apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
  name: "csi.spiffe.io"
spec:
  # We only support ephemeral, inline volumes. We don't need a controller to
  # provision and attach volumes.
  attachRequired: false

  # We want the pod information so that the CSI driver can verify that an
  # ephemeral mount was requested.
  podInfoOnMount: true

  # We don't want (or need) K8s to change ownership on the contents of the mount
  # when it is mounted into the pod, since the Workload API is completely open
  # (i.e. 0777).
  # Note, this was added in Kubernetes 1.19, so omit
  fsGroupPolicy: None

  # We only support ephemeral volumes. Note that this requires Kubernetes 1.16
  volumeLifecycleModes: # added in Kubernetes 1.16, this field is beta
    - Ephemeral
