diff --git a/charts/README.md b/charts/README.md index fa7f1a516e..1f3f647ec7 100644 --- a/charts/README.md +++ b/charts/README.md @@ -121,7 +121,7 @@ The following table lists the configurable parameters of the latest Azure File C | `node.cloudConfigSecretName` | cloud config secret name of node driver | `azure-cloud-provider` | `node.cloudConfigSecretNamespace` | cloud config secret namespace of node driver | `kube-system` | `node.allowEmptyCloudConfig` | Whether allow running node driver without cloud config | `true` -| `node.allowInlineVolumeKeyAccessWithIdentity` | Whether allow accessing storage account key using cluster identity for inline volume | `false` +| `node.allowInlineVolumeKeyAccessWithIdentity` | Whether allow accessing storage account key using cluster identity for inline volume. It will be removed in future release as inline volumes no longer support identity-based key access | `false` | `node.maxUnavailable` | `maxUnavailable` value of driver node daemonset | `1` | `node.livenessProbe.healthPort ` | health check port for liveness probe | `29613` | | `node.nodeDriverRegistrar.healthPort` | health check port for node-driver-registrar liveness probe | `29617` | diff --git a/charts/latest/azurefile-csi-driver-v0.0.0.tgz b/charts/latest/azurefile-csi-driver-v0.0.0.tgz index 576e199e45..e4a9aa585a 100644 Binary files a/charts/latest/azurefile-csi-driver-v0.0.0.tgz and b/charts/latest/azurefile-csi-driver-v0.0.0.tgz differ diff --git a/charts/latest/azurefile-csi-driver/templates/NOTES.txt b/charts/latest/azurefile-csi-driver/templates/NOTES.txt index e606367edb..7aca7b0ec2 100644 --- a/charts/latest/azurefile-csi-driver/templates/NOTES.txt +++ b/charts/latest/azurefile-csi-driver/templates/NOTES.txt @@ -3,3 +3,8 @@ The Azure File CSI Driver is getting deployed to your cluster. To check Azure File CSI Driver pods status, please run: kubectl --namespace={{ .Release.Namespace }} get pods --selector="app.kubernetes.io/instance={{ .Release.Name }}" --watch +{{- if .Values.node.allowInlineVolumeKeyAccessWithIdentity }} + +{{ "\033[33m" }}WARNING: 'allowInlineVolumeKeyAccessWithIdentity' will be deprecated in a future release. + Inline volumes will no longer support identity-based key access.{{ "\033[0m" }} +{{- end }} diff --git a/charts/latest/azurefile-csi-driver/templates/csi-azurefile-node-windows.yaml b/charts/latest/azurefile-csi-driver/templates/csi-azurefile-node-windows.yaml index afabb32002..d4150b7c27 100644 --- a/charts/latest/azurefile-csi-driver/templates/csi-azurefile-node-windows.yaml +++ b/charts/latest/azurefile-csi-driver/templates/csi-azurefile-node-windows.yaml @@ -134,7 +134,7 @@ spec: - "--user-agent-suffix={{ .Values.driver.userAgentSuffix }}" - "--allow-empty-cloud-config={{ .Values.node.allowEmptyCloudConfig }}" - "--enable-get-volume-stats={{ .Values.feature.enableGetVolumeStats }}" - - "--allow-inline-volume-key-access-with-identity={{ .Values.node.allowInlineVolumeKeyAccessWithIdentity }}" + - "--allow-inline-volume-key-access-with-identity={{ .Values.node.allowInlineVolumeKeyAccessWithIdentity }}" # It will be removed in future release. - "--metrics-address=0.0.0.0:{{ .Values.node.metricsPort }}" ports: - containerPort: {{ .Values.node.livenessProbe.healthPort }} diff --git a/charts/latest/azurefile-csi-driver/templates/csi-azurefile-node.yaml b/charts/latest/azurefile-csi-driver/templates/csi-azurefile-node.yaml index 2b087c922c..f282347e62 100644 --- a/charts/latest/azurefile-csi-driver/templates/csi-azurefile-node.yaml +++ b/charts/latest/azurefile-csi-driver/templates/csi-azurefile-node.yaml @@ -208,7 +208,7 @@ spec: - "--enable-volume-mount-group={{ .Values.feature.enableVolumeMountGroup }}" - "--enable-get-volume-stats={{ .Values.feature.enableGetVolumeStats }}" - "--mount-permissions={{ .Values.linux.mountPermissions }}" - - "--allow-inline-volume-key-access-with-identity={{ .Values.node.allowInlineVolumeKeyAccessWithIdentity }}" + - "--allow-inline-volume-key-access-with-identity={{ .Values.node.allowInlineVolumeKeyAccessWithIdentity }}" # It will be removed in future release. - "--metrics-address=0.0.0.0:{{ .Values.node.metricsPort }}" - "--enable-kata-cc-mount={{ .Values.node.enableKataCCMount }}" livenessProbe: diff --git a/charts/latest/azurefile-csi-driver/values.yaml b/charts/latest/azurefile-csi-driver/values.yaml index a2e205120b..7a6e8de5c5 100644 --- a/charts/latest/azurefile-csi-driver/values.yaml +++ b/charts/latest/azurefile-csi-driver/values.yaml @@ -126,7 +126,7 @@ node: cloudConfigSecretName: azure-cloud-provider cloudConfigSecretNamespace: kube-system allowEmptyCloudConfig: true - allowInlineVolumeKeyAccessWithIdentity: false + allowInlineVolumeKeyAccessWithIdentity: false # It will be removed in future release. enableKataCCMount: false enableManagedIdentityAuth: true metricsPort: 29615 diff --git a/pkg/azurefile/azurefile.go b/pkg/azurefile/azurefile.go index f1051b665b..352b4e7279 100644 --- a/pkg/azurefile/azurefile.go +++ b/pkg/azurefile/azurefile.go @@ -338,6 +338,9 @@ func NewDriver(options *DriverOptions) *Driver { driver.userAgentSuffix = options.UserAgentSuffix driver.allowEmptyCloudConfig = options.AllowEmptyCloudConfig driver.allowInlineVolumeKeyAccessWithIdentity = options.AllowInlineVolumeKeyAccessWithIdentity + if options.AllowInlineVolumeKeyAccessWithIdentity { + klog.Warning("allow-inline-volume-key-access-with-identity will be deprecated in future releases (in future release it will be no-op even flag is set); in future inline volumes no longer support identity-based key access") + } driver.enableVHDDiskFeature = options.EnableVHDDiskFeature driver.enableVolumeMountGroup = options.EnableVolumeMountGroup driver.enableGetVolumeStats = options.EnableGetVolumeStats diff --git a/pkg/azurefile/azurefile_options.go b/pkg/azurefile/azurefile_options.go index 998293ff6d..f47e81080a 100644 --- a/pkg/azurefile/azurefile_options.go +++ b/pkg/azurefile/azurefile_options.go @@ -70,7 +70,7 @@ func (o *DriverOptions) AddFlags() *flag.FlagSet { fs.StringVar(&o.CustomUserAgent, "custom-user-agent", "", "custom userAgent") fs.StringVar(&o.UserAgentSuffix, "user-agent-suffix", "", "userAgent suffix") fs.BoolVar(&o.AllowEmptyCloudConfig, "allow-empty-cloud-config", true, "allow running driver without cloud config") - fs.BoolVar(&o.AllowInlineVolumeKeyAccessWithIdentity, "allow-inline-volume-key-access-with-identity", false, "allow accessing storage account key using cluster identity for inline volume") + fs.BoolVar(&o.AllowInlineVolumeKeyAccessWithIdentity, "allow-inline-volume-key-access-with-identity", false, "allow accessing storage account key using cluster identity for inline volume. It will be DEPRECATED in future release as inline volume will no longer support identity-based key access") fs.BoolVar(&o.EnableVHDDiskFeature, "enable-vhd", true, "enable VHD disk feature (experimental)") fs.BoolVar(&o.EnableVolumeMountGroup, "enable-volume-mount-group", true, "indicates whether enabling VOLUME_MOUNT_GROUP") fs.BoolVar(&o.EnableGetVolumeStats, "enable-get-volume-stats", true, "allow GET_VOLUME_STATS on agent node")