diff --git a/docs/driver-parameters.md b/docs/driver-parameters.md index 9290463b7d..697e5ce3dd 100644 --- a/docs/driver-parameters.md +++ b/docs/driver-parameters.md @@ -20,8 +20,9 @@ accessTier | [Access tier for file share](https://docs.microsoft.com/en-us/azure server | specify Azure storage account server address | existing server address, e.g. `accountname.privatelink.file.core.windows.net` | No | if empty, driver will use default `accountname.file.core.windows.net` or other sovereign cloud account address disableDeleteRetentionPolicy | specify whether disable DeleteRetentionPolicy for storage account created by driver | `true`,`false` | No | `false` allowBlobPublicAccess | Allow or disallow public access to all blobs or containers for storage account created by driver | `true`,`false` | No | `false` -storageEndpointSuffix | specify Azure storage endpoint suffix | `core.windows.net` | No | if empty, driver will use default storage endpoint suffix according to cloud environment, e.g. `core.windows.net` +storageEndpointSuffix | specify Azure storage endpoint suffix | `core.windows.net`, `core.chinacloudapi.cn`, etc | No | if empty, driver will use default storage endpoint suffix according to cloud environment, e.g. `core.windows.net` tags | [tags](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources) would be created in newly created storage account | tag format: 'foo=aaa,bar=bbb' | No | "" +matchTags | specify whether matching tags when driver tries to find a suitable storage account | `true`,`false` | No | `false` --- | **Following parameters are only for SMB protocol** | --- | --- | subscriptionID | specify Azure subscription ID in which Azure file share will be created | Azure subscription ID | No | if not empty, `resourceGroup` must be provided storeAccountKey | whether store account key to k8s secret

Note:
`false` means driver would leverage kubelet identity to get account key | `true`,`false` | No | `true` diff --git a/go.mod b/go.mod index aa7be32c01..f8cce15bff 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module sigs.k8s.io/azurefile-csi-driver go 1.17 require ( - github.com/Azure/azure-sdk-for-go v63.1.0+incompatible + github.com/Azure/azure-sdk-for-go v63.2.0+incompatible github.com/Azure/azure-storage-file-go v0.8.0 github.com/Azure/go-autorest/autorest v0.11.25 github.com/Azure/go-autorest/autorest/adal v0.9.18 @@ -150,5 +150,5 @@ replace ( k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.24.0-alpha.4 k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.24.0-alpha.4 k8s.io/sample-controller => k8s.io/sample-controller v0.24.0-alpha.4 - sigs.k8s.io/cloud-provider-azure => sigs.k8s.io/cloud-provider-azure v0.7.1-0.20220406062855-4f3bab6bc8b2 + sigs.k8s.io/cloud-provider-azure => sigs.k8s.io/cloud-provider-azure v0.7.1-0.20220415032100-325969906b39 ) diff --git a/go.sum b/go.sum index e37a1ee710..a8397da6c1 100644 --- a/go.sum +++ b/go.sum @@ -43,8 +43,8 @@ dmitri.shuralyov.com/gpu/mtl v0.0.0-20201218220906-28db891af037/go.mod h1:H6x//7 github.com/Azure/azure-pipeline-go v0.2.1 h1:OLBdZJ3yvOn2MezlWvbrBMTEUQC72zAftRZOMdj5HYo= github.com/Azure/azure-pipeline-go v0.2.1/go.mod h1:UGSo8XybXnIGZ3epmeBw7Jdz+HiUVpqIlpz/HKHylF4= github.com/Azure/azure-sdk-for-go v55.