feat: add token requests client

[aramase]

Signed-off-by: Anish Ramasekar [email protected]

What this PR does / why we need it:

• Adds token request client to the driver
  • This client will be used to generate token for configured audiences and expiration seconds. If this is enabled, providers no longer need to generate the token.
  • We're reusing the token generation logic from kubelet which caches the token until it expires and cache cleanup is explicitly called as part of NodeUnpublishVolume.
  • This change is added as backward compat to support kubernetes < 1.20. In 1.20+ by having token requests as part of CSI driver spec, kubelet will generate the token and pass to the driver as part of CSI volume mount context.
  • We're using the CSI driver spec to define the token audience and expiration seconds as mentioned here: https://kubernetes-csi.github.io/docs/token-requests.html
• Added e2e test with e2e-provider

Which issue(s) this PR fixes (optional, using fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when the PR gets merged):
Fixes #

Special notes for your reviewer:

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aramase

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [aramase]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[aramase]

/uncc @ritazh
/cc @nilekhc

This is ready for review!

[tam7t]

Looking great, gonna need a bit more time to think a few things through though!

[tam7t]

i feel like there must be a way to do this without all these replace directives (I'm goin got checkout the branch and try playing around with some things to make go mod happy...)

[tam7t]

Okay so I think i understand this a bit better...

This PR introduces a dependency on https://pkg.go.dev/k8s.io/kubernetes/pkg/kubelet/token

which pulls in the k8s.io/kubernetes v1.23.0 module, but according to kubernetes/kubernetes#90358 (comment)

"depending on k8s.io/kubernetes directly as a library, which is not supported"

I guess what we're doing here is whats mentioned kubernetes/kubernetes#79384

Since this token dependency is not permanent (we have plan to remove and replace with RequiresRepublish once thats supposed by all K8s supported releases) I think I'm good with these replace directives - but we should definitely add a comment explaining that k8s.io/kubernetes dependency causes the problems linking to kubernetes/kubernetes#79384

[aramase]

/label tide/merge-method-squash

[aramase]

/test pull-secrets-store-csi-driver-e2e-azure

[tam7t]

oof i'm noticing that this doesnt directly depend on k8s.io/kubernetes but still needs all these replace directives...

I wonder if providers (which depend on sigs.k8s.io/secrets-store-csi-driver to pull in the protobuf interface) will also need the replace directives. If so we may wanna move the protobuf to its own go module so it doesnt pull in all the transitive dependency issues.

(we dont need to do that as part of this PR)

[aramase]

opened an issue for it: #852

[tam7t]

Looking good! just a few more comments

[tam7t]

/lgtm