deprecate allow-inline-volume-key-access-with-identity flag (no-op)

[srranjan-sri]

What type of PR is this?

What this PR does / why we need it:
This PR adds a warning to inform users that the allow-inline-volume-key-access-with-identity flag will be deprecated in a future release when it is set to true.

Which issue(s) this PR fixes:

Fixes #

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• tested upgrade from previous version

Special notes for your reviewer:

Release note:

none

[k8s-ci-robot]

Hi @srranjan-sri. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[landreasyan]

/ok-to-test

[Copilot]

Pull request overview

Deprecates the --allow-inline-volume-key-access-with-identity flag by making it a no-op and ensuring inline/ephemeral volume behavior no longer depends on this setting, while updating Helm chart documentation and templates to reflect the deprecation.

Changes:

• Remove the allowInlineVolumeKeyAccessWithIdentity field from the runtime Driver and stop using it in inline/ephemeral volume logic.
• Emit a warning at startup if the deprecated flag is set to true, clarifying it has no effect.
• Update Helm values, templates, and chart README to mark the setting as deprecated/no-op.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/azurefile/nodeserver.go	Removes conditional behavior tied to the deprecated flag for ephemeral volume handling.
pkg/azurefile/azurefile.go	Drops the Driver field and adds a deprecation warning when the option is enabled.
pkg/azurefile/azurefile_options.go	Updates the CLI flag help text to clearly indicate deprecation and no-op behavior.
charts/README.md	Marks the Helm value as deprecated/no-op in the configuration table.
charts/latest/azurefile-csi-driver/values.yaml	Adds an inline deprecation note for the Helm value.
charts/latest/azurefile-csi-driver/templates/csi-azurefile-node.yaml	Annotates the node argument as deprecated/no-op.
charts/latest/azurefile-csi-driver/templates/csi-azurefile-node-windows.yaml	Annotates the windows node argument as deprecated/no-op.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mittachaitu]

LGTM!!

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mittachaitu, srranjan-sri
Once this PR has been reviewed and has the lgtm label, please assign andyzhangx for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[landreasyan]

/lgtm

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[srranjan-sri]

/retest

[mittachaitu]

In template let's add a check and print that this option will be depricated in future release, so that this will get notified to user as part of upgrades/new installations

{{- if values.node.allowInlineVolumeKeyAccessWithIdentity }}
{{- printf "WARNING: 'allowInlineVolumeKeyAccessWithIdentity' will be deprecated in future releases." | quote | indent 0 }}
{{- end }}

[andyzhangx]

we should leave the allow-inline-volume-key-access-with-identity flag as it is now since only open source admin user can enable this feature, there is no impact on AKS managed csi driver.

The original inline volume with managed identity auth mount is already non supported.

[mittachaitu]

we should leave the allow-inline-volume-key-access-with-identity flag as it is now since only open source admin user can enable this feature, there is no impact on AKS managed csi driver.

The original inline volume with managed identity auth mount is already non supported.

Here the issue is little different even admin enables this flag they will not have control on pods which uses inline volume. If admin enables this flag and some arbitrary pod shouldn't access fileshare (without right set of permissions/authorization). So, irrespective of flag enablement this PR does right thing from security point for OpenSource users.

[andyzhangx]

we should leave the allow-inline-volume-key-access-with-identity flag as it is now since only open source admin user can enable this feature, there is no impact on AKS managed csi driver.
The original inline volume with managed identity auth mount is already non supported.

Here the issue is little different even admin enables this flag they will not have control on pods which uses inline volume. If admin enables this flag and some arbitrary pod shouldn't access fileshare (without right set of permissions/authorization). So, irrespective of flag enablement this PR does right thing from security point for OpenSource users.

@srranjan-sri we could add some notes about the usage of this flag, leaving this flag as disabled by default should be ok.

[k8s-ci-robot]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.