OCPBUGS-77562, STOR-2758: Rebase to upstream v4.11.0 for OCP 4.22

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: release
   namespace: openshift
-  tag: rhel-9-release-golang-1.24-openshift-4.22
+  tag: rhel-9-release-golang-1.25-openshift-4.22

CHANGELOG/CHANGELOG-4.11.md

@@ -0,0 +1,83 @@
+# Release notes for v4.11.0
+
+[Documentation](https://kubernetes-csi.github.io)
+
+# Changelog since v4.10.0
+
+## Changes by Kind
+
+### Bug or Regression
+
+- Fixed log spam "VolumeAttachment attached status and actual state do not match. Adding back to VolumeAttachment queue for forced reprocessing" for VolumeAttachments of unrelated CSI drivers. ([#682](https://github.com/kubernetes-csi/external-attacher/pull/682), [@jsafrane](https://github.com/jsafrane))
+- Fixed the module path to include `/v4`. ([#696](https://github.com/kubernetes-csi/external-attacher/pull/696), [@jsafrane](https://github.com/jsafrane))
+- Updated go version to fix CVE-2025-68121. ([#701](https://github.com/kubernetes-csi/external-attacher/pull/701), [@jsafrane](https://github.com/jsafrane))
+
+### Other (Cleanup or Flake)
+
+- Bump k8s dependencies to v1.35.0 ([#693](https://github.com/kubernetes-csi/external-attacher/pull/693), [@dfajmon](https://github.com/dfajmon))
+
+## Dependencies
+
+### Added
+- github.com/Masterminds/semver/v3: [v3.4.0](https://github.com/Masterminds/semver/tree/v3.4.0)
+- golang.org/x/tools/go/expect: v0.1.0-deprecated
+- golang.org/x/tools/go/packages/packagestest: v0.1.1-deprecated
+
+### Changed
+- github.com/container-storage-interface/spec: [v1.11.0 → v1.12.0](https://github.com/container-storage-interface/spec/compare/v1.11.0...v1.12.0)
+- github.com/go-logr/logr: [v1.4.2 → v1.4.3](https://github.com/go-logr/logr/compare/v1.4.2...v1.4.3)
+- github.com/google/pprof: [d1b30fe → 27863c8](https://github.com/google/pprof/compare/d1b30fe...27863c8)
+- github.com/kubernetes-csi/csi-lib-utils: [v0.22.0 → v0.23.2](https://github.com/kubernetes-csi/csi-lib-utils/compare/v0.22.0...v0.23.2)
+- github.com/kubernetes-csi/csi-test/v5: [v5.3.1 → v5.4.0](https://github.com/kubernetes-csi/csi-test/compare/v5.3.1...v5.4.0)
+- github.com/mailru/easyjson: [v0.9.0 → v0.9.1](https://github.com/mailru/easyjson/compare/v0.9.0...v0.9.1)
+- github.com/onsi/ginkgo/v2: [v2.21.0 → v2.27.2](https://github.com/onsi/ginkgo/compare/v2.21.0...v2.27.2)
+- github.com/onsi/gomega: [v1.35.1 → v1.38.2](https://github.com/onsi/gomega/compare/v1.35.1...v1.38.2)
+- github.com/prometheus/client_golang: [v1.22.0 → v1.23.2](https://github.com/prometheus/client_golang/compare/v1.22.0...v1.23.2)
