github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-21 02:41:25 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #103001 from zshihang/csi

Browse Source 
CSIServiceAccountToken ga
This commit is contained in:
Kubernetes Prow Robot 2021-06-26 19:31:23 -07:00 committed by GitHub
commit a0f9c8c277
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
19 changed files with 45 additions and 148 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
api/openapi-spec/swagger.json generated
View File

@ -13753,7 +13753,7 @@
"type": "boolean"
},
"requiresRepublish": {
"description": "RequiresRepublish indicates the CSI driver wants `NodePublishVolume` being periodically called to reflect any possible change in the mounted volume. This field defaults to false.\n\nNote: After a successful initial NodePublishVolume call, subsequent calls to NodePublishVolume should only update the contents of the volume. New mount points will not be seen by a running container.\n\nThis is a beta feature and only available when the CSIServiceAccountToken feature is enabled.",
"description": "RequiresRepublish indicates the CSI driver wants `NodePublishVolume` being periodically called to reflect any possible change in the mounted volume. This field defaults to false.\n\nNote: After a successful initial NodePublishVolume call, subsequent calls to NodePublishVolume should only update the contents of the volume. New mount points will not be seen by a running container.",
"type": "boolean"
},
"storageCapacity": {
@ -13761,7 +13761,7 @@
"type": "boolean"
},
"tokenRequests": {
"description": "TokenRequests indicates the CSI driver needs pods' service account tokens it is mounting volume for to do necessary authentication. Kubelet will pass the tokens in VolumeContext in the CSI NodePublishVolume calls. The CSI driver should parse and validate the following VolumeContext: \"csi.storage.k8s.io/serviceAccount.tokens\": {\n \"<audience>\": {\n \"token\": <token>,\n \"expirationTimestamp\": <expiration timestamp in RFC3339>,\n },\n ...\n}\n\nNote: Audience in each TokenRequest should be different and at most one token is empty string. To receive a new token after expiry, RequiresRepublish can be used to trigger NodePublishVolume periodically.\n\nThis is a beta feature and only available when the CSIServiceAccountToken feature is enabled.",
"description": "TokenRequests indicates the CSI driver needs pods' service account tokens it is mounting volume for to do necessary authentication. Kubelet will pass the tokens in VolumeContext in the CSI NodePublishVolume calls. The CSI driver should parse and validate the following VolumeContext: \"csi.storage.k8s.io/serviceAccount.tokens\": {\n \"<audience>\": {\n \"token\": <token>,\n \"expirationTimestamp\": <expiration timestamp in RFC3339>,\n },\n ...\n}\n\nNote: Audience in each TokenRequest should be different and at most one token is empty string. To receive a new token after expiry, RequiresRepublish can be used to trigger NodePublishVolume periodically.",
"items": {
"$ref": "#/definitions/io.k8s.api.storage.v1.TokenRequest"
},

6
pkg/apis/storage/types.go
View File

@ -381,9 +381,6 @@ type CSIDriverSpec struct {
// most one token is empty string. To receive a new token after expiry,
// RequiresRepublish can be used to trigger NodePublishVolume periodically.
//
// This is a beta feature and only available when the
// CSIServiceAccountToken feature is enabled.
//
// +optional
// +listType=atomic
TokenRequests []TokenRequest
@ -396,9 +393,6 @@ type CSIDriverSpec struct {
// to NodePublishVolume should only update the contents of the volume. New
// mount points will not be seen by a running container.
//
// This is a beta feature and only available when the
// CSIServiceAccountToken feature is enabled.
//
// +optional
RequiresRepublish *bool
}

2
pkg/apis/storage/v1/defaults.go
View File

@ -60,7 +60,7 @@ func SetDefaults_CSIDriver(obj *storagev1.CSIDriver) {
if len(obj.Spec.VolumeLifecycleModes) == 0 && utilfeature.DefaultFeatureGate.Enabled(features.CSIInlineVolume) {
obj.Spec.VolumeLifecycleModes = append(obj.Spec.VolumeLifecycleModes, storagev1.VolumeLifecyclePersistent)
}
if obj.Spec.RequiresRepublish == nil && utilfeature.DefaultFeatureGate.Enabled(features.CSIServiceAccountToken) {
if obj.Spec.RequiresRepublish == nil {
obj.Spec.RequiresRepublish = new(bool)
*(obj.Spec.RequiresRepublish) = false
}

