Hi, I’m currently using the Incus cluster api project to provision k8s clusters on my Incus cluster. This works fine but now I’m looking for a way to add CSI to my clusters. The lxd-csi-driver seems like a good fit, using the storage pools als a way to configure volumes but it seems to use devlxd which I see no mentions of in Incus.
Does anyone have any insight on this? Can this driver work with Incus or is it LXD only?
Hmm, not, it definitely wouldn’t work as is.
It looks like recent LXD allows for an instance to directly interact with the LXD API through /dev/lxd (equivalent of our /dev/incus), effectively assigning some kind of authentication token to the container for those interactions.
I’m not sure that’s something we’d necessarily want to replicate as that seems quite tricky from a security point of view.
An alternative would be to have the same code talk to the regular Incus HTTPS API instead, authenticating either with a regular TLS certificate (which can be restricted) or using OIDC and OpenFGA for fine grained control.