+- github.com/prometheus/common: [v0.64.0 → v0.66.1](https://github.com/prometheus/common/compare/v0.64.0...v0.66.1)
+- github.com/rogpeppe/go-internal: [v1.13.1 → v1.14.1](https://github.com/rogpeppe/go-internal/compare/v1.13.1...v1.14.1)
+- github.com/spf13/cobra: [v1.9.1 → v1.10.0](https://github.com/spf13/cobra/compare/v1.9.1...v1.10.0)
+- github.com/spf13/pflag: [v1.0.6 → v1.0.9](https://github.com/spf13/pflag/compare/v1.0.6...v1.0.9)
+- github.com/stoewer/go-strcase: [v1.3.0 → v1.3.1](https://github.com/stoewer/go-strcase/compare/v1.3.0...v1.3.1)
+- github.com/stretchr/testify: [v1.10.0 → v1.11.1](https://github.com/stretchr/testify/compare/v1.10.0...v1.11.1)
+- go.etcd.io/bbolt: v1.4.2 → v1.4.3
+- go.etcd.io/etcd/api/v3: v3.6.4 → v3.6.5
+- go.etcd.io/etcd/client/pkg/v3: v3.6.4 → v3.6.5
+- go.etcd.io/etcd/client/v3: v3.6.4 → v3.6.5
+- go.etcd.io/etcd/pkg/v3: v3.6.4 → v3.6.5
+- go.etcd.io/etcd/server/v3: v3.6.4 → v3.6.5
+- go.opentelemetry.io/auto/sdk: v1.1.0 → v1.2.1
+- go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.58.0 → v0.61.0
+- go.opentelemetry.io/otel/metric: v1.35.0 → v1.38.0
+- go.opentelemetry.io/otel/sdk/metric: v1.34.0 → v1.36.0
+- go.opentelemetry.io/otel/sdk: v1.34.0 → v1.36.0
+- go.opentelemetry.io/otel/trace: v1.35.0 → v1.38.0
+- go.opentelemetry.io/otel: v1.35.0 → v1.38.0
+- go.yaml.in/yaml/v2: v2.4.2 → v2.4.3
+- golang.org/x/crypto: v0.38.0 → v0.45.0
+- golang.org/x/mod: v0.20.0 → v0.29.0
+- golang.org/x/net: v0.40.0 → v0.47.0
+- golang.org/x/sync: v0.14.0 → v0.18.0
+- golang.org/x/sys: v0.33.0 → v0.38.0
+- golang.org/x/term: v0.32.0 → v0.37.0
+- golang.org/x/text: v0.25.0 → v0.31.0
+- golang.org/x/tools: v0.26.0 → v0.38.0
+- google.golang.org/genproto/googleapis/rpc: a0af3ef → 200df99
+- google.golang.org/grpc: v1.72.1 → v1.72.2
+- google.golang.org/protobuf: v1.36.6 → v1.36.8
+- gopkg.in/evanphx/json-patch.v4: v4.12.0 → v4.13.0
+- k8s.io/api: v0.34.0 → v0.35.0
+- k8s.io/apimachinery: v0.34.0 → v0.35.0
+- k8s.io/apiserver: v0.34.0 → v0.35.0
+- k8s.io/client-go: v0.34.0 → v0.35.0
+- k8s.io/component-base: v0.34.0 → v0.35.0
+- k8s.io/csi-translation-lib: v0.34.0 → v0.35.0
+- k8s.io/kms: v0.34.0 → v0.35.0
+- k8s.io/kube-openapi: f3f2b99 → 589584f
+- k8s.io/utils: 4c0f3b2 → bc988d5
+- sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.33.0 → v0.34.0
+- sigs.k8s.io/json: cfa47c3 → 2d32026
+- sigs.k8s.io/structured-merge-diff/v6: v6.3.0 → v6.3.2
+
+### Removed
+- github.com/go-task/slim-sprig: [52ccab3](https://github.com/go-task/slim-sprig/tree/52ccab3)
+- sigs.k8s.io/structured-merge-diff/v4: v4.6.0

