Skip to content

Commit fedaeb6

Browse files
nixpanicnixpanic
committed
Add secret reference in PV annotations for ControllerModifyVolume
The ControllerModifyVolume CSI procedure should be able to receive credentials if the storage provider requires them. The values of the following keys in the StorageClass are copied into annotations of the PersistentVolume: - csi.storage.k8s.io/controller-modify-secret-name > volume.kubernetes.io/controller-modify-secret-name - csi.storage.k8s.io/controller-modify-secret-namespace > volume.kubernetes.io/controller-modify-secret-namespace The external-resizer can use these annotations to resolve the secret that needs to be passed in ControllerModifyVolume.
1 parent 1b71152 commit fedaeb6

File tree

2 files changed

+51
-3
lines changed

2 files changed

+51
-3
lines changed

‎pkg/controller/controller.go‎

Lines changed: 41 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,9 @@ const (
105105
prefixedNodeExpandSecretNameKey = csiParameterPrefix + "node-expand-secret-name"
106106
prefixedNodeExpandSecretNamespaceKey = csiParameterPrefix + "node-expand-secret-namespace"
107107

108+
prefixedControllerModifySecretNameKey = csiParameterPrefix + "controller-modify-secret-name"
109+
prefixedControllerModifySecretNamespaceKey = csiParameterPrefix + "controller-modify-secret-namespace"
110+
108111
// [Deprecated] CSI Parameters that are put into fields but
109112
// NOT stripped from the parameters passed to CreateVolume
110113
provisionerSecretNameKey = "csiProvisionerSecretName"
@@ -148,6 +151,11 @@ const (
148151
annDeletionProvisionerSecretRefName = "volume.kubernetes.io/provisioner-deletion-secret-name"
149152
annDeletionProvisionerSecretRefNamespace = "volume.kubernetes.io/provisioner-deletion-secret-namespace"
150153

154+
// Annotation for secret name and namespace will be added to the pv object
155+
// and used for ControllerModifyVolume procedures by the external-resizer
156+
annModifyControllerSecretRefName = "volume.kubernetes.io/controller-modify-secret-name"
157+
annModifyControllerSecretRefNamespace = "volume.kubernetes.io/controller-modify-secret-namespace"
158+
151159
snapshotNotBound = "snapshot %s not bound"
152160

153161
pvcCloneFinalizer = "provisioner.storage.kubernetes.io/cloning-protection"
@@ -205,6 +213,12 @@ var (
205213
secretNameKey: prefixedNodeExpandSecretNameKey,
206214
secretNamespaceKey: prefixedNodeExpandSecretNamespaceKey,
207215
}
216+
217+
controllerModifySecretParams = secretParamsMap{
218+
name: "ControllerModify",
219+
secretNameKey: prefixedControllerModifySecretNameKey,
220+
secretNamespaceKey: prefixedControllerModifySecretNamespaceKey,
221+
}
208222
)
209223

210224
// ProvisionerCSITranslator contains the set of CSI Translation functionality
@@ -540,7 +554,7 @@ func (p *csiProvisioner) getVolumeCapabilities(
540554
return volumeCaps, nil
541555
}
542556

543-
type deletionSecretParams struct {
557+
type annotatedSecretParams struct {
544558
name string
545559
namespace string
546560
}
@@ -550,7 +564,8 @@ type prepareProvisionResult struct {
550564
migratedVolume bool
551565
req *csi.CreateVolumeRequest
552566
csiPVSource *v1.CSIPersistentVolumeSource
553-
provDeletionSecrets *deletionSecretParams
567+
provDeletionSecrets *annotatedSecretParams
568+
provModifySecrets *annotatedSecretParams
554569
}
555570

556571
// prepareProvision does non-destructive parameter checking and preparations for provisioning a volume.
@@ -739,6 +754,10 @@ func (p *csiProvisioner) prepareProvision(ctx context.Context, claim *v1.Persist
739754
if err != nil {
740755
return nil, controller.ProvisioningNoChange, err
741756
}
757+
controllerModifySecretRef, err := getSecretReference(controllerModifySecretParams, sc.Parameters, pvName, claim)
758+
if err != nil {
759+
return nil, controller.ProvisioningNoChange, err
760+
}
742761
csiPVSource := &v1.CSIPersistentVolumeSource{
743762
Driver: p.driverName,
744763
// VolumeHandle and VolumeAttributes will be added after provisioning.
@@ -760,13 +779,21 @@ func (p *csiProvisioner) prepareProvision(ctx context.Context, claim *v1.Persist
760779
req.Parameters[pvcNamespaceKey] = claim.GetNamespace()
761780
req.Parameters[pvNameKey] = pvName
762781
}
763-
deletionAnnSecrets := new(deletionSecretParams)
764782

783+
deletionAnnSecrets := new(annotatedSecretParams)
765784
if provisionerSecretRef != nil {
766785
deletionAnnSecrets.name = provisionerSecretRef.Name
767786
deletionAnnSecrets.namespace = provisionerSecretRef.Namespace
768787
}
769788

789+
var modifyAnnSecrets *annotatedSecretParams
790+
if controllerModifySecretRef != nil {
791+
modifyAnnSecrets = &annotatedSecretParams{
792+
name: controllerModifySecretRef.Name,
793+
namespace: controllerModifySecretRef.Namespace,
794+
}
795+
}
796+
770797
if vacName != "" {
771798
vac, err := p.client.StorageV1().VolumeAttributesClasses().Get(ctx, vacName, metav1.GetOptions{})
772799
if err != nil {
@@ -786,6 +813,7 @@ func (p *csiProvisioner) prepareProvision(ctx context.Context, claim *v1.Persist
786813
req: &req,
787814
csiPVSource: csiPVSource,
788815
provDeletionSecrets: deletionAnnSecrets,
816+
provModifySecrets: modifyAnnSecrets,
789817
}, controller.ProvisioningNoChange, nil
790818

