[DO NOT MERGE] POC: Enable Lustre CSI Driver to Impersonate Pod Service Account

[tyuchn]

POC: Enable Lustre CSI Driver to Impersonate Pod Service Account

What this PR does

This PR serves as a Proof of Concept (POC) to demonstrate that the Lustre CSI driver can impersonate the k8s service account of the pod it is mounting a volume for.

This is achieved by using Workload Identity to exchange the pod's service account token for a Google Cloud IAM token, which is then used to authorize API calls against the Lustre service.

Success Criteria

The primary success criterion is that the CSI driver can successfully use the pod's assigned service account to call the Lustre API, GET the instance, and mount the volume without a permission denied error.

---

Verification Steps

The following steps outline the test case, showing the state of the pod before and after the correct IAM permissions are applied. The CSI driver is deployed in a GKE cluster with workload identity enabled.

1. Create a Kubernetes Service Account

First, create the service account for the pod.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: lustre-pod-sa

2. Create a Pod Using the Service Account

Next, create a pod that uses the service account and requests a Lustre volume.

apiVersion: v1
kind: Pod
metadata:
  name: lustre-pod
spec:
  serviceAccountName: lustre-pod-sa
  containers:
    - name: nginx
      image: nginx
      volumeMounts:
        - mountPath: /lustre_volume
          name: mypvc
  volumes:
    - name: mypvc
      persistentVolumeClaim:
        claimName: preprov-pvc

Result (Before IAM Binding): At this stage, the pod will be stuck in the ContainerCreating status. The CSI driver logs will show a permission denied error when it attempts to call the Lustre API to get instance details, causing the mount to fail.

3. Grant IAM Permissions to the Service Account

Bind the roles/lustre.viewer role to the Kubernetes service account via Workload Identity.

gcloud projects add-iam-policy-binding projects/tyuchn-joonix \
    --role=roles/lustre.viewer \
    --member=principal://iam.googleapis.com/projects/693257449117/locations/global/workloadIdentityPools/tyuchn-joonix.svc.id.goog/subject/ns/default/sa/lustre-pod-sa

4. Verify the Pod is Running

Result (After IAM Binding): Shortly after the IAM policy is applied, the pod's status will change to Running. The CSI driver logs will confirm that it successfully validated the instance by calling the Lustre API, and the volume mount is completed without any permission issues.