CSI Plugin Setup and Configuration

This article details points to consider when setting up and configuring the CSI plugin. Note that when setting up the plugin, the features below require Lightbits release 3.18.1 or newer.

IP-ACL

• Lightbits Cluster: IP-ACL enforcement uses the iptables-based firewall on the storage nodes. Enable it at installation time by setting ipacl_explicit_allow: true in the Ansible inventory.

• CSI Plugin: Add ip-acl: enabled to the StorageClass parameters. With the lb-csi-workload-examples Helm chart, use --set global.storageClass.ipAcl=enabled.

In-Band Authentication

• Lightbits Cluster: Enable the feature flag with lbcli enable feature-flag in-band-authentication, and then turn on in-band authentication with lbcli enable in-band-auth.

• CSI Plugin: Set inBandAuth: true in the lb-csi Helm chart values. This requires the discovery-client to run as a container (discoveryClientInContainer: true). With static manifests, deploy lb-csi-plugin-k8s-dc-iba.yaml. The setting can also be passed to the plugin with the --inband-auth flag or LB_CSI_INBAND_AUTH=true. The plugin checks whether the Lightbits cluster has in-band authentication enabled, but the setting is still needed at deployment time because it changes how the node pod is laid out. If the cluster requires in-band authentication and the plugin was deployed without this setting, volume staging fails with an explicit error.