new doc for overall status

Author: dims

docs/openstack-kubernetes-integration-options.md

@@ -0,0 +1,52 @@
+## OpenStack and Kubernetes integration options
+
+### In-tree OpenStack provider in Kubernetes repository
+
+Traditional option `--cloud-provider` and `cloud-config` in `kubelet`, `kube-apiserver` and `kube-controller-manager`
+
+### Cloud Controller Manager (CCM) in Kubernetes repository
+
+Temporary stop gap binary `cloud-controller-manager` that has both `--cloud-provider` and `--cloud-config`
+command line params. Need to set `--cloud-provider=external` for the other kubernetes binaries.
+
+Also use the `--external-cloud-volume-plugin` command line parameter in `kube-controller-manager` to use the
+in-tree cinder volume plugin. Note that the provisioner name for the in-tree volume plugin is `kubernetes.io/cinder`
+
+### External OpenStack provider
+
+Mostly the same code as CCM, but code moved out of the main kubernetes repository. `--cloud-provider` is hard coded
+to `openstack`. `--cloud-config` needs to be specified.
+
+Similar to CCM, you can use the `--external-cloud-volume-plugin` in `kube-controller-manager` until support for that
+flag is dropped.
+
+Scenarios tested:
+- External LBaaS with Neutron LBaaSv2
+- Internal LBaaS with Neutron LBaaSv2
+- LVM / iSCSI with Cinder
+- Ceph / RBD with Cinder
+
+TODO:
+- Test LBaaS scenarios with Octavia
+
+### Kubernetes Keystone Webhooks
+
+There are two scenarios, authentication and authorization. They can be configured/used independently. There is
+support in the kubectl CLI for OpenStack auth provider. This provider can pick up the usual OS_* env vars and
+use them to talk to kube api server. However you need the auth webhook to authenticate the tokens.
+
+The authorization is a WIP. the initial thought was to provide a way similar to OpenStack Keystone policy files
+to do some authorization checks. You can just use the kubernetes builtin RBAC support.
+
+### Cinder Standalone provisioner
+
+Tested with `LVM / iSCSI` and `Ceph / RBD` scenarios. The provisioner name is `openstack.org/standalone-cinder`.
+You can use this along with the External OpenStack provider or CCM.
+
+### Cinder Flex volume driver
+
+WIP - There is some code, needs to be tested
+
+### Cinder CSI driver
+
+WIP - There is some example code in a SIG-storage repo. Need to investigate