Revert "EFS-CSI pod impersonation implementation"

[wongma7]

Reverts #710

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wongma7

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [wongma7]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[adammw]

Is there any more information on the reason for the revert?

[andrecastro]

Why this was reverted?

[dims]

@adammw @andrecastro can you please share some context on why the sudden interest in a revert after 2-ish years?

[andrecastro]

@dims I manage a multi-tenant platform based on k8s, meaning I have applications of different teams sharing the same cluster. I would like to whitelist the applications using the EFS resource policy, restricting the access only to the roles associated to the pods (IRSA) that need access.

Right now I'm doing it via templates and naming patterns that we have in our platform, but I think this feature would be a valid option thinking about security concerns.

The secrets-store-csi-driver-provider-aws have something similar. I can create secrets on AWS Secrets Manager and restrict the access to the pods. The provider kind of impersonate the pod mounting the secret, using its permissions.

[dims]

@andrecastro thanks for sharing! please open a new issue and point it back to the discussion here (and cut-n-paste the info here). it's just that folks don't really pay attention to old closed PRs and better visibility as a fresh request.

[adammw]

#1439 was opened back in August