Skip to content

Commit e171a98

Browse files
manishymmanishym
committed
Add snapshot secret reference to group snapshot controller.
Fixes: #834 Signed-off-by: Manish <[email protected]>
1 parent 533a2ee commit e171a98

File tree

3 files changed

+132
-10
lines changed

3 files changed

+132
-10
lines changed

‎pkg/common-controller/groupsnapshot_controller_helper.go

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -743,7 +743,7 @@ func (ctrl *csiSnapshotCommonController) createGroupSnapshotContent(groupSnapsho
743743
TODO: Add PVC finalizer
744744
*/
745745

746-
groupSnapshotClass, volumes, contentName, err := ctrl.getCreateGroupSnapshotInput(groupSnapshot)
746+
groupSnapshotClass, volumes, contentName, snapshotterSecretRef, err := ctrl.getCreateGroupSnapshotInput(groupSnapshot)
747747
if err != nil {
748748
return nil, fmt.Errorf("failed to get input parameters to create group snapshot %s: %q", groupSnapshot.Name, err)
749749
}
@@ -773,8 +773,15 @@ func (ctrl *csiSnapshotCommonController) createGroupSnapshotContent(groupSnapsho
773773
}
774774

775775
/*
776-
TODO: Add secret reference details
776+
Add secret reference details
777777
*/
778+
if snapshotterSecretRef != nil {
779+
klog.V(5).Infof("createGroupSnapshotContent: set annotation [%s] on volume group snapshot content [%s].", utils.AnnDeletionSecretRefName, groupSnapshotContent.Name)
780+
metav1.SetMetaDataAnnotation(&groupSnapshotContent.ObjectMeta, utils.AnnDeletionSecretRefName, snapshotterSecretRef.Name)
781+
782+
klog.V(5).Infof("creategroupSnapshotContent: set annotation [%s] on volume group snapshot content [%s].", utils.AnnDeletionSecretRefNamespace, groupSnapshotContent.Name)
783+
metav1.SetMetaDataAnnotation(&groupSnapshotContent.ObjectMeta, utils.AnnDeletionSecretRefNamespace, snapshotterSecretRef.Namespace)
784+
}
778785

779786
var updateGroupSnapshotContent *crdv1alpha1.VolumeGroupSnapshotContent
780787
klog.V(5).Infof("volume group snapshot content %#v", groupSnapshotContent)
@@ -810,7 +817,7 @@ func (ctrl *csiSnapshotCommonController) createGroupSnapshotContent(groupSnapsho
810817
return updateGroupSnapshotContent, nil
811818
}
812819

813-
func (ctrl *csiSnapshotCommonController) getCreateGroupSnapshotInput(groupSnapshot *crdv1alpha1.VolumeGroupSnapshot) (*crdv1alpha1.VolumeGroupSnapshotClass, []*v1.PersistentVolume, string, error) {
820+
func (ctrl *csiSnapshotCommonController) getCreateGroupSnapshotInput(groupSnapshot *crdv1alpha1.VolumeGroupSnapshot) (*crdv1alpha1.VolumeGroupSnapshotClass, []*v1.PersistentVolume, string, *v1.SecretReference, error) {
814821
className := groupSnapshot.Spec.VolumeGroupSnapshotClassName
815822
klog.V(5).Infof("getCreateGroupSnapshotInput [%s]", groupSnapshot.Name)
816823
var groupSnapshotClass *crdv1alpha1.VolumeGroupSnapshotClass
@@ -819,23 +826,29 @@ func (ctrl *csiSnapshotCommonController) getCreateGroupSnapshotInput(groupSnapsh
819826
groupSnapshotClass, err = ctrl.getGroupSnapshotClass(*className)
820827
if err != nil {
821828
klog.Errorf("getCreateGroupSnapshotInput failed to getClassFromVolumeGroupSnapshot %s", err)
822-
return nil, nil, "", err
829+
return nil, nil, "", nil, err
823830
}
824831
} else {
825832
klog.Errorf("failed to getCreateGroupSnapshotInput %s without a group snapshot class", groupSnapshot.Name)
826-
return nil, nil, "", fmt.Errorf("failed to take group snapshot %s without a group snapshot class", groupSnapshot.Name)
833+
return nil, nil, "", nil, fmt.Errorf("failed to take group snapshot %s without a group snapshot class", groupSnapshot.Name)
827834
}
828835

