Skip to content

Commit 67dcee2

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #1034 from manishym/secretReference
Add snapshot secret reference to group snapshot controller.
2 parents 8756a3e + e171a98 commit 67dcee2

File tree

3 files changed

+132
-10
lines changed

3 files changed

+132
-10
lines changed

‎pkg/common-controller/groupsnapshot_controller_helper.go

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -743,7 +743,7 @@ func (ctrl *csiSnapshotCommonController) createGroupSnapshotContent(groupSnapsho
743743
TODO: Add PVC finalizer
744744
*/
745745

746-
groupSnapshotClass, volumes, contentName, err := ctrl.getCreateGroupSnapshotInput(groupSnapshot)
746+
groupSnapshotClass, volumes, contentName, snapshotterSecretRef, err := ctrl.getCreateGroupSnapshotInput(groupSnapshot)
747747
if err != nil {
748748
return nil, fmt.Errorf("failed to get input parameters to create group snapshot %s: %q", groupSnapshot.Name, err)
749749
}
@@ -773,8 +773,15 @@ func (ctrl *csiSnapshotCommonController) createGroupSnapshotContent(groupSnapsho
773773
}
774774

775775
/*
776-
TODO: Add secret reference details
776+
Add secret reference details
777777
*/
778+
if snapshotterSecretRef != nil {
779+
klog.V(5).Infof("createGroupSnapshotContent: set annotation [%s] on volume group snapshot content [%s].", utils.AnnDeletionSecretRefName, groupSnapshotContent.Name)
780+
metav1.SetMetaDataAnnotation(&groupSnapshotContent.ObjectMeta, utils.AnnDeletionSecretRefName, snapshotterSecretRef.Name)
781+
782+
klog.V(5).Infof("creategroupSnapshotContent: set annotation [%s] on volume group snapshot content [%s].", utils.AnnDeletionSecretRefNamespace, groupSnapshotContent.Name)
783+
metav1.SetMetaDataAnnotation(&groupSnapshotContent.ObjectMeta, utils.AnnDeletionSecretRefNamespace, snapshotterSecretRef.Namespace)
784+
}
778785

779786
var updateGroupSnapshotContent *crdv1alpha1.VolumeGroupSnapshotContent
780787
klog.V(5).Infof("volume group snapshot content %#v", groupSnapshotContent)
@@ -810,7 +817,7 @@ func (ctrl *csiSnapshotCommonController) createGroupSnapshotContent(groupSnapsho
810817
return updateGroupSnapshotContent, nil
811818
}
812819

813-
func (ctrl *csiSnapshotCommonController) getCreateGroupSnapshotInput(groupSnapshot *crdv1alpha1.VolumeGroupSnapshot) (*crdv1alpha1.VolumeGroupSnapshotClass, []*v1.PersistentVolume, string, error) {
820+
func (ctrl *csiSnapshotCommonController) getCreateGroupSnapshotInput(groupSnapshot *crdv1alpha1.VolumeGroupSnapshot) (*crdv1alpha1.VolumeGroupSnapshotClass, []*v1.PersistentVolume, string, *v1.SecretReference, error) {
814821
className := groupSnapshot.Spec.VolumeGroupSnapshotClassName
815822
klog.V(5).Infof("getCreateGroupSnapshotInput [%s]", groupSnapshot.Name)
816823
var groupSnapshotClass *crdv1alpha1.VolumeGroupSnapshotClass
@@ -819,23 +826,29 @@ func (ctrl *csiSnapshotCommonController) getCreateGroupSnapshotInput(groupSnapsh
819826
groupSnapshotClass, err = ctrl.getGroupSnapshotClass(*className)
820827
if err != nil {
821828
klog.Errorf("getCreateGroupSnapshotInput failed to getClassFromVolumeGroupSnapshot %s", err)
822-
return nil, nil, "", err
829+
return nil, nil, "", nil, err
823830
}
824831
} else {
825832
klog.Errorf("failed to getCreateGroupSnapshotInput %s without a group snapshot class", groupSnapshot.Name)
826-
return nil, nil, "", fmt.Errorf("failed to take group snapshot %s without a group snapshot class", groupSnapshot.Name)
833+
return nil, nil, "", nil, fmt.Errorf("failed to take group snapshot %s without a group snapshot class", groupSnapshot.Name)
827834
}
828835

