Add csi-proxy project #362

jingxu97 · 2020-09-10T05:46:07Z

Add csi-proxy project in docs

jingxu97 · 2020-09-10T21:22:11Z

xing-yang · 2020-09-16T13:35:11Z

/release-note-none

msau42 · 2020-09-16T19:05:15Z

book/src/SUMMARY.md

@@ -31,6 +31,7 @@
            - [Volume Snapshot & Restore](snapshot-restore-feature.md)
        - [Ephemeral Local Volumes](ephemeral-local-volumes.md)
        - [Volume Limits](volume-limits.md)
+        - [CSI proxy](csi-proxy.md)


Can we have 2 pages?

One for the csi proxy component, which should go under "Kubernetes Cluster Controllers", and one for Windows, which should go under "Features".

The csi-proxy page focuses on what a cluster operator needs to do to deploy the csi-proxy, and the Windows feature page focuses on how csi driver authors can add Windows support to their driver.

msau42 · 2020-09-16T19:09:52Z

book/src/csi-proxy.md

+
+Status | Min K8s Version | Max K8s Version
+--|--|--
+Alpha | 1.18 | - 


Can you put the actual version in this column?

it is the actual version?

I mean a number like "v0.1.0"

msau42 · 2020-09-16T19:11:48Z

book/src/csi-proxy.md

+
+Run csi-proxy.exe binary directly on Window node. Command line options
+
+* `-kubelet-csi-plugins-path`: This is the prefix path of the Kubelet plugin directory in the host file system (`C:\var\lib\kubelet` is used by default).


What is this path used for? Do we append "/plugins_registry or /plugins" after it?

this path is mainly for validating the path requested from client is valid (under pod volume dir), not some other arbitrary path for security reason.

Can you add more details of what this path is used for in the description of this field? The name of this field is also confusing because it's the kubelet root, not the plugins path.

we are in the process of hanging this part to use kublet-path instead of two to match the name. will update it after the change is done.

has this been updated for v1?

-kubelet-csi-plugins-path and -kubelet-pod-path below should be replaced with (or noted as removed in favor of) -kubelet-pod-path in v1.0.

updated, thanks!

msau42 · 2020-09-16T19:13:16Z

book/src/csi-proxy.md

+
+* `-kubelet-csi-plugins-path`: This is the prefix path of the Kubelet plugin directory in the host file system (`C:\var\lib\kubelet` is used by default).
+
+* `-kubelet-pod-path`: This is the prefix path of the kubelet pod directory in the host file system (`C:\var\lib\kubelet` is used by default).


This is assuming "/pods" are appended afterwards?

Should this just be the kubelet root directory?

at the initial design, it was set to pod dir, but then due to some issue (I forgot the cause), we relax it to the upper level path in there https://github.com/kubernetes-csi/csi-proxy/pull/28/files

So that's why we say it is prefix. I think the idea is user might still set it to different paths as they desire. We could use one parameter like kublet dir, but to change this, it would be user facing breaking change, so we try to avoid it unless very necessary.

Can we change this for the GA v1 version? I think this field is a little confusing because pod path is usually "/var/lib/kubelet/pods". Especially because this path and the csi-plugins-path is the same. Can we combine the two options?

yes, we plan to do it.

msau42 · 2020-09-16T19:14:02Z

book/src/csi-proxy.md

+
+CSI Proxy is a binary that exposes a set of gRPC APIs around storage operations over named pipes in Windows. A container, such as CSI node plugins, can mount the named pipes depending on operations it wants to exercise on the host and invoke the APIs.
+
+Each named pipe will support a specific version of an API (e.g. v1alpha1, v2beta1) that targets a specific area of storage (e.g. disk, volume, file, SMB, iSCSI).


Where do these pipes get created?

added some examples \.\pipe\csi-proxy-disk-v1beta1

msau42 · 2020-09-16T20:48:39Z

book/src/csi-proxy.md

+
+## Deployment
+
+Directly run csi-proxy.exe binary or run it as a Windows Serivce.


