Prevent unauthorised volume mode conversion during volume restore

[RaunakShah]

Enhancement Description

• One-line enhancement description (can be used as a release note): Prevent unauthorised volume mode conversion during volume restore.

• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/3141-prevent-volume-mode-conversion

• Primary contact (assignee): @RaunakShah @xing-yang

• Responsible SIGs: SIG-Storage

• Enhancement target (which target equals to which milestone):

  • Alpha release target (x.y): 1.24
  • Beta release target (x.y): 1.27
  • Stable release target (x.y): 1.28

• Alpha

  • KEP (k/enhancements) update PR(s):
    • https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/3141-prevent-volume-mode-conversion
  • Code (k/k) update PR(s):
    • Update generated code for SourceVolumeMode field in VolumeSnapshotContents kubernetes-csi/external-snapshotter#665
    • Update snapshotter and client modules kubernetes-csi/external-snapshotter#670
  • Docs (k/website) update PR(s):
    • Add docs for preventing volume mode conversion website#32673

• Beta

  • KEP (k/enhancements) update PR(s):
    • KEP-3141: Graduate "Prevent unauthorised volume mode conversion" to Beta  #3556
  • Code (k/k) update PR(s):
    • Add tests for volume mode conversion feature kubernetes-csi/external-provisioner#867
    • Add and enable sidecar e2e test to enable volume mode conversion kubernetes-csi/external-provisioner#832
    • Fix string pointer comparison for source volume mode conversion kubernetes-csi/external-provisioner#793
    • Register metrics exposed by sig-storage-lib kubernetes-csi/external-provisioner#792
    • Change annotation name to allow volume mode change kubernetes-csi/external-provisioner#791
    • Add dataSource label to pvcs created kubernetes-sigs/sig-storage-lib-external-provisioner#128
    • Add optional canary job to all CSI sidecar repos test-infra#28307
  • Docs (k/website) update(s):
    • Update volume mode change annotation in documentation website#39367

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[RaunakShah]

/sig storage

[gracenng]

Hi @RaunakShah ! 1.24 Enhancements team here. Just checking in as we approach enhancements freeze on 18:00pm PT on Thursday Feb 3rd. This enhancements is targeting alpha for 1.24, is that correct?.
Here’s where this enhancement currently stands:

• Updated KEP file using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for this release with latest-milestone: 1.24
• KEP has a test plan section filled out.
• KEP has up to date graduation criteria.
• KEP has a production readiness review that has been completed and merged into k/enhancements.

The status of this enhancement is track as at risk
Thanks!

[xing-yang]

/milestone v1.24

[xing-yang]

@gracenng Yes, this is targeting Alpha in 1.24.

[gracenng]

Hi @RaunakShah , 1.24 Enhancements Team here.

Reaching out as we're less than a week away from Enhancement Freeze on Thursday, February 3rd.
Updated some points on the check list above, let me know if I missed anything.
I'm monitoring #3151 and current status is at risk

[gracenng]

All good for 1.24 Enhancements Freeze

[xing-yang]

@gracenng Should this have a Tracked/Yes label?

[didicodes]

Hi @xing-yang & @RaunakShah, 1.24 Docs shadow here. 👋

This enhancement is marked as Needs Docs for the 1.24 release.

Please follow the steps detailed in the documentation to open a PR against the dev-1.24 branch in the k/website repo. This PR can be just a placeholder at this time and must be created before Thursday 31st March 2022, 18:00 PDT.

Also, if needed take a look at Documenting for a release to familiarize yourself with the docs requirement for the release.

Thank you! 🙌

[gracenng]

Hi @RaunakShah 1.24 Enhancements Team here,

With Code Freeze approaching on 18:00 PDT Tuesday March 29th 2022, the enhancement status is at risk as there is no linked k/k PR. Kindly list them in this issue. Thanks!

[xing-yang]

PRs are submitted here:
kubernetes-csi/external-snapshotter#665
kubernetes-csi/external-snapshotter#670

[xing-yang]

@gracenng It might be better to label this feature as "tracked/out-of-tree" as all the code changes are out-of-tree.

[gracenng]

All good for Code Freeze!

[nate-double-u]

Hi @RaunakShah, reminder that tomorrow (April 5th) is the deadline for 1.24 Docs Ready for Review.

Please open a PR (and link it back here), push your docs content for this enhancement, and remove the work-in-progress label when ready for review.

We have a tight turnaround to getting docs reviewed and approved for the release, and we’re hoping to have all docs in for review by tomorrow. Thank you!

[xing-yang]

Here's the doc PR: kubernetes/website#32673

[RaunakShah]

@nate-double-u @xing-yang I've removed the WIP label from the doc PR.