1
pkg/apis/storage/v1/defaults_test.go
View File

@ -94,7 +94,6 @@ func TestSetDefaultVolumeBindingMode(t *testing.T) {
func TestSetDefaultCSIDriver(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIInlineVolume, true)()
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIServiceAccountToken, true)()
enabled := true
disabled := false

2
pkg/apis/storage/v1beta1/defaults.go
View File

@ -60,7 +60,7 @@ func SetDefaults_CSIDriver(obj *storagev1beta1.CSIDriver) {
if len(obj.Spec.VolumeLifecycleModes) == 0 && utilfeature.DefaultFeatureGate.Enabled(features.CSIInlineVolume) {
obj.Spec.VolumeLifecycleModes = append(obj.Spec.VolumeLifecycleModes, storagev1beta1.VolumeLifecyclePersistent)
}
if obj.Spec.RequiresRepublish == nil && utilfeature.DefaultFeatureGate.Enabled(features.CSIServiceAccountToken) {
if obj.Spec.RequiresRepublish == nil {
obj.Spec.RequiresRepublish = new(bool)
*(obj.Spec.RequiresRepublish) = false
}

1
pkg/apis/storage/v1beta1/defaults_test.go
View File

@ -142,7 +142,6 @@ func TestSetDefaultVolumeLifecycleModesDisabled(t *testing.T) {
func TestSetDefaultCSIDriver(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIInlineVolume, true)()
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIServiceAccountToken, true)()
enabled := true
disabled := false

3
pkg/features/kube_features.go
View File

@ -577,6 +577,7 @@ const (
// owner: @zshihang
// alpha: v1.20
// beta: v1.21
// ga: v1.22
//
// Enable kubelet to pass pod's service account token to NodePublishVolume
// call of CSI driver which is mounting volumes for that pod.
@ -760,7 +761,7 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS
ConfigurableFSGroupPolicy: {Default: true, PreRelease: featuregate.Beta},
CSIInlineVolume: {Default: true, PreRelease: featuregate.Beta},
CSIStorageCapacity: {Default: true, PreRelease: featuregate.Beta},
CSIServiceAccountToken: {Default: true, PreRelease: featuregate.Beta},
CSIServiceAccountToken: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.23
GenericEphemeralVolume: {Default: true, PreRelease: featuregate.Beta},
CSIVolumeFSGroupPolicy: {Default: true, PreRelease: featuregate.Beta},
RuntimeClass: {Default: true, PreRelease: featuregate.GA, LockToDefault: true}, // remove in 1.23

7
pkg/printers/internalversion/printers.go
View File

@ -520,12 +520,11 @@ func AddHandlers(h printers.PrintHandler) {
Name: "StorageCapacity", Type: "boolean", Description: storagev1.CSIDriverSpec{}.SwaggerDoc()["storageCapacity"],
})
}
if utilfeature.DefaultFeatureGate.Enabled(features.CSIServiceAccountToken) {
csiDriverColumnDefinitions = append(csiDriverColumnDefinitions, []metav1.TableColumnDefinition{
{Name: "TokenRequests", Type: "string", Description: storagev1.CSIDriverSpec{}.SwaggerDoc()["tokenRequests"]},
{Name: "RequiresRepublish", Type: "boolean", Description: storagev1.CSIDriverSpec{}.SwaggerDoc()["requiresRepublish"]},
}...)
}
csiDriverColumnDefinitions = append(csiDriverColumnDefinitions, []metav1.TableColumnDefinition{
{Name: "Modes", Type: "string", Description: storagev1.CSIDriverSpec{}.SwaggerDoc()["volumeLifecycleModes"]},
{Name: "Age", Type: "string", Description: metav1.ObjectMeta{}.SwaggerDoc()["creationTimestamp"]},
@ -1419,7 +1418,7 @@ func printCSIDriver(obj *storage.CSIDriver, options printers.GenerateOptions) ([
}
row.Cells = append(row.Cells, storageCapacity)
}
if utilfeature.DefaultFeatureGate.Enabled(features.CSIServiceAccountToken) {
tokenRequests := "<unset>"
if obj.Spec.TokenRequests != nil {
audiences := []string{}
@ -1433,7 +1432,7 @@ func printCSIDriver(obj *storage.CSIDriver, options printers.GenerateOptions) ([
requiresRepublish = *obj.Spec.RequiresRepublish
}
row.Cells = append(row.Cells, tokenRequests, requiresRepublish)
}
row.Cells = append(row.Cells, modes, translateTimestampSince(obj.CreationTimestamp))
return []metav1.TableRow{row}, nil
}