Clarify this should be run on Kubernetes nodes.

msau42 · 2020-09-29T00:45:20Z

book/src/csi-proxy.md

+
+CSI Proxy is a binary that exposes a set of gRPC APIs around storage operations over named pipes in Windows. A container, such as CSI node plugins, can mount the named pipes depending on operations it wants to exercise on the host and invoke the APIs.
+
+Each named pipe will support a specific version of an API (e.g. v1alpha1, v2beta1) that targets a specific area of storage (e.g. disk, volume, file, SMB, iSCSI). For example, `\\.\pipe\csi-proxy-filesystem-v1alpha1`, `\\.\pipe\csi-proxy-disk-v1beta1`


Is there a place where every pipe is actually documented and we can point to?

not really, just a short explanation on csi-proxy readme. https://github.com/kubernetes-csi/csi-proxy

Can we open an issue to investigate if we can have some api reference generator?

yes, we are checking on it

msau42 · 2020-09-29T00:49:51Z

book/src/csi-windows.md

+CSI drivers (e.g. AzureDisk, GCE PD, etc.) are recommended to be deployed as containers. CSI driver’s node plugin typically runs on every worker node in the cluster (as a DaemonSet). Node plugin containers need to run with elevated privileges to perform storage related operations. However, Windows currently does not support privileged containers. To solve this problem, [CSI Proxy](https://github.com/kubernetes-csi/csi-proxy) - that runs on the Windows host and executes a set of privileged storage operations on Windows nodes on behalf of containers in a CSI Node plugin daemonset. This enables multiple CSI Node plugin authors to execute privileges storage operations on Windows nodes without having to ship a custom privileged operation proxy (until privileged operations get enabled for containers in Windows in the future).
+
+## How to use the CSI Proxy for Windows?
+The CSI Proxy executable - csi-proxy.exe - needs to be deployed and running on all Windows nodes in a cluster - similar to kubelet.exe, dockerd.exe, etc. This may be achieved by enhancing any existing Windows node setup mechanism or script used for installing and configuring dockerd.exe/containerd.exe, kubelet.exe, kubeproxy.exe, etc.


The instructions for csi-proxy deployment should go in the csi-proxy page, and you can link to it from here

msau42 · 2020-09-29T00:51:18Z

book/src/csi-windows.md

+        kubernetes.io/os: windows
+      containers:
+        - name: csi-driver-registrar
+          image: gke.gcr.io/csi-node-driver-registrar:win-v1


Let's use K8s community images instead of gke images.

msau42 · 2020-09-29T00:54:35Z

book/src/csi-windows.md

+
+## Overview
+
+CSI drivers (e.g. AzureDisk, GCE PD, etc.) are recommended to be deployed as containers. CSI driver’s node plugin typically runs on every worker node in the cluster (as a DaemonSet). Node plugin containers need to run with elevated privileges to perform storage related operations. However, Windows currently does not support privileged containers. To solve this problem, [CSI Proxy](https://github.com/kubernetes-csi/csi-proxy) - that runs on the Windows host and executes a set of privileged storage operations on Windows nodes on behalf of containers in a CSI Node plugin daemonset. This enables multiple CSI Node plugin authors to execute privileges storage operations on Windows nodes without having to ship a custom privileged operation proxy (until privileged operations get enabled for containers in Windows in the future).


It would be good to mention somewhere that csi controller level operations/sidecars are not supported on Windows.

"To solve this problem, CSI Proxy is a binary that runs on the Windows host"

msau42 · 2020-09-29T00:55:37Z

book/src/csi-windows.md

+## How to use the CSI Proxy for Windows?
+The CSI Proxy executable - csi-proxy.exe - needs to be deployed and running on all Windows nodes in a cluster - similar to kubelet.exe, dockerd.exe, etc. This may be achieved by enhancing any existing Windows node setup mechanism or script used for installing and configuring dockerd.exe/containerd.exe, kubelet.exe, kubeproxy.exe, etc.
+
+The CSI Proxy executable surfaces a set of named pipes, each corresponding to a specific version of a storage API group. The set of storage API groups supported as of Beta are: Disks, Volumes, SMB, FileSystem. The daemonset specification of a CSI node plugin for Windows can mount the desired named pipes from CSI Proxy based on the version of the API groups that satisfy the privileged operations that the node-plugin needs to execute.


