Authorization v2.0

CSM Authorization can be installed by using the provided Helm v3 charts on Kubernetes platforms.

The following CSM Authorization components are installed in the specified namespace:

• proxy-service, which forwards requests from the CSI Driver to the backend storage array
• tenant-service, which configures tenants, role bindings, and generates JSON Web Tokens
• role-service, which configures roles for tenants to be bound to
• storage-service, which configures backend storage arrays for the proxy-server to foward requests to

The following third-party components are installed in the specified namespace:

• redis, which stores data regarding tenants and their volume ownership, quota, and revokation status
• redis-commander, a web management tool for Redis

The following third-party components are optionally installed in the specified namespace:

• cert-manager, which optionally provides a self-signed certificate to configure the CSM Authorization Ingresses
• nginx-ingress-controller, which fulfills the CSM Authorization Ingresses

Install CSM Authorization

Steps

1. Install Vault or configure an existing Vault.

2. Create a namespace where you want to install CSM Authorization.

   kubectl create namespace authorization
   

3. Add the Dell Helm Charts repo

     helm repo add dell https://dell.github.io/helm-charts
   

4. Prepare samples/csm-authorization/config.yaml which contains the JWT signing secret. The following table lists the configuration parameters.

   Parameter	Description	Required	Default
   web.jwtsigningsecret	String used to sign JSON Web Tokens	true	secret

   Example:

   web:
     jwtsigningsecret: randomString123
   

   After editing the file, run the following command to create a secret called karavi-config-secret:

   
   kubectl create secret generic karavi-config-secret -n authorization --from-file=config.yaml=samples/csm-authorization/config.yaml
   

   Use the following command to replace or update the secret:

   
   kubectl create secret generic karavi-config-secret -n authorization --from-file=config.yaml=samples/csm-authorization/config.yaml -o yaml --dry-run=client | kubectl replace -f -
   

5. Copy the default values.yaml file cp charts/csm-authorization-v2.0/values.yaml myvalues.yaml

6. Look over all the fields in myvalues.yaml and fill in/adjust any as needed.

7. Install the driver using helm:

To install CSM Authorization with the service Ingresses using your own certificate, run:

helm -n authorization install authorization -f myvalues.yaml charts/csm-authorization-v2.0 \
--set-file authorization.certificate=<location-of-certificate-file> \
--set-file authorization.privateKey=<location-of-private-key-file>

To install CSM Authorization with the service Ingresses using a self-signed certificate generated via cert-manager, run:

helm -n authorization install authorization -f myvalues.yaml charts/csm-authorization-v2.0

Install Dellctl

Note: Karavictl will not work with Authorization v2.x. Please use dellctl instead.

Follow the instructions for Installing dellctl.

Configuring the CSM Authorization Proxy Server

Follow the instructions available in CSM Authorization for Configuring the CSM Authorization Proxy Server.

Configuring a Dell CSI Driver with CSM for Authorization

Follow the instructions available in CSM Authorization for

• Configuring PowerFlex with Authorization.
• Configuring PowerMax with Authorization.
• Configuring PowerScale with Authorization.

Updating CSM for Authorization Proxy Server Configuration

CSM for Authorization has a subset of configuration parameters that can be updated dynamically:

Updating configuration parameters can be done by editing the karavi-config-secret. The secret can be queried using k3s and kubectl like so:

kubectl -n authorization get secret/karavi-config-secret

To update parameters, you must edit the base64 encoded data in the secret. The karavi-config-secret data can be decoded like so:

kubectl -n authorization get secret/karavi-config-secret -o yaml | grep config.yaml | head -n 1 | awk '{print $2}' | base64 -d

Save the output to a file or copy it to an editor to make changes. Once you are done with the changes, you must encode the data to base64. If your changes are in a file, you can encode it like so:

cat <file> | base64

Copy the new, encoded data and edit the karavi-config-secret with the new data. Run this command to edit the secret:

kubectl -n karavi edit secret/karavi-config-secret

Replace the data in config.yaml under the data field with your new, encoded data. Save the changes and CSM Authorization will read the changed secret.

Note: If you are updating the signing secret, the tenants need to be updated with new tokens via the dellctl generate token command.

CSM for Authorization Proxy Server Dynamic Configuration Settings

Some settings are not stored in the karavi-config-secret but in the csm-config-params ConfigMap, such as LOG_LEVEL and LOG_FORMAT. To update the CSM Authorization logging settings during runtime, run the below command, make your changes, and save the updated configMap data.

kubectl -n authorization edit configmap/csm-config-params

This edit will not update the logging level for the sidecar-proxy containers running in the CSI Driver pods. To update the sidecar-proxy logging levels, you must update the associated CSI Driver ConfigMap in a similar fashion:

kubectl -n [CSM_CSI_DRVIER_NAMESPACE] edit configmap/<release_name>-config-params

Using PowerFlex as an example, kubectl -n vxflexos edit configmap/vxflexos-config-params can be used to update the logging level of the sidecar-proxy and the driver.