized, maintained and optimized without affecting kubernetes core code base. Aside from those benefits, it could also be consumed by other container orchestrators such as ECS. -- cgit v1.2.3 From ed836ba981ec7e2d59c60fb68aa0e2adeb2c238e Mon Sep 17 00:00:00 2001 From: Cheng Pan Date: Thu, 29 Nov 2018 18:34:24 +0000 Subject: Address comment --- keps/NEXT_KEP_NUMBER | 2 +- keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md | 74 ------------------------ keps/sig-aws/20181127-aws-ebs-csi-driver.md | 74 ++++++++++++++++++++++++ 3 files changed, 75 insertions(+), 75 deletions(-) delete mode 100644 keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md create mode 100644 keps/sig-aws/20181127-aws-ebs-csi-driver.md diff --git a/keps/NEXT_KEP_NUMBER b/keps/NEXT_KEP_NUMBER index 8f92bfdd..f5c89552 100644 --- a/keps/NEXT_KEP_NUMBER +++ b/keps/NEXT_KEP_NUMBER @@ -1 +1 @@ -35 +32 diff --git a/keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md b/keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md deleted file mode 100644 index 74d349c7..00000000 --- a/keps/sig-aws/0034-20181127-aws-ebs-csi-driver.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -kep-number: 34 -title: aws-ebs-csi-driver -authors: - - "@leakingtapan" -owning-sig: sig-aws -reviewers: - - "@d-nishi" - - "@jsafrane" -approvers: - - "@d-nishi" - - "@jsafrane" -editor: TBD -creation-date: 2018-11-27 -last-updated: 2018-11-27 -status: provisional ---- - -# AWS Elastic Block Store (EBS) CSI Driver - -## Table of Contents - -* [Table of Contents](#table-of-contents) -* [Summary](#summary) -* [Motivation](#motivation) - * [Goals](#goals) - * [Non-Goals](#non-goals) -* [Proposal](#proposal) - * [User Stories](#user-stories) - * [Static Provisioning](#static-provisioning) - * [Volume Schduling](#volume-scheduling) - * [Risks and Mitigations](#risks-and-mitigations) -* [Graduation Criteria](#graduation-criteria) -* [Implementation History](#implementation-history) - -## Summary -AWS EBS CSI Driver implements [Container Storage Interface](https://github.com/container-storage-interface/spec/tree/master) which is the standard of storage interface for container. It provides the same in-tree AWS EBS plugin features including volume creation, volume attachment, volume mounting and volume scheduling. It is also configurable on what is the EBS volume type to create, what is the file system file should be formatted, which KMS key to use to create encrypted volume, etc. - -## Motivation -Similar to CNI plugins, AWS EBS CSI driver will be a stand alone plugin that lives out-of-tree of kuberenetes. Being out-of-tree, it will be benefit from being modularized, maintained and optimized without affecting kubernetes core code base. Aside from those benefits, it could also be consumed by other container orchestrators such as ECS. - -### Goals -AWS EBS CSI driver will provide similar user experience as in-tree EBS plugin: -* As an application developer, he will not even notice any difference between EBS CSI driver and in-tree plugin. His workflow will stay the same as current. -* As an infrastructure operator, he just need to create/update storage class to use CSI driver to manage underlying storage backend. - -List of driver features include volume creation/deletion, volume attach/detach, volume mount/unmount, volume scheduling, create volume configurations, volume snapshotting, mount options, raw block volume, etc. - -### Non-Goals -* Supporting non AWS block storage -* Supporting other AWS storage serivces such as Dynamodb, S3, etc. - -## Proposal - -### User Stories - -#### Static Provisioning -Operator creates a pre-created EBS volume on AWS and a PV that refer the EBS volume on cluster. Developer creates PVC and a Pod that uses the PVC. Then developer deploys the Pod during which time the PV will be attached to container inside Pod after PVC bonds to PV successfully. - -#### Volume Scheduling -Operation creates StorageClass with volumeBindingMode = WaitForFirstConsumer. When developer deploys a Pod that has PVC that is trying to claim for a PV, a new PV will be created, attached, formatted and mounted inside Pod's container by the EBS CSI driver. Topology information provided by EBS CSI driver will be used during Pod scheduling to guarantee that both Pod and volume are collocated in the same availability zone. - -### Risks and Mitigations -* *Information disclosure* - AWS EBS CSI driver requires permission to perform AWS operation on users' behave. EBS CSI driver will make sure non of credentials are logged. And we will instruct user to grant only required permission to driver as best securtiy practise. -* *Escalation of Privileges* - Since EBS CSI driver is formatting and mounting volumes, it requires root privilege to permform the operations. So that driver will have higher privilege than other containers in the cluster. The driver will not execute random command provided by untrusted user. All of its interfaces are only provided for kuberenetes system components to interact with. The driver will also validate requests to make sure it aligns with its assumption. - -## Graduation Criteria -AWS EBS CSI driver provides the same features