From ac6d32a65a2bf418a4c55fc5f979fd5fb89a2141 Mon Sep 17 00:00:00 2001 From: Cheng Pan Date: Wed, 6 Mar 2019 19:31:46 +0000 Subject: [PATCH] Remove the condition for only wait for KMS key is used --- pkg/cloudprovider/providers/aws/aws.go | 22 ++++++++++----------- pkg/cloudprovider/providers/aws/aws_test.go | 7 +++++++ 2 files changed, 17 insertions(+), 12 deletions(-) diff --git a/pkg/cloudprovider/providers/aws/aws.go b/pkg/cloudprovider/providers/aws/aws.go index da7787285a5..c21cdc3c449 100644 --- a/pkg/cloudprovider/providers/aws/aws.go +++ b/pkg/cloudprovider/providers/aws/aws.go @@ -2327,19 +2327,17 @@ func (c *Cloud) CreateDisk(volumeOptions *VolumeOptions) (KubernetesVolumeID, er } volumeName := KubernetesVolumeID("aws://" + aws.StringValue(response.AvailabilityZone) + "/" + string(awsID)) - // AWS has a bad habbit of reporting success when creating a volume with - // encryption keys that either don't exists or have wrong permissions. - // Such volume lives for couple of seconds and then it's silently deleted - // by AWS. There is no other check to ensure that given KMS key is correct, - // because Kubernetes may have limited permissions to the key. - if len(volumeOptions.KmsKeyID) > 0 { - err := c.waitUntilVolumeAvailable(volumeName) - if err != nil { - if isAWSErrorVolumeNotFound(err) { - err = fmt.Errorf("failed to create encrypted volume: the volume disappeared after creation, most likely due to inaccessible KMS encryption key") - } - return "", err + err = c.waitUntilVolumeAvailable(volumeName) + if err != nil { + // AWS has a bad habbit of reporting success when creating a volume with + // encryption keys that either don't exists or have wrong permissions. + // Such volume lives for couple of seconds and then it's silently deleted + // by AWS. There is no other check to ensure that given KMS key is correct, + // because Kubernetes may have limited permissions to the key. + if isAWSErrorVolumeNotFound(err) { + err = fmt.Errorf("failed to create encrypted volume: the volume disappeared after creation, most likely due to inaccessible KMS encryption key") } + return "", err } return volumeName, nil diff --git a/pkg/cloudprovider/providers/aws/aws_test.go b/pkg/cloudprovider/providers/aws/aws_test.go index d37630e837c..5bbd2ca4637 100644 --- a/pkg/cloudprovider/providers/aws/aws_test.go +++ b/pkg/cloudprovider/providers/aws/aws_test.go @@ -1793,12 +1793,19 @@ func TestCreateDisk(t *testing.T) { }}, }, } + volume := &ec2.Volume{ AvailabilityZone: aws.String("us-east-1a"), VolumeId: aws.String("vol-volumeId0"), + State: aws.String("available"), } awsServices.ec2.(*MockedFakeEC2).On("CreateVolume", request).Return(volume, nil) + describeVolumesRequest := &ec2.DescribeVolumesInput{ + VolumeIds: []*string{aws.String("vol-volumeId0")}, + } + awsServices.ec2.(*MockedFakeEC2).On("DescribeVolumes", describeVolumesRequest).Return([]*ec2.Volume{volume}, nil) + volumeID, err := c.CreateDisk(volumeOptions) assert.Nil(t, err, "Error creating disk: %v", err) assert.Equal(t, volumeID, KubernetesVolumeID("aws://us-east-1a/vol-volumeId0"))