Skip to content

Commit 1937e19

Browse files
andyzhangxandyzhangx
committed
chore: make confidentialContainerLabel configurable in storage class
1 parent 8bd4dcd commit 1937e19

File tree

5 files changed

+66
-55
lines changed

5 files changed

+66
-55
lines changed

‎pkg/azurefile/azurefile.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,8 @@ const (
162162
premium = "premium"
163163
selectRandomMatchingAccountField = "selectrandommatchingaccount"
164164
accountQuotaField = "accountquota"
165-
defaultKataCCLabel = "kubernetes.azure.com/kata-cc-isolation"
165+
confidentialContainerLabelField = "confidentialcontainerlabel"
166+
defaultConfidentialContainerLabel = "kubernetes.azure.com/kata-cc-isolation"
166167
runtimeClassHandlerField = "runtimeclasshandler"
167168
defaultRuntimeClassHandler = "kata-cc"
168169

@@ -472,7 +473,7 @@ func (d *Driver) Run(ctx context.Context) error {
472473
csi.RegisterControllerServer(server, d)
473474
csi.RegisterNodeServer(server, d)
474475
d.server = server
475-
d.isKataNode = isKataNode(ctx, d.NodeID, d.kubeClient)
476+
d.isKataNode = isKataNode(ctx, d.NodeID, defaultConfidentialContainerLabel, d.kubeClient)
476477

477478
listener, err := csicommon.ListenEndpoint(ctx, d.endpoint)
478479
if err != nil {
@@ -1345,7 +1346,7 @@ func (d *Driver) getFileShareClientForSub(subscriptionID string) (fileshareclien
13451346
return d.cloud.ComputeClientFactory.GetFileShareClientForSub(subscriptionID)
13461347
}
13471348

1348-
func isKataNode(ctx context.Context, nodeID string, kubeClient clientset.Interface) bool {
1349+
func isKataNode(ctx context.Context, nodeID, confidentialContainerLabel string, kubeClient clientset.Interface) bool {
13491350
if nodeID == "" {
13501351
return false
13511352
}
@@ -1366,7 +1367,7 @@ func isKataNode(ctx context.Context, nodeID string, kubeClient clientset.Interfa
13661367
}
13671368

13681369
// Check for the kata isolation labels
1369-
if _, ok := node.Labels[defaultKataCCLabel]; !ok {
1370+
if _, ok := node.Labels[confidentialContainerLabel]; !ok {
13701371
return false
13711372
}
13721373
klog.V(4).Infof("node(%s) is a kata node with labels: %v", nodeID, node.Labels)

‎pkg/azurefile/azurefile_test.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1675,7 +1675,7 @@ func TestIsKataNode(t *testing.T) {
16751675
nodeName: "test-node",
16761676
setupClient: true,
16771677
labels: map[string]string{
1678-
defaultKataCCLabel: "",
1678+
defaultConfidentialContainerLabel: "",
16791679
},
16801680
expected: true,
16811681
},
@@ -1684,7 +1684,7 @@ func TestIsKataNode(t *testing.T) {
16841684
nodeName: "test-node",
16851685
setupClient: true,
16861686
labels: map[string]string{
1687-
defaultKataCCLabel: "test",
1687+
defaultConfidentialContainerLabel: "test",
16881688
"kubernetes.azure.com/kata-mshv-vm-isolation": "true",
16891689
"katacontainers.io/kata-runtime": "true",
16901690
},
@@ -1711,7 +1711,7 @@ func TestIsKataNode(t *testing.T) {
17111711
_, err := clientset.CoreV1().Nodes().Create(ctx, node, metav1.CreateOptions{})
17121712
assert.NoError(t, err)
17131713
}
1714-
result := isKataNode(ctx, tc.nodeName, clientset)
1714+
result := isKataNode(ctx, tc.nodeName, defaultConfidentialContainerLabel, clientset)
17151715
assert.Equal(t, tc.expected, result)
17161716
})
17171717
}

