Add secret support for Provision and Delete from pvc name and namespace #274

ggriffiths · 2019-05-07T23:34:56Z

Signed-off-by: Grant Griffiths [email protected]

What type of PR is this?
/kind feature

What this PR does / why we need it:

This allows Provision to pass the correct PVC object so that the k8s secrets can be pulled and used during provisioning.

Which issue(s) this PR fixes:
Fixes #170
Fixes #233

Special notes for your reviewer:

I'm still testing this change on my k8s cluster, which is why I've added the WIP tag.

Does this PR introduce a user-facing change?:

Users can now provide a secret name and namespace during provision by passing the correct storage class parameters: "provisioner-secret-name" and "provisioner-secret-namespace"

k8s-ci-robot · 2019-05-07T23:35:11Z

Hi @ggriffiths. Thanks for your PR.

I'm waiting for a kubernetes-csi or kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

ggriffiths · 2019-05-08T19:22:53Z

Verified that this change works on my k8s cluster with our CSI driver. Ready for review.

ggriffiths · 2019-05-10T17:19:14Z

/assign @msau42

msau42 · 2019-05-10T20:43:38Z

/ok-to-test

pkg/controller/controller.go

j-griffith · 2019-05-10T23:16:11Z

/lgtm

pkg/controller/controller.go

pkg/controller/controller_test.go

pkg/controller/controller.go

pkg/controller/controller_test.go

msau42 · 2019-05-15T16:04:17Z

pkg/controller/controller_test.go

+			},
+			expectErr: true,
+		},
+		"simple - valid": deleteTestcase{


This should be failing since annotations is not supported?

This wasn't failing because I was using PV Annotations instead of SC Parameters in the test.

msau42 · 2019-05-15T16:05:31Z

pkg/controller/controller_test.go

+					},
+				},
+			},
+			expectErr: false,


Is there a way to validate what secret reference we generated? And expect if it got set or ignored?

I don't think easily from testing Delete at a high level. I think getSecretReference tests should cover that.

ggriffiths · 2019-05-16T19:24:21Z

Just re-tested this on my local k8s cluster and Provision/delete are working.

Also pvc.annotations as SC params are correctly causing errors in provision/delete:

error resolving value "static-${pv.name}-${pvc.namespace}-${pvc.name}-${pvc.annotations['akey']}": invalid tokens: ["pvc.annotations['akey']" "pvc.name"]

msau42 · 2019-05-16T23:15:20Z

pkg/controller/controller_test.go

@@ -558,6 +558,17 @@ func TestGetSecretReference(t *testing.T) {
 			pvc:          nil,
 			expectRef:    &v1.SecretReference{Name: "name", Namespace: "ns"},
 		},
+		"simple - valid, pvc name and namespace": {
+			secretParams: provisionerSecretParams,
+			params:       map[string]string{provisionerSecretNameKey: "name", provisionerSecretNamespaceKey: "ns"},


Can you make the keys used in the params different from the values in the PVC? That way we make sure we're not accidentally using pvc values.

msau42 · 2019-05-16T23:19:31Z

pkg/controller/controller_test.go

 		"template - valid": {
 			secretParams: nodePublishSecretParams,
 			params: map[string]string{
-				nodePublishSecretNameKey:      "static-${pv.name}-${pvc.namespace}-${pvc.name}-${pvc.annotations['akey']}",
+				nodePublishSecretNameKey:      "static-${pv.name}-${pvc.namespace}-${pvc.name}",


annotations are allowed for nodepublish right?

Yeah, they are. Just made this into two unit tests - one for nodePublish secrets and one for provisioner secrets

msau42 · 2019-05-16T23:22:47Z

pkg/controller/controller_test.go

+			},
+			expectErr: true,
+		},
+		"simple - valid case": deleteTestcase{


Also one more test case where claimRef is set

Added this test case.

msau42

Just one nit, otherwise lgtm!
/approve

msau42 · 2019-05-17T01:00:32Z

pkg/controller/controller_test.go

+			},
+			expectRef: &v1.SecretReference{Name: "static-provisioner-pvname-pvcnamespace-pvcname", Namespace: "static-provisioner-pvname-pvcnamespace"},
+		},
+		"template - invalid provisioner secret, annotations not supported": {


this is already at L589?

Good catch, removed this duplicate test.

k8s-ci-robot · 2019-05-17T01:01:58Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ggriffiths, msau42

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [msau42]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

msau42 · 2019-05-17T01:01:58Z

Also please squash your commits

Signed-off-by: Grant Griffiths <[email protected]>

ggriffiths · 2019-05-17T01:55:08Z

Squashed into one commit. Thanks for the review!

msau42 · 2019-05-17T02:22:45Z

/lgtm

Thanks!

"Add secret support for Provision and Delete from pvc name and namespace"

Backport kubernetes-csi#274 from the master

Signed-off-by: Grant Griffiths <[email protected]> Backport kubernetes-csi#274 from the master

Backport kubernetes-csi#274 from the master

k8s-ci-robot requested review from lpabon and msau42 May 7, 2019 23:35

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 7, 2019

ggriffiths changed the title ~~[WIP] Add support for Provision secrets from pvc name and namespace~~ Add support for Provision secrets from name and namespace May 8, 2019