12
pkg/registry/storage/csidriver/strategy.go
View File

@ -56,10 +56,6 @@ func (csiDriverStrategy) PrepareForCreate(ctx context.Context, obj runtime.Objec
if !utilfeature.DefaultFeatureGate.Enabled(features.CSIVolumeFSGroupPolicy) {
csiDriver.Spec.FSGroupPolicy = nil
}
if !utilfeature.DefaultFeatureGate.Enabled(features.CSIServiceAccountToken) {
csiDriver.Spec.TokenRequests = nil
csiDriver.Spec.RequiresRepublish = nil
}
}
func (csiDriverStrategy) Validate(ctx context.Context, obj runtime.Object) field.ErrorList {
@ -100,14 +96,6 @@ func (csiDriverStrategy) PrepareForUpdate(ctx context.Context, obj, old runtime.
!utilfeature.DefaultFeatureGate.Enabled(features.CSIVolumeFSGroupPolicy) {
newCSIDriver.Spec.FSGroupPolicy = nil
}
if oldCSIDriver.Spec.TokenRequests == nil &&
!utilfeature.DefaultFeatureGate.Enabled(features.CSIServiceAccountToken) {
newCSIDriver.Spec.TokenRequests = nil
}
if oldCSIDriver.Spec.RequiresRepublish == nil &&
!utilfeature.DefaultFeatureGate.Enabled(features.CSIServiceAccountToken) {
newCSIDriver.Spec.RequiresRepublish = nil
}
// Any changes to the mutable fields increment the generation number.
if !apiequality.Semantic.DeepEqual(oldCSIDriver.Spec.TokenRequests, newCSIDriver.Spec.TokenRequests) || !apiequality.Semantic.DeepEqual(oldCSIDriver.Spec.RequiresRepublish, newCSIDriver.Spec.RequiresRepublish) {

