pod2daemon

pod2daemon enables secure communication between a Kubernetes pod and a daemon (e.g. created with a DaemonSet) running on the host. It creates a Kubernetes FlexVolume Driver type nodeagent/uds to enable Nodeagent to verify the identity of a workload. A Flexvolume driver type nodeagent/uds is added to each workload and when such a workload is created, with the volume type mounted, the Nodeagent is notified by the Flexvolume driver. The workloadhandler creates a Unix Domain Socket (UDS) per workload and then initializes the workloadAPI Grpc Server (see below). The workloadAPI Grpc server can get the credentials of the workload from the workload handler.

The code here was tested with Kubernetes version v1.8.

What is in this repo

Flexvolume driver:

This is the flex volume driver that should be copied to /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds/uds Or you can use the provided initcontainer that copies the binary to the specified location on the node. See nodeagent/nodeagent.yaml

How to build

FlexVolume Binary

make build

Outputs to bin/flexvol-<arch>

Docker image

make image

How to setup the FlexVolume driver

See nodeagent/nodeagent.yaml initContainer to see how the FlexVolume driver is setup.

The nodeagent.yaml also shows how the nodeagent volumes need to be setup.

How to setup the Workload

See flexvol/udsver-mount.yaml for a sample of how a workload will setup the flexvolume.

...snip
     containers:
        volumeMounts:
        - mountPath: /tmp/udsver
          name: test-volume
      volumes:
        - name: test-volume
          flexVolume:
            driver: nodeagent/uds