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc= -github.com/Azure/azure-sdk-for-go v63.1.0+incompatible h1:yNC7qlSUWVF8p0TzxdmWW1FJ3DdIA+0Pge41IU/2+9U= -github.com/Azure/azure-sdk-for-go v63.1.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc= +github.com/Azure/azure-sdk-for-go v63.2.0+incompatible h1:OIqkK/zTGqVUuzpEvY0B1YSYDRAFC/j+y0w2GovCggI= +github.com/Azure/azure-sdk-for-go v63.2.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc= github.com/Azure/azure-storage-file-go v0.8.0 h1:OX8DGsleWLUE6Mw4R/OeWEZMvsTIpwN94J59zqKQnTI= github.com/Azure/azure-storage-file-go v0.8.0/go.mod h1:3w3mufGcMjcOJ3w+4Gs+5wsSgkT7xDwWWqMMIrXtW4c= github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8= @@ -1220,8 +1220,8 @@ rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.27/go.mod h1:tq2nT0Kx7W+/f2JVE+zxYtUhdjuELJkVpNz+x/QN5R4= sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.30 h1:dUk62HQ3ZFhD48Qr8MIXCiKA8wInBQCtuE4QGfFW7yA= sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.30/go.mod h1:fEO7lRTdivWO2qYVCVG7dEADOMo/MLDCVr8So2g88Uw= -sigs.k8s.io/cloud-provider-azure v0.7.1-0.20220406062855-4f3bab6bc8b2 h1:+gTjgmMhhQ5rpd9jo10ZUiAra+GLAO/5/9Cu5VYHy68= -sigs.k8s.io/cloud-provider-azure v0.7.1-0.20220406062855-4f3bab6bc8b2/go.mod h1:QP8vTdPEAKK2W+sIgCDQIr15Ivc+tYMRMrJS+Clv85I= +sigs.k8s.io/cloud-provider-azure v0.7.1-0.20220415032100-325969906b39 h1:p7amRwo+9wihR5TcHSqMZNdA/VLADopmVyVu7ZDVpCE= +sigs.k8s.io/cloud-provider-azure v0.7.1-0.20220415032100-325969906b39/go.mod h1:k/vjhynZDcDyV8Z1Pfpmel/SfoNC6mKHU9K9Nmf85i4= sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6/go.mod h1:p4QtZmO4uMYipTQNzagwnNoseA6OxSUutVw05NhYDRs= sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 h1:kDi4JBNAsJWfz1aEXhO8Jg87JJaPNLh5tIzYHgStQ9Y= sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2/go.mod h1:B+TnT182UBxE84DiCz4CVE26eOSDAeYCpfDnC2kdKMY= diff --git a/pkg/azurefile/azurefile.go b/pkg/azurefile/azurefile.go index b877a1e30b..b9fd93fc8c 100644 --- a/pkg/azurefile/azurefile.go +++ b/pkg/azurefile/azurefile.go @@ -85,6 +85,7 @@ const ( serverNameField = "server" fsTypeField = "fstype" protocolField = "protocol" + matchTagsField = "matchtags" tagsField = "tags" storageAccountField = "storageaccount" storageAccountTypeField = "storageaccounttype" diff --git a/pkg/azurefile/controllerserver.go b/pkg/azurefile/controllerserver.go index 4a1b5fc498..c124d4b10d 100644 --- a/pkg/azurefile/controllerserver.go +++ b/pkg/azurefile/controllerserver.go @@ -109,7 +109,7 @@ func (d *Driver) CreateVolume(ctx context.Context, req *csi.CreateVolumeRequest) } var sku, subsID, resourceGroup, location, account, fileShareName, diskName, fsType, secretName string var secretNamespace, pvcNamespace, protocol, customTags, storageEndpointSuffix, networkEndpointType, accessTier, rootSquashType string - var createAccount, useDataPlaneAPI, useSeretCache, disableDeleteRetentionPolicy, enableLFS bool + var createAccount, useDataPlaneAPI, useSeretCache, disableDeleteRetentionPolicy, enableLFS, matchTags bool var vnetResourceGroup, vnetName, subnetName, shareNamePrefix string // set