829836
volumes, err := ctrl.getVolumesFromVolumeGroupSnapshot(groupSnapshot)
830837
if err != nil {
831838
klog.Errorf("getCreateGroupSnapshotInput failed to get PersistentVolume objects [%s]: Error: [%#v]", groupSnapshot.Name, err)
832-
return nil, nil, "", err
839+
return nil, nil, "", nil, err
833840
}
834841

835842
// Create VolumeGroupSnapshotContent name
836843
contentName := utils.GetDynamicSnapshotContentNameForGroupSnapshot(groupSnapshot)
837844

838-
return groupSnapshotClass, volumes, contentName, nil
845+
// Get the secret reference
846+
snapshotterSecretRef, err := utils.GetGroupSnapshotSecretReference(utils.SnapshotterSecretParams, groupSnapshotClass.Parameters, contentName, groupSnapshot)
847+
if err != nil {
848+
return nil, nil, "", nil, err
849+
}
850+
851+
return groupSnapshotClass, volumes, contentName, snapshotterSecretRef, nil
839852
}
840853

841854
// syncGroupSnapshotContent deals with one key off the queue

‎pkg/sidecar-controller/groupsnapshot_helper.go

Lines changed: 48 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -423,6 +423,11 @@ func (ctrl *csiSnapshotSideCarController) createGroupSnapshotWrapper(groupSnapsh
423423
creationTime = time.Now()
424424
}
425425

426+
groupSnapshotSecret, err := utils.GetSecretReference(utils.GroupSnapshotterSecretParams, class.Parameters, groupSnapshotContent.GetObjectMeta().GetName(), nil)
427+
if err != nil {
428+
klog.Errorf("Failed to get secret reference for group snapshot content %s: %v", groupSnapshotContent.Name, err)
429+
return groupSnapshotContent, fmt.Errorf("failed to get secret reference for group snapshot content %s: %v", groupSnapshotContent.Name, err)
430+
}
426431
// Create individual snapshots and snapshot contents
427432
var snapshotContentNames []string
428433
for _, snapshot := range snapshots {
@@ -452,6 +457,13 @@ func (ctrl *csiSnapshotSideCarController) createGroupSnapshotWrapper(groupSnapsh
452457
},
453458
}
454459

460+
if groupSnapshotSecret != nil {
461+
klog.V(5).Infof("createGroupSnapshotContent: set annotation [%s] on volume snapshot content [%s].", utils.AnnDeletionSecretRefName, volumeSnapshotContent.Name)
462+
metav1.SetMetaDataAnnotation(&volumeSnapshotContent.ObjectMeta, utils.AnnDeletionSecretRefName, groupSnapshotSecret.Name)
463+
464+
klog.V(5).Infof("createGroupSnapshotContent: set annotation [%s] on volume snapshot content [%s].", utils.AnnDeletionSecretRefNamespace, volumeSnapshotContent.Name)
465+
metav1.SetMetaDataAnnotation(&volumeSnapshotContent.ObjectMeta, utils.AnnDeletionSecretRefNamespace, groupSnapshotSecret.Namespace)
466+
}
455467
label := make(map[string]string)
456468
label["volumeGroupSnapshotName"] = groupSnapshotContent.Spec.VolumeGroupSnapshotRef.Name
457469
volumeSnapshot := &crdv1.VolumeSnapshot{
@@ -498,7 +510,7 @@ func (ctrl *csiSnapshotSideCarController) createGroupSnapshotWrapper(groupSnapsh
498510

499511
func (ctrl *csiSnapshotSideCarController) getCSIGroupSnapshotInput(groupSnapshotContent *crdv1alpha1.VolumeGroupSnapshotContent) (*crdv1alpha1.VolumeGroupSnapshotClass, map[string]string, error) {
500512
className := groupSnapshotContent.Spec.VolumeGroupSnapshotClassName
501-
klog.V(5).Infof("getCSIGroupSnapshotInput for group snapshot content [%s]", groupSnapshotContent.Name)
513+
klog.V(5).Infof("getCSIGroupSnapshotInput for group snapshot content %s", groupSnapshotContent.Name)
502514
var class *crdv1alpha1.VolumeGroupSnapshotClass
503515
var err error
504516
if className != nil {
@@ -517,9 +529,13 @@ func (ctrl *csiSnapshotSideCarController) getCSIGroupSnapshotInput(groupSnapshot
517529
klog.V(5).Infof("getCSISnapshotInput for groupSnapshotContent [%s]: no VolumeGroupSnapshotClassName provided for pre-provisioned group snapshot", groupSnapshotContent.Name)
518530
}
519531

