kubernetes-csi/csi-driver-nfs

[Feature request] add ssh tunnel support

jear opened this issue · 6 comments

jear commented

I still have SSH tunnel to access NFSv3 mounts.

Typically :

ssh -i /tmp/id_rsa_datafabric.pem -o 'StrictHostKeyChecking no' -4 usr@my-nfs-ip.nip.io -L 2049:localhost:2049 -N -f \
&& ssh -i /tmp/id_rsa_datafabric.pem -o 'StrictHostKeyChecking no' -4 usr@my-nfs-ip.nip.io -L 111:localhost:111 -N -f \
&& mount -v -t nfs -o vers=3,port=2049,nolock,rw,proto=tcp,mountproto=tcp localhost:/my-fabric/my-tenant/my-nfs_vol /mnt/nfs

This solution is requiring privileged securityContext set to true.
To avoid I need to use NFS CSI driver.

The solution would consist to add SSH tunnels support to this CSI project.

Describe alternatives you've considered
https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner
https://stackoverflow.com/questions/64574328/how-to-mount-kerberised-nfs-on-kubernetes
https://docs.docker.com.xy2401.com/ee/ucp/kubernetes/storage/use-nfs-volumes/

oreissig commented

Is this the same as #390?

jear commented

this is indeed similar : the solution should be k8s-distro agnostic ( because users don't necessarily have an account in a public cloud ), i.e. from an IAM perspective, uid/gid is coming from external AD/LDAP...
Today my solution is to store the ssh private key in an external secret management system ( Vault ) and store the token to access Vault in an opaque secret, injected by trusted users.

k8s-triage-robot commented

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle rotten
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot commented

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Reopen this issue with /reopen
  • Mark this issue as fresh with /remove-lifecycle rotten
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

k8s-ci-robot commented

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Reopen this issue with /reopen
  • Mark this issue as fresh with /remove-lifecycle rotten
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.