exa-operator is a Kubernetes operator designed to enhance storage isolation in environments where exa-csi-driver does not provide sufficient protection.
PV as a cluster wide resource, all users can see all PersistentVolumes (PVs). Since PV specs expose the volumeHandle (e.g., an lustrefs path), malicious or careless users can manually create PVCs bound to volumes belonging to other namespaces.
This operator provides additional capabilities for exa-csi-driver by automatically annotating PVs and validating PVC binding requests, ensuring that users cannot access volumes outside their namespace.
The main goals of exa-operator are:
- Mutating Webhook
- On the first binding of a static PV or when a dynamic PVC is automatically created, the operator injects an
originannotation (the namespace of the PVC that created the binding). - when a static PV is manually created, the operator checks whether any existing PV with the same prefix already has an annotation or a
claimRef. If such a PV exists, the new PV automatically inherits the sameoriginannotation.
- On the first binding of a static PV or when a dynamic PVC is automatically created, the operator injects an
- Validating Webhook
- With this annotation in place, the validating webhook ensures that PVCs from other namespaces cannot bind to the PV.
- Controller
- For existing PVs (created before the operator was installed), the controller automatically patches them with the appropriate
originannotation to enforce the same isolation rules.
- For existing PVs (created before the operator was installed), the controller automatically patches them with the appropriate
In short, exa-operator provides namespace-level volume isolation for exascaler CSI drivers that lack this functionality by default.
Prerequisite: Ensure that exa-csi-driver is correctly deployed in your cluster before deploying the operator.
This operator relies on the CSI driver for PV provisioning and binding.
Apply the combined manifest:
kubectl apply -f operator.yamlThis single YAML file contains all resources needed to install the operator:
- RBAC
- Deployment (controller + webhook)
- Webhook TLS Secret
- MutatingWebhookConfiguration
- ValidatingWebhookConfiguration