829836
volumes, err := ctrl.getVolumesFromVolumeGroupSnapshot(groupSnapshot)
830837
if err != nil {
831838
klog.Errorf("getCreateGroupSnapshotInput failed to get PersistentVolume objects [%s]: Error: [%#v]", groupSnapshot.Name, err)
832-
return nil, nil, "", err
839+
return nil, nil, "", nil, err
833840
}
834841

835842
// Create VolumeGroupSnapshotContent name
836843
contentName := utils.GetDynamicSnapshotContentNameForGroupSnapshot(groupSnapshot)
837844

838-
return groupSnapshotClass, volumes, contentName, nil
845+
// Get the secret reference
846+
snapshotterSecretRef, err := utils.GetGroupSnapshotSecretReference(utils.SnapshotterSecretParams, groupSnapshotClass.Parameters, contentName, groupSnapshot)
847+
if err != nil {
848+
return nil, nil, "", nil, err
849+
}
850+
851+
return groupSnapshotClass, volumes, contentName, snapshotterSecretRef, nil
839852
}
840853

841854
// syncGroupSnapshotContent deals with one key off the queue

‎pkg/sidecar-controller/groupsnapshot_helper.go

Lines changed: 48 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -423,6 +423,11 @@ func (ctrl *csiSnapshotSideCarController) createGroupSnapshotWrapper(groupSnapsh
423423
creationTime = time.Now()
424424
}
425425

426+
groupSnapshotSecret, err := utils.GetSecretReference(utils.GroupSnapshotterSecretParams, class.Parameters, groupSnapshotContent.GetObjectMeta().GetName(), nil)
427+
if err != nil {
428+
klog.Errorf("Failed to get secret reference for group snapshot content %s: %v", groupSnapshotContent.Name, err)
429+
return groupSnapshotContent, fmt.Errorf("failed to get secret reference for group snapshot content %s: %v", groupSnapshotContent.Name, err)
430+
}
426431
// Create individual snapshots and snapshot contents
427432
var snapshotContentNames []string
428433
for _, snapshot := range snapshots {
@@ -452,6 +457,13 @@ func (ctrl *csiSnapshotSideCarController) createGroupSnapshotWrapper(groupSnapsh
452457
},
453458
}
454459

460+
if groupSnapshotSecret != nil {
461+
klog.V(5).Infof("createGroupSnapshotContent: set annotation [%s] on volume snapshot content [%s].", utils.AnnDeletionSecretRefName, volumeSnapshotContent.Name)
462+
metav1.SetMetaDataAnnotation(&volumeSnapshotContent.ObjectMeta, utils.AnnDeletionSecretRefName, groupSnapshotSecret.Name)
463+
464+
klog.V(5).Infof("createGroupSnapshotContent: set annotation [%s] on volume snapshot content [%s].", utils.AnnDeletionSecretRefNamespace, volumeSnapshotContent.Name)
465+
metav1.SetMetaDataAnnotation(&volumeSnapshotContent.ObjectMeta, utils.AnnDeletionSecretRefNamespace, groupSnapshotSecret.Namespace)
466+
}
455467
label := make(map[string]string)
456468
label["volumeGroupSnapshotName"] = groupSnapshotContent.Spec.VolumeGroupSnapshotRef.Name
457469
volumeSnapshot := &crdv1.VolumeSnapshot{
@@ -503,7 +515,7 @@ func (ctrl *csiSnapshotSideCarController) createGroupSnapshotWrapper(groupSnapsh
503515

504516
func (ctrl *csiSnapshotSideCarController) getCSIGroupSnapshotInput(groupSnapshotContent *crdv1alpha1.VolumeGroupSnapshotContent) (*crdv1alpha1.VolumeGroupSnapshotClass, map[string]string, error) {
505517
className := groupSnapshotContent.Spec.VolumeGroupSnapshotClassName
506-
klog.V(5).Infof("getCSIGroupSnapshotInput for group snapshot content [%s]", groupSnapshotContent.Name)
518+
klog.V(5).Infof("getCSIGroupSnapshotInput for group snapshot content %s", groupSnapshotContent.Name)
507519
var class *crdv1alpha1.VolumeGroupSnapshotClass
508520
var err error
509521
if className != nil {
@@ -522,9 +534,13 @@ func (ctrl *csiSnapshotSideCarController) getCSIGroupSnapshotInput(groupSnapshot
522534
klog.V(5).Infof("getCSISnapshotInput for groupSnapshotContent [%s]: no VolumeGroupSnapshotClassName provided for pre-provisioned group snapshot", groupSnapshotContent.Name)
523535
}
524536