Dockerfile.ocp

@@ -1,4 +1,4 @@
-FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.22 AS builder
+FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS builder
 WORKDIR /go/src/github.com/kubernetes-csi/external-attacher
 COPY . .
 RUN make build

cmd/csi-attacher/main.go

@@ -31,8 +31,6 @@ import (
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	"k8s.io/client-go/informers"
 	"k8s.io/client-go/kubernetes"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/client-go/util/workqueue"
 	utilflag "k8s.io/component-base/cli/flag"
 	"k8s.io/component-base/featuregate"
@@ -46,14 +44,15 @@ import (
 	"k8s.io/klog/v2"
 
 	"github.com/container-storage-interface/spec/lib/go/csi"
+	libconfig "github.com/kubernetes-csi/csi-lib-utils/config"
 	"github.com/kubernetes-csi/csi-lib-utils/connection"
 	"github.com/kubernetes-csi/csi-lib-utils/leaderelection"
 	"github.com/kubernetes-csi/csi-lib-utils/metrics"
 	"github.com/kubernetes-csi/csi-lib-utils/rpc"
 	"github.com/kubernetes-csi/csi-lib-utils/standardflags"
-	"github.com/kubernetes-csi/external-attacher/pkg/attacher"
-	"github.com/kubernetes-csi/external-attacher/pkg/controller"
-	"github.com/kubernetes-csi/external-attacher/pkg/features"
+	"github.com/kubernetes-csi/external-attacher/v4/pkg/attacher"
+	"github.com/kubernetes-csi/external-attacher/v4/pkg/controller"
+	"github.com/kubernetes-csi/external-attacher/v4/pkg/features"
 	"google.golang.org/grpc"
 )
 
@@ -65,34 +64,17 @@ const (
 
 // Command line flags
 var (
-	kubeconfig    = flag.String("kubeconfig", "", "Absolute path to the kubeconfig file. Required only when running out of cluster.")
-	resync        = flag.Duration("resync", 10*time.Minute, "Resync interval of the controller.")
-	csiAddress    = flag.String("csi-address", "/run/csi/socket", "Address of the CSI driver socket.")
-	showVersion   = flag.Bool("version", false, "Show version.")
-	timeout       = flag.Duration("timeout", 15*time.Second, "Timeout for waiting for attaching or detaching the volume.")
-	workerThreads = flag.Uint("worker-threads", 10, "Number of attacher worker threads")
-	maxEntries    = flag.Int("max-entries", 0, "Max entries per each page in volume lister call, 0 means no limit.")
-
-	retryIntervalStart = flag.Duration("retry-interval-start", time.Second, "Initial retry interval of failed create volume or deletion. It doubles with each failure, up to retry-interval-max.")
-	retryIntervalMax   = flag.Duration("retry-interval-max", 5*time.Minute, "Maximum retry interval of failed create volume or deletion.")
-
-	enableLeaderElection        = flag.Bool("leader-election", false, "Enable leader election.")
-	leaderElectionNamespace     = flag.String("leader-election-namespace", "", "Namespace where the leader election resource lives. Defaults to the pod namespace if not set.")
-	leaderElectionLeaseDuration = flag.Duration("leader-election-lease-duration", 15*time.Second, "Duration, in seconds, that non-leader candidates will wait to force acquire leadership. Defaults to 15 seconds.")
-	leaderElectionRenewDeadline = flag.Duration("leader-election-renew-deadline", 10*time.Second, "Duration, in seconds, that the acting leader will retry refreshing leadership before giving up. Defaults to 10 seconds.")
-	leaderElectionRetryPeriod   = flag.Duration("leader-election-retry-period", 5*time.Second, "Duration, in seconds, the LeaderElector clients should wait between tries of actions. Defaults to 5 seconds.")
+	resync             = flag.Duration("resync", 10*time.Minute, "Resync interval of the controller.")
+	timeout            = flag.Duration("timeout", 15*time.Second, "Timeout for waiting for attaching or detaching the volume.")
+	retryIntervalStart = flag.Duration("retry-interval-start", time.Second, "Initial retry interval of failed provisioning or deletion. It doubles with each failure, up to retry-interval-max.")
+	retryIntervalMax   = flag.Duration("retry-interval-max", 5*time.Minute, "Maximum retry interval of failed provisioning or deletion.")
+	workerThreads      = flag.Uint("worker-threads", 10, "Number of attacher worker threads")
+	maxEntries         = flag.Int("max-entries", 0, "Max entries per each page in volume lister call, 0 means no limit.")
 
 	defaultFSType = flag.String("default-fstype", "", "The default filesystem type of the volume to publish. Defaults to empty string")
 
 	reconcileSync = flag.Duration("reconcile-sync", 1*time.Minute, "Resync interval of the VolumeAttachment reconciler.")
 