Can we link to the go-client that plugin authors can import into their csi driver? Do we have a sample driver they can use as an example?

we can use gce pd driver as an example

msau42 · 2020-09-29T01:27:11Z

book/src/csi-proxy.md

+
+**Status:** Beta starting with v0.2.0
+
+Status | Min K8s Version | Max K8s Version


Similar to the other component pages, can you add a column for where the community binaries are located?

added, right now only in staging

I will update this after promote to release is available.

Let's update the entry here with v1.0

msau42 · 2020-09-29T01:28:45Z

book/src/csi-windows.md

+Status | Min K8s Version | Max K8s Version
+--|--|--
+Alpha | 1.18 | -
+Beta | 1.19 | -


It would also be good to add a column for which version of node-driver-registrar and csi-proxy are required

msau42 · 2020-09-29T02:00:35Z

book/src/csi-proxy.md

+
+## Deployment
+
+Directly run csi-proxy.exe binary or run it as a Windows Serivce on Kubernetes nodes.


Can you add a note here saying that is it the responsibility of the Kubernetes distribution or cluster admin to install csi-proxy

jingxu97 · 2021-03-13T00:01:54Z

updated it to address comments.
sorry for the long delay.

@msau42 @xing-yang

msau42 · 2021-04-14T04:15:22Z

book/src/csi-proxy.md

+
+CSI Proxy is a binary that exposes a set of gRPC APIs around storage operations over named pipes in Windows. A container, such as CSI node plugins, can mount the named pipes depending on operations it wants to exercise on the host and invoke the APIs.
+
+Each named pipe will support a specific version of an API (e.g. v1alpha1, v2beta1) that targets a specific area of storage (e.g. disk, volume, file, SMB, iSCSI). For example, `\\.\pipe\csi-proxy-filesystem-v1alpha1`, `\\.\pipe\csi-proxy-disk-v1beta1`


Can we open an issue to investigate if we can have some api reference generator?

msau42 · 2021-04-14T04:16:31Z

book/src/csi-proxy.md

+
+Run csi-proxy.exe binary directly on Window node. Command line options
+
+* `-kubelet-csi-plugins-path`: This is the prefix path of the Kubelet plugin directory in the host file system (`C:\var\lib\kubelet` is used by default).


Can you add more details of what this path is used for in the description of this field? The name of this field is also confusing because it's the kubelet root, not the plugins path.

msau42 · 2021-04-14T04:18:10Z

book/src/csi-proxy.md

+
+* `-kubelet-csi-plugins-path`: This is the prefix path of the Kubelet plugin directory in the host file system (`C:\var\lib\kubelet` is used by default).
+
+* `-kubelet-pod-path`: This is the prefix path of the kubelet pod directory in the host file system (`C:\var\lib\kubelet` is used by default).


Can we change this for the GA v1 version? I think this field is a little confusing because pod path is usually "/var/lib/kubelet/pods". Especially because this path and the csi-plugins-path is the same. Can we combine the two options?

msau42 · 2021-04-14T04:23:50Z

book/src/csi-windows.md

+
+Status | Min K8s Version | Min CSI proxy Version | Min Node Driver Registrar Version | latest artifacts
+--|--|--
+Beta | 1.19 | 0.2.0 | 1.3.0 | [binary](gs://k8s-staging-sig-storage/csi-proxy/csi-proxy-master.exe)


For the binary, is it versioned? how do we get v0.2.0 vs v0.3.0?

We also really need to get the binary promotion issue solved. Artifacts in staging are generally automatically deleted after 30 days. We can't have anyone depending on the staging location.

Does the path include the version now?

I would say let's not publish the staging location for now and update this once we get the official version so that we don't have users depending on a staging version that could get garbage collected.

msau42 · 2021-04-14T04:26:06Z

book/src/csi-windows.md

+
+## Overview
+
+CSI drivers (e.g. AzureDisk, GCE PD, etc.) are recommended to be deployed as containers. CSI driver’s node plugin typically runs on every worker node in the cluster (as a DaemonSet). Node plugin containers need to run with elevated privileges to perform storage related operations. However, Windows currently does not support privileged containers. To solve this problem, [CSI Proxy](https://github.com/kubernetes-csi/csi-proxy) - that runs on the Windows host and executes a set of privileged storage operations on Windows nodes on behalf of containers in a CSI Node plugin daemonset. This enables multiple CSI Node plugin authors to execute privileges storage operations on Windows nodes without having to ship a custom privileged operation proxy (until privileged operations get enabled for containers in Windows in the future).


