Adding fs_group_policy field for kubernetes_csi_driver

sharon-raphael · sharon.rc.official@gmail.com · commit 3360f35b21e1 · 2025-07-03T15:14:30.000+05:30
diff --git a/docs/resources/csi_driver.md b/docs/resources/csi_driver.md
@@ -50,6 +50,7 @@ Required:
 
 Optional:
 
+- `fs_group_policy` (String) Defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Defaults to `ReadWriteOnceWithFSType`. Valid options are `File`, `None`, and `ReadWriteOnceWithFSType`.
 - `pod_info_on_mount` (Boolean) Indicates that the CSI volume driver requires additional pod information (like podName, podUID, etc.) during mount operations
 - `volume_lifecycle_modes` (List of String) Defines what kind of volumes this CSI volume driver supports
 
@@ -68,6 +69,7 @@ resource "kubernetes_csi_driver" "example" {
     attach_required        = true
     pod_info_on_mount      = true
     volume_lifecycle_modes = ["Ephemeral"]
+    fs_group_policy        = "File"
   }
 }
 ```
diff --git a/docs/resources/csi_driver_v1.md b/docs/resources/csi_driver_v1.md
@@ -50,6 +50,7 @@ Required:
 
 Optional:
 
+- `fs_group_policy` (String) Defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Defaults to `ReadWriteOnceWithFSType`. Valid options are `File`, `None`, and `ReadWriteOnceWithFSType`.
 - `pod_info_on_mount` (Boolean) Indicates that the CSI volume driver requires additional pod information (like podName, podUID, etc.) during mount operations
 - `volume_lifecycle_modes` (List of String) Defines what kind of volumes this CSI volume driver supports
 
@@ -68,6 +69,7 @@ resource "kubernetes_csi_driver_v1" "example" {
     attach_required        = true
     pod_info_on_mount      = true
     volume_lifecycle_modes = ["Ephemeral"]
+    fs_group_policy        = "File"
   }
 }
 ```
diff --git a/examples/resources/csi_driver/example_1.tf b/examples/resources/csi_driver/example_1.tf
@@ -7,5 +7,6 @@ resource "kubernetes_csi_driver" "example" {
     attach_required        = true
     pod_info_on_mount      = true
     volume_lifecycle_modes = ["Ephemeral"]
+    fs_group_policy        = "File"
   }
 }
diff --git a/examples/resources/csi_driver_v1/example_1.tf b/examples/resources/csi_driver_v1/example_1.tf
@@ -7,5 +7,6 @@ resource "kubernetes_csi_driver_v1" "example" {
     attach_required        = true
     pod_info_on_mount      = true
     volume_lifecycle_modes = ["Ephemeral"]
+    fs_group_policy        = "File"
   }
 }
diff --git a/kubernetes/resource_kubernetes_csi_driver_v1.go b/kubernetes/resource_kubernetes_csi_driver_v1.go
@@ -64,6 +64,17 @@ func resourceKubernetesCSIDriverV1() *schema.Resource {
 								}, false),
 							},
 						},
+						"fs_group_policy": {
+							Type:        schema.TypeString,
+							Description: "Defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Defaults to `ReadWriteOnceWithFSType`. Valid options are `File`, `None`, and `ReadWriteOnceWithFSType`.",
+							Optional:    true,
+							Default:     "ReadWriteOnceWithFSType",
+							ValidateFunc: validation.StringInSlice([]string{
+								string(storage.ReadWriteOnceWithFSTypeFSGroupPolicy),
+								string(storage.NoneFSGroupPolicy),
+								string(storage.FileFSGroupPolicy),
+							}, false),
+						},
 					},
 				},
 			},
diff --git a/kubernetes/resource_kubernetes_csi_driver_v1_test.go b/kubernetes/resource_kubernetes_csi_driver_v1_test.go