53
pkg/registry/storage/csidriver/strategy_test.go
View File

@ -95,7 +95,6 @@ func TestCSIDriverPrepareForCreate(t *testing.T) {
name string
withCapacity bool
withInline bool
withServiceAccountToken bool
}{
{
name: "inline enabled",
@ -113,21 +112,12 @@ func TestCSIDriverPrepareForCreate(t *testing.T) {
name: "capacity disabled",
withCapacity: false,
},
{
name: "serviceAccountToken enabled",
withServiceAccountToken: true,
},
{
name: "serviceAccountToken disabled",
withServiceAccountToken: false,
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIStorageCapacity, test.withCapacity)()
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIInlineVolume, test.withInline)()
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIServiceAccountToken, test.withServiceAccountToken)()
csiDriver := &storage.CSIDriver{
ObjectMeta: metav1.ObjectMeta{
@ -167,21 +157,6 @@ func TestCSIDriverPrepareForCreate(t *testing.T) {
t.Errorf("VolumeLifecycleModes not stripped: %v", csiDriver.Spec)
}
}
if test.withServiceAccountToken {
if csiDriver.Spec.TokenRequests == nil {
t.Errorf("TokenRequests modified: %v", csiDriver.Spec)
}
if csiDriver.Spec.RequiresRepublish == nil {
t.Errorf("RequiresRepublish modified: %v", csiDriver.Spec)
}
} else {
if csiDriver.Spec.TokenRequests != nil {
t.Errorf("TokenRequests stripped: %v", csiDriver.Spec)
}
if csiDriver.Spec.RequiresRepublish != nil {
t.Errorf("RequiresRepublish stripped: %v", csiDriver.Spec)
}
}
})
}
}
@ -227,7 +202,6 @@ func TestCSIDriverPrepareForUpdate(t *testing.T) {
enabled := true
disabled := false
gcp := "gcp"
vault := "vault"
driverWithCapacityEnabled := &storage.CSIDriver{
ObjectMeta: metav1.ObjectMeta{
Name: "foo",
@ -253,15 +227,6 @@ func TestCSIDriverPrepareForUpdate(t *testing.T) {
RequiresRepublish: &enabled,
},
}
driverWithServiceAccountTokenVault := &storage.CSIDriver{
ObjectMeta: metav1.ObjectMeta{
Name: "foo",
},
Spec: storage.CSIDriverSpec{
TokenRequests: []storage.TokenRequest{{Audience: vault}},
RequiresRepublish: &enabled,
},
}
resultPersistent := []storage.VolumeLifecycleMode{storage.VolumeLifecyclePersistent}
@ -270,7 +235,6 @@ func TestCSIDriverPrepareForUpdate(t *testing.T) {
old, update *storage.CSIDriver
csiStorageCapacityEnabled bool
csiInlineVolumeEnabled bool
csiServiceAccountTokenEnabled bool
wantCapacity *bool
wantModes []storage.VolumeLifecycleMode
wantTokenRequests []storage.TokenRequest
@ -317,35 +281,18 @@ func TestCSIDriverPrepareForUpdate(t *testing.T) {
},
{
name: "service account token feature enabled, before: none, update: audience=gcp",
csiServiceAccountTokenEnabled: true,
old: driverWithNothing,
update: driverWithServiceAccountTokenGCP,
wantTokenRequests: []storage.TokenRequest{{Audience: gcp}},
wantRequiresRepublish: &enabled,
wantGeneration: 1,
},
{
name: "service account token feature disabled, before: none, update: audience=gcp",
old: driverWithNothing,
update: driverWithServiceAccountTokenGCP,
wantTokenRequests: nil,
wantRequiresRepublish: nil,
},
{
name: "service account token feature disabled, before: audience=vault, update: audience=gcp",
old: driverWithServiceAccountTokenVault,
update: driverWithServiceAccountTokenGCP,
wantTokenRequests: []storage.TokenRequest{{Audience: gcp}},
wantRequiresRepublish: &enabled,
wantGeneration: 1,
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIStorageCapacity, test.csiStorageCapacityEnabled)()
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIInlineVolume, test.csiInlineVolumeEnabled)()
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIServiceAccountToken, test.csiServiceAccountTokenEnabled)()
csiDriver := test.update.DeepCopy()
Strategy.PrepareForUpdate(ctx, csiDriver, test.old)

2
pkg/volume/csi/csi_mounter.go
View File

@ -229,13 +229,11 @@ func (c *csiMountMgr) SetUpAt(dir string, mounterArgs volume.MounterArgs) error
}
// Inject pod service account token into volume attributes
if utilfeature.DefaultFeatureGate.Enabled(features.CSIServiceAccountToken) {
serviceAccountTokenAttrs, err := c.podServiceAccountTokenAttrs()
if err != nil {
return volumetypes.NewTransientOperationFailure(log("mounter.SetUpAt failed to get service accoount token attributes: %v", err))
}
volAttribs = mergeMap(volAttribs, serviceAccountTokenAttrs)
}
err = csi.NodePublishVolume(
ctx,

1
pkg/volume/csi/csi_mounter_test.go
View File

@ -938,7 +938,6 @@ func TestIsCorruptedDir(t *testing.T) {
}
func TestPodServiceAccountTokenAttrs(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIServiceAccountToken, true)()
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.CSIInlineVolume, true)()
scheme := runtime.NewScheme()
utilruntime.Must(pkgauthenticationv1.RegisterDefaults(scheme))