"To solve this problem, CSI Proxy is a binary that runs on the Windows host"

msau42 · 2021-04-14T04:29:14Z

book/src/csi-windows.md

+The CSI Proxy executable surfaces a set of named pipes, each corresponding to a specific version of a storage API group. The set of storage API groups supported as of Beta are: Disks, Volumes, SMB, FileSystem. The daemonset specification of a CSI node plugin for Windows can mount the desired named pipes from CSI Proxy based on the version of the API groups that satisfy the privileged operations that the node-plugin needs to execute.
+
+
+The following daemonset YAML shows how to mount various API groups from CSI Proxy into a CSI Node plugin:


msau42 · 2021-04-14T04:29:38Z

book/src/csi-windows.md

+            type: ""
+        - name: csi-proxy-filesystem-pipe
+          hostPath:
+            path: \\.\pipe\csi-proxy-filesystem-v1alpha1


Why is this still alpha?

msau42 · 2021-04-14T04:30:51Z

book/src/csi-proxy.md

+
+CSI Proxy is a binary that exposes a set of gRPC APIs around storage operations over named pipes in Windows. A container, such as CSI node plugins, can mount the named pipes depending on operations it wants to exercise on the host and invoke the APIs.
+
+Each named pipe will support a specific version of an API (e.g. v1alpha1, v2beta1) that targets a specific area of storage (e.g. disk, volume, file, SMB, iSCSI). For example, `\\.\pipe\csi-proxy-filesystem-v1alpha1`, `\\.\pipe\csi-proxy-disk-v1beta1`


Is there any information we can provide about backwards compatibility of apigroups? How many api versions will csi-proxy support at a time?

csi-proxy support backwards compatibility. So all api versions (alpha, beta, GA) are being supported.

msau42 · 2021-04-14T04:31:49Z

book/src/csi-windows.md

+
+## Status
+
+Status | Min K8s Version | Min CSI proxy Version | Min Node Driver Registrar Version | latest artifacts


When I preview this page, the table formatting does not seem correct

msau42 · 2021-04-14T04:32:31Z

book/src/csi-windows.md

+
+## Overview
+
+CSI drivers (e.g. AzureDisk, GCE PD, etc.) are recommended to be deployed as containers. CSI driver’s node plugin typically runs on every worker node in the cluster (as a DaemonSet). Node plugin containers need to run with elevated privileges to perform storage related operations. However, Windows currently does not support privileged containers. To solve this problem, [CSI Proxy](https://github.com/kubernetes-csi/csi-proxy) - that runs on the Windows host and executes a set of privileged storage operations on Windows nodes on behalf of containers in a CSI Node plugin daemonset. This enables multiple CSI Node plugin authors to execute privileges storage operations on Windows nodes without having to ship a custom privileged operation proxy (until privileged operations get enabled for containers in Windows in the future).


typo: privileges => privileged

msau42 · 2021-04-14T04:34:12Z

/assign @ddebroy
to also help review

jingxu97 · 2021-06-01T21:36:17Z

@msau42 @ddebroy PTAL. Once artifacts promotion is resolved, I will update the doc related to it.

ddebroy

Couple of nits. Thanks for getting this up!

ddebroy · 2021-06-02T00:17:31Z

book/src/csi-proxy.md

+
+## Usage
+
+Run csi-proxy.exe binary directly on Window node. Command line options


nit: on Windows => on a Windows

ddebroy · 2021-06-02T00:19:28Z

book/src/csi-proxy.md

+
+## Deployment
+
+It the responsibility of the Kubernetes distribution or cluster admin to install csi-proxy. Directly run csi-proxy.exe binary or run it as a Windows Serivce on Kubernetes nodes.


nit: Windows Service (spelling).

