kubernetes-sigs / blob-csi-driver / 40876886516

84%

master: 83%

Build Type

Pull #2727

github

Committed by kapilupadhayay

Commit Message

Add opt-in authorization for inline volume Secret reads

Inline (ephemeral) CSI volumes can reference a Kubernetes Secret via
secretName to supply storage account credentials. Today any pod using
an inline volume can read that Secret's contents indirectly, even if
its ServiceAccount has no RBAC permission to read Secrets directly,
because the node plugin (running with cluster-wide Secret read access)
fetches the Secret on the pod's behalf without checking the caller's
own authorization.

This mirrors the fix already shipped in azurefile-csi-driver (PR
#3296).

Add a new node driver flag, --inline-volume-secret-authz, with three
modes:
  - off (default): no behavior change, fully backward compatible.
  - warn: perform a SubjectAccessReview for the pod's ServiceAccount
    and log a warning on denial, without blocking the mount.
  - enforce: deny the mount with PermissionDenied if the pod's
    ServiceAccount cannot "get" the referenced Secret.

The check uses a SubjectAccessReview against the pod's namespace and
ServiceAccount (read from the serviceAccount.name key that kubelet
injects into VolumeContext for ephemeral volumes), requiring the
csi-blob-node ClusterRole to be granted
subjectaccessreviews.authorization.k8s.io create permission.

Only inline volumes are affected; PV-based volumes are unchanged,
since their Secret reference is already subject to the PV/PVC
binding's own RBAC model.

Validated end-to-end on a real AKS cluster across all four mount
protocols (fuse, fuse2, nfs, aznfs): authorized pods mount
successfully, unauthorized pods are blocked in enforce mode, and no
regression was found in any protocol's mount path.

Pull Request Pull Request #2727: Add opt-in authorization for inline volume Secret reads

Coverage Stats

55 of 70 new or added lines in 1 file covered. (78.57%)

125 existing lines in 2 files now uncovered.

3374 of 4045 relevant lines covered (83.41%)

15.01 hits per line