Connectors CSI Driver

TOC

Overview

The Connectors CSI Driver is a storage driver implemented based on the Container Storage Interface (CSI) specification. It can mount configurations from the Connector as volumes into Kubernetes workloads. Key features include:

  • Mounting configuration files from the Connector into Pods
  • Supporting dynamic variable rendering in configuration files to automatically inject runtime information
  • Supporting the simultaneous mounting of multiple configuration files

All configuration data comes from the ConnectorClass configuration associated with the Connector.

Quick Start

1. Create a ConnectorClass

First, create a ConnectorClass that includes Git configuration:

cat << EOF | kubectl apply -f -
apiVersion: connectors.alauda.io/v1alpha1
kind: ConnectorClass
metadata:
  name: my-git
spec:
  address:
    type: string
  configurations:
  - name: config
    data:
      .gitconfig: |
        this is git config
EOF

2. Create a Connector

Then, create a Connector that connects to GitHub:

cat << EOF | kubectl apply -f -
apiVersion: connectors.alauda.io/v1alpha1
kind: Connector
metadata:
  name: git-connector
spec:
  address: https://github.com
  connectorClassName: my-git
EOF

3. Create a Pod Using the CSI Driver

Create a Pod that mounts the configuration:

cat << EOF | kubectl create -f -
apiVersion: v1
kind: Pod
metadata:
  name: csi-demo
  namespace: default
spec:
  restartPolicy: Never
  containers:
  - name: web
    image: bitnami/git:2.47.1
    imagePullPolicy: IfNotPresent
    command: ["sleep", "3600"]
    volumeMounts:
    - name: git-config
      mountPath: /tmp/config
  volumes:
  - name: git-config
    csi:
      readOnly: true
      driver: connectors-csi
      volumeAttributes:
        connector.name: "git-connector"
        connector.namespace: "default"
        configuration.names: "config"
EOF

Verify the mounted files:

# List all mounted files (including built-in configurations)
kubectl exec -ti csi-demo -- ls -l /tmp/config

# View the custom configuration from ConnectorClass
kubectl exec -ti csi-demo -- cat /tmp/config/.gitconfig

Built-in Configurations

The CSI Driver automatically provides built-in configuration files that are always mounted into Pods.

Available Files

File NameDescription
context.tokenAuthentication token for the proxy service
connector.status.proxyAddressProxy address (see connectors-proxy)
http.proxyForward proxy URL with authentication for HTTP
https.proxyForward proxy URL with authentication for HTTPS
context.proxy.caCertCA certificate for the connectors proxy

Usage Examples

Forward proxy (if supported by your CLI and ConnectorClass):

export http_proxy=$(cat /{mount-path}/http.proxy)
export https_proxy=$(cat /{mount-path}/https.proxy)

# Your CLI command

Reverse proxy (if supported by your ConnectorClass):

export TOKEN=$(cat /{mount-path}/context.token)
export SERVER=$(cat /{mount-path}/connector.status.proxyAddress)

# Your CLI command
{cli} --server $SERVER --token $TOKEN

CSI Volume Parameters

Volume Parameters

ParameterRequiredDescription
readOnlyYesMust be true
driverYesMust be connectors-csi

Volume Attributes

ParameterRequiredDescription
connector.nameYesConnector name
connector.namespaceNoConnector namespace (defaults to Pod's namespace)
configuration.namesNoComma-separated configuration names (e.g., config1,config2), the configuration names are the names of the configurations in the ConnectorClass
token.expirationNoToken expiration time (default: 30m)

Examples

Mount a single configuration:

volumes:
- name: config
  csi:
    driver: connectors-csi
    readOnly: true
    volumeAttributes:
      connector.name: "my-connector"
      configuration.names: "config1"

Mount multiple configurations:

volumes:
- name: config
  csi:
    driver: connectors-csi
    readOnly: true
    volumeAttributes:
      connector.name: "my-connector"
      configuration.names: "config1,config2"

Notes:

  • If configuration.names is omitted, only built-in configurations are mounted
  • When multiple configurations contain files with the same name, later configurations overwrite earlier ones

Configuration File Rendering

The CSI Driver performs variable rendering when mounting configuration files, using Go template syntax.

Available Variables

VariableDescription
.connector.status.proxyAddressProxy address of the Connector; refer to connectors-proxy
.connector.spec.*Spec of the Connector, you can get all fields of the Connector Spec, eg. .connector.spec.address or .connector.spec.params
.context.tokenAuthentication token for accessing the proxy service
.context.proxy.caCertCA certificate for accessing the connectors proxy (forward proxy); refer to connectors-proxy

Built-in Functions

Refer to sprig for supported functions

For example: b64enc: Base64 encoding of a string

About the Proxy Service

Connectors provide a proxy service for each Connector, allowing clients to access target resources without needing to store the original credentials. For more details, please refer to connectors-proxy.

Configuration examples

Constant content

apiVersion: connectors.alauda.io/v1alpha1
kind: ConnectorClass
metadata:
  name: my-git
spec:
  address:
    type: string
  configurations:
  - name: config
    data:
      .gitconfig: |
        this is git config

Using connector.spec.params

The following ConnectorClass defines a parameter sslVerify to control the SSL verification during git clone.

kind: ConnectorClass
metadata:
  name: git
spec:

  params:
  - name: sslVerify
    type: string
    default: "true"

  configurations:
  - name: config
    data:
      .gitconfig: |
        {{ $sslVerify := "true" -}}
        {{- range .connector.spec.params }}{{- if eq .name "sslVerify" }}{{$sslVerify = .value }}{{ end }}{{- end }}
        [http]
          sslVerify = {{ $sslVerify }}

Using proxy service and token

The following ConnectorClass provides a file named .gitconfig, which automatically injects headers and replaces the git URL during git clone by using the proxy service and token.

kind: ConnectorClass
metadata:
  name: git
spec:
  configurations:
  - name: config
    data:
      .gitconfig: |
        [http]
            extraHeader = Authorization: Basic {{ printf ":%s" .context.token | b64enc }}
        [url "{{ .connector.status.proxyAddress }}"]
            insteadOf = {{.connector.spec.address}}