@@ -38,6 +38,7 @@ func TestAccKubernetesCSIDriverV1_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "spec.0.attach_required", "true"),
 					resource.TestCheckResourceAttr(resourceName, "spec.0.pod_info_on_mount", "true"),
 					resource.TestCheckResourceAttr(resourceName, "spec.0.volume_lifecycle_modes.0", "Ephemeral"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.fs_group_policy", "File"),
 				),
 			},
 			{
@@ -107,6 +108,7 @@ func testAccKubernetesCSIDriverV1BasicConfig(name string, attached bool) string
     attach_required        = %[2]t
     pod_info_on_mount      = %[2]t
     volume_lifecycle_modes = ["Ephemeral"]
+    fs_group_policy        = "File"
   }
 }
 `, name, attached)
diff --git a/kubernetes/resource_kubernetes_csi_driver_v1beta1.go b/kubernetes/resource_kubernetes_csi_driver_v1beta1.go
@@ -13,8 +13,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
-	storage "k8s.io/api/storage/v1beta1"
+
 	"k8s.io/apimachinery/pkg/api/errors"
+
+	storage "k8s.io/api/storage/v1beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	pkgApi "k8s.io/apimachinery/pkg/types"
 )
@@ -60,6 +62,17 @@ func resourceKubernetesCSIDriverV1Beta1() *schema.Resource {
 								}, false),
 							},
 						},
+						"fs_group_policy": {
+							Type:        schema.TypeString,
+							Description: "Defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Defaults to `ReadWriteOnceWithFSType`. Valid options are `File`, `None`, and `ReadWriteOnceWithFSType`.",
+							Optional:    true,
+							Default:     "ReadWriteOnceWithFSType",
+							ValidateFunc: validation.StringInSlice([]string{
+								string(storage.ReadWriteOnceWithFSTypeFSGroupPolicy),
+								string(storage.NoneFSGroupPolicy),
+								string(storage.FileFSGroupPolicy),
+							}, false),
+						},
 					},
 				},
 			},
diff --git a/kubernetes/resource_kubernetes_csi_driver_v1beta1_test.go b/kubernetes/resource_kubernetes_csi_driver_v1beta1_test.go
@@ -37,6 +37,7 @@ func TestAccKubernetesCSIDriverV1Beta1_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "spec.0.attach_required", "true"),
 					resource.TestCheckResourceAttr(resourceName, "spec.0.pod_info_on_mount", "true"),
 					resource.TestCheckResourceAttr(resourceName, "spec.0.volume_lifecycle_modes.0", "Ephemeral"),
+					resource.TestCheckResourceAttr(resourceName, "spec.0.fs_group_policy", "File"),
 				),
 			},
 			{
@@ -107,6 +108,7 @@ func testAccKubernetesCSIDriverBasicV1Beta1Config(name string, attached bool) st
     attach_required        = %[2]t
     pod_info_on_mount      = %[2]t
     volume_lifecycle_modes = ["Ephemeral"]
+    fs_group_policy        = "File"
   }
 }
 `, name, attached)
diff --git a/kubernetes/structure_csi_driver.go b/kubernetes/structure_csi_driver.go
@@ -28,6 +28,10 @@ func expandCSIDriverSpec(l []interface{}) storage.CSIDriverSpec {
 		obj.VolumeLifecycleModes = expandCSIDriverVolumeLifecycleModes(v)
 	}
 
+	if v, ok := in["fs_group_policy"].(string); ok && v != "" {
+		obj.FSGroupPolicy = ptr.To(storage.FSGroupPolicy(v))
+	}
+
 	return obj
 }
 
@@ -52,6 +56,10 @@ func flattenCSIDriverSpec(in storage.CSIDriverSpec) []interface{} {
 		att["volume_lifecycle_modes"] = in.VolumeLifecycleModes
 	}
 
+	if in.FSGroupPolicy != nil {
+		att["fs_group_policy"] = in.FSGroupPolicy
+	}
+
 	return []interface{}{att}
 }
 