791819
}
@@ -868,6 +896,7 @@ func (p *csiProvisioner) Provision(ctx context.Context, options controller.Provi
868896
klog.V(3).Infof("create volume rep: %+v", rep.Volume)
869897
}
870898
volumeAttributes := map[string]string{provisionerIDKey: p.identity}
899+
871900
maps.Copy(volumeAttributes, rep.Volume.VolumeContext)
872901
respCap := rep.GetVolume().GetCapacityBytes()
873902

@@ -943,6 +972,13 @@ func (p *csiProvisioner) Provision(ctx context.Context, options controller.Provi
943972
metav1.SetMetaDataAnnotation(&pv.ObjectMeta, annDeletionProvisionerSecretRefNamespace, "")
944973
}
945974

975+
// Set annModifyControllerSecretRefName and namespace in PV object when modify secrets are configured.
976+
if result.provModifySecrets != nil {
977+
klog.V(5).Infof("createVolumeOperation: set annotation [%s/%s] on pv [%s].", annModifyControllerSecretRefNamespace, annModifyControllerSecretRefName, pv.Name)
978+
metav1.SetMetaDataAnnotation(&pv.ObjectMeta, annModifyControllerSecretRefName, result.provModifySecrets.name)
979+
metav1.SetMetaDataAnnotation(&pv.ObjectMeta, annModifyControllerSecretRefNamespace, result.provModifySecrets.namespace)
980+
}
981+
946982
if options.StorageClass.ReclaimPolicy != nil {
947983
pv.Spec.PersistentVolumeReclaimPolicy = *options.StorageClass.ReclaimPolicy
948984
}
@@ -1030,6 +1066,8 @@ func removePrefixedParameters(param map[string]string) (map[string]string, error
10301066
case prefixedDefaultSecretNamespaceKey:
10311067
case prefixedNodeExpandSecretNameKey:
10321068
case prefixedNodeExpandSecretNamespaceKey:
1069+
case prefixedControllerModifySecretNameKey:
1070+
case prefixedControllerModifySecretNamespaceKey:
10331071
default:
10341072
return map[string]string{}, fmt.Errorf("found unknown parameter key \"%s\" with reserved namespace %s", k, csiParameterPrefix)
10351073
}

‎pkg/controller/controller_test.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -237,6 +237,8 @@ func TestStripPrefixedCSIParams(t *testing.T) {
237237
prefixedDefaultSecretNamespaceKey: "csiBar",
238238
prefixedNodeExpandSecretNameKey: "csiBar",
239239
prefixedNodeExpandSecretNamespaceKey: "csiBar",
240+
prefixedControllerModifySecretNameKey: "csiBar",
241+
prefixedControllerModifySecretNamespaceKey: "csiBar",
240242
},
241243
expectedParams: map[string]string{},
242244
},
@@ -926,6 +928,8 @@ func getDefaultStorageClassSecretParameters() map[string]string {
926928
prefixedProvisionerSecretNamespaceKey: defaultSecretNsName,
927929
prefixedNodeExpandSecretNameKey: "nodeexpandsecret",
928930
prefixedNodeExpandSecretNamespaceKey: defaultSecretNsName,
931+
prefixedControllerModifySecretNameKey: "ctrlmodifysecret",
932+
prefixedControllerModifySecretNamespaceKey: defaultSecretNsName,
929933
}
930934
}
931935

@@ -1623,6 +1627,8 @@ func provisionTestcases() (int64, map[string]provisioningTestcase) {
16231627
expectedPVSpec: &pvSpec{
16241628
Name: "test-testi",
16251629
Annotations: map[string]string{
1630+
annModifyControllerSecretRefName: "ctrlmodifysecret",
1631+
annModifyControllerSecretRefNamespace: defaultSecretNsName,
16261632
annDeletionProvisionerSecretRefName: "provisionersecret",
16271633
annDeletionProvisionerSecretRefNamespace: defaultSecretNsName,
16281634
},
@@ -1682,6 +1688,8 @@ func provisionTestcases() (int64, map[string]provisioningTestcase) {
16821688
expectedPVSpec: &pvSpec{
16831689
Name: "test-testi",
16841690
Annotations: map[string]string{
1691+
annModifyControllerSecretRefName: "default-secret",
1692+
annModifyControllerSecretRefNamespace: "default-ns",
16851693
annDeletionProvisionerSecretRefName: "default-secret",
16861694
annDeletionProvisionerSecretRefNamespace: "default-ns",
16871695
},
@@ -1741,6 +1749,8 @@ func provisionTestcases() (int64, map[string]provisioningTestcase) {
17411749
expectedPVSpec: &pvSpec{
17421750
Name: "test-testi",
17431751
Annotations: map[string]string{
1752+
annModifyControllerSecretRefName: "my-pvc",
1753+
annModifyControllerSecretRefNamespace: "default-ns",
17441754
annDeletionProvisionerSecretRefName: "my-pvc",
17451755
annDeletionProvisionerSecretRefNamespace: "default-ns",
17461756
},

0 commit comments

Comments
 (0)