Skip to content

Simplify Auth v2 deployment by removing karavi-authorization-config Secret requirement #1672

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Oct 7, 2025
Merged

Simplify Auth v2 deployment by removing karavi-authorization-config Secret requirement #1672

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
c8f3ada
remove karavi-authorization-config secret
shaynafinocchiaro Aug 4, 2025
fdf5a26
update upgrade pages
shaynafinocchiaro Sep 23, 2025
47d1cbd
update powermax
shaynafinocchiaro Sep 23, 2025
90c9bf1
updates
shaynafinocchiaro Sep 23, 2025
be42f53
Docs update
santhoshatdell Sep 24, 2025
d478d44
Resolved merge conflict
santhoshatdell Oct 2, 2025
55c4547
Resolved merge conflict
santhoshatdell Oct 2, 2025
a9b3d7f
Merge branch 'main' into auth-condense-secret1
santhoshatdell Oct 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 8 additions & 30 deletions content/docs/concepts/authorization/v2.x/configuration/powerflex/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,29 +19,7 @@ Given a setup where Kubernetes, a storage system, and the Authorization Proxy Se

This takes the assumption that Powerflex will be installed in the `vxflexos` namespace.

2. Edit these parameters in `samples/secret/karavi-authorization-config.json` file in the [CSI PowerFlex](https://github.com/dell/csi-powerflex/tree/main/samples/secret/karavi-authorization-config.json) driver and update/add connection information for one or more backend storage arrays. In an instance where multiple CSI drivers are configured on the same Kubernetes cluster, the port range in the *endpoint* parameter must be different for each driver.

{{< collapse id="1" title="Parameters">}}
| Parameter | Description | Required | Default |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------ |
| username | Username for connecting to the backend storage array. This parameter is ignored. | No | - |
| password | Password for connecting to to the backend storage array. This parameter is ignored. | No | - |
| intendedEndpoint | HTTPS REST API endpoint of the backend storage array. | Yes | - |
| endpoint | HTTPS localhost endpoint that the authorization sidecar will listen on. | Yes | https://localhost:9400 |
| systemID | System ID of the backend storage array. | Yes | " " |
| skipCertificateValidation | A boolean that enables/disables certificate validation of the backend storage array. This parameter is not used. | No | true |
| isDefault | A boolean that indicates if the array is the default array. This parameter is not used. | No | default value from values.yaml |
{{< /collapse >}}
<ul style="list-style-type: none;">
<li>Create the karavi-authorization-config secret using this command:

```bash
kubectl -n vxflexos create secret generic karavi-authorization-config --from-file=config=samples/secret/karavi-authorization-config.json -o yaml --dry-run=client | kubectl apply -f -
```
</li>
</ul>

3. Create the proxy-server-root-certificate secret.
2. Create the proxy-server-root-certificate secret.

If running in *insecure* mode, create the secret with empty data:

Expand All @@ -55,17 +33,17 @@ Given a setup where Kubernetes, a storage system, and the Authorization Proxy Se
kubectl -n vxflexos create secret generic proxy-server-root-certificate --from-file=rootCertificate.pem=/path/to/rootCA -o yaml --dry-run=client | kubectl apply -f -
```

4. Prepare the driver configuration secret, applicable to your driver installation method, to communicate with the Container Storage Modules Authorization sidecar.
3. Prepare the driver configuration secret, applicable to your driver installation method, to communicate with the Container Storage Modules Authorization sidecar.

**Operator**

Refer to the [Create Secret](../../../../../getting-started/installation/kubernetes/powerflex/csmoperator/#create-secret) section to prepare `secret.yaml` to configure the driver to communicate with the Authorization sidecar.

- Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`.
- Update `endpoint` to an HTTPS localhost endpoint that the authorization sidecar will listen on.

- Update `skipCertificateValidation` to `true`.

- The `username` and `password` can be any value since they will be ignored.
- The `username` and `password` fields are not used during authentication and can be set to any value.

Example:

Expand All @@ -83,11 +61,11 @@ Given a setup where Kubernetes, a storage system, and the Authorization Proxy Se

Refer to the [Install the Driver](../../../../../getting-started/installation/kubernetes/powerflex/helm/#install-driver) section to edit the parameters in `samples/config.yaml` to configure the driver to communicate with Authorization sidecar.

- Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`.
- Update `endpoint` to an HTTPS localhost endpoint that the authorization sidecar will listen on.

- Update `skipCertificateValidation` to `true`.

- The `username` and `password` can be any value since they will be ignored.
- The `username` and `password` fields are not used during authentication and can be set to any value.

Example:

Expand All @@ -101,7 +79,7 @@ Given a setup where Kubernetes, a storage system, and the Authorization Proxy Se
mdm: "10.0.0.3,10.0.0.4"
```