@@ -78,5 +86,12 @@ func patchCSIDriverSpec(keyPrefix, pathPrefix string, d *schema.ResourceData) *P
 		})
 	}
 
+	if d.HasChange(keyPrefix + "fs_group_policy") {
+		ops = append(ops, &ReplaceOperation{
+			Path:  pathPrefix + "/fsGroupPolicy",
+			Value: d.Get(keyPrefix + "fs_group_policy").(string),
+		})
+	}
+
 	return &ops
 }
diff --git a/kubernetes/structure_csi_driver_v1.go b/kubernetes/structure_csi_driver_v1.go
@@ -28,6 +28,10 @@ func expandCSIDriverV1Spec(l []interface{}) storage.CSIDriverSpec {
 		obj.VolumeLifecycleModes = expandCSIDriverV1VolumeLifecycleModes(v)
 	}
 
+	if v, ok := in["fs_group_policy"].(string); ok && v != "" {
+		obj.FSGroupPolicy = ptr.To(storage.FSGroupPolicy(v))
+	}
+
 	return obj
 }
 
@@ -52,6 +56,10 @@ func flattenCSIDriverV1Spec(in storage.CSIDriverSpec) []interface{} {
 		att["volume_lifecycle_modes"] = in.VolumeLifecycleModes
 	}
 
+	if in.FSGroupPolicy != nil {
+		att["fs_group_policy"] = in.FSGroupPolicy
+	}
+
 	return []interface{}{att}
 }
 
@@ -78,5 +86,12 @@ func patchCSIDriverV1Spec(keyPrefix, pathPrefix string, d *schema.ResourceData)
 		})
 	}
 
+	if d.HasChange(keyPrefix + "fs_group_policy") {
+		ops = append(ops, &ReplaceOperation{
+			Path:  pathPrefix + "/fsGroupPolicy",
+			Value: d.Get(keyPrefix + "fs_group_policy").(string),
+		})
+	}
+
 	return &ops
 }