3
pkg/volume/csi/csi_plugin.go
View File

@ -339,9 +339,6 @@ func (p *csiPlugin) CanSupport(spec *volume.Spec) bool {
}
func (p *csiPlugin) RequiresRemount(spec *volume.Spec) bool {
if !utilfeature.DefaultFeatureGate.Enabled(features.CSIServiceAccountToken) {
return false
}
if p.csiDriverLister == nil {
return false
}

6
staging/src/k8s.io/api/storage/v1/generated.proto
View File

@ -182,9 +182,6 @@ message CSIDriverSpec {
// most one token is empty string. To receive a new token after expiry,
// RequiresRepublish can be used to trigger NodePublishVolume periodically.
//
// This is a beta feature and only available when the
// CSIServiceAccountToken feature is enabled.
//
// +optional
// +listType=atomic
repeated TokenRequest tokenRequests = 6;
@ -197,9 +194,6 @@ message CSIDriverSpec {
// to NodePublishVolume should only update the contents of the volume. New
// mount points will not be seen by a running container.
//
// This is a beta feature and only available when the
// CSIServiceAccountToken feature is enabled.
//
// +optional
optional bool requiresRepublish = 7;
}

6
staging/src/k8s.io/api/storage/v1/types.go
View File

@ -381,9 +381,6 @@ type CSIDriverSpec struct {
// most one token is empty string. To receive a new token after expiry,
// RequiresRepublish can be used to trigger NodePublishVolume periodically.
//
// This is a beta feature and only available when the
// CSIServiceAccountToken feature is enabled.
//
// +optional
// +listType=atomic
TokenRequests []TokenRequest `json:"tokenRequests,omitempty" protobuf:"bytes,6,opt,name=tokenRequests"`
@ -396,9 +393,6 @@ type CSIDriverSpec struct {
// to NodePublishVolume should only update the contents of the volume. New
// mount points will not be seen by a running container.
//
// This is a beta feature and only available when the
// CSIServiceAccountToken feature is enabled.
//
// +optional
RequiresRepublish *bool `json:"requiresRepublish,omitempty" protobuf:"varint,7,opt,name=requiresRepublish"`
}

4
staging/src/k8s.io/api/storage/v1/types_swagger_doc_generated.go generated
View File

