ScaleIO - Secret to be stored in/loaded from a static namespace

[vladimirvivien]

What this PR does / why we need it:
This PR is to decouple the ScaleIO secret from the same namespace as that of the PV/PVC/Storageclass that uses it (#53619). Currently, authorized non-admin k8s user, who creates volumes, may end up having unauthorized access to ScaleIO secret information. This PR assumes all ScaleIO secrets are assigned to a namespace called scaleio that is protected from non-admin users.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #53619

Special notes for your reviewer:

Release note:

NONE

[k8s-ci-robot]

Hi @vladimirvivien. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[k8s-github-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vladimirvivien
We suggest the following additional approver: gnufied

Assign the PR to them by writing /assign @gnufied in a comment when ready.

Associated issue: 53619

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

• pkg/volume/OWNERS

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[vladimirvivien]

/ok-to-test

[k8s-ci-robot]

@vladimirvivien: you can't request testing unless you are a kubernetes member.

In response to this:

/ok-to-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[liggitt]

the same comment as #53622 (comment) applies here. this change has a few problems:

1. it is not backwards compatible (it breaks existing volumes that use secrets in the pod namespace)
2. it hardcodes a namespace which cannot be assumed to be available

the approach outlined in #53622 (comment) is what should be followed to enable detaching mount credentials from the pod namespace.

[vladimirvivien]

@liggitt
Thank you for the feedback. However, we're pursuing this fix as immediate solution for customers who are using the k8s with scaleio and are asking for it right now. We are aware of the customers using k8s+scaleio and plan to manage any backward compatibility issues using many channels including update to the documentation.

Part of any upgrade/setup directions will:

• include instructions to set up the namespace ahead of time (as is the case now).
• Update the doc accordingly to include the static name for the namespace
• Prescribe ways to handle any backward compatibility issues upon changing k8s versions

Lastly, we're pursuing this simple approach in hope of getting this cherry-picked for previous k8s release. We are planning on implementing the full API object update in a future PR.

[liggitt]

cc @rootfs
for work on similar issues in other volume plugins (including WIP #51530)

[k8s-github-robot]

@vladimirvivien PR needs rebase

[thockin]

Assign back to me once it is LGTM'ed and ready for approval.