[sftim]

This enhancement proposal mentions the annotation snapshot.storage.kubernetes.io/allowVolumeModeChange. Would it be possible to deprecate that in favor of a more conventional snapshot.storage.kubernetes.io/allow-volume-mode-change?

[xing-yang]

This enhancement proposal mentions the annotation snapshot.storage.kubernetes.io/allowVolumeModeChange. Would it be possible to deprecate that in favor of a more conventional snapshot.storage.kubernetes.io/allow-volume-mode-change?

We could do that in 1.25.

[nate-double-u]

A note for when this KEP goes to beta (targeting v1.25): the documentation that was added in v1.24 needs to be updated.

[Priyankasaggu11929]

/milestone clear

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[xing-yang]

/remove-lifecycle stale

[fsmunoz]

Hello @RaunakShah 👋, v1.27 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PDT Thursday 9th February 2023.

This enhancement is targeting for stage beta for 1.27 (please correct me, if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone: 1.27
• KEP readme has a updated detailed test plan section filled out
• KEP readme has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

For this KEP, we would need to update the following:

• Update kep.yaml to reflect current stage information. This is covered in KEP-3141: Graduate "Prevent unauthorised volume mode conversion" to Beta  #3556.
• Update the Tests section with the information from the latest template (KEP-3141: Graduate "Prevent unauthorised volume mode conversion" to Beta  #3556 covers this)
• Complete the missing PRR sections (KEP-3141: Graduate "Prevent unauthorised volume mode conversion" to Beta  #3556 covers this)
• Update to the latest KEP template. Specifically, there is an additional question in the Scalability section ("Can enabling / using this feature result in resource exhaustion of some node resources (PIDs, sockets, inodes, etc.)?") that isn't covered in KEP-3141: Graduate "Prevent unauthorised volume mode conversion" to Beta  #3556 .

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[logicalhan]

Is there a PR for the beta version of this KEP that I can review for PRR?

[RaunakShah]

Hi @logicalhan, you can find that here - #3556
The PRR was actually already reviewed by @deads2k prior to 1.26, but we couldn't get the e2e tests in in time, so this was moved to 1.27.
I've updated the PRR reviewer to you for Beta in the latest commit on that PR. Let me know if I should change it back!

[RaunakShah]

I've updated the PRR reviewer to you for Beta in the latest commit on that PR. Let me know if I should change it back!

Oops, that didn't work.. Reverted that commit

[logicalhan]

Let me know if I should change it back!

Oh you should change it back, I'm actually just a shadow reviewer this cycle.

[logicalhan]

The PRR was actually already reviewed by @deads2k prior to 1.26, but we couldn't get the e2e tests in in time, so this was moved to 1.27.

If this is true, then we don't really need a PRR review this time around.

[fsmunoz]

@RaunakShah I've updated my comment to include what is the status considering #3556 . It's almost there, please take a look at the updated template topic I've raised.

[RaunakShah]

@fsmunoz thank you, I've updated the KEP template with the latest template. PTAL!

[fsmunoz]

Thank you @RaunakShah ! This enhancement is ready to be traced for graduation to beta in v1.27.

/label tracked/yes
/remove-label tracked/no

[jsafrane]

@RaunakShah befora graduating to GA, please update the KEP, the new flag is in external-provisioner and snapshot-controller, not external-snapshotter sidecar:

enhancements/keps/sig-storage/3141-prevent-volume-mode-conversion/README.md

Lines 264 to 266 in 42a4b1c

	A new out-of-tree flag named `PreventVolumeModeConversion` will be introduced on
	`external-snapshotter` and `external-provisioner`. Both of these components are
	out-of-tree so this proposal will not require any in-tree feature gates.

In addition, there could be version skew between the external-provisioner (shipped by a CSI driver vendor) and snapshot-controller (shipped by Kubernetes vendor). I'd appreciate a little more detail in Version skew strategy chapter, now it says it's OK, but it does not say how do we achieve that. What exactly happens when there is new a external-provisioner with old snapshot-controller.

[fsmunoz]

Hi @RaunakShah 👋,

Checking in as we approach 1.27 code freeze at 17:00 PDT on Tuesday 14th March 2023.

Please ensure the following items are completed:

• All PRs to the Kubernetes repo that are related to your enhancement are linked in the above issue description (for tracking purposes).
• All PRs are fully merged by the code freeze deadline.

• Update generated code for SourceVolumeMode field in VolumeSnapshotContents kubernetes-csi/external-snapshotter#665
• Update snapshotter and client modules kubernetes-csi/external-snapshotter#670

For this enhancement, it looks like all linked PRs are merged.

Please let me know what other PRs in k/k I should be tracking for this KEP.

As always, we are here to help should questions come up. Thanks!

[xing-yang]

Hi @fsmunoz, all code PRs are merged. Just docs/blog remaining. Thanks!