@ -54,8 +54,8 @@ var map_CSIDriverSpec = map[string]string{
"volumeLifecycleModes": "volumeLifecycleModes defines what kind of volumes this CSI volume driver supports. The default if the list is empty is \"Persistent\", which is the usage defined by the CSI specification and implemented in Kubernetes via the usual PV/PVC mechanism. The other mode is \"Ephemeral\". In this mode, volumes are defined inline inside the pod spec with CSIVolumeSource and their lifecycle is tied to the lifecycle of that pod. A driver has to be aware of this because it is only going to get a NodePublishVolume call for such a volume. For more information about implementing this mode, see https://kubernetes-csi.github.io/docs/ephemeral-local-volumes.html A driver can support one or more of these modes and more modes may be added in the future. This field is beta.\n\nThis field is immutable.",
"storageCapacity": "If set to true, storageCapacity indicates that the CSI volume driver wants pod scheduling to consider the storage capacity that the driver deployment will report by creating CSIStorageCapacity objects with capacity information.\n\nThe check can be enabled immediately when deploying a driver. In that case, provisioning new volumes with late binding will pause until the driver deployment has published some suitable CSIStorageCapacity object.\n\nAlternatively, the driver can be deployed with the field unset or false and it can be flipped later when storage capacity information has been published.\n\nThis field is immutable.\n\nThis is a beta field and only available when the CSIStorageCapacity feature is enabled. The default is false.",
"fsGroupPolicy": "Defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Refer to the specific FSGroupPolicy values for additional details. This field is beta, and is only honored by servers that enable the CSIVolumeFSGroupPolicy feature gate.\n\nThis field is immutable.\n\nDefaults to ReadWriteOnceWithFSType, which will examine each volume to determine if Kubernetes should modify ownership and permissions of the volume. With the default policy the defined fsGroup will only be applied if a fstype is defined and the volume's access mode contains ReadWriteOnce.",
"tokenRequests": "TokenRequests indicates the CSI driver needs pods' service account tokens it is mounting volume for to do necessary authentication. Kubelet will pass the tokens in VolumeContext in the CSI NodePublishVolume calls. The CSI driver should parse and validate the following VolumeContext: \"csi.storage.k8s.io/serviceAccount.tokens\": {\n \"<audience>\": {\n \"token\": <token>,\n \"expirationTimestamp\": <expiration timestamp in RFC3339>,\n },\n ...\n}\n\nNote: Audience in each TokenRequest should be different and at most one token is empty string. To receive a new token after expiry, RequiresRepublish can be used to trigger NodePublishVolume periodically.\n\nThis is a beta feature and only available when the CSIServiceAccountToken feature is enabled.",
"requiresRepublish": "RequiresRepublish indicates the CSI driver wants `NodePublishVolume` being periodically called to reflect any possible change in the mounted volume. This field defaults to false.\n\nNote: After a successful initial NodePublishVolume call, subsequent calls to NodePublishVolume should only update the contents of the volume. New mount points will not be seen by a running container.\n\nThis is a beta feature and only available when the CSIServiceAccountToken feature is enabled.",
"tokenRequests": "TokenRequests indicates the CSI driver needs pods' service account tokens it is mounting volume for to do necessary authentication. Kubelet will pass the tokens in VolumeContext in the CSI NodePublishVolume calls. The CSI driver should parse and validate the following VolumeContext: \"csi.storage.k8s.io/serviceAccount.tokens\": {\n \"<audience>\": {\n \"token\": <token>,\n \"expirationTimestamp\": <expiration timestamp in RFC3339>,\n },\n ...\n}\n\nNote: Audience in each TokenRequest should be different and at most one token is empty string. To receive a new token after expiry, RequiresRepublish can be used to trigger NodePublishVolume periodically.",
"requiresRepublish": "RequiresRepublish indicates the CSI driver wants `NodePublishVolume` being periodically called to reflect any possible change in the mounted volume. This field defaults to false.\n\nNote: After a successful initial NodePublishVolume call, subsequent calls to NodePublishVolume should only update the contents of the volume. New mount points will not be seen by a running container.",
}
func (CSIDriverSpec) SwaggerDoc() map[string]string {

6
staging/src/k8s.io/api/storage/v1beta1/generated.proto
View File

@ -184,9 +184,6 @@ message CSIDriverSpec {
// most one token is empty string. To receive a new token after expiry,
// RequiresRepublish can be used to trigger NodePublishVolume periodically.
//
// This is a beta feature and only available when the
// CSIServiceAccountToken feature is enabled.
//
// +optional
// +listType=atomic
repeated TokenRequest tokenRequests = 6;
@ -199,9 +196,6 @@ message CSIDriverSpec {
// to NodePublishVolume should only update the contents of the volume. New
// mount points will not be seen by a running container.
//
// This is a beta feature and only available when the
// CSIServiceAccountToken feature is enabled.
//
// +optional
optional bool requiresRepublish = 7;
}

6
staging/src/k8s.io/api/storage/v1beta1/types.go
View File

@ -402,9 +402,6 @@ type CSIDriverSpec struct {
// most one token is empty string. To receive a new token after expiry,
// RequiresRepublish can be used to trigger NodePublishVolume periodically.
//
// This is a beta feature and only available when the
// CSIServiceAccountToken feature is enabled.
//
// +optional
// +listType=atomic
TokenRequests []TokenRequest `json:"tokenRequests,omitempty" protobuf:"bytes,6,opt,name=tokenRequests"`
@ -417,9 +414,6 @@ type CSIDriverSpec struct {
// to NodePublishVolume should only update the contents of the volume. New
// mount points will not be seen by a running container.
//
// This is a beta feature and only available when the
// CSIServiceAccountToken feature is enabled.
//
// +optional
RequiresRepublish *bool `json:"requiresRepublish,omitempty" protobuf:"varint,7,opt,name=requiresRepublish"`
}

4
staging/src/k8s.io/api/storage/v1beta1/types_swagger_doc_generated.go generated
View File