-	metricsAddress = flag.String("metrics-address", "", "(deprecated) The TCP network address where the prometheus metrics endpoint will listen (example: `:8080`). The default is empty string, which means metrics endpoint is disabled. Only one of `--metrics-address` and `--http-endpoint` can be set.")
-	httpEndpoint   = flag.String("http-endpoint", "", "The TCP network address where the HTTP server for diagnostics, including metrics and leader election health check, will listen (example: `:8080`). The default is empty string, which means the server is disabled. Only one of `--metrics-address` and `--http-endpoint` can be set.")
-	metricsPath    = flag.String("metrics-path", "/metrics", "The HTTP path where prometheus metrics will be exposed. Default is `/metrics`.")
-
-	kubeAPIQPS   = flag.Float64("kube-api-qps", 5, "QPS to use while communicating with the kubernetes apiserver. Defaults to 5.0.")
-	kubeAPIBurst = flag.Int("kube-api-burst", 10, "Burst to use while communicating with the kubernetes apiserver. Defaults to 10.")
-
 	maxGRPCLogLength = flag.Int("max-grpc-log-length", -1, "The maximum amount of characters logged for every grpc responses. Defaults to no limit")
 
 	featureGates map[string]bool
@@ -111,6 +93,7 @@ func main() {
 	c := logsapi.NewLoggingConfiguration()
 	logsapi.AddGoFlags(c, flag.CommandLine)
 	logs.InitLogs()
+	standardflags.RegisterCommonFlags(flag.CommandLine)
 	standardflags.AddAutomaxprocs(klog.Infof)
 	flag.Parse()
 	logger := klog.Background()
@@ -124,29 +107,27 @@ func main() {
 		klog.FlushAndExit(klog.ExitFlushTimeout, 1)
 	}
 
-	if *showVersion {
+	if standardflags.Configuration.ShowVersion {
 		fmt.Println(os.Args[0], version)
 		return
 	}
 	logger.Info("Version", "version", version)
 
-	if *metricsAddress != "" && *httpEndpoint != "" {
+	if standardflags.Configuration.MetricsAddress != "" && standardflags.Configuration.HttpEndpoint != "" {
 		logger.Error(nil, "Only one of `--metrics-address` and `--http-endpoint` can be set")
 		klog.FlushAndExit(klog.ExitFlushTimeout, 1)
 	}
-	addr := *metricsAddress
+	addr := standardflags.Configuration.MetricsAddress
 	if addr == "" {
-		addr = *httpEndpoint
+		addr = standardflags.Configuration.HttpEndpoint
 	}
 
 	// Create the client config. Use kubeconfig if given, otherwise assume in-cluster.
-	config, err := buildConfig(*kubeconfig)
+	config, err := libconfig.BuildConfig(standardflags.Configuration.KubeConfig, standardflags.Configuration)
 	if err != nil {
 		logger.Error(err, "Failed to build a Kubernetes config")
 		klog.FlushAndExit(klog.ExitFlushTimeout, 1)
 	}
-	config.QPS = (float32)(*kubeAPIQPS)
-	config.Burst = *kubeAPIBurst
 	config.ContentType = runtime.ContentTypeProtobuf
 
 	if *workerThreads == 0 {
@@ -167,9 +148,9 @@ func main() {
 	// Connect to CSI.
 	connection.SetMaxGRPCLogLength(*maxGRPCLogLength)
 	ctx := context.Background()
-	csiConn, err := connection.Connect(ctx, *csiAddress, metricsManager, connection.OnConnectionLoss(connection.ExitOnConnectionLoss()))
+	csiConn, err := connection.Connect(ctx, standardflags.Configuration.CSIAddress, metricsManager, connection.OnConnectionLoss(connection.ExitOnConnectionLoss()))
 	if err != nil {
-		logger.Error(err, "Failed to connect to the CSI driver", "csiAddress", *csiAddress)
+		logger.Error(err, "Failed to connect to the CSI driver", "csiAddress", standardflags.Configuration.CSIAddress)
 		klog.FlushAndExit(klog.ExitFlushTimeout, 1)
 	}
 