ddebroy · 2021-06-02T00:22:28Z

book/src/csi-windows.md

+
+## Overview
+
+CSI drivers (e.g. AzureDisk, GCE PD, etc.) are recommended to be deployed as containers. CSI driver’s node plugin typically runs on every worker node in the cluster (as a DaemonSet). Node plugin containers need to run with elevated privileges to perform storage related operations. However, Windows currently does not support privileged containers. To solve this problem, [CSI Proxy](https://github.com/kubernetes-csi/csi-proxy) is a binary that runs on the Windows host and executes a set of privileged storage operations on Windows nodes on behalf of containers in a CSI Node plugin daemonset. This enables multiple CSI Node plugin authors to execute privileged storage operations on Windows nodes without having to ship a custom privileged operation proxy (until privileged operations get enabled for containers in Windows in the future).


However, Windows currently does not support privileged containers => since the PRs for Windows privileged support are now merged, should we say, it is in the process of being introduced?

added a line there

jingxu97 · 2021-07-12T23:22:09Z

ping @msau42 @ddebroy

msau42 · 2021-07-14T16:40:59Z

book/src/csi-proxy.md

+
+Run csi-proxy.exe binary directly on Window node. Command line options
+
+* `-kubelet-csi-plugins-path`: This is the prefix path of the Kubelet plugin directory in the host file system (`C:\var\lib\kubelet` is used by default).


has this been updated for v1?

msau42 · 2021-07-14T16:41:54Z

book/src/csi-proxy.md

+
+* `-windows-service`: Configure as a Windows Service
+
+* `-log_file`: If non-empty, use this log file. (Note: must set `logtostdrr`=false if setting -log_file)


Is this a flag from klog that uses underscores? (vs dashes for the other args)

https://github.com/kubernetes-csi/csi-proxy/blob/master/vendor/k8s.io/klog/v2/klog.go#L427

This is from klog option, not csi-proxy actually

msau42 · 2021-07-14T16:42:50Z

book/src/csi-windows.md

+
+Status | Min K8s Version | Min CSI proxy Version | Min Node Driver Registrar Version | latest artifacts
+--|--|--
+Beta | 1.19 | 0.2.0 | 1.3.0 | [binary](gs://k8s-staging-sig-storage/csi-proxy/csi-proxy-master.exe)


Does the path include the version now?

ddebroy

A few comments to update based on v1 changes.

ddebroy · 2021-07-19T21:27:09Z

book/src/csi-proxy.md

+
+**Status:** Beta starting with v0.2.0
+
+Status | Min K8s Version | Max K8s Version


Let's update the entry here with v1.0

ddebroy · 2021-07-19T21:29:34Z

book/src/csi-proxy.md

+
+Run csi-proxy.exe binary directly on Window node. Command line options
+
+* `-kubelet-csi-plugins-path`: This is the prefix path of the Kubelet plugin directory in the host file system (`C:\var\lib\kubelet` is used by default).


-kubelet-csi-plugins-path and -kubelet-pod-path below should be replaced with (or noted as removed in favor of) -kubelet-pod-path in v1.0.

ddebroy · 2021-07-19T21:31:48Z

book/src/csi-windows.md

+
+## Overview
+
+CSI drivers (e.g. AzureDisk, GCE PD, etc.) are recommended to be deployed as containers. CSI driver’s node plugin typically runs on every worker node in the cluster (as a DaemonSet). Node plugin containers need to run with elevated privileges to perform storage related operations. However, Windows was not supporting privileged containers (Note: privileged containers a.k.a Host process is introduced as alpha feature in Kubernetes 1.22 very recently). To solve this problem, [CSI Proxy](https://github.com/kubernetes-csi/csi-proxy) is a binary that runs on the Windows host and executes a set of privileged storage operations on Windows nodes on behalf of containers in a CSI Node plugin daemonset. This enables multiple CSI Node plugin authors to execute privileged storage operations on Windows nodes without having to ship a custom privileged operation proxy (until privileged operations get enabled for containers in Windows in the future).


couple of nits:
"CSI Node plugin authors to execute" => "CSI Node plugins to execute"
Let's remove "(until privileged operations get enabled for containers in Windows in the future)."

