Add CnsVolumeAttachment CRD to track VMs attached to a PVC

[skogta]

What this PR does / why we need it:
Creating a new CRD called CnsVolumeAttachment to keep track of VMs that are attached to a given PVC.
This CRD is not user facing and is only meant for book keeping.

This CRD is required because with RWX volumes, a volume can be attached to multiple VMs. It is not safe to delete such a volumes unless all VMs attached to it have been detached.

CSI can rely on this CRD to find out if a given volumes is currently attached or not.

There are 3 functions for this CRD - to add a VM to the instance, to remove a VM from the instance and to find if the CR exists or not.

Testing done:

apiVersion: v1
items:
- apiVersion: cns.vmware.com/v1alpha1
  kind: CnsVolumeAttachment
  metadata:
    creationTimestamp: "2025-07-31T13:33:17Z"
    finalizers:
    - cns.vmware.com
    generation: 1
    name: rwm-pvc-3
    namespace: test
    resourceVersion: "384214"
    uid: ed6c967e-859b-4c26-9f56-0981c29a67c6
  spec:
    attachedVms:
    - 2bcce803-cea3-44ac-968d-e49f2de90379
kind: List
metadata:
  resourceVersion: ""

PVC has finalizer

Name:          pvc-1
Namespace:     test
StorageClass:  vsan-default-storage-policy
Status:        Bound
Volume:        pvc-08dbd91e-63eb-406f-867e-c6c6dfd3fc5e
Labels:        <none>
Annotations:   csi.vsphere.volume-accessible-topology: [{"topology.kubernetes.io/zone":"az1"}]
               pv.kubernetes.io/bind-completed: yes
               pv.kubernetes.io/bound-by-controller: yes
               volume.beta.kubernetes.io/storage-provisioner: csi.vsphere.vmware.com
               volume.kubernetes.io/storage-provisioner: csi.vsphere.vmware.com
               volumehealth.storage.kubernetes.io/health: accessible
               volumehealth.storage.kubernetes.io/health-timestamp: Mon Aug  4 14:26:46 UTC 2025
Finalizers:    [kubernetes.io/pvc-protection cns.vmware.com/pvc-protection]
Capacity:      100Mi
Access Modes:  RWO
VolumeMode:    Filesystem
Used By:       <none>
Events:
  Type    Reason                 Age                    From                                                                                          Message
  ----    ------                 ----                   ----                                                                                          -------
  Normal  Provisioning           2m44s                  csi.vsphere.vmware.com_4200d5d06c7f5c505e20ac022d1225d2_d3cc96bb-a2c5-4996-8bcd-41a6b7ce5584  External provisioner is provisioning volume for claim "test/pvc-1"
  Normal  ExternalProvisioning   2m40s (x4 over 2m44s)  persistentvolume-controller                                                                   Waiting for a volume to be created either by the external provisioner 'csi.vsphere.vmware.com' or manually by the system administrator. If volume creation is delayed, please verify that the provisioner is running and correctly registered.
  Normal  ProvisioningSucceeded  2m40s                  csi.vsphere.vmware.com_4200d5d06c7f5c505e20ac022d1225d2_d3cc96bb-a2c5-4996-8bcd-41a6b7ce5584  Successfully provisioned volume pvc-08dbd91e-63eb-406f-867e-c6c6dfd3fc5e

Logs

{"level":"info","time":"2025-07-31T13:33:47.260032259Z","caller":"cnsvolumeattachment/cnsvolumeattachment.go:196","msg":"Removing VmInstanceUUID 2bcce803-cea3-44ac-968d-e49f2de90379 from cnsVolumeAttachment test/rwm-pvc-3","TraceId":"7dc4f216-ba2f-41f0-8eee-27ff02041af0"}
{"level":"info","time":"2025-07-31T13:33:47.260069943Z","caller":"cnsvolumeattachment/cnsvolumeattachment.go:205","msg":"Acquired lock for cnsVolumeAttachment instance test/rwm-pvc-3","TraceId":"7dc4f216-ba2f-41f0-8eee-27ff02041af0"}
{"level":"info","time":"2025-07-31T13:33:47.277450849Z","caller":"cnsvolumeattachment/cnsvolumeattachment.go:231","msg":"Verifying if VM UUID test/rwm-pvc-3 exists in list of already attached VMs. Current list: [2bcce803-cea3-44ac-968d-e49f2de90379]","TraceId":"7dc4f216-ba2f-41f0-8eee-27ff02041af0"}
{"level":"info","time":"2025-07-31T13:33:47.27752388Z","caller":"cnsvolumeattachment/cnsvolumeattachment.go:237","msg":"Removing VmUUID 2bcce803-cea3-44ac-968d-e49f2de90379 from Attached VMs list","TraceId":"7dc4f216-ba2f-41f0-8eee-27ff02041af0"}
{"level":"info","time":"2025-07-31T13:33:47.277559598Z","caller":"cnsvolumeattachment/cnsvolumeattachment.go:241","msg":"attached VMs after this []","TraceId":"7dc4f216-ba2f-41f0-8eee-27ff02041af0"}
{"level":"info","time":"2025-07-31T13:33:47.277587788Z","caller":"cnsvolumeattachment/cnsvolumeattachment.go:243","msg":"Deleting cnsVolumeAttachment instance test/rwm-pvc-3 from API server","TraceId":"7dc4f216-ba2f-41f0-8eee-27ff02041af0"}
{"level":"info","time":"2025-07-31T13:33:47.277621165Z","caller":"cnsvolumeattachment/cnsvolumeattachment.go:341","msg":"Removing \"cns.vmware.com\" finalizer from CnsNodeVmBatchAttachment instance with name: \"rwm-pvc-3\" on namespace: \"test\"","TraceId":"7dc4f216-ba2f-41f0-8eee-27ff02041af0"}
{"level":"info","time":"2025-07-31T13:33:47.456826302Z","caller":"cnsvolumeattachment/cnsvolumeattachment.go:265","msg":"Successfully deleted cnsVolumeAttachment instance test/rwm-pvc-3","TraceId":"7dc4f216-ba2f-41f0-8eee-27ff02041af0"}
{"level":"info","time":"2025-07-31T13:33:47.456928646Z","caller":"cnsvolumeattachment/cnsvolumeattachment.go:208","msg":"Released lock for instance test/rwm-pvc-3","TraceId":"7dc4f216-ba2f-41f0-8eee-27ff02041af0"}

Deleted PVC and it got stuck in terminating state.
Delete batch attachment CR and observed the PVC also got deleted.

Added unit tests.

[k8s-ci-robot]

Hi @skogta. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[akankshapanse]

/ok-to-test

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: skogta
Once this PR has been reviewed and has the lgtm label, please assign deepakkinni for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[skogta]

ok-to-test-wcp

[deepakkinni]

Triggering CSI-WCP Pre-checkin Pipeline for this PR... Job takes approximately an hour to complete
Jenkins Build #32

[deepakkinni]

SUCCESS --- Jenkins Build #32

[ravikumarkp7]

ok-to-test-wcp

[deepakkinni]

Triggering CSI-WCP Pre-checkin Pipeline for this PR... Job takes approximately an hour to complete
Jenkins Build #38

[deepakkinni]

FAILED --- Jenkins Build #38

[deepakkinni]

Triggering CSI-WCP Pre-checkin Pipeline for this PR... Job takes approximately an hour to complete
Jenkins Build #39

[k8s-ci-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.