[FEATURE]: Add support for COSI

[shanduur]

Summary

Allow usage of kubernetes controlled Buckets and BucketAccesses instead of manually provided secrets via Container Object Storage Interface (COSI).

Expected behavior

COSI stands for Container Object Storage Interface. It is similar to the CSI spec, but instead of targeting the Block and File storage, it targets the Object storage - e.g. AWS S3, MinIO, Dell EMC ObjectScale and other. It defines few new concepts like Buckets, BucketClaims, BucketClasses, BucketAccesses and BucketAccessClasses.

• Buckets - represents a Bucket (or its equivalent) in the storage backend. Generally, it should be created only in the brownfield provisioning scenario, otherwise is automatically created by controller. Think of PersistentVolume / PV but for Object storage.

  Sample manifest:

  apiVersion: objectstorage.k8s.io/v1alpha1
  kind: Bucket
  metadata:
    name: my-bucket
  spec:
    driverName: cosi.dellemc.com
    bucketClassName: my-bucket-class
    bucketClaim: my-bucket-claim
    deletionPolicy: Delete
    protocols:
      - S3
    parameters:
      param1: value

• BucketClaims - represents a claim (or request) to provision a Bucket. Think of PersistentVolumeClaim / PVC but for Object storage.

  Sample manifest:

  apiVersion: objectstorage.k8s.io/v1alpha1
  kind: BucketClaim
  metadata:
    name: my-bucketclaim
    namespace: my-namespace
  spec:
    bucketClassName: my-bucketclass
    protocols: [ 'S3' ]

• BucketClasses - represents a class of Bucket resources with similar characteristics. It should be created by cluster administrator. Think of StorageClass / SC but for Object storage.

  Sample manifest:

  apiVersion: objectstorage.k8s.io/v1alpha1
  kind: BucketClass
  metadata:
    name: my-bucketclass
  driverName: cosi.dellemc.com
  deletionPolicy: Delete
  parameters:
    param1: value

• BucketAccesses - represents a access request to generate a Secret, that will allow you to access Object storage.

  Sample manifest:

  apiVersion: objectstorage.k8s.io/v1alpha1
  kind: BucketAccess
  metadata:
    name: my-bucketaccess
    namespace: my-namespace
  spec:
    bucketClaimName: my-bucketclaim
    protocol: S3
    bucketAccessClassName: my-bucketaccessclass
    credentialsSecretName: my-s3-secret

• BucketAccessClasses - represents a class of BucketAccess resources with similar characteristics. It should be created by cluster administrator.

  Sample manifest:

  apiVersion: objectstorage.k8s.io/v1alpha1
  kind: BucketAccessClass
  metadata:
    name: my-bucketaccessclass
  driverName: cosi.dellemc.com
  authenticationType: Key
  parameters:
    param1: value

Workflow

Full video by Jiffin Tony Thottan: https://www.youtube.com/watch?v=lff2c7n5s6Q

Right now there are few COSI Drivers that can provision the storage:

• Azure Blob COSI Driver
• Ceph COSI
• Dell COSI for ObjectScale
• S3GW COSI Driver

And few other are under the development, most importantly MinIO.

Possible fixes

Until the COSI is in alpha (observe spec) it should stay as optional feature - especially when there is no COSI Driver for AWS and MinIO publicly available.