allowBlobPublicAccess as false by default allowBlobPublicAccess := to.BoolPtr(false) @@ -149,6 +149,8 @@ func (d *Driver) CreateVolume(ctx context.Context, req *csi.CreateVolumeRequest) secretNamespace = v case protocolField: protocol = v + case matchTagsField: + matchTags = strings.EqualFold(v, trueValue) case tagsField: customTags = v case createAccountField: @@ -203,6 +205,10 @@ func (d *Driver) CreateVolume(ctx context.Context, req *csi.CreateVolumeRequest) } } + if matchTags && account != "" { + return nil, status.Errorf(codes.InvalidArgument, fmt.Sprintf("matchTags must set as false when storageAccount(%s) is provided", account)) + } + if subsID != "" && subsID != d.cloud.SubscriptionID { if fsType == nfs || protocol == nfs { return nil, status.Errorf(codes.InvalidArgument, fmt.Sprintf("NFS protocol is not supported in cross subscription(%s)", subsID)) @@ -321,6 +327,7 @@ func (d *Driver) CreateVolume(ctx context.Context, req *csi.CreateVolumeRequest) ResourceGroup: resourceGroup, Location: location, EnableHTTPSTrafficOnly: enableHTTPSTrafficOnly, + MatchTags: matchTags, Tags: tags, VirtualNetworkResourceIDs: vnetResourceIDs, CreateAccount: createAccount, diff --git a/pkg/azurefile/controllerserver_test.go b/pkg/azurefile/controllerserver_test.go index 22b7cedb1a..7af6e6168b 100644 --- a/pkg/azurefile/controllerserver_test.go +++ b/pkg/azurefile/controllerserver_test.go @@ -174,19 +174,10 @@ func TestCreateVolume(t *testing.T) { name: "Volume lock already present", testFunc: func(t *testing.T) { req := &csi.CreateVolumeRequest{ - Name: "random-vol-name-vol-cap-invalid", - CapacityRange: stdCapRange, - VolumeCapabilities: []*csi.VolumeCapability{ - { - AccessType: &csi.VolumeCapability_Block{ - Block: nil, - }, - AccessMode: &csi.VolumeCapability_AccessMode{ - Mode: csi.VolumeCapability_AccessMode_SINGLE_NODE_WRITER, - }, - }, - }, - Parameters: nil, + Name: "random-vol-name-vol-cap-invalid", + CapacityRange: stdCapRange, + VolumeCapabilities: stdVolCap, + Parameters: nil, } ctx := context.Background() @@ -215,19 +206,10 @@ func TestCreateVolume(t *testing.T) { } req := &csi.CreateVolumeRequest{ - Name: "random-vol-name-vol-cap-invalid", - CapacityRange: stdCapRange, - VolumeCapabilities: []*csi.VolumeCapability{ - { - AccessType: &csi.VolumeCapability_Block{ - Block: nil, - }, - AccessMode: &csi.VolumeCapability_AccessMode{ - Mode: csi.VolumeCapability_AccessMode_SINGLE_NODE_WRITER, - }, - }, - }, - Parameters: allParam, + Name: "random-vol-name-vol-cap-invalid", + CapacityRange: stdCapRange, + VolumeCapabilities: stdVolCap, + Parameters: allParam, } ctx := context.Background() @@ -253,19 +235,10 @@ func TestCreateVolume(t *testing.T) { } req := &csi.CreateVolumeRequest{ - Name: "random-vol-name-vol-cap-invalid", - CapacityRange: stdCapRange, - VolumeCapabilities: []*csi.VolumeCapability{ - { - AccessType: &csi.VolumeCapability_Block{ - Block: nil, - }, - AccessMode: &csi.VolumeCapability_AccessMode{ - Mode: csi.VolumeCapability_AccessMode_SINGLE_NODE_WRITER, - }, - }, - }, - Parameters: allParam, + Name: "random-vol-name-vol-cap-invalid", + CapacityRange: stdCapRange, + VolumeCapabilities: stdVolCap, + Parameters: allParam, } ctx := context.Background() @@ -292,19 +265,10 @@ func TestCreateVolume(t *testing.T) { } req := &csi.CreateVolumeRequest{ - Name: "random-vol-name-vol-cap-invalid", - CapacityRange: stdCapRange, - VolumeCapabilities: []*csi.VolumeCapability{ - { - AccessType: &csi.VolumeCapability_Block{ - Block: nil, - }, - AccessMode: &csi.VolumeCapability_AccessMode{ - Mode: csi.VolumeCapability_AccessMode_SINGLE_NODE_WRITER, - }, - }, - }, - Parameters: allParam, + Name: "random-vol-name-vol-cap-invalid", + CapacityRange: stdCapRange, + VolumeCapabilities: stdVolCap, + Parameters: allParam, } ctx := context.Background() @@ -331,19 +295,10 @@ func TestCreateVolume(t *testing.T) { } req := &csi.CreateVolumeRequest{ - Name: "random-vol-name-vol-cap-invalid", - CapacityRange: stdCapRange, - VolumeCapabilities: []*csi.VolumeCapability{ - { - AccessType: &csi.VolumeCapability_Block{ - Block: nil, - }, - AccessMode: &csi.VolumeCapability_AccessMode{ - Mode: csi.VolumeCapability_AccessMode_SINGLE_NODE_WRITER, - }, - }, - }, - Parameters: allParam, + Name: "random-vol-name-vol-cap-invalid", + CapacityRange: stdCapRange, + VolumeCapabilities: stdVolCap, + Parameters: allParam, } d := NewFakeDriver() @@ -372,19 +327,10 @@ func TestCreateVolume(t *testing.T) { } req := &csi.CreateVolumeRequest{ - Name: "random-vol-name-vol-cap-invalid", - CapacityRange: stdCapRange, - VolumeCapabilities: []*csi.VolumeCapability{ - { - AccessType: &csi.VolumeCapability_Block{ - Block: nil, - }, - AccessMode: &csi.VolumeCapability_AccessMode{ - Mode: csi.VolumeCapability_AccessMode_SINGLE_NODE_WRITER, - }, - }, - }, - Parameters: allParam, + Name: "random-vol-name-vol-cap-invalid", + CapacityRange: stdCapRange, + VolumeCapabilities: stdVolCap, + Parameters: allParam, } d := NewFakeDriver() @@ -404,6 +350,38 @@ func TestCreateVolume(t *testing.T) { } }, }, + { + name: "storageAccount and matchTags conflict", + testFunc: func(t *testing.T) { + allParam := map[string]string{ + storageAccountField: "abc", + matchTagsField: "true", + } + + req := &csi.CreateVolumeRequest{ + Name: "random-vol-name-vol-cap-invalid", + CapacityRange: stdCapRange, + VolumeCapabilities: stdVolCap, + Parameters: allParam, + } + + d := NewFakeDriver() + d.cloud = &azure.Cloud{ + Config: azure.Config{}, + } + + d.AddControllerServiceCapabilities( + []csi.ControllerServiceCapability_RPC_Type{ + csi.ControllerServiceCapability_RPC_CREATE_DELETE_VOLUME, + }) + + expectedErr := status.Errorf(codes.InvalidArgument, "matchTags must set as false when storageAccount(abc) is provided") + _, err := d.CreateVolume(context.Background(), req) + if !reflect.DeepEqual(err, expectedErr) { + t.Errorf("Unexpected error: %v", err) + } + }, + }, { name: "Failed to update subnet service endpoints", testFunc: func(t *testing.T) { @@ -422,19 +400,10 @@ func TestCreateVolume(t *testing.T) { retErr := retry.NewError(false, fmt.Errorf("the subnet does not exist")) req := &csi.CreateVolumeRequest{ - Name: "random-vol-name-vol-cap-invalid", - CapacityRange: stdCapRange, - VolumeCapabilities: []*csi.VolumeCapability{ - { - AccessType: &csi.VolumeCapability_Block{ - Block: nil, - }, - AccessMode: &csi.VolumeCapability_AccessMode{ - Mode: csi.VolumeCapability_AccessMode_SINGLE_NODE_WRITER, - }, - }, - }, - Parameters: allParam, + Name: "random-vol-name-vol-cap-invalid", + CapacityRange: stdCapRange, + VolumeCapabilities: stdVolCap, + Parameters: allParam, } ctx := context.Background() d := NewFakeDriver() diff --git a/test/e2e/dynamic_provisioning_test.go b/test/e2e/dynamic_provisioning_test.go index 4caf773032..a28429b5d5 100644 --- a/test/e2e/dynamic_provisioning_test.go +++ b/test/e2e/dynamic_provisioning_test.go @@ -214,6 +214,7 @@ var _ = ginkgo.Describe("Dynamic Provisioning", func() { scParameters := map[string]string{ "skuName": "Standard_LRS", "secretNamespace": "default", + "matchTags": "true", } if !isUsingInTreeVolumePlugin { scParameters["allowBlobPublicAccess"] = "false" diff --git a/vendor/github.com/Azure/azure-sdk-for-go/version/version.go b/vendor/github.com/Azure/azure-sdk-for-go/version/version.go index 24c87e2e33..fd750c3bf0 100644 --- a/vendor/github.com/Azure/azure-sdk-for-go/version/version.go +++ b/vendor/github.com/Azure/azure-sdk-for-go/version/version.go @@ -4,4 +4,4 @@ package version // Licensed under the MIT License. See License.txt in the project root for license information. // Number contains the semantic version of this SDK. -const Number = "v63.1.0" +const Number = "v63.2.0" diff --git a/vendor/modules.txt b/vendor/modules.txt index ca2c3855ae..848c972b53 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1,7 +1,7 @@ # github.com/Azure/azure-pipeline-go v0.2.1 ## explicit github.com/Azure/azure-pipeline-go/pipeline -# github.com/Azure/azure-sdk-for-go v63.1.0+incompatible +# github.com/Azure/azure-sdk-for-go v63.2.0+incompatible ## explicit github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2021-07-01/compute github.com/Azure/azure-sdk-for-go/services/containerservice/mgmt/2020-04-01/containerservice @@ -1112,7 +1112,7 @@ k8s.io/utils/trace ## explicit; go 1.17 sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/client sigs.k8s.io/apiserver-network-proxy/konnectivity-client/proto/client -# sigs.k8s.io/cloud-provider-azure v0.7.4 => sigs.k8s.io/cloud-provider-azure v0.7.1-0.20220406062855-4f3bab6bc8b2 +# sigs.k8s.io/cloud-provider-azure v0.7.4 => sigs.k8s.io/cloud-provider-azure v0.7.1-0.20220415032100-325969906b39 ## explicit; go 1.17 sigs.k8s.io/cloud-provider-azure/pkg/auth sigs.k8s.io/cloud-provider-azure/pkg/azureclients @@ -1207,4 +1207,4 @@ sigs.k8s.io/yaml # k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.24.0-alpha.4 # k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.24.0-alpha.4 # k8s.io/sample-controller => k8s.io/sample-controller v0.24.0-alpha.4 -# sigs.k8s.io/cloud-provider-azure => sigs.k8s.io/cloud-provider-azure v0.7.1-0.20220406062855-4f3bab6bc8b2 +# sigs.k8s.io/cloud-provider-azure => sigs.k8s.io/cloud-provider-azure v0.7.1-0.20220415032100-325969906b39 diff --git a/vendor/sigs.k8s.io/cloud-provider-azure/pkg/consts/consts.go b/vendor/sigs.k8s.io/cloud-provider-azure/pkg/consts/consts.go index 47fc7e70db..6bb5ebe0f0 100644 --- a/vendor/sigs.k8s.io/cloud-provider-azure/pkg/consts/consts.go +++ b/vendor/sigs.k8s.io/cloud-provider-azure/pkg/consts/consts.go @@ -353,7 +353,7 @@ const ( // metadata service const ( // ImdsInstanceAPIVersion is the imds instance api version - ImdsInstanceAPIVersion = "2019-03-11" + ImdsInstanceAPIVersion = "2021-10-01" // ImdsLoadBalancerAPIVersion is the imds load balancer api version ImdsLoadBalancerAPIVersion = "2020-10-01" // ImdsServer is the imds server endpoint diff --git a/vendor/sigs.k8s.io/cloud-provider-azure/pkg/provider/azure_standard.go b/vendor/sigs.k8s.io/cloud-provider-azure/pkg/provider/azure_standard.go index dc20c69360..69c53e1bf0 100644 --- a/vendor/sigs.k8s.io/cloud-provider-azure/pkg/provider/azure_standard.go +++ b/vendor/sigs.k8s.io/cloud-provider-azure/pkg/provider/azure_standard.go @@ -26,6 +26,7 @@ import ( "strings" "sync" "time" + "unicode" "sigs.k8s.io/cloud-provider-azure/pkg/consts" @@ -392,6 +393,11 @@ func (az *Cloud) getDefaultFrontendIPConfigName(service *v1.Service) string { // Azure lb front end configuration name must not exceed 80 characters if len(ipcName) > consts.FrontendIPConfigNameMaxLength { ipcName = ipcName[:consts.FrontendIPConfigNameMaxLength] + // Cutting the string may result in char like "-" as the string end. + // If the last char is not a letter or '_', replace it with "_". + if !unicode.IsLetter(rune(ipcName[len(ipcName)-1:][0])) && ipcName[len(ipcName)-1:] != "_" { + ipcName = ipcName[:len(ipcName)-1] + "_" + } } return ipcName } diff --git a/vendor/sigs.k8s.io/cloud-provider-azure/pkg/provider/azure_storageaccount.go b/vendor/sigs.k8s.io/cloud-provider-azure/pkg/provider/azure_storageaccount.go index 57d9cd2a60..278567821d 100644 --- a/vendor/sigs.k8s.io/cloud-provider-azure/pkg/provider/azure_storageaccount.go +++ b/vendor/sigs.k8s.io/cloud-provider-azure/pkg/provider/azure_storageaccount.go @@ -57,6 +57,7 @@ type AccountOptions struct { VNetResourceGroup string VNetName string SubnetName string + MatchTags bool } type accountWithLocation struct { @@ -152,6 +153,12 @@ func (az *Cloud) EnsureStorageAccount(ctx context.Context, accountOptions *Accou subsID = accountOptions.SubscriptionID } + if len(accountOptions.Tags) == 0 { + accountOptions.Tags = make(map[string]string) + } + // set built-in tags + accountOptions.Tags[consts.CreatedByTag] = "azure" + var createNewAccount bool if len(accountName) == 0 { createNewAccount = true @@ -234,10 +241,6 @@ func (az *Cloud) EnsureStorageAccount(ctx context.Context, accountOptions *Accou if accountKind != "" { kind = storage.Kind(accountKind) } - if len(accountOptions.Tags) == 0 { - accountOptions.Tags = make(map[string]string) - } - accountOptions.Tags[consts.CreatedByTag] = "azure" tags := convertMapToMapPointer(accountOptions.Tags) klog.V(2).Infof("azure - no matching account found, begin to create a new account %s in resource group %s, location: %s, accountType: %s, accountKind: %s, tags: %+v", @@ -508,6 +511,11 @@ func isTaggedWithSkip(account storage.Account) bool { } func isTagsEqual(account storage.Account, accountOptions *AccountOptions) bool { + if !accountOptions.MatchTags { + // always return true when tags matching is false (by default) + return true + } + // nil and empty map should be regarded as equal if len(account.Tags) == 0 && len(accountOptions.Tags) == 0 { return true