Fix the name of the snapshot controller leader election RoleBinding #601

robbie-demuth · 2020-10-26T18:11:24Z

Is this a bug fix or adding new feature?

Bug fix

What is this PR about? / Why do we need it?

Before, the RoleBinding was named snapshot-controller-leaderelection. It
also incorrectly referenced the snapshot-controller-leaderelection Role
instead of the ebs-snapshot-controller-leaderelection Role defined by
the Helm chart

By default, the objects for the snapshot controller from
kubernetes-csi/external-snapshotter [1] are installed into the default
namespace. The manifests, however, recommend installing the objects in
the kube-system namespace instead. One of the objects is a RoleBinding
named snapshot-controller-leaderelection. When installing the snapshot
controller from the external-snapshotter repo into the kube-system
namespace, the AWS EBS CSI driver Helm chart fails to install with the
following error because the RoleBindings conflict:

Error: rendered manifests contain a resource that already exists. Unable to continue with install: RoleBinding "snapshot-controller-leaderelection" in namespace "kube-system" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "aws-ebs-csi-driver"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "kube-system"

If the snapshot controller from the external-snapshotter repo is
installed into the default namespace, the AWS EBS CSI driver Helm chart
installs (and seems to work) without issue even though the
snapshot-controller-leaderelection Role in the kube-system namespace
does not exist

[1] https://github.com/kubernetes-csi/external-snapshotter/tree/v3.0.1/deploy/kubernetes/snapshot-controller

What testing is done?

Installed the modified Helm chart and validated that the snapshot controller is able to snapshot volumes, etc

Before, the RoleBinding was named snapshot-controller-leaderelection. It also incorrectly referenced the snapshot-controller-leaderelection Role instead of the ebs-snapshot-controller-leaderelection Role defined by the Helm chart By default, the objects for the snapshot controller from kubernetes-csi/external-snapshotter [1] are installed into the default namespace. The manifests, however, recommend installing the objects in the kube-system namespace instead. One of the objects is a RoleBinding named snapshot-controller-leaderelection. When installing the snapshot controller from the external-snapshotter repo into the kube-system namespace, the AWS EBS CSI driver Helm chart fails to install with the following error because the RoleBindings conflict: `Error: rendered manifests contain a resource that already exists. Unable to continue with install: RoleBinding "snapshot-controller-leaderelection" in namespace "kube-system" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "aws-ebs-csi-driver"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "kube-system"` If the snapshot controller from the external-snapshotter repo is installed into the default namespace, the AWS EBS CSI driver Helm chart installs (and seems to work) without issue even though the snapshot-controller-leaderelection Role in the kube-system namespace does not exist [1] https://github.com/kubernetes-csi/external-snapshotter/tree/v3.0.1/deploy/kubernetes/snapshot-controller

k8s-ci-robot · 2020-10-26T18:11:32Z

Hi @robbie-demuth. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

robbie-demuth · 2020-10-26T18:12:04Z

aws-ebs-csi-driver/templates/rolebinding-snapshot-controller-leaderelection.yaml

@@ -3,7 +3,7 @@
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: snapshot-controller-leaderelection
+  name: ebs-snapshot-controller-leaderelection


Should I also bump the Helm chart version from 0.6.1 to 0.6.2? Similarly, what's the release process like for the Helm chart? I see it's attached to the GitHub release, but is it released independently as well or do I need to wait for a GitHub release to be cut for this change to be officially available?

robbie-demuth · 2020-10-26T18:12:16Z

aws-ebs-csi-driver/templates/rolebinding-snapshot-controller-leaderelection.yaml

@@ -13,7 +13,7 @@ subjects:
    namespace: kube-system
 roleRef:
  kind: Role
-  name: snapshot-controller-leaderelection
+  name: ebs-snapshot-controller-leaderelection


I mentioned this briefly in the commit message / PR description, but I'm unsure how this repository's snapshot controller was working if the snapshot controller from the external-snapshotter repository was installed into a namespace other than kube-system. In that case, the role previously referenced here would not have existed. Are we sure that this role / role binding are needed?