5. Enable Container Storage Modules Authorization in the driver installation applicable to your installation method.
4. Enable Container Storage Modules Authorization in the driver installation applicable to your installation method.
Alternatively, you can use the minimal sample files provided in respective CSM versions folder under samples [here](https://github.com/dell/csm-operator/tree/main/samples) and install the module using default value.

**Operator**
Expand Down Expand Up @@ -176,4 +154,4 @@ Given a setup where Kubernetes, a storage system, and the Authorization Proxy Se
skipCertificateValidation: true
```

1. Install the CSI PowerFlex driver following the appropriate documentation for your installation method.
5. Install the CSI PowerFlex driver following the appropriate documentation for your installation method.
40 changes: 13 additions & 27 deletions content/docs/concepts/authorization/v2.x/configuration/powermax/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,25 +20,7 @@ Given a setup where Kubernetes, a storage system, and the Container Storage Modu

This takes the assumption that PowerMax will be installed in the `powermax` namespace.

2. Edit these parameters in `samples/secret/karavi-authorization-config.json` file in the [CSI PowerMax](https://github.com/dell/csi-powermax/tree/main/samples/secret/karavi-authorization-config.json) driver and update/add connection information for one or more backend storage arrays. In an instance where multiple CSI drivers are configured on the same Kubernetes cluster, the port range in the *endpoint* parameter must be different for each driver.

| Parameter | Description | Required | Default |
| --------- | ----------- | -------- |-------- |
| username | Username for connecting to the backend storage array. This parameter is ignored. | No | - |
| password | Password for connecting to to the backend storage array. This parameter is ignored. | No | - |
| intendedEndpoint | HTTPS REST API endpoint of the backend storage array. | Yes | - |
| endpoint | HTTPS localhost endpoint that the authorization sidecar will listen on. | Yes | https://localhost:9400 |
| systemID | System ID of the backend storage array. | Yes | " " |
| skipCertificateValidation | A boolean that enables/disables certificate validation of the backend storage array. This parameter is not used. | No | true |
| isDefault | A boolean that indicates if the array is the default array. This parameter is not used. | No | default value from values.yaml |

Create the karavi-authorization-config secret using this command:

```bash
kubectl -n powermax create secret generic karavi-authorization-config --from-file=config=samples/secret/karavi-authorization-config.json -o yaml --dry-run=client | kubectl apply -f -
```

3. Create the proxy-server-root-certificate secret.
2. Create the proxy-server-root-certificate secret.

If running in *insecure* mode, create the secret with empty data:

Expand All @@ -52,13 +34,15 @@ Given a setup where Kubernetes, a storage system, and the Container Storage Modu
kubectl -n powermax create secret generic proxy-server-root-certificate --from-file=rootCertificate.pem=/path/to/rootCA -o yaml --dry-run=client | kubectl apply -f -
```

4. Prepare the driver configuration secret, applicable to your driver installation method, to communicate with Authorization sidecar.
3. Prepare the driver configuration secret, applicable to your driver installation method, to communicate with Authorization sidecar.

**Operator**

Refer to the [Install Driver](../../../../../getting-started/installation/kubernetes/powermax/csmoperator/#install-driver) section to prepare `powermax-creds.yaml` to configure the driver to communicate with Authorization sidecar.