‎pkg/azurefile/controllerserver.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,7 @@ func (d *Driver) CreateVolume(ctx context.Context, req *csi.CreateVolumeRequest)
228228
case serverNameField:
229229
case folderNameField:
230230
case clientIDField:
231+
case confidentialContainerLabelField:
231232
case runtimeClassHandlerField:
232233
// no op, only used in NodeStageVolume
233234
case fsGroupChangePolicyField:

‎pkg/azurefile/controllerserver_test.go

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -906,23 +906,24 @@ var _ = ginkgo.Describe("TestCreateVolume", func() {
906906
}
907907

908908
allParam := map[string]string{
909-
skuNameField: "premium",
910-
storageAccountTypeField: "stoacctype",
911-
locationField: "loc",
912-
storageAccountField: "stoacc",
913-
resourceGroupField: "rg",
914-
shareNameField: "",
915-
diskNameField: "diskname.vhd",
916-
fsTypeField: "",
917-
storeAccountKeyField: "storeaccountkey",
918-
secretNamespaceField: "default",
919-
mountPermissionsField: "0755",
920-
accountQuotaField: "1000",
921-
useDataPlaneAPIField: "oauth",
922-
clientIDField: "client-id",
923-
provisionedBandwidthField: "100",
924-
provisionedIopsField: "800",
925-
runtimeClassHandlerField: "runtime-handler",
909+
skuNameField: "premium",
910+
storageAccountTypeField: "stoacctype",
911+
locationField: "loc",
912+
storageAccountField: "stoacc",
913+
resourceGroupField: "rg",
914+
shareNameField: "",
915+
diskNameField: "diskname.vhd",
916+
fsTypeField: "",
917+
storeAccountKeyField: "storeaccountkey",
918+
secretNamespaceField: "default",
919+
mountPermissionsField: "0755",
920+
accountQuotaField: "1000",
921+
useDataPlaneAPIField: "oauth",
922+
clientIDField: "client-id",
923+
provisionedBandwidthField: "100",
924+
provisionedIopsField: "800",
925+
runtimeClassHandlerField: "runtime-handler",
926+
confidentialContainerLabelField: "confidential-container-label",
926927
}
927928

928929
req := &csi.CreateVolumeRequest{

‎pkg/azurefile/nodeserver.go

Lines changed: 39 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -113,44 +113,52 @@ func (d *Driver) NodePublishVolume(ctx context.Context, req *csi.NodePublishVolu
113113
}
114114
}
115115

