Connectors CSI Driver
TOC
Overview
The Connectors CSI Driver is a storage driver implemented based on the Container Storage Interface (CSI) specification. It can mount configurations from the Connector as volumes into Kubernetes workloads. Key features include:
- Mounting configuration files from the Connector into Pods
- Supporting dynamic variable rendering in configuration files to automatically inject runtime information
- Supporting the simultaneous mounting of multiple configuration files
All configuration data comes from the ConnectorClass configuration associated with the Connector.
Quick Start
1. Create a ConnectorClass
First, create a ConnectorClass that includes Git configuration:
cat << EOF | kubectl apply -f -
apiVersion: connectors.alauda.io/v1alpha1
kind: ConnectorClass
metadata:
name: my-git
spec:
address:
type: string
configurations:
- name: config
data:
.gitconfig: |
this is git config
EOF
2. Create a Connector
Then, create a Connector that connects to GitHub:
cat << EOF | kubectl apply -f -
apiVersion: connectors.alauda.io/v1alpha1
kind: Connector
metadata:
name: git-connector
spec:
address: https://github.com
connectorClassName: my-git
EOF
3. Create a Pod Using the CSI Driver
Create a Pod that mounts the configuration:
cat << EOF | kubectl create -f -
apiVersion: v1
kind: Pod
metadata:
name: csi-demo
namespace: default
spec:
restartPolicy: Never
containers:
- name: web
image: bitnami/git:2.47.1
imagePullPolicy: IfNotPresent
command: ["sleep", "3600"]
volumeMounts:
- name: git-config
mountPath: /tmp/config
volumes:
- name: git-config
csi:
readOnly: true
driver: connectors-csi
volumeAttributes:
connector.name: "git-connector"
connector.namespace: "default"
configuration.names: "config"
EOF
Verify the mounted files:
# List all mounted files (including built-in configurations)
kubectl exec -ti csi-demo -- ls -l /tmp/config
# View the custom configuration from ConnectorClass
kubectl exec -ti csi-demo -- cat /tmp/config/.gitconfig
Built-in Configurations
The CSI Driver automatically provides built-in configuration files that are always mounted into Pods.
Available Files
| File Name | Description |
|---|
context.token | Authentication token for the proxy service |
connector.status.proxyAddress | Proxy address (see connectors-proxy) |
http.proxy | Forward proxy URL with authentication for HTTP |
https.proxy | Forward proxy URL with authentication for HTTPS |
context.proxy.caCert | CA certificate for the connectors proxy |
Usage Examples
Forward proxy (if supported by your CLI and ConnectorClass):
export http_proxy=$(cat /{mount-path}/http.proxy)
export https_proxy=$(cat /{mount-path}/https.proxy)
# Your CLI command
Reverse proxy (if supported by your ConnectorClass):
export TOKEN=$(cat /{mount-path}/context.token)
export SERVER=$(cat /{mount-path}/connector.status.proxyAddress)
# Your CLI command
{cli} --server $SERVER --token $TOKEN
CSI Volume Parameters
Volume Parameters
| Parameter | Required | Description |
|---|
| readOnly | Yes | Must be true |
| driver | Yes | Must be connectors-csi |
Volume Attributes
| Parameter | Required | Description |
|---|
| connector.name | Yes | Connector name |
| connector.namespace | No | Connector namespace (defaults to Pod's namespace) |
| configuration.names | No | Comma-separated configuration names (e.g., config1,config2), the configuration names are the names of the configurations in the ConnectorClass |
| token.expiration | No | Token expiration time (default: 30m) |
Examples
Mount a single configuration:
volumes:
- name: config
csi:
driver: connectors-csi
readOnly: true
volumeAttributes:
connector.name: "my-connector"
configuration.names: "config1"
Mount multiple configurations:
volumes:
- name: config
csi:
driver: connectors-csi
readOnly: true
volumeAttributes:
connector.name: "my-connector"
configuration.names: "config1,config2"
Notes:
- If
configuration.names is omitted, only built-in configurations are mounted
- When multiple configurations contain files with the same name, later configurations overwrite earlier ones
Configuration File Rendering
The CSI Driver performs variable rendering when mounting configuration files, using Go template syntax.
Available Variables
| Variable | Description |
|---|
.connector.status.proxyAddress | Proxy address of the Connector; refer to connectors-proxy |
.connector.spec.* | Spec of the Connector, you can get all fields of the Connector Spec, eg. .connector.spec.address or .connector.spec.params |
.context.token | Authentication token for accessing the proxy service |
.context.proxy.caCert | CA certificate for accessing the connectors proxy (forward proxy); refer to connectors-proxy |
Built-in Functions
Refer to sprig for supported functions
For example: b64enc: Base64 encoding of a string
About the Proxy Service
Connectors provide a proxy service for each Connector, allowing clients to access target resources without needing to store the original credentials. For more details, please refer to connectors-proxy.
Configuration examples
Constant content
apiVersion: connectors.alauda.io/v1alpha1
kind: ConnectorClass
metadata:
name: my-git
spec:
address:
type: string
configurations:
- name: config
data:
.gitconfig: |
this is git config
Using connector.spec.params
The following ConnectorClass defines a parameter sslVerify to control the SSL verification during git clone.
kind: ConnectorClass
metadata:
name: git
spec:
params:
- name: sslVerify
type: string
default: "true"
configurations:
- name: config
data:
.gitconfig: |
{{ $sslVerify := "true" -}}
{{- range .connector.spec.params }}{{- if eq .name "sslVerify" }}{{$sslVerify = .value }}{{ end }}{{- end }}
[http]
sslVerify = {{ $sslVerify }}
Using proxy service and token
The following ConnectorClass provides a file named .gitconfig, which automatically injects headers and replaces the git URL during git clone by using the proxy service and token.
kind: ConnectorClass
metadata:
name: git
spec:
configurations:
- name: config
data:
.gitconfig: |
[http]
extraHeader = Authorization: Basic {{ printf ":%s" .context.token | b64enc }}
[url "{{ .connector.status.proxyAddress }}"]
insteadOf = {{.connector.spec.address}}