ddebroy · 2021-07-19T21:33:44Z

book/src/csi-windows.md

+            - name: plugin-dir
+              mountPath: C:\csi
+            - name: csi-proxy-disk-pipe
+              mountPath: \\.\pipe\csi-proxy-disk-v1beta2


Let's update the api versions in this example to the latest - v1

jingxu97 · 2021-07-20T05:44:23Z

@msau42 @ddebroy PTAL. THanks!

msau42 · 2021-07-20T20:12:45Z

book/src/csi-proxy.md

+
+Run csi-proxy.exe binary directly on a Window node. Starting from v1.0.0, the command line options are
+
+* -kubelet-path: This is the prefix path of the kubelet directory in the host file system


Can you give an example?

Also add the backticks around the arg.

msau42 · 2021-07-20T20:13:03Z

book/src/csi-proxy.md

+
+## Usage
+
+Run csi-proxy.exe binary directly on a Window node. Starting from v1.0.0, the command line options are


typo: "Windows"

msau42 · 2021-07-20T20:16:07Z

book/src/csi-proxy.md

+
+* `-kubelet-pod-path`: This is the prefix path of the kubelet pod directory in the host file system (`C:\var\lib\kubelet` is used by default).
+
+* `-windows-service`: Configure as a Windows Service


Are these options also available in 1.0? The indenting makes it seem like these options are not available in 1.0 anymore. Maybe for simplicilty, let's remove the detailed entries for the old kubelet path arguments, and just mention in the description for kubelet-path that it replaces kubelet-pod-path and kubelet-csi-plugins-path in previous versions.

msau42 · 2021-07-20T20:17:55Z

book/src/csi-windows.md

+
+Status | Min K8s Version | Min CSI proxy Version | Min Node Driver Registrar Version | latest artifacts
+--|--|--
+Beta | 1.19 | 0.2.0 | 1.3.0 | [binary](gs://k8s-staging-sig-storage/csi-proxy/csi-proxy-master.exe)


I would say let's not publish the staging location for now and update this once we get the official version so that we don't have users depending on a staging version that could get garbage collected.

Add csi-proxy project in docs

msau42 · 2021-07-23T17:53:56Z

/lgtm
/approve

k8s-ci-robot · 2021-07-23T17:54:04Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jingxu97, msau42

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [msau42]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Sep 10, 2020

k8s-ci-robot requested review from saad-ali and xing-yang September 10, 2020 05:46

k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Sep 10, 2020

jingxu97 force-pushed the sep/csiproxy branch 2 times, most recently from 028469f to 0924dbf Compare September 10, 2020 21:28

k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Sep 16, 2020

msau42 reviewed Sep 16, 2020

View reviewed changes

jingxu97 force-pushed the sep/csiproxy branch from 0924dbf to f60223b Compare September 27, 2020 22:34

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Sep 27, 2020

jingxu97 force-pushed the sep/csiproxy branch from f60223b to da6dc02 Compare September 27, 2020 22:42

msau42 reviewed Sep 29, 2020

View reviewed changes

jingxu97 force-pushed the sep/csiproxy branch 2 times, most recently from 2caee7a to 0bb454f Compare December 5, 2020 00:40

jingxu97 mentioned this pull request Feb 1, 2021

Create a "Window Support" Section under "Features" #318

Closed

jingxu97 force-pushed the sep/csiproxy branch from 0bb454f to 1e220bb Compare March 12, 2021 23:29

msau42 reviewed Apr 14, 2021

View reviewed changes

k8s-ci-robot assigned ddebroy Apr 14, 2021

jingxu97 force-pushed the sep/csiproxy branch from 1e220bb to 1d3612f Compare June 1, 2021 21:37

ddebroy reviewed Jun 2, 2021

View reviewed changes

jingxu97 force-pushed the sep/csiproxy branch from 1d3612f to 3e8c450 Compare June 2, 2021 01:25

msau42 reviewed Jul 14, 2021

View reviewed changes

ddebroy reviewed Jul 19, 2021

View reviewed changes

ddebroy mentioned this pull request Jul 19, 2021

Support CSI plugins in Windows kubernetes/enhancements#1122

Closed

jingxu97 force-pushed the sep/csiproxy branch from 3e8c450 to 6cf4f7a Compare July 20, 2021 05:44

