webhook: validate owned-by annotation on create, update, delete

[connorkuehl]

This annotation is already validated on the PVC current object in the Delete handler, but to be more consistent, also check the new object in the Update and Create handlers.

[FrankYang0529]

LGTM. Thank you.

[ibrokethecloud]

lgtm. thanks.

[w13915984028]

Wait a minute:

For VM related PVCs, the owned-by is trully set; but there are some PVCs used by applications like rancher-monitoring, vcluster, the owned-by is not set.

In v1.2.1 and later, rancher-monitoring is an addon, if we enable it on the fly, it will create the PVCs and they are checked by the Harvester webhook.

harvester112:~ # kubectl get pvc vm66-disk-0-3pmjd -oyaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations:
    harvesterhci.io/imageId: default/image-wzkml
    harvesterhci.io/owned-by: '[{"schema":"kubevirt.io.virtualmachine","refs":["default/vm66"]}]'
    pv.kubernetes.io/bind-completed: "yes"
    pv.kubernetes.io/bound-by-controller: "yes"
    volume.beta.kubernetes.io/storage-provisioner: driver.longhorn.io
    volume.kubernetes.io/storage-provisioner: driver.longhorn.io
  creationTimestamp: "2023-05-16T10:02:41Z"

harvester112:~ # kubectl get pvc prometheus-rancher-monitoring-prometheus-db-prometheus-rancher-monitoring-prometheus-0 -n cattle-monitoring-system -oyaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations:
    pv.kubernetes.io/bind-completed: "yes"
    pv.kubernetes.io/bound-by-controller: "yes"
    volume.beta.kubernetes.io/storage-provisioner: driver.longhorn.io
    volume.kubernetes.io/storage-provisioner: driver.longhorn.io
  creationTimestamp: "2023-03-07T13:29:05Z"

[w13915984028]

Should we add another annotation like managed-by harvesterhci.io, to combine with owned-by?

In Harvester, user may also use helm to deploy other charts (we know some customers are doing so), those related PVCs will have no such annotations.

[connorkuehl]

In v1.2.1 and later, rancher-monitoring is an addon, if we enable it on the fly, it will create the PVCs and they are checked by the Harvester webhook.

The webhook doesn't require that harvesterhci.io/owned-by is present, it only requires that if the annotation is there that it has the correct structure. It won't reject Rancher's PVCs.

harvester/pkg/ref/annotation.go

Line 197 in fe90d54

if !ok {

[w13915984028]

Got it, great, thanks.

[bk201]

@Mergifyio backport v1.2

[mergify]

backport v1.2

✅ Backports have been created

• #5078 webhook: validate owned-by annotation on create, update, delete (backport #5031) has been created for branch v1.2

[bk201]

@Mergifyio backport v1.1

[mergify]

backport v1.1

✅ Backports have been created

• #5079 webhook: validate owned-by annotation on create, update, delete (backport #5031) has been created for branch v1.1