@@ -194,9 +175,9 @@ func main() {
 	translator := csitrans.New()
 	if translator.IsMigratedCSIDriverByName(csiAttacher) {
 		metricsManager = metrics.NewCSIMetricsManagerWithOptions(csiAttacher, metrics.WithMigration())
-		migratedCsiClient, err := connection.Connect(ctx, *csiAddress, metricsManager, connection.OnConnectionLoss(connection.ExitOnConnectionLoss()))
+		migratedCsiClient, err := connection.Connect(ctx, standardflags.Configuration.CSIAddress, metricsManager, connection.OnConnectionLoss(connection.ExitOnConnectionLoss()))
 		if err != nil {
-			logger.Error(err, "Failed to connect to the CSI driver", "csiAddress", *csiAddress, "migrated", true)
+			logger.Error(err, "Failed to connect to the CSI driver", "csiAddress", standardflags.Configuration.CSIAddress, "migrated", true)
 			klog.FlushAndExit(klog.ExitFlushTimeout, 1)
 		}
 		csiConn.Close()
@@ -216,13 +197,13 @@ func main() {
 	// Prepare http endpoint for metrics + leader election healthz
 	mux := http.NewServeMux()
 	if addr != "" {
-		metricsManager.RegisterToServer(mux, *metricsPath)
+		metricsManager.RegisterToServer(mux, standardflags.Configuration.MetricsPath)
 		metricsManager.SetDriverName(csiAttacher)
 		go func() {
-			logger.Info("ServeMux listening", "address", addr, "metricsPath", *metricsPath)
+			logger.Info("ServeMux listening", "address", addr, "metricsPath", standardflags.Configuration.MetricsPath)
 			err := http.ListenAndServe(addr, mux)
 			if err != nil {
-				logger.Error(err, "Failed to start HTTP server at specified address and metrics path", "address", addr, "metricsPath", *metricsPath)
+				logger.Error(err, "Failed to start HTTP server at specified address and metrics path", "address", addr, "metricsPath", standardflags.Configuration.MetricsPath)
 				klog.FlushAndExit(klog.ExitFlushTimeout, 1)
 			}
 		}()
@@ -332,49 +313,15 @@ func main() {
 		}
 	}
 
-	if !*enableLeaderElection {
-		run(klog.NewContext(context.Background(), logger))
-	} else {
-		// Create a new clientset for leader election. When the attacher
-		// gets busy and its client gets throttled, the leader election
-		// can proceed without issues.
-		leClientset, err := kubernetes.NewForConfig(config)
-		if err != nil {
-			logger.Error(err, "Failed to create leaderelection client")
-			klog.FlushAndExit(klog.ExitFlushTimeout, 1)
-		}
-
-		// Name of config map with leader election lock
-		lockName := "external-attacher-leader-" + csiAttacher
-		le := leaderelection.NewLeaderElection(leClientset, lockName, run)
-		if *httpEndpoint != "" {
-			le.PrepareHealthCheck(mux, leaderelection.DefaultHealthCheckTimeout)
-		}
-
-		if *leaderElectionNamespace != "" {
-			le.WithNamespace(*leaderElectionNamespace)
-		}
-
-		le.WithLeaseDuration(*leaderElectionLeaseDuration)
-		le.WithRenewDeadline(*leaderElectionRenewDeadline)
-		le.WithRetryPeriod(*leaderElectionRetryPeriod)
-		if utilfeature.DefaultFeatureGate.Enabled(features.ReleaseLeaderElectionOnExit) {
-			le.WithReleaseOnCancel(true)
-			le.WithContext(ctx)
-		}
-
-		if err := le.Run(); err != nil {
-			logger.Error(err, "Failed to initialize leader election")
-			klog.FlushAndExit(klog.ExitFlushTimeout, 1)
-		}
-	}
-}
-
-func buildConfig(kubeconfig string) (*rest.Config, error) {
-	if kubeconfig != "" {
-		return clientcmd.BuildConfigFromFlags("", kubeconfig)
-	}
-	return rest.InClusterConfig()
+	leaderelection.RunWithLeaderElection(
+		ctx,
+		config,
+		standardflags.Configuration,
+		run,
+		"external-attacher-leader-"+csiAttacher,
+		mux,
+		utilfeature.DefaultFeatureGate.Enabled(features.ReleaseLeaderElectionOnExit),
+	)
 }
 
 func supportsControllerCapabilities(ctx context.Context, csiConn *grpc.ClientConn) (bool, bool, bool, bool, error) {