116-
enableKataCCMount := d.isKataNode && d.enableKataCCMount
117-
if enableKataCCMount && context[podNameField] != "" && context[podNamespaceField] != "" {
118-
runtimeClass, err := getRuntimeClassForPodFunc(ctx, d.kubeClient, context[podNameField], context[podNamespaceField])
119-
if err != nil {
120-
return nil, status.Errorf(codes.Internal, "failed to get runtime class for pod %s/%s: %v", context[podNamespaceField], context[podNameField], err)
121-
}
122-
klog.V(2).Infof("NodePublishVolume: volume(%s) mount on %s with runtimeClass %s", volumeID, target, runtimeClass)
123-
runtimeClassHandler := getValueInMap(context, runtimeClassHandlerField)
124-
if runtimeClassHandler == "" {
125-
runtimeClassHandler = defaultRuntimeClassHandler
126-
}
127-
isConfidentialRuntimeClass, err := isConfidentialRuntimeClassFunc(ctx, d.kubeClient, runtimeClass, runtimeClassHandler)
128-
if err != nil {
129-
return nil, status.Errorf(codes.Internal, "failed to check if runtime class %s is confidential: %v", runtimeClass, err)
116+
if d.enableKataCCMount && context[podNameField] != "" && context[podNamespaceField] != "" {
117+
enableKataCCMount := d.isKataNode
118+
confidentialContainerLabel := getValueInMap(context, confidentialContainerLabelField)
119+
if !enableKataCCMount && confidentialContainerLabel != "" {
120+
klog.V(2).Infof("NodePublishVolume: checking if node %s is a kata node with confidential container label %s", d.NodeID, confidentialContainerLabel)
121+
enableKataCCMount = isKataNode(ctx, d.NodeID, confidentialContainerLabel, d.kubeClient)
130122
}
131-
if isConfidentialRuntimeClass {
132-
klog.V(2).Infof("NodePublishVolume for volume(%s) where runtimeClass is %s", volumeID, runtimeClass)
133-
source := req.GetStagingTargetPath()
134-
if len(source) == 0 {
135-
return nil, status.Error(codes.InvalidArgument, "Staging target not provided")
136-
}
137-
// Load the mount info from staging area
138-
mountInfo, err := d.directVolume.VolumeMountInfo(source)
123+
124+
if enableKataCCMount {
125+
runtimeClass, err := getRuntimeClassForPodFunc(ctx, d.kubeClient, context[podNameField], context[podNamespaceField])
139126
if err != nil {
140-
return nil, status.Errorf(codes.Internal, "failed to load mount info from %s: %v", source, err)
127+
return nil, status.Errorf(codes.Internal, "failed to get runtime class for pod %s/%s: %v", context[podNamespaceField], context[podNameField], err)
141128
}
142-
if mountInfo == nil {
143-
return nil, status.Errorf(codes.Internal, "mount info is nil for volume %s", volumeID)
129+
klog.V(2).Infof("NodePublishVolume: volume(%s) mount on %s with runtimeClass %s", volumeID, target, runtimeClass)
130+
runtimeClassHandler := getValueInMap(context, runtimeClassHandlerField)
131+
if runtimeClassHandler == "" {
132+
runtimeClassHandler = defaultRuntimeClassHandler
144133
}
145-
data, err := json.Marshal(mountInfo)
134+
isConfidentialRuntimeClass, err := isConfidentialRuntimeClassFunc(ctx, d.kubeClient, runtimeClass, runtimeClassHandler)
146135
if err != nil {
147-
return nil, status.Errorf(codes.Internal, "failed to marshal mount info %s: %v", source, err)
136+
return nil, status.Errorf(codes.Internal, "failed to check if runtime class %s is confidential: %v", runtimeClass, err)
148137
}
149-
if err = d.directVolume.Add(target, string(data)); err != nil {
150-
return nil, status.Errorf(codes.Internal, "failed to save mount info %s: %v", target, err)
138+
if isConfidentialRuntimeClass {
139+
klog.V(2).Infof("NodePublishVolume for volume(%s) where runtimeClass is %s", volumeID, runtimeClass)
140+
source := req.GetStagingTargetPath()
141+
if len(source) == 0 {
142+
return nil, status.Error(codes.InvalidArgument, "Staging target not provided")
143+
}
144+
// Load the mount info from staging area
145+
mountInfo, err := d.directVolume.VolumeMountInfo(source)
146+
if err != nil {
147+
return nil, status.Errorf(codes.Internal, "failed to load mount info from %s: %v", source, err)
148+
}
149+
if mountInfo == nil {
150+
return nil, status.Errorf(codes.Internal, "mount info is nil for volume %s", volumeID)
151+
}
152+
data, err := json.Marshal(mountInfo)
153+
if err != nil {
154+
return nil, status.Errorf(codes.Internal, "failed to marshal mount info %s: %v", source, err)
155+
}
156+
if err = d.directVolume.Add(target, string(data)); err != nil {
157+
return nil, status.Errorf(codes.Internal, "failed to save mount info %s: %v", target, err)
158+
}
159+
klog.V(2).Infof("NodePublishVolume: direct volume mount %s at %s successfully", source, target)
160+
return &csi.NodePublishVolumeResponse{}, nil
151161
}
152-
klog.V(2).Infof("NodePublishVolume: direct volume mount %s at %s successfully", source, target)
153-
return &csi.NodePublishVolumeResponse{}, nil
154162
}
155163
}
156164
}

0 commit comments

Comments
 (0)