KEP-3636 CSI Drivers in Windows as HostProcess Pods

[mauriciopoppe]

• One-line PR description: CSI Proxy go library to run CSI Drivers in Windows as HostProcess Pods

• Issue link: CSI Drivers in Windows as HostProcess Pods #3636

/cc @msau42 @ddebroy @jingxu97

[mauriciopoppe]

/sig storage

[mauriciopoppe]

/cc @jingxu97

[jsturtevant]

/cc @marosset @brasmith-ms

[ameade]

Hey @mauriciopoppe, was nice meeting you briefly at KubeCon. Just some minor comments.

From the code PR, "The named pipes are not protected, this means that not only CSI Drivers but any Windows workload can mount them and execute privileged storage operations (imagine a workload reformatting the volume of another workload ). This is a current problem as of now." I think this is the case for any Pod that mounts a hostPath, windows or otherwise. I guess filesystem permissions help here?

We should mention that hostProcess support is going stable in k8s 1.26 and requires containerd 1.7 (unreleased) as mentioned in the SIG Windows update at KubeCon.

Maybe mention for those that will need to make the conversion about the new small host process base image. bit.ly/hpc-base-image

[mauriciopoppe]

@ameade

From the code PR, "The named pipes are not protected, this means that not only CSI Drivers but any Windows workload can mount them and execute privileged storage operations (imagine a workload reformatting the volume of another workload ). This is a current problem as of now." I think this is the case for any Pod that mounts a hostPath, windows or otherwise. I guess filesystem permissions help here?

You're right on it being a problem in Linux too, I've updated the security part so that there's a suggested workflow for Cluster Administrators to determine the workload privileges per namespace using Pod Security Standards.

We should mention that hostProcess support is going stable in k8s 1.26 and requires containerd 1.7 (unreleased) as mentioned in the SIG Windows update at KubeCon.
Maybe mention for those that will need to make the conversion about the new small host process base image. bit.ly/hpc-base-image

Good points, I'll add them to the doc

[torredil]

Updated graduation criteria and latest revision looks good to me.
/lgtm

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle stale
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle rotten
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[mauriciopoppe]

/remove-lifecycle rotten

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[mauriciopoppe]

I made a few changes to the KEP:

• Completed the section "Feature Enablement and Rollback"
• Deprecation (mentioning that there's no deprecation of the v1 model)

Could you please take a look again @msau42? Also cc @torredil @andyzhangx @laozc, hopefully this goes to "alpha" in 1.35.

[torredil]

/lgtm for the alpha target, thank you @mauriciopoppe!

[torredil]

In a sig-storage meeting, @bswartz advocated for supporting both solutions (existing CSI-proxy, due to security benefits) and HostProcess mode. As I understand it, the current KEP proposes that HostProcess mode be a replacement for CSI-proxy. So I think this is something worth discussing more, seems like a really important decision that we should close on sooner rather than later.

Right now we maintain the HostProcess implementation in a separate branch over at https://github.com/kubernetes-csi/csi-proxy, which may not be ideal in the world where we decide to maintain both solutions.

cc: @msau42

[mauriciopoppe]

Thanks for the comment. I added the following non-goal:

• Deprecate the client/server model - This model is still used by the majority of CSI Driver implementations,
  adopting the new go module model will take time and in the meantime we still plan to maintain
  both models.

Also in the "Deprecation" section:

We plan to maintain both versions (the client/server model and the go library model) because the majority of CSI Drivers use the client/server model. There is no deprecation of the CSI Proxy v1 model.

---

Agreed, it's hard to maintain both solutions in different branches. At some point we made changes in the branches (moved master = v2, branch 1.x = v1) and that broke our internal release pipeline and might have broken other pipelines as well.

I can expand on how the branches will move in a separate document. I don't think we'll have updates in the branch assignments even when we reach GA.

[deads2k]

This is a nice way to document how to leverage this feature for out of tree projects. PRR isn't needed since these projects are out of tree.

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: deads2k, mauriciopoppe

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• keps/prod-readiness/OWNERS [deads2k]
• keps/sig-windows/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mauriciopoppe]

Hey @marosset, this is an overdue KEP that we discussed in Kubecon NA 2022 (3 years ago!). I'd appreciate a review if you have the time, thanks!

/assign @marosset

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle stale
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[mauriciopoppe]

/remove-lifecycle stale