diff --git a/pkg/apis/storage/validation/validation_test.go b/pkg/apis/storage/validation/validation_test.go index dd4b8ae21b4..8e692f04973 100644 --- a/pkg/apis/storage/validation/validation_test.go +++ b/pkg/apis/storage/validation/validation_test.go @@ -1873,7 +1873,12 @@ func TestCSIDriverValidationUpdate(t *testing.T) { notRequiresRepublish := false ======= resourceVersion := "1" +<<<<<<< HEAD >>>>>>> Relax validation for CSIVolumeFSGroupPolicy +======= + invalidFSGroupPolicy := storage.ReadWriteOnceWithFSTypeFSGroupPolicy + invalidFSGroupPolicy = "invalid-mode" +>>>>>>> Move CSIVolumeFSGroupPolicy to beta old := storage.CSIDriver{ ObjectMeta: metav1.ObjectMeta{Name: driverName, ResourceVersion: resourceVersion}, Spec: storage.CSIDriverSpec{ @@ -1887,11 +1892,27 @@ func TestCSIDriverValidationUpdate(t *testing.T) { }, } - // Currently there is only one success case: exactly the same - // as the existing object. - successCases := []storage.CSIDriver{old} + // Currently we compare the object against itself + // and ensure updates succeed + successCases := []storage.CSIDriver{ + old, + // An invalid FSGroupPolicy should still pass + { + ObjectMeta: metav1.ObjectMeta{Name: driverName, ResourceVersion: resourceVersion}, + Spec: storage.CSIDriverSpec{ + AttachRequired: &attachNotRequired, + PodInfoOnMount: ¬PodInfoOnMount, + VolumeLifecycleModes: []storage.VolumeLifecycleMode{ + storage.VolumeLifecycleEphemeral, + storage.VolumeLifecyclePersistent, + }, + FSGroupPolicy: &invalidFSGroupPolicy, + }, + }, + } for _, csiDriver := range successCases { - if errs := ValidateCSIDriverUpdate(&csiDriver, &old); len(errs) != 0 { + newDriver := csiDriver.DeepCopy() + if errs := ValidateCSIDriverUpdate(&csiDriver, newDriver); len(errs) != 0 { t.Errorf("expected success for %+v: %v", csiDriver, errs) } } @@ -1967,6 +1988,21 @@ func TestCSIDriverValidationUpdate(t *testing.T) { } }, }, + { + name: "FSGroupPolicy invalidated", + modify: func(new *storage.CSIDriver) { + invalidFSGroupPolicy := storage.ReadWriteOnceWithFSTypeFSGroupPolicy + invalidFSGroupPolicy = "invalid" + new.Spec.FSGroupPolicy = &invalidFSGroupPolicy + }, + }, + { + name: "FSGroupPolicy changed", + modify: func(new *storage.CSIDriver) { + fileFSGroupPolicy := storage.FileFSGroupPolicy + new.Spec.FSGroupPolicy = &fileFSGroupPolicy + }, + }, } for _, test := range errorCases { diff --git a/pkg/features/kube_features.go b/pkg/features/kube_features.go index f79c8d40193..3ae6c65689f 100644 --- a/pkg/features/kube_features.go +++ b/pkg/features/kube_features.go @@ -432,6 +432,7 @@ const ( // owner: @huffmanca // alpha: v1.19 + // beta: v1.20 // // Determines if a CSI Driver supports applying fsGroup. CSIVolumeFSGroupPolicy featuregate.Feature = "CSIVolumeFSGroupPolicy" @@ -764,7 +765,7 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS CSIStorageCapacity: {Default: false, PreRelease: featuregate.Alpha}, CSIServiceAccountToken: {Default: false, PreRelease: featuregate.Alpha}, GenericEphemeralVolume: {Default: false, PreRelease: featuregate.Alpha}, - CSIVolumeFSGroupPolicy: {Default: false, PreRelease: featuregate.Alpha}, + CSIVolumeFSGroupPolicy: {Default: true, PreRelease: featuregate.Beta}, RuntimeClass: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.23 NodeLease: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, SCTPSupport: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.22 diff --git a/pkg/volume/csi/csi_test.go b/pkg/volume/csi/csi_test.go index 993a7b35b90..a353532c851 100644 --- a/pkg/volume/csi/csi_test.go +++ b/pkg/volume/csi/csi_test.go @@ -27,6 +27,7 @@ import ( api "k8s.io/api/core/v1" v1 "k8s.io/api/core/v1" storage "k8s.io/api/storage/v1" + storagev1 "k8s.io/api/storage/v1" meta "k8s.io/apimachinery/pkg/apis/meta/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" @@ -47,6 +48,7 @@ import ( // based on operations from the volume manager/reconciler/operation executor func TestCSI_VolumeAll(t *testing.T) { defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIInlineVolume, true)() + defaultFSGroupPolicy := storagev1.ReadWriteOnceWithFSTypeFSGroupPolicy tests := []struct { name string @@ -87,6 +89,7 @@ func TestCSI_VolumeAll(t *testing.T) { driverSpec: &storage.CSIDriverSpec{ // Required for the driver to be accepted for the persistent volume. VolumeLifecycleModes: []storage.VolumeLifecycleMode{storage.VolumeLifecyclePersistent}, + FSGroupPolicy: &defaultFSGroupPolicy, }, }, { @@ -104,6 +107,7 @@ func TestCSI_VolumeAll(t *testing.T) { driverSpec: &storage.CSIDriverSpec{ // This will cause the volume to be rejected. VolumeLifecycleModes: []storage.VolumeLifecycleMode{storage.VolumeLifecycleEphemeral}, + FSGroupPolicy: &defaultFSGroupPolicy, }, shouldFail: true, }, @@ -122,6 +126,7 @@ func TestCSI_VolumeAll(t *testing.T) { driverSpec: &storage.CSIDriverSpec{ // Required for the driver to be accepted for the inline volume. VolumeLifecycleModes: []storage.VolumeLifecycleMode{storage.VolumeLifecycleEphemeral}, + FSGroupPolicy: &defaultFSGroupPolicy, }, }, { @@ -139,6 +144,7 @@ func TestCSI_VolumeAll(t *testing.T) { driverSpec: &storage.CSIDriverSpec{ // Required for the driver to be accepted for the inline volume. VolumeLifecycleModes: []storage.VolumeLifecycleMode{storage.VolumeLifecyclePersistent, storage.VolumeLifecycleEphemeral}, + FSGroupPolicy: &defaultFSGroupPolicy, }, }, { diff --git a/pkg/volume/csi/csi_util_test.go b/pkg/volume/csi/csi_util_test.go index 3df12babcde..f4d3582b004 100644 --- a/pkg/volume/csi/csi_util_test.go +++ b/pkg/volume/csi/csi_util_test.go @@ -85,6 +85,7 @@ func makeTestVol(name string, driverName string) *api.Volume { } func getTestCSIDriver(name string, podInfoMount *bool, attachable *bool, volumeLifecycleModes []storagev1.VolumeLifecycleMode) *storagev1.CSIDriver { + defaultFSGroupPolicy := storagev1.ReadWriteOnceWithFSTypeFSGroupPolicy return &storagev1.CSIDriver{ ObjectMeta: meta.ObjectMeta{ Name: name, @@ -93,6 +94,7 @@ func getTestCSIDriver(name string, podInfoMount *bool, attachable *bool, volumeL PodInfoOnMount: podInfoMount, AttachRequired: attachable, VolumeLifecycleModes: volumeLifecycleModes, + FSGroupPolicy: &defaultFSGroupPolicy, }, } }