520-
// TODO: Resolve snapshotting secret credentials.
532+
// Resolve snapshotting secret credentials.
533+
snapshotterCredentials, err := ctrl.GetGroupCredentialsFromAnnotation(groupSnapshotContent)
534+
if err != nil {
535+
return nil, nil, err
536+
}
521537

522-
return class, nil, nil
538+
return class, snapshotterCredentials, nil
523539
}
524540

525541
// getGroupSnapshotClass is a helper function to get group snapshot class from the class name.
@@ -826,3 +842,32 @@ func (ctrl *csiSnapshotSideCarController) checkandUpdateGroupSnapshotContentStat
826842
}
827843
return ctrl.createGroupSnapshotWrapper(groupSnapshotContent)
828844
}
845+
846+
func (ctrl *csiSnapshotSideCarController) GetGroupCredentialsFromAnnotation(content *crdv1alpha1.VolumeGroupSnapshotContent) (map[string]string, error) {
847+
var groupSnapshotterCredentials map[string]string
848+
var err error
849+
850+
// Check if annotation exists
851+
if metav1.HasAnnotation(content.ObjectMeta, utils.AnnDeletionSecretRefName) && metav1.HasAnnotation(content.ObjectMeta, utils.AnnDeletionSecretRefNamespace) {
852+
annDeletionSecretName := content.Annotations[utils.AnnDeletionSecretRefName]
853+
annDeletionSecretNamespace := content.Annotations[utils.AnnDeletionSecretRefNamespace]
854+
855+
groupSnapshotterSecretRef := &v1.SecretReference{}
856+
857+
if annDeletionSecretName == "" || annDeletionSecretNamespace == "" {
858+
return nil, fmt.Errorf("cannot retrieve secrets for volume group snapshot content %#v, err: secret name or namespace not specified", content.Name)
859+
}
860+
861+
groupSnapshotterSecretRef.Name = annDeletionSecretName
862+
groupSnapshotterSecretRef.Namespace = annDeletionSecretNamespace
863+
864+
groupSnapshotterCredentials, err = utils.GetCredentials(ctrl.client, groupSnapshotterSecretRef)
865+
if err != nil {
866+
// Continue with deletion, as the secret may have already been deleted.
867+
klog.Errorf("Failed to get credentials for snapshot %s: %s", content.Name, err.Error())
868+
return nil, fmt.Errorf("cannot get credentials for snapshot content %#v", content.Name)
869+
}
870+
}
871+
872+
return groupSnapshotterCredentials, nil
873+
}

‎pkg/utils/util.go

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,9 @@ const (
5757
PrefixedSnapshotterSecretNameKey = csiParameterPrefix + "snapshotter-secret-name" // Prefixed name key for DeleteSnapshot secret
5858
PrefixedSnapshotterSecretNamespaceKey = csiParameterPrefix + "snapshotter-secret-namespace" // Prefixed namespace key for DeleteSnapshot secret
5959

60+
PrefixedGroupSnapshotterSecretNameKey = csiParameterPrefix + "group-snapshotter-secret-name" // Prefixed name key for CreateGroupSnapshot secret
61+
PrefixedGroupSnapshotterSecretNamespaceKey = csiParameterPrefix + "group-snapshotter-secret-namespace" // Prefixed namespace key for DeleteGroupSnapshot secret
62+
6063
PrefixedSnapshotterListSecretNameKey = csiParameterPrefix + "snapshotter-list-secret-name" // Prefixed name key for ListSnapshots secret
6164
PrefixedSnapshotterListSecretNamespaceKey = csiParameterPrefix + "snapshotter-list-secret-namespace" // Prefixed namespace key for ListSnapshots secret
6265

@@ -150,6 +153,12 @@ var SnapshotterSecretParams = secretParamsMap{
150153
secretNamespaceKey: PrefixedSnapshotterSecretNamespaceKey,
151154
}
152155