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 8, 2019

k8s-ci-robot assigned msau42 May 10, 2019

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 10, 2019

msau42 reviewed May 10, 2019

View reviewed changes

pkg/controller/controller.go Outdated Show resolved Hide resolved

ggriffiths changed the title ~~Add support for Provision secrets from name and namespace~~ Add secret support for Provision and Delete from pvc name and namespace May 10, 2019

ggriffiths force-pushed the provision_pvc_secret_name_namespace branch from 1184530 to 9625615 Compare May 10, 2019 22:41

msau42 reviewed May 10, 2019

View reviewed changes

pkg/controller/controller.go Outdated Show resolved Hide resolved

pkg/controller/controller.go Outdated Show resolved Hide resolved

pkg/controller/controller_test.go Show resolved Hide resolved

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 14, 2019

ggriffiths force-pushed the provision_pvc_secret_name_namespace branch from e0ab76e to 82727cc Compare May 14, 2019 01:02

msau42 reviewed May 14, 2019

View reviewed changes

pkg/controller/controller.go Show resolved Hide resolved

pkg/controller/controller.go Outdated Show resolved Hide resolved

pkg/controller/controller.go Outdated Show resolved Hide resolved

pkg/controller/controller.go Outdated Show resolved Hide resolved

msau42 reviewed May 15, 2019

View reviewed changes

pkg/controller/controller.go Outdated Show resolved Hide resolved

ggriffiths force-pushed the provision_pvc_secret_name_namespace branch from 01968e5 to bad6c2d Compare May 15, 2019 07:40

msau42 reviewed May 15, 2019

View reviewed changes

ggriffiths force-pushed the provision_pvc_secret_name_namespace branch from 7ba682e to dc795ce Compare May 16, 2019 19:22

msau42 reviewed May 16, 2019

View reviewed changes

ggriffiths force-pushed the provision_pvc_secret_name_namespace branch from dc795ce to 7ab6eeb Compare May 17, 2019 00:31

msau42 reviewed May 17, 2019

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 17, 2019

Allow PVC name/namespace as template for provisioner-secret

9b9bcc6

Signed-off-by: Grant Griffiths <[email protected]>

ggriffiths force-pushed the provision_pvc_secret_name_namespace branch from a5ef3a8 to 9b9bcc6 Compare May 17, 2019 01:53

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 17, 2019

k8s-ci-robot merged commit 967b7a3 into kubernetes-csi:master May 17, 2019

ggriffiths deleted the provision_pvc_secret_name_namespace branch May 17, 2019 02:24

oleksiys added a commit to oleksiys/external-provisioner that referenced this pull request May 19, 2019

Backport kubernetes-csi#274 to Kubernetes 1.13

9ebbc51

"Add secret support for Provision and Delete from pvc name and namespace"

oleksiys mentioned this pull request May 19, 2019

[release-1.0] Add secret support for Provision and Delete from pvc name and namespace #281

Merged

oleksiys pushed a commit to oleksiys/external-provisioner that referenced this pull request Jun 3, 2019

Allow PVC name/namespace as template for provisioner-secret

65328d1

Backport kubernetes-csi#274 from the master

oleksiys pushed a commit to oleksiys/external-provisioner that referenced this pull request Jun 3, 2019

Allow PVC name/namespace as template for provisioner-secret

b73abc9

Signed-off-by: Grant Griffiths <[email protected]> Backport kubernetes-csi#274 from the master

This was referenced Jun 3, 2019

[release-1.1] Add secret support for Provision and Delete from pvc name and namespace #286

Merged

[release-1.2] Add secret support for Provision and Delete from pvc name and namespace #287

Merged

oleksiys pushed a commit to oleksiys/external-provisioner that referenced this pull request Jun 14, 2019

Allow PVC name/namespace as template for provisioner-secret

b23ded9

Backport kubernetes-csi#274 from the master

This was referenced Jun 20, 2019

User's RBAC violations during volume provisioning #213

Closed

No credential in DeleteVolume RPC when defined StorageClass for PV is deleted already #222

Closed

ggriffiths mentioned this pull request Oct 18, 2019

REQUEST: New membership for ggriffiths kubernetes/org#1322

Closed

6 tasks

ggriffiths mentioned this pull request Dec 11, 2019

REQUEST: New membership for ggriffiths kubernetes/org#1480

Closed

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add secret support for Provision and Delete from pvc name and namespace #274

Add secret support for Provision and Delete from pvc name and namespace #274

ggriffiths commented May 7, 2019 •

edited

Loading

k8s-ci-robot commented May 7, 2019

ggriffiths commented May 8, 2019

ggriffiths commented May 10, 2019

msau42 commented May 10, 2019

j-griffith commented May 10, 2019 •

edited

Loading

msau42 May 15, 2019

ggriffiths May 15, 2019

msau42 May 15, 2019

ggriffiths May 15, 2019

ggriffiths commented May 16, 2019

msau42 May 16, 2019

msau42 May 16, 2019

ggriffiths May 17, 2019

msau42 May 16, 2019

ggriffiths May 17, 2019

msau42 left a comment

msau42 May 17, 2019

ggriffiths May 17, 2019

k8s-ci-robot commented May 17, 2019

msau42 commented May 17, 2019

ggriffiths commented May 17, 2019

msau42 commented May 17, 2019

Add secret support for Provision and Delete from pvc name and namespace #274

Add secret support for Provision and Delete from pvc name and namespace #274

Conversation

ggriffiths commented May 7, 2019 • edited Loading

k8s-ci-robot commented May 7, 2019

ggriffiths commented May 8, 2019

ggriffiths commented May 10, 2019

msau42 commented May 10, 2019

j-griffith commented May 10, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ggriffiths commented May 16, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

msau42 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented May 17, 2019

msau42 commented May 17, 2019

ggriffiths commented May 17, 2019

msau42 commented May 17, 2019

ggriffiths commented May 7, 2019 •

edited

Loading

j-griffith commented May 10, 2019 •

edited

Loading