525-
// TODO: Resolve snapshotting secret credentials.
537+
// Resolve snapshotting secret credentials.
538+
snapshotterCredentials, err := ctrl.GetGroupCredentialsFromAnnotation(groupSnapshotContent)
539+
if err != nil {
540+
return nil, nil, err
541+
}
526542

527-
return class, nil, nil
543+
return class, snapshotterCredentials, nil
528544
}
529545

530546
// getGroupSnapshotClass is a helper function to get group snapshot class from the class name.
@@ -831,3 +847,32 @@ func (ctrl *csiSnapshotSideCarController) checkandUpdateGroupSnapshotContentStat
831847
}
832848
return ctrl.createGroupSnapshotWrapper(groupSnapshotContent)
833849
}
850+
851+
func (ctrl *csiSnapshotSideCarController) GetGroupCredentialsFromAnnotation(content *crdv1alpha1.VolumeGroupSnapshotContent) (map[string]string, error) {
852+
var groupSnapshotterCredentials map[string]string
853+
var err error
854+
855+
// Check if annotation exists
856+
if metav1.HasAnnotation(content.ObjectMeta, utils.AnnDeletionSecretRefName) && metav1.HasAnnotation(content.ObjectMeta, utils.AnnDeletionSecretRefNamespace) {
857+
annDeletionSecretName := content.Annotations[utils.AnnDeletionSecretRefName]
858+
annDeletionSecretNamespace := content.Annotations[utils.AnnDeletionSecretRefNamespace]
859+
860+
groupSnapshotterSecretRef := &v1.SecretReference{}
861+
862+
if annDeletionSecretName == "" || annDeletionSecretNamespace == "" {
863+
return nil, fmt.Errorf("cannot retrieve secrets for volume group snapshot content %#v, err: secret name or namespace not specified", content.Name)
864+
}
865+
866+
groupSnapshotterSecretRef.Name = annDeletionSecretName
867+
groupSnapshotterSecretRef.Namespace = annDeletionSecretNamespace
868+
869+
groupSnapshotterCredentials, err = utils.GetCredentials(ctrl.client, groupSnapshotterSecretRef)
870+
if err != nil {
871+
// Continue with deletion, as the secret may have already been deleted.
872+
klog.Errorf("Failed to get credentials for snapshot %s: %s", content.Name, err.Error())
873+
return nil, fmt.Errorf("cannot get credentials for snapshot content %#v", content.Name)
874+
}
875+
}
876+
877+
return groupSnapshotterCredentials, nil
878+
}

‎pkg/utils/util.go

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@ const (
5858
PrefixedSnapshotterSecretNameKey = csiParameterPrefix + "snapshotter-secret-name" // Prefixed name key for DeleteSnapshot secret
5959
PrefixedSnapshotterSecretNamespaceKey = csiParameterPrefix + "snapshotter-secret-namespace" // Prefixed namespace key for DeleteSnapshot secret
6060

61+
PrefixedGroupSnapshotterSecretNameKey = csiParameterPrefix + "group-snapshotter-secret-name" // Prefixed name key for CreateGroupSnapshot secret
62+
PrefixedGroupSnapshotterSecretNamespaceKey = csiParameterPrefix + "group-snapshotter-secret-namespace" // Prefixed namespace key for DeleteGroupSnapshot secret
63+
6164
PrefixedSnapshotterListSecretNameKey = csiParameterPrefix + "snapshotter-list-secret-name" // Prefixed name key for ListSnapshots secret
6265
PrefixedSnapshotterListSecretNamespaceKey = csiParameterPrefix + "snapshotter-list-secret-namespace" // Prefixed namespace key for ListSnapshots secret
6366

@@ -151,6 +154,12 @@ var SnapshotterSecretParams = secretParamsMap{
151154
secretNamespaceKey: PrefixedSnapshotterSecretNamespaceKey,
152155
}
153156

