Merge pull request #85569 from xenolinux/k8s-csi-iso-sec

OSDOCS#12418: KubeVirt CSI Security and Isolation for hosted clusters

Author: xenolinux

hosted_control_planes/hcp-manage/hcp-manage-virt.adoc

@@ -43,6 +43,7 @@ include::modules/hcp-virt-csi-snapshot.adoc[leveloffset=+2]
 include::modules/hcp-virt-multiple-snapshots.adoc[leveloffset=+2]
 include::modules/hcp-virt-root-volume.adoc[leveloffset=+2]
 include::modules/hcp-virt-image-caching.adoc[leveloffset=+2]
+include::modules/hcp-virt-storage-security-isolation.adoc[leveloffset=+2]
 
 [role="_additional-resources"]
 .Additional resources

modules/hcp-virt-storage-security-isolation.adoc

@@ -0,0 +1,17 @@
+// Module included in the following assemblies:
+//
+// * hosted_control_planes/hcp-manage/hcp-manage-virt.adoc
+
+:_mod-docs-content-type: CONCEPT
+[id="hcp-virt-storage-security-isolation_{context}"]
+= KubeVirt CSI storage security and isolation
+
+KubeVirt Container Storage Interface (CSI) extends the storage capabilities of the underlying infrastructure cluster to hosted clusters. The CSI driver ensures secure and isolated access to the infrastructure storage classes and hosted clusters by using the following security constraints:
+
+* The storage of a hosted cluster is isolated from the other hosted clusters.
+
+* Worker nodes in a hosted cluster do not have a direct API access to the infrastructure cluster. The hosted cluster can provision storage on the infrastructure cluster only through the controlled KubeVirt CSI interface.
+
+* The hosted cluster does not have access to the KubeVirt CSI cluster controller. As a result, the hosted cluster cannot access arbitrary storage volumes on the infrastructure cluster that are not associated with the hosted cluster. The KubeVirt CSI cluster controller runs in a pod in the hosted control plane namespace.
+
+* Role-based access control (RBAC) of the KubeVirt CSI cluster controller limits the persistent volume claim (PVC) access to only the hosted control plane namespace. Therefore, KubeVirt CSI components cannot access storage from the other namespaces.