msau42 reviewed Jul 20, 2021

View reviewed changes

Add csi-proxy project

93bd708

Add csi-proxy project in docs

jingxu97 force-pushed the sep/csiproxy branch from 6cf4f7a to 93bd708 Compare July 22, 2021 20:52

k8s-ci-robot assigned msau42 Jul 23, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 23, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 23, 2021

k8s-ci-robot merged commit 6d1cc8e into kubernetes-csi:master Jul 23, 2021


		Run csi-proxy.exe binary directly on Window node. Command line options

		* `-kubelet-csi-plugins-path`: This is the prefix path of the Kubelet plugin directory in the host file system (`C:\var\lib\kubelet` is used by default).


		* `-kubelet-csi-plugins-path`: This is the prefix path of the Kubelet plugin directory in the host file system (`C:\var\lib\kubelet` is used by default).

		* `-kubelet-pod-path`: This is the prefix path of the kubelet pod directory in the host file system (`C:\var\lib\kubelet` is used by default).


		CSI Proxy is a binary that exposes a set of gRPC APIs around storage operations over named pipes in Windows. A container, such as CSI node plugins, can mount the named pipes depending on operations it wants to exercise on the host and invoke the APIs.

		Each named pipe will support a specific version of an API (e.g. v1alpha1, v2beta1) that targets a specific area of storage (e.g. disk, volume, file, SMB, iSCSI).


		## Deployment

		Directly run csi-proxy.exe binary or run it as a Windows Serivce.


		## Overview

		CSI drivers (e.g. AzureDisk, GCE PD, etc.) are recommended to be deployed as containers. CSI driver’s node plugin typically runs on every worker node in the cluster (as a DaemonSet). Node plugin containers need to run with elevated privileges to perform storage related operations. However, Windows currently does not support privileged containers. To solve this problem, [CSI Proxy](https://github.com/kubernetes-csi/csi-proxy) - that runs on the Windows host and executes a set of privileged storage operations on Windows nodes on behalf of containers in a CSI Node plugin daemonset. This enables multiple CSI Node plugin authors to execute privileges storage operations on Windows nodes without having to ship a custom privileged operation proxy (until privileged operations get enabled for containers in Windows in the future).


		Status: Beta starting with v0.2.0

		Status \| Min K8s Version \| Max K8s Version

		The CSI Proxy executable surfaces a set of named pipes, each corresponding to a specific version of a storage API group. The set of storage API groups supported as of Beta are: Disks, Volumes, SMB, FileSystem. The daemonset specification of a CSI node plugin for Windows can mount the desired named pipes from CSI Proxy based on the version of the API groups that satisfy the privileged operations that the node-plugin needs to execute.


		The following daemonset YAML shows how to mount various API groups from CSI Proxy into a CSI Node plugin:


		## Status

		Status \| Min K8s Version \| Min CSI proxy Version \| Min Node Driver Registrar Version \| latest artifacts


		## Usage

		Run csi-proxy.exe binary directly on Window node. Command line options


		## Deployment

		It the responsibility of the Kubernetes distribution or cluster admin to install csi-proxy. Directly run csi-proxy.exe binary or run it as a Windows Serivce on Kubernetes nodes.


		* `-windows-service`: Configure as a Windows Service

		* `-log_file`: If non-empty, use this log file. (Note: must set `logtostdrr`=false if setting -log_file)


		Run csi-proxy.exe binary directly on a Window node. Starting from v1.0.0, the command line options are

		* -kubelet-path: This is the prefix path of the kubelet directory in the host file system

Add csi-proxy project #362

Add csi-proxy project #362

Conversation

jingxu97 commented Sep 10, 2020

jingxu97 commented Sep 10, 2020

xing-yang commented Sep 16, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jingxu97 Mar 12, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jingxu97 commented Mar 13, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

msau42 commented Apr 14, 2021

jingxu97 commented Jun 1, 2021

ddebroy left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jingxu97 Mar 12, 2021 •

edited

Loading

jingxu97 commented Mar 13, 2021 •

edited

Loading