@ -54,8 +54,8 @@ var map_CSIDriverSpec = map[string]string{
"volumeLifecycleModes": "VolumeLifecycleModes defines what kind of volumes this CSI volume driver supports. The default if the list is empty is \"Persistent\", which is the usage defined by the CSI specification and implemented in Kubernetes via the usual PV/PVC mechanism. The other mode is \"Ephemeral\". In this mode, volumes are defined inline inside the pod spec with CSIVolumeSource and their lifecycle is tied to the lifecycle of that pod. A driver has to be aware of this because it is only going to get a NodePublishVolume call for such a volume. For more information about implementing this mode, see https://kubernetes-csi.github.io/docs/ephemeral-local-volumes.html A driver can support one or more of these modes and more modes may be added in the future.\n\nThis field is immutable.",
"storageCapacity": "If set to true, storageCapacity indicates that the CSI volume driver wants pod scheduling to consider the storage capacity that the driver deployment will report by creating CSIStorageCapacity objects with capacity information.\n\nThe check can be enabled immediately when deploying a driver. In that case, provisioning new volumes with late binding will pause until the driver deployment has published some suitable CSIStorageCapacity object.\n\nAlternatively, the driver can be deployed with the field unset or false and it can be flipped later when storage capacity information has been published.\n\nThis field is immutable.\n\nThis is a beta field and only available when the CSIStorageCapacity feature is enabled. The default is false.",
"fsGroupPolicy": "Defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Refer to the specific FSGroupPolicy values for additional details. This field is beta, and is only honored by servers that enable the CSIVolumeFSGroupPolicy feature gate.\n\nThis field is immutable.\n\nDefaults to ReadWriteOnceWithFSType, which will examine each volume to determine if Kubernetes should modify ownership and permissions of the volume. With the default policy the defined fsGroup will only be applied if a fstype is defined and the volume's access mode contains ReadWriteOnce.",
"tokenRequests": "TokenRequests indicates the CSI driver needs pods' service account tokens it is mounting volume for to do necessary authentication. Kubelet will pass the tokens in VolumeContext in the CSI NodePublishVolume calls. The CSI driver should parse and validate the following VolumeContext: \"csi.storage.k8s.io/serviceAccount.tokens\": {\n \"<audience>\": {\n \"token\": <token>,\n \"expirationTimestamp\": <expiration timestamp in RFC3339>,\n },\n ...\n}\n\nNote: Audience in each TokenRequest should be different and at most one token is empty string. To receive a new token after expiry, RequiresRepublish can be used to trigger NodePublishVolume periodically.\n\nThis is a beta feature and only available when the CSIServiceAccountToken feature is enabled.",
"requiresRepublish": "RequiresRepublish indicates the CSI driver wants `NodePublishVolume` being periodically called to reflect any possible change in the mounted volume. This field defaults to false.\n\nNote: After a successful initial NodePublishVolume call, subsequent calls to NodePublishVolume should only update the contents of the volume. New mount points will not be seen by a running container.\n\nThis is a beta feature and only available when the CSIServiceAccountToken feature is enabled.",
"tokenRequests": "TokenRequests indicates the CSI driver needs pods' service account tokens it is mounting volume for to do necessary authentication. Kubelet will pass the tokens in VolumeContext in the CSI NodePublishVolume calls. The CSI driver should parse and validate the following VolumeContext: \"csi.storage.k8s.io/serviceAccount.tokens\": {\n \"<audience>\": {\n \"token\": <token>,\n \"expirationTimestamp\": <expiration timestamp in RFC3339>,\n },\n ...\n}\n\nNote: Audience in each TokenRequest should be different and at most one token is empty string. To receive a new token after expiry, RequiresRepublish can be used to trigger NodePublishVolume periodically.",
"requiresRepublish": "RequiresRepublish indicates the CSI driver wants `NodePublishVolume` being periodically called to reflect any possible change in the mounted volume. This field defaults to false.\n\nNote: After a successful initial NodePublishVolume call, subsequent calls to NodePublishVolume should only update the contents of the volume. New mount points will not be seen by a running container.",
}
func (CSIDriverSpec) SwaggerDoc() map[string]string {