Update endpoint to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`. Leave `username` and `password` with the default values base64 encoded.
- Update `primaryEndpoint` and `endpoint` to an HTTPS localhost endpoint that the authorization sidecar will listen on.

- The `username` and `password` fields are not used during authentication and can be set to any value.

**Note:** Authorization does not currently support the `backupEndpoint` parameter.

Expand All @@ -83,7 +67,9 @@ Given a setup where Kubernetes, a storage system, and the Container Storage Modu

Refer to the [Install the Driver](../../../../../getting-started/installation/kubernetes/powermax/helm/#install-driver) section where you edit `samples/secret/secret.yaml` with the credentials of the PowerMax.

Update endpoint to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`. Leave `username` and `password` with the default values base64 encoded.
- Update `primaryEndpoint` and `endpoint` to an HTTPS localhost endpoint that the authorization sidecar will listen on.

- The `username` and `password` fields are not used during authentication and can be set to any value.

**Note:** Authorization does not currently support the `backupEndpoint` parameter.

Expand All @@ -104,7 +90,7 @@ Given a setup where Kubernetes, a storage system, and the Container Storage Modu
maxOutstandingWrite: 10
```

5. **Operator Only**: Prepare the reverse proxy configMap using sample [here](https://github.com/dell/csm-operator/blob/main/samples/csireverseproxy/config.yaml). Fill in the appropriate values for driver configuration.
4. **Operator Only**: Prepare the reverse proxy configMap using sample [here](https://github.com/dell/csm-operator/blob/main/samples/csireverseproxy/config.yaml). Fill in the appropriate values for driver configuration.
Example: config.yaml
```yaml
port: 2222
Expand All @@ -122,7 +108,7 @@ Given a setup where Kubernetes, a storage system, and the Container Storage Modu
skipCertificateValidation: true
```

6. Enable Container Storage Modules Authorization in the driver installation applicable to your installation method.
5. Enable Container Storage Modules Authorization in the driver installation applicable to your installation method.
Alternatively, you can use the minimal sample files provided in respective CSM versions folder under samples [here](https://github.com/dell/csm-operator/tree/main/samples) and install the module using default value.

**Operator**
Expand Down Expand Up @@ -195,9 +181,9 @@ Given a setup where Kubernetes, a storage system, and the Container Storage Modu

Refer to the [Install the Driver](../../../../../getting-started/installation/kubernetes/powermax/helm/#install-driver) section to edit the parameters in `my-powermax-settings.yaml` file to configure the driver to communicate with Authorization sidecar.

- Update `global.storageArrays.endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`.
- Update `global.storageArrays.endpoint` to an HTTPS localhost endpoint that the authorization sidecar will listen on.

- Update `global.managementServers.endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`.
- Update `global.managementServers.endpoint` to an HTTPS localhost endpoint that the authorization sidecar will listen on.

- Update `authorization.enabled` to `true`.

Expand Down Expand Up @@ -241,4 +227,4 @@ Given a setup where Kubernetes, a storage system, and the Container Storage Modu
skipCertificateValidation: true
```

7. Install the Dell CSI PowerMax driver following the appropriate documentation for your installation method.
6. Install the Dell CSI PowerMax driver following the appropriate documentation for your installation method.
38 changes: 12 additions & 26 deletions content/docs/concepts/authorization/v2.x/configuration/powerscale/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,25 +20,7 @@ Given a setup where Kubernetes, a storage system, and the Container Storage Modu

This takes the assumption that PowerScale will be installed in the `isilon` namespace.

