add cmdline args to enable group snapshot webhooks

[Rakshith-R]

What type of PR is this?

/kind bug

What this PR does / why we need it:

VolumeGroupSnapshots are still in alpha.
This commit adds cmdline args to enable group snapshot webhooks while keeping it disbaled by default.

Which issue(s) this PR fixes:

Fixes #921

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

yes,

Webhooks for group snapshot CRs will be disabled by default. Command line argument `enable-volume-group-snapshot-webhook` needs to be added to enable these webhooks.

/cc @xing-yang

[k8s-ci-robot]

Hi @Rakshith-R. Thanks for your PR.

I'm waiting for a kubernetes-csi member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Rakshith-R]

I've tested this locally, the error mentioned in #921 is no longer seen in absence of volumegroup snapshot CRDs.

[xing-yang]

/ok-to-test

[xing-yang]

Can you also test if the CRDs are installed but the new RBAC's are not installed? See this comment: #921 (comment)

[Rakshith-R]

Can you also test if the CRDs are installed but the new RBAC's are not installed? See this comment: #921 (comment)

With default configurations, the webhook is disabled and we don't get any errors.

If cmdline arg to enable group snapshot webhook is set: The following error is seen.

^Crakshithr4:external-snapshotter$ k logs snapshot-validation-deployment-84fbf47fbc-tm6vv snapshot-validation 
I1016 11:00:25.948533       1 certwatcher.go:129] Updated current TLS certificate
W1016 11:00:25.955254       1 reflector.go:535] github.com/kubernetes-csi/external-snapshotter/client/v6/informers/externalversions/factory.go:133: failed to list *v1alpha1.VolumeGroupSnapshotClass: volumegroupsnapshotclasses.groupsnapshot.storage.k8s.io is forbidden: User "system:serviceaccount:default:snapshot-webhook" cannot list resource "volumegroupsnapshotclasses" in API group "groupsnapshot.storage.k8s.io" at the cluster scope
E1016 11:00:25.955276       1 reflector.go:147] github.com/kubernetes-csi/external-snapshotter/client/v6/informers/externalversions/factory.go:133: Failed to watch *v1alpha1.VolumeGroupSnapshotClass: failed to list *v1alpha1.VolumeGroupSnapshotClass: volumegroupsnapshotclasses.groupsnapshot.storage.k8s.io is forbidden: User "system:serviceaccount:default:snapshot-webhook" cannot list resource "volumegroupsnapshotclasses" in API group "groupsnapshot.storage.k8s.io" at the cluster scope
W1016 11:00:27.494232       1 reflector.go:535] github.com/kubernetes-csi/external-snapshotter/client/v6/informers/externalversions/factory.go:133: failed to list *v1alpha1.VolumeGroupSnapshotClass: volumegroupsnapshotclasses.groupsnapshot.storage.k8s.io is forbidden: User "system:serviceaccount:default:snapshot-webhook" cannot list resource "volumegroupsnapshotclasses" in API group "groupsnapshot.storage.k8s.io" at the cluster scope
E1016 11:00:27.494410       1 reflector.go:147] github.com/kubernetes-csi/external-snapshotter/client/v6/informers/externalversions/factory.go:133: Failed to watch *v1alpha1.VolumeGroupSnapshotClass: failed to list *v1alpha1.VolumeGroupSnapshotClass: volumegroupsnapshotclasses.groupsnapshot.storage.k8s.io is forbidden: User "system:serviceaccount:default:snapshot-webhook" cannot list resource "volumegroupsnapshotclasses" in API group "groupsnapshot.storage.k8s.io" at the cluster scope
W1016 11:00:30.536292       1 reflector.go:535] github.com/kubernetes-csi/external-snapshotter/client/v6/informers/externalversions/factory.go:133: failed to list *v1alpha1.VolumeGroupSnapshotClass: volumegroupsnapshotclasses.groupsnapshot.storage.k8s.io is forbidden: User "system:serviceaccount:default:snapshot-webhook" cannot list resource "volumegroupsnapshotclasses" in API group "groupsnapshot.storage.k8s.io" at the cluster scope
E1016 11:00:30.536323       1 reflector.go:147] github.com/kubernetes-csi/external-snapshotter/client/v6/informers/externalversions/factory.go:133: Failed to watch *v1alpha1.VolumeGroupSnapshotClass: failed to list *v1alpha1.VolumeGroupSnapshotClass: volumegroupsnapshotclasses.groupsnapshot.storage.k8s.io is forbidden: User "system:serviceaccount:default:snapshot-webhook" cannot list resource "volumegroupsnapshotclasses" in API group "groupsnapshot.storage.k8s.io" at the cluster scope

---

I don't think the failures seen in the ci is related to this pr

• https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-csi_external-snapshotter/922/pull-kubernetes-csi-external-snapshotter-1-27-on-kubernetes-1-27/1712824186033934336
• https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-csi_external-snapshotter/922/pull-kubernetes-csi-external-snapshotter-1-28-on-kubernetes-1-28/1712824186088460288

rerunning the tests:

/test pull-kubernetes-csi-external-snapshotter-1-27-on-kubernetes-1-27

/test pull-kubernetes-csi-external-snapshotter-1-28-on-kubernetes-1-28

[xing-yang]

Were you able to reproduce the problem seeing in #921 (comment) without your changes?

[xing-yang]

/retest

[xing-yang]

Please rebase to get around the Trivy error.

[Rakshith-R]

Were you able to reproduce the problem seeing in #921 (comment) without your changes?

First, without CRDs it fails to find CRDs, errors is similar to the one reported in #921 description

I think the output from #921 (comment) is after the user installed only vgsclass CRDs. vgs and vgsc is still missing.

After CRDs are installed, it should fail with RBAC issues.

[xing-yang]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Rakshith-R, xing-yang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [xing-yang]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sunnylovestiramisu]

/cherry-pick release-6.3

[k8s-infra-cherrypick-robot]

@sunnylovestiramisu: new pull request created: #940

In response to this:

/cherry-pick release-6.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.