157+
var GroupSnapshotterSecretParams = secretParamsMap{
158+
name: "GroupSnapshotter",
159+
secretNameKey: PrefixedGroupSnapshotterSecretNameKey,
160+
secretNamespaceKey: PrefixedGroupSnapshotterSecretNamespaceKey,
161+
}
162+
154163
var SnapshotterListSecretParams = secretParamsMap{
155164
name: "SnapshotterList",
156165
secretNameKey: PrefixedSnapshotterListSecretNameKey,
@@ -392,6 +401,61 @@ func GetSecretReference(secretParams secretParamsMap, snapshotClassParams map[st
392401
return ref, nil
393402
}
394403

404+
// GetSecretReference for the group snapshot
405+
func GetGroupSnapshotSecretReference(secretParams secretParamsMap, volumeGroupSnapshotClassParams map[string]string, groupSnapContentName string, volumeGroupSnapshot *crdv1alpha1.VolumeGroupSnapshot) (*v1.SecretReference, error) {
406+
nameTemplate, namespaceTemplate, err := verifyAndGetSecretNameAndNamespaceTemplate(secretParams, volumeGroupSnapshotClassParams)
407+
if err != nil {
408+
return nil, fmt.Errorf("failed to get name and namespace template from params: %v", err)
409+
}
410+
if nameTemplate == "" && namespaceTemplate == "" {
411+
return nil, nil
412+
}
413+
414+
ref := &v1.SecretReference{}
415+
416+
// Secret namespace template can make use of the VolumeGroupSnapshotContent name, VolumeGroupSnapshot name or namespace.
417+
// Note that neither of those things are under the control of the VolumeGroupSnapshot user.
418+
namespaceParams := map[string]string{"volumegroupsnapshotcontent.name": groupSnapContentName}
419+
// volume group snapshot may be nil when resolving create/delete volumegroupsnapshot secret names because the
420+
// volume group snapshot may or may not exist at delete time
421+
if volumeGroupSnapshot != nil {
422+
namespaceParams["volumegroupsnapshot.namespace"] = volumeGroupSnapshot.Namespace
423+
}
424+
425+
resolvedNamespace, err := resolveTemplate(namespaceTemplate, namespaceParams)
426+
if err != nil {
427+
return nil, fmt.Errorf("error resolving value %q: %v", namespaceTemplate, err)
428+
}
429+
430+
if len(validation.IsDNS1123Label(resolvedNamespace)) > 0 {
431+
if namespaceTemplate != resolvedNamespace {
432+
return nil, fmt.Errorf("%q resolved to %q which is not a valid namespace name", namespaceTemplate, resolvedNamespace)
433+
}
434+
return nil, fmt.Errorf("%q is not a valid namespace name", namespaceTemplate)
435+
}
436+
ref.Namespace = resolvedNamespace
437+
438+
// Secret name template can make use of the VolumeGroupSnapshotContent name, VolumeGroupSnapshot name or namespace.
439+
// Note that VolumeGroupSnapshot name and namespace are under the VolumeGroupSnapshot user's control.
440+
nameParams := map[string]string{"volumegroupsnapshotcontent.name": groupSnapContentName}
441+
if volumeGroupSnapshot != nil {
442+
nameParams["volumegroupsnapshot.name"] = volumeGroupSnapshot.Name
443+
nameParams["volumegroupsnapshot.namespace"] = volumeGroupSnapshot.Namespace
444+
}
445+
resolvedName, err := resolveTemplate(nameTemplate, nameParams)
446+
if err != nil {
447+
return nil, fmt.Errorf("error resolving value %q: %v", nameTemplate, err)
448+
}
449+
if len(validation.IsDNS1123Subdomain(resolvedName)) > 0 {
450+
if nameTemplate != resolvedName {
451+
return nil, fmt.Errorf("%q resolved to %q which is not a valid secret name", nameTemplate, resolvedName)
452+
}
453+
return nil, fmt.Errorf("%q is not a valid secret name", nameTemplate)
454+
}
455+
ref.Name = resolvedName
456+
return ref, nil
457+
}
458+
395459
// resolveTemplate resolves the template by checking if the value is missing for a key
396460
func resolveTemplate(template string, params map[string]string) (string, error) {
397461
missingParams := sets.NewString()

0 commit comments

Comments
 (0)