as in-tree plugin. - -## Implementation History -* 2018-11-26 Initial proposal to SIG -* 2018-11-26 Initial KEP draft -* 2018-12-03 Alpha release with kuberentes 1.13 - diff --git a/keps/sig-aws/20181127-aws-ebs-csi-driver.md b/keps/sig-aws/20181127-aws-ebs-csi-driver.md new file mode 100644 index 00000000..74d349c7 --- /dev/null +++ b/keps/sig-aws/20181127-aws-ebs-csi-driver.md @@ -0,0 +1,74 @@ +--- +kep-number: 34 +title: aws-ebs-csi-driver +authors: + - "@leakingtapan" +owning-sig: sig-aws +reviewers: + - "@d-nishi" + - "@jsafrane" +approvers: + - "@d-nishi" + - "@jsafrane" +editor: TBD +creation-date: 2018-11-27 +last-updated: 2018-11-27 +status: provisional +--- + +# AWS Elastic Block Store (EBS) CSI Driver + +## Table of Contents + +* [Table of Contents](#table-of-contents) +* [Summary](#summary) +* [Motivation](#motivation) + * [Goals](#goals) + * [Non-Goals](#non-goals) +* [Proposal](#proposal) + * [User Stories](#user-stories) + * [Static Provisioning](#static-provisioning) + * [Volume Schduling](#volume-scheduling) + * [Risks and Mitigations](#risks-and-mitigations) +* [Graduation Criteria](#graduation-criteria) +* [Implementation History](#implementation-history) + +## Summary +AWS EBS CSI Driver implements [Container Storage Interface](https://github.com/container-storage-interface/spec/tree/master) which is the standard of storage interface for container. It provides the same in-tree AWS EBS plugin features including volume creation, volume attachment, volume mounting and volume scheduling. It is also configurable on what is the EBS volume type to create, what is the file system file should be formatted, which KMS key to use to create encrypted volume, etc. + +## Motivation +Similar to CNI plugins, AWS EBS CSI driver will be a stand alone plugin that lives out-of-tree of kuberenetes. Being out-of-tree, it will be benefit from being modularized, maintained and optimized without affecting kubernetes core code base. Aside from those benefits, it could also be consumed by other container orchestrators such as ECS. + +### Goals +AWS EBS CSI driver will provide similar user experience as in-tree EBS plugin: +* As an application developer, he will not even notice any difference between EBS CSI driver and in-tree plugin. His workflow will stay the same as current. +* As an infrastructure operator, he just need to create/update storage class to use CSI driver to manage underlying storage backend. + +List of driver features include volume creation/deletion, volume attach/detach, volume mount/unmount, volume scheduling, create volume configurations, volume snapshotting, mount options, raw block volume, etc. + +### Non-Goals +* Supporting non AWS block storage +* Supporting other AWS storage serivces such as Dynamodb, S3, etc. + +## Proposal + +### User Stories + +#### Static Provisioning +Operator creates a pre-created EBS volume on AWS and a PV that refer the EBS volume on cluster. Developer creates PVC and a Pod that uses the PVC. Then developer deploys the Pod during which time the PV will be attached to container inside Pod after PVC bonds to PV successfully. + +#### Volume Scheduling +Operation creates StorageClass with volumeBindingMode = WaitForFirstConsumer. When developer deploys a Pod that has PVC that is trying to claim for a PV, a new PV will be created, attached, formatted and mounted inside Pod's container by the EBS CSI driver. Topology information provided by EBS CSI driver will be used during Pod scheduling to guarantee that both Pod and volume are collocated in the same availability zone. + +### Risks and Mitigations +* *Information disclosure* - AWS EBS CSI driver requires permission to perform AWS operation on users' behave. EBS CSI driver will make sure non of credentials are logged. And we will instruct user to grant only required permission to driver as best securtiy practise. +* *Escalation of Privileges* - Since EBS CSI driver is formatting and mounting volumes, it requires root privilege to permform the operations. So that driver will have higher privilege than other containers in the cluster. The driver will not execute random command provided by untrusted user. All of its interfaces are only provided for kuberenetes system components to interact with. The driver will also validate requests to make sure it aligns with its assumption. + +## Graduation Criteria +AWS EBS CSI driver provides the same features as in-tree plugin. + +## Implementation History +* 2018-11-26 Initial proposal to SIG +* 2018-11-26 Initial KEP draft +* 2018-12-03 Alpha release with kuberentes 1.13 + -- cgit v1.2.3 From 9598bdf4059d8dee1bda1de738836834139d284f Mon Sep 17 00:00:00 2001 From: Cheng Pan Date: Thu, 29 Nov 2018 18:36:01 +0000 Subject: Remove KEP number in metadata --- keps/sig-aws/20181127-aws-ebs-csi-driver.md | 1 - 1 file changed, 1 deletion(-) diff --git a/keps/sig-aws/20181127-aws-ebs-csi-driver.md b/keps/sig-aws/20181127-aws-ebs-csi-driver.md index 74d349c7..81cb1e7b 100644 --- a/keps/sig-aws/20181127-aws-ebs-csi-driver.md +++ b/keps/sig-aws/20181127-aws-ebs-csi-driver.md @@ -1,5 +1,4 @@ --- -kep-number: 34 title: aws-ebs-csi-driver authors: - "@leakingtapan" -- cgit v1.2.3