Block RWX volume creation for VMFS datastores if policy is not EZT

[skogta]

What this PR does / why we need it:
Add a validation in CSI to fail RWX volume creation if policy is for VMFS datastores and is NOT EZT.
This is a requirement for multiwriter.

Testing done:

DYNAMIC:

Created RWX volume with vSAN policy - reached Bound state.
Created RWX volume with VMFS EZT policy - reached Bound state.

Created RWX volume with VMFS non-EZT policy - stayed in Pending state. See below:

Name:          rwx-pvc-vmfs-non-ezt
Namespace:     test
StorageClass:  vmfs-1
Status:        Pending
Volume:        
Labels:        <none>
Annotations:   volume.beta.kubernetes.io/storage-provisioner: csi.vsphere.vmware.com
               volume.kubernetes.io/storage-provisioner: csi.vsphere.vmware.com
Finalizers:    [kubernetes.io/pvc-protection]
Capacity:      
Access Modes:  
VolumeMode:    Block
Used By:       <none>
Events:
  Type     Reason                Age               From                                                                                          Message
  ----     ------                ----              ----                                                                                          -------
  Normal   ExternalProvisioning  11s               persistentvolume-controller                                                                   Waiting for a volume to be created either by the external provisioner 'csi.vsphere.vmware.com' or manually by the system administrator. If volume creation is delayed, please verify that the provisioner is running and correctly registered.
  Normal   Provisioning          4s (x4 over 11s)  csi.vsphere.vmware.com_42153cccacdf638453d78f7d0390adf1_3583e745-e910-4532-aaad-545d77e3d05e  External provisioner is provisioning volume for claim "test/rwx-pvc-vmfs-non-ezt"
  Warning  ProvisioningFailed    4s (x4 over 11s)  csi.vsphere.vmware.com_42153cccacdf638453d78f7d0390adf1_3583e745-e910-4532-aaad-545d77e3d05e  failed to provision volume with StorageClass "vmfs-1": rpc error: code = Unknown desc = Policy 64059831-c138-49f1-a341-86b10564fbb2 is for VMFS datastores. It must be Thick Provision Eager Zero for RWX block volumes

Created RWXOvolume with vSAN policy - reached Bound state.
Created RWO volume with VMFS EZT policy - reached Bound state.
Created RWO volume with VMFS non-EZT policy - reached Bound state.

STATIC:

Create RWX volume with vSAN policy - PVC and PV got created.
Create RWX volume with VMFS EZT policy - PVC and PV got created.
Create RWX volume with VMFS non-EZT policy - PVC and PV failed o get created. Error:

Name:         test4
Namespace:    test
Labels:       <none>
Annotations:  <none>
API Version:  cns.vmware.com/v1alpha1
Kind:         CnsRegisterVolume
Metadata:
  Creation Timestamp:  2025-11-06T13:56:11Z
  Generation:          1
  Resource Version:    3383517
  UID:                 fb1e2c6f-d80c-428d-9dd0-083eeb66c679
Spec:
  Access Mode:  ReadWriteMany
  Pvc Name:     rwx-block-vmfs-non-ezt
  Volume ID:    6658723e-5a2a-45dd-842e-2218739bf2dd
  Volume Mode:  Block
Status:
  Error:       Policy 64059831-c138-49f1-a341-86b10564fbb2 is for VMFS datastores. It must be Thick Provision Eager Zero for RWX block volumes
  Registered:  false
Events:
  Type     Reason                   Age   From            Message
  ----     ------                   ----  ----            -------
  Warning  CnsRegisterVolumeFailed  1s    cns.vmware.com  Policy 64059831-c138-49f1-a341-86b10564fbb2 is for VMFS datastores. It must be Thick Provision Eager Zero for RWX block volumes

Pre-checkin pipelines are in progress.

[k8s-ci-robot]

Hi @skogta. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[divyenpatel]

/ok-to-test

[divyenpatel]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: divyenpatel, skogta

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [divyenpatel]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[skogta]

/retest-required