Original file line number	Diff line number	Diff line change
`@@ -50,6 +50,7 @@ Required:`
`50`	`50`
`51`	`51`	`Optional:`
`52`	`52`
	`53`	+- `fs_group_policy` (String) Defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Defaults to `ReadWriteOnceWithFSType`. Valid options are `File`, `None`, and `ReadWriteOnceWithFSType`.
`53`	`54`	- `pod_info_on_mount` (Boolean) Indicates that the CSI volume driver requires additional pod information (like podName, podUID, etc.) during mount operations
`54`	`55`	- `volume_lifecycle_modes` (List of String) Defines what kind of volumes this CSI volume driver supports
`55`	`56`
`@@ -68,6 +69,7 @@ resource "kubernetes_csi_driver" "example" {`
`68`	`69`	`attach_required = true`
`69`	`70`	`pod_info_on_mount = true`
`70`	`71`	`volume_lifecycle_modes = ["Ephemeral"]`
	`72`	`+ fs_group_policy = "File"`
`71`	`73`	`}`
`72`	`74`	`}`
`73`	`75`	```
Original file line number	Diff line number	Diff line change
`@@ -7,5 +7,6 @@ resource "kubernetes_csi_driver" "example" {`
`7`	`7`	`attach_required = true`
`8`	`8`	`pod_info_on_mount = true`
`9`	`9`	`volume_lifecycle_modes = ["Ephemeral"]`
	`10`	`+ fs_group_policy = "File"`
`10`	`11`	`}`
`11`	`12`	`}`
Original file line number	Diff line number	Diff line change
`@@ -38,6 +38,7 @@ func TestAccKubernetesCSIDriverV1_basic(t *testing.T) {`
`38`	`38`	`resource.TestCheckResourceAttr(resourceName, "spec.0.attach_required", "true"),`
`39`	`39`	`resource.TestCheckResourceAttr(resourceName, "spec.0.pod_info_on_mount", "true"),`
`40`	`40`	`resource.TestCheckResourceAttr(resourceName, "spec.0.volume_lifecycle_modes.0", "Ephemeral"),`
	`41`	`+ resource.TestCheckResourceAttr(resourceName, "spec.0.fs_group_policy", "File"),`
`41`	`42`	`),`
`42`	`43`	`},`
`43`	`44`	`{`
`@@ -107,6 +108,7 @@ func testAccKubernetesCSIDriverV1BasicConfig(name string, attached bool) string`
`107`	`108`	`attach_required = %[2]t`
`108`	`109`	`pod_info_on_mount = %[2]t`
`109`	`110`	`volume_lifecycle_modes = ["Ephemeral"]`
	`111`	`+ fs_group_policy = "File"`
`110`	`112`	`}`
`111`	`113`	`}`
`112`	`114`	`, name, attached)
Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,7 @@ func TestAccKubernetesCSIDriverV1Beta1_basic(t *testing.T) {`
`37`	`37`	`resource.TestCheckResourceAttr(resourceName, "spec.0.attach_required", "true"),`
`38`	`38`	`resource.TestCheckResourceAttr(resourceName, "spec.0.pod_info_on_mount", "true"),`
`39`	`39`	`resource.TestCheckResourceAttr(resourceName, "spec.0.volume_lifecycle_modes.0", "Ephemeral"),`
	`40`	`+ resource.TestCheckResourceAttr(resourceName, "spec.0.fs_group_policy", "File"),`
`40`	`41`	`),`
`41`	`42`	`},`
`42`	`43`	`{`
`@@ -107,6 +108,7 @@ func testAccKubernetesCSIDriverBasicV1Beta1Config(name string, attached bool) st`
`107`	`108`	`attach_required = %[2]t`
`108`	`109`	`pod_info_on_mount = %[2]t`
`109`	`110`	`volume_lifecycle_modes = ["Ephemeral"]`
	`111`	`+ fs_group_policy = "File"`
`110`	`112`	`}`
`111`	`113`	`}`
`112`	`114`	`, name, attached)
Original file line number	Diff line number	Diff line change
`@@ -28,6 +28,10 @@ func expandCSIDriverSpec(l []interface{}) storage.CSIDriverSpec {`
`28`	`28`	`obj.VolumeLifecycleModes = expandCSIDriverVolumeLifecycleModes(v)`
`29`	`29`	`}`
`30`	`30`
	`31`	`+ if v, ok := in["fs_group_policy"].(string); ok && v != "" {`
	`32`	`+ obj.FSGroupPolicy = ptr.To(storage.FSGroupPolicy(v))`
	`33`	`+ }`
	`34`	`+`
`31`	`35`	`return obj`
`32`	`36`	`}`
`33`	`37`
`@@ -52,6 +56,10 @@ func flattenCSIDriverSpec(in storage.CSIDriverSpec) []interface{} {`
`52`	`56`	`att["volume_lifecycle_modes"] = in.VolumeLifecycleModes`
`53`	`57`	`}`
`54`	`58`
	`59`	`+ if in.FSGroupPolicy != nil {`
	`60`	`+ att["fs_group_policy"] = in.FSGroupPolicy`
	`61`	`+ }`
	`62`	`+`
`55`	`63`	`return []interface{}{att}`
`56`	`64`	`}`
`57`	`65`
`@@ -78,5 +86,12 @@ func patchCSIDriverSpec(keyPrefix, pathPrefix string, d schema.ResourceData) P`
`78`	`86`	`})`
`79`	`87`	`}`
`80`	`88`
	`89`	`+ if d.HasChange(keyPrefix + "fs_group_policy") {`
	`90`	`+ ops = append(ops, &ReplaceOperation{`
	`91`	`+ Path: pathPrefix + "/fsGroupPolicy",`
	`92`	`+ Value: d.Get(keyPrefix + "fs_group_policy").(string),`
	`93`	`+ })`
	`94`	`+ }`
	`95`	`+`
`81`	`96`	`return &ops`
`82`	`97`	`}`