robbie-demuth · 2020-10-26T18:12:29Z

deploy/kubernetes/overlays/alpha/rbac_add_snapshot_controller_leaderelection_rolebinding.yaml

@@ -3,7 +3,7 @@
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: snapshot-controller-leaderelection
+  name: ebs-snapshot-controller-leaderelection


Running make generate-kustomize as instructed by https://github.com/kubernetes-sigs/aws-ebs-csi-driver#helm-and-manifests resulted in some other changes, but they're not relevant to this PR, so I didn't commit them

Let me handle running it again after this meges, this fell off my radar but it's a straightforward fix thank you

coveralls · 2020-10-26T19:23:22Z

Pull Request Test Coverage Report for Build 1278

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 81.253%

Totals
Change from base Build 1269:	0.0%
Covered Lines:	1595
Relevant Lines:	1963

💛 - Coveralls

fejta-bot · 2020-10-26T21:48:21Z

Unknown CLA label state. Rechecking for CLA labels.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/check-cla

wongma7 · 2020-10-27T19:16:05Z

/ok-to-test

will take a llook

wongma7 · 2020-12-04T21:55:09Z

/lgtm
/approve
thank you

k8s-ci-robot · 2020-12-04T21:55:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: robbie-demuth, wongma7

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [wongma7]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

wongma7 · 2020-12-04T21:55:35Z

Really appreicate the thorough description btw

wongma7 · 2020-12-04T22:00:33Z

One last comment: it's questoinable why we are installing the snapshot controller in the first place and causing this conflict scenario, ideally the snapshot controller should be installed separately since it can be reused by multiple csi drivers, but I'm going to leave it as a follow up issue: #635

k8s-ci-robot requested review from jsafrane and wongma7 October 26, 2020 18:11

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Oct 26, 2020

robbie-demuth mentioned this pull request Oct 26, 2020

Fix the name of the snapshot controller leader election RoleBinding #599

Closed

robbie-demuth commented Oct 26, 2020

View reviewed changes

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Oct 26, 2020

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 27, 2020

k8s-ci-robot assigned wongma7 Dec 4, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Dec 4, 2020

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 4, 2020

wongma7 mentioned this pull request Dec 4, 2020

Don't install snapshot controller #635

Closed

k8s-ci-robot merged commit 00bcf57 into kubernetes-sigs:master Dec 4, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix the name of the snapshot controller leader election RoleBinding #601

Fix the name of the snapshot controller leader election RoleBinding #601

robbie-demuth commented Oct 26, 2020 •

edited

k8s-ci-robot commented Oct 26, 2020

robbie-demuth Oct 26, 2020

robbie-demuth Oct 26, 2020

robbie-demuth Oct 26, 2020

wongma7 Dec 4, 2020

coveralls commented Oct 26, 2020

fejta-bot commented Oct 26, 2020

wongma7 commented Oct 27, 2020

wongma7 commented Dec 4, 2020

k8s-ci-robot commented Dec 4, 2020

wongma7 commented Dec 4, 2020

wongma7 commented Dec 4, 2020

Fix the name of the snapshot controller leader election RoleBinding #601

Fix the name of the snapshot controller leader election RoleBinding #601

Conversation

robbie-demuth commented Oct 26, 2020 • edited

k8s-ci-robot commented Oct 26, 2020

robbie-demuth Oct 26, 2020

Choose a reason for hiding this comment

robbie-demuth Oct 26, 2020

Choose a reason for hiding this comment

robbie-demuth Oct 26, 2020

Choose a reason for hiding this comment

wongma7 Dec 4, 2020

Choose a reason for hiding this comment

coveralls commented Oct 26, 2020

Pull Request Test Coverage Report for Build 1278

💛 - Coveralls

fejta-bot commented Oct 26, 2020

wongma7 commented Oct 27, 2020

wongma7 commented Dec 4, 2020

k8s-ci-robot commented Dec 4, 2020

wongma7 commented Dec 4, 2020

wongma7 commented Dec 4, 2020

robbie-demuth commented Oct 26, 2020 •

edited