156+
var GroupSnapshotterSecretParams = secretParamsMap{
157+
name: "GroupSnapshotter",
158+
secretNameKey: PrefixedGroupSnapshotterSecretNameKey,
159+
secretNamespaceKey: PrefixedGroupSnapshotterSecretNamespaceKey,
160+
}
161+
153162
var SnapshotterListSecretParams = secretParamsMap{
154163
name: "SnapshotterList",
155164
secretNameKey: PrefixedSnapshotterListSecretNameKey,
@@ -376,6 +385,61 @@ func GetSecretReference(secretParams secretParamsMap, snapshotClassParams map[st
376385
return ref, nil
377386
}
378387

388+
// GetSecretReference for the group snapshot
389+
func GetGroupSnapshotSecretReference(secretParams secretParamsMap, volumeGroupSnapshotClassParams map[string]string, groupSnapContentName string, volumeGroupSnapshot *crdv1alpha1.VolumeGroupSnapshot) (*v1.SecretReference, error) {
390+
nameTemplate, namespaceTemplate, err := verifyAndGetSecretNameAndNamespaceTemplate(secretParams, volumeGroupSnapshotClassParams)
391+
if err != nil {
392+
return nil, fmt.Errorf("failed to get name and namespace template from params: %v", err)
393+
}
394+
if nameTemplate == "" && namespaceTemplate == "" {
395+
return nil, nil
396+
}
397+
398+
ref := &v1.SecretReference{}
399+
400+
// Secret namespace template can make use of the VolumeGroupSnapshotContent name, VolumeGroupSnapshot name or namespace.
401+
// Note that neither of those things are under the control of the VolumeGroupSnapshot user.
402+
namespaceParams := map[string]string{"volumegroupsnapshotcontent.name": groupSnapContentName}
403+
// volume group snapshot may be nil when resolving create/delete volumegroupsnapshot secret names because the
404+
// volume group snapshot may or may not exist at delete time
405+
if volumeGroupSnapshot != nil {
406+
namespaceParams["volumegroupsnapshot.namespace"] = volumeGroupSnapshot.Namespace
407+
}
408+
409+
resolvedNamespace, err := resolveTemplate(namespaceTemplate, namespaceParams)
410+
if err != nil {
411+
return nil, fmt.Errorf("error resolving value %q: %v", namespaceTemplate, err)
412+
}
413+
414+
if len(validation.IsDNS1123Label(resolvedNamespace)) > 0 {
415+
if namespaceTemplate != resolvedNamespace {
416+
return nil, fmt.Errorf("%q resolved to %q which is not a valid namespace name", namespaceTemplate, resolvedNamespace)
417+
}
418+
return nil, fmt.Errorf("%q is not a valid namespace name", namespaceTemplate)
419+
}
420+
ref.Namespace = resolvedNamespace
421+
422+
// Secret name template can make use of the VolumeGroupSnapshotContent name, VolumeGroupSnapshot name or namespace.
423+
// Note that VolumeGroupSnapshot name and namespace are under the VolumeGroupSnapshot user's control.
424+
nameParams := map[string]string{"volumegroupsnapshotcontent.name": groupSnapContentName}
425+
if volumeGroupSnapshot != nil {
426+
nameParams["volumegroupsnapshot.name"] = volumeGroupSnapshot.Name
427+
nameParams["volumegroupsnapshot.namespace"] = volumeGroupSnapshot.Namespace
428+
}
429+
resolvedName, err := resolveTemplate(nameTemplate, nameParams)
430+
if err != nil {
431+
return nil, fmt.Errorf("error resolving value %q: %v", nameTemplate, err)
432+
}
433+
if len(validation.IsDNS1123Subdomain(resolvedName)) > 0 {
434+
if nameTemplate != resolvedName {
435+
return nil, fmt.Errorf("%q resolved to %q which is not a valid secret name", nameTemplate, resolvedName)
436+
}
437+
return nil, fmt.Errorf("%q is not a valid secret name", nameTemplate)
438+
}
439+
ref.Name = resolvedName
440+
return ref, nil
441+
}
442+
379443
// resolveTemplate resolves the template by checking if the value is missing for a key
380444
func resolveTemplate(template string, params map[string]string) (string, error) {
381445
missingParams := sets.NewString()

0 commit comments

Comments
 (0)