2. Edit these parameters in `samples/secret/karavi-authorization-config.json` file in [CSI PowerScale](https://github.com/dell/csi-powerscale/tree/main/samples/secret/karavi-authorization-config.json) driver and update/add connection information for one or more backend storage arrays. In an instance where multiple CSI drivers are configured on the same Kubernetes cluster, the port range in the *endpoint* parameter must be different for each driver.

| Parameter | Description | Required | Default |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------ |
| username | Username for connecting to the backend storage array. This parameter is ignored. | No | - |
| password | Password for connecting to to the backend storage array. This parameter is ignored. | No | - |
| intendedEndpoint | HTTPS REST API endpoint of the backend storage array. | Yes | - |
| endpoint | HTTPS localhost endpoint that the authorization sidecar will listen on. | Yes | https://localhost:9400 |
| systemID | Cluster name of the backend storage array. | Yes | " " |
| skipCertificateValidation | A boolean that enables/disables certificate validation of the backend storage array. This parameter is not used. | No | true |
| isDefault | A boolean that indicates if the array is the default array. This parameter is not used. | No | default value from values.yaml |

Create the karavi-authorization-config secret using this command:

```bash
kubectl -n isilon create secret generic karavi-authorization-config --from-file=config=samples/secret/karavi-authorization-config.json -o yaml --dry-run=client | kubectl apply -f -
```

3. Create the proxy-server-root-certificate secret.
2. Create the proxy-server-root-certificate secret.

If running in *insecure* mode, create the secret with empty data:

Expand All @@ -52,19 +34,21 @@ Given a setup where Kubernetes, a storage system, and the Container Storage Modu
kubectl -n isilon create secret generic proxy-server-root-certificate --from-file=rootCertificate.pem=/path/to/rootCA -o yaml --dry-run=client | kubectl apply -f -
```

4. Prepare the driver configuration secret, applicable to your driver installation method, to communicate with Authorization sidecar.
3. Prepare the driver configuration secret, applicable to your driver installation method, to communicate with Authorization sidecar.

**Operator**

Refer to the [Prerequisite](../../../../../getting-started/installation/kubernetes/powerscale/csmoperator/#install-driver) section to prepare the `secret.yaml` file to configure the driver to communicate with the CSM Authorization sidecar.

- Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`.
- Update `endpoint` to an HTTPS localhost endpoint that the authorization sidecar will listen on.

- Update `endpointPort` to the port that the authorization sidecar will listen on.

- Update `mountEndpoint` to the PowerScale OneFS API server. For example, 10.0.0.1.

- Update `skipCertificateValidation` to `true`.

- The `username` and `password` can be any value since they will be ignored.
- The `username` and `password` fields are not used during authentication and can be set to any value.

Example:

Expand All @@ -84,13 +68,15 @@ Given a setup where Kubernetes, a storage system, and the Container Storage Modu

Refer to the [Install the Driver](../../../../../getting-started/installation/kubernetes/powerscale/helm/#install-driver) section to edit the parameters to prepare the `samples/secret/secret.yaml` file to configure the driver to communicate with Authorization sidecar.

- Update `endpoint` to match the localhost endpoint in `samples/secret/karavi-authorization-config.json`.
- Update `endpoint` to an HTTPS localhost endpoint that the authorization sidecar will listen on.

- Update `endpointPort` to the port that the authorization sidecar will listen on.

- Update `mountEndpoint` to the PowerScale OneFS API server. For example, 10.0.0.1.

- Update `skipCertificateValidation` to `true`.

- The `username` and `password` can be any value since they will be ignored.
- The `username` and `password` fields are not used during authentication and can be set to any value.

Example:

Expand All @@ -106,7 +92,7 @@ Given a setup where Kubernetes, a storage system, and the Container Storage Modu
skipCertificateValidation: true
```

5. Enable Container Storage Modules Authorization in the driver installation applicable to your installation method.
4. Enable Container Storage Modules Authorization in the driver installation applicable to your installation method.

**Operator**

Expand Down Expand Up @@ -178,4 +164,4 @@ Given a setup where Kubernetes, a storage system, and the Container Storage Modu
skipCertificateValidation: true
```

6. Install the Dell CSI PowerScale driver following the appropriate documentation for your installation method.
5. Install the Dell CSI PowerScale driver following the appropriate documentation for your installation method.
Loading
Loading