kubernetes-sigs / kubernetes-sigs/container-object-storage-interface
mechanism for drivers to indicate that an access needs re-reconciled at a given date/time
- Dominant language
- Go
- Stars
- 95
- Forks
- 44
- Avg merge
- 8h 12m
- Merged PRs (30d)
- 4
Description
# Enhancement
**Is your feature request related to a problem?/Why is this needed**
Some object storage backends have automatic credential rotation for accesses. After an automatic rotation, COSI's stored credentials will fail to work. COSI should update the secret containing credentials after the rotation so that user apps can continue operating healthily.
**Describe the solution you'd like in detail**
COSI should provide an interface that allows drivers to indicate a desire to re-reconcile certain accesses at/after a given time.
Alternatively, (possibly preferably) COSI could implement a more generic API that would allow a driver to request the controller re-reconcile any access(es) by name/ID. This would allow drivers to re-reconcile after internal updates of any kind, even those not tied to a known timeframe.
**Describe alternatives you've considered**
A possible workaround could be to have drivers reboot their own pod when any access (or bucket) needs updated. This is an unfortunately blunt mechanism but a viable workaround while COSI works on an API and implementation details for this.
**Additional context**
n/a
Contributor guide
Research direction
Start by reviewing the COSI access and driver/controller API boundaries described in the issue, along with how stored credentials are reconciled. Define what a driver-triggered reconciliation request must identify and when it should occur, then document the behavior needed to keep rotated credentials available to user applications.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100