CSIServiceAccountToken ga #103001

zshihang · 2021-06-18T16:53:38Z

What type of PR is this?

/kind feature
/kind api-change

xref: kubernetes/enhancements#2047

What this PR does / why we need it:

graduate CSIServiceAccountToken feature to stable

Does this PR introduce a user-facing change?

CSIServiceAccountToken is GA.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

- [KEP]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1855-csi-driver-service-account-token

zshihang · 2021-06-18T16:53:50Z

/cc @msau42

zshihang · 2021-06-18T16:54:29Z

/sig auth
/sig storage
/triage accepted
/priority important-soon

fejta-bot · 2021-06-18T17:42:08Z

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

msau42 · 2021-06-18T19:45:08Z

pkg/registry/storage/csidriver/strategy_test.go

@@ -113,21 +113,12 @@ func TestCSIDriverPrepareForCreate(t *testing.T) {
 			name:         "capacity disabled",
 			withCapacity: false,
 		},
-		{


withServiceAccountToken definition can be removed.

msau42 · 2021-06-18T19:45:44Z

pkg/registry/storage/csidriver/strategy_test.go

@@ -167,21 +158,6 @@ func TestCSIDriverPrepareForCreate(t *testing.T) {
 					t.Errorf("VolumeLifecycleModes not stripped: %v", csiDriver.Spec)
 				}
 			}
-			if test.withServiceAccountToken {
-				if csiDriver.Spec.TokenRequests == nil {


Should we keep the assertion that the fields are not dropped?

in any case we no longer drop fields so no need to assert fields are not dropped.

In the base CSIDriver object input to the test, can we set some values to these fields? That way we test that this method no longer mutates those fields.

we already set. line 133-134.

zshihang · 2021-06-21T18:36:26Z

/assign @liggitt for api review

zshihang · 2021-06-21T21:51:41Z

/retest
/assign @liggitt

msau42 · 2021-06-24T23:56:11Z

/lgtm
/approve

Just a nit on unit test

liggitt · 2021-06-26T20:23:34Z

/lgtm
/approve

k8s-ci-robot · 2021-06-26T20:23:51Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, msau42, zshihang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~api/OWNERS~~ [liggitt]
~~pkg/apis/storage/OWNERS~~ [liggitt]
~~pkg/features/OWNERS~~ [liggitt,msau42]
~~pkg/printers/OWNERS~~ [liggitt]
~~pkg/registry/OWNERS~~ [liggitt]
~~pkg/volume/csi/OWNERS~~ [liggitt,msau42]
~~staging/src/k8s.io/api/storage/OWNERS~~ [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

fejta-bot · 2021-06-27T00:37:46Z

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

This PR updates the feature gate status based on upstream implementation. The chanegs are listed below with links to upstream PRs merged: - BalanceAttacedNodeVolumes kubernetes/kubernetes#102443 - CSIMigrationvSphereComplete kubernetes/kubernetes#101272 - CSIServiceAccountToken kubernetes/kubernetes#103001 - DaemonSetUpdateSurge kubernetes/kubernetes#101742 - DisableCloudProviders kubernetes/kubernetes#100136 - IndexedJob kubernetes/kubernetes#101292 - LegacyNodeRoleBehavior kubernetes/kubernetes#100776 - NamespaceDefaultLabelName kubernetes/kubernetes#101342 - NetworkPolicyEndPort kubernetes/kubernetes#102834 - NodeDisruptionExclusion kubernetes/kubernetes#100776 - PodAffinityNamespaceSelector kubernetes/kubernetes#101496 - PodDeletionCost kubernetes/kubernetes#101080 - PreferNominatedNode kubernetes/kubernetes#102201 - ServiceLoadBalancerClass kubernetes/kubernetes#103129 - ServiceNodeExclusion kubernetes/kubernetes#100776 - ServiceTopology kubernetes/kubernetes#102412 - SizeMemoryBackedVoluems kubernetes/kubernetes#101048 - StatefulSetMinReadySeconds kubernetes/kubernetes#100842 - SuspendJob kubernetes/kubernetes#102022 - WindowsHostProcessContainers kubernetes/kubernetes#99576

Without token audience static PVs fail to mount in workload identity clusters. This has been solved in AKS by adding token audience to CSIDriver: kubernetes-sigs/azurefile-csi-driver#1763 This API went GA in k/k 1.22: kubernetes/kubernetes#103001

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jun 18, 2021

k8s-ci-robot requested review from msau42, deads2k and hongchaodeng June 18, 2021 16:53

msau42 reviewed Jun 18, 2021

View reviewed changes

CSIServiceAccountToken ga

8231a3e

zshihang force-pushed the csi branch from 4946f24 to 8231a3e Compare June 21, 2021 18:35

k8s-ci-robot assigned liggitt Jun 21, 2021

liggitt added this to the v1.22 milestone Jun 22, 2021

liggitt added this to Assigned in API Reviews Jun 22, 2021

msau42 mentioned this pull request Jun 23, 2021

update doc for CSIServiceAccountToken ga kubernetes/website#28586

Closed

liggitt moved this from Assigned to In progress in API Reviews Jun 24, 2021

liggitt assigned msau42 Jun 24, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 24, 2021

liggitt moved this from In progress to API review completed, 1.22 in API Reviews Jun 26, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 26, 2021

k8s-ci-robot merged commit a0f9c8c into kubernetes:master Jun 27, 2021

tengqm mentioned this pull request Jun 27, 2021

Update feature gates for 1.22 kubernetes/website#28644

Merged

zshihang mentioned this pull request Sep 15, 2022

release issue for feature CSIServiceAccountToken kubernetes/enhancements#2047

Closed

20 tasks

RomanBednar mentioned this pull request May 2, 2024

OCPBUGS-32785: add token audience for Azure File openshift/csi-operator#224

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CSIServiceAccountToken ga #103001

CSIServiceAccountToken ga #103001

zshihang commented Jun 18, 2021

zshihang commented Jun 18, 2021

zshihang commented Jun 18, 2021

fejta-bot commented Jun 18, 2021

msau42 Jun 18, 2021

zshihang Jun 21, 2021

msau42 Jun 18, 2021

zshihang Jun 21, 2021

msau42 Jun 24, 2021

zshihang Jun 25, 2021

zshihang commented Jun 21, 2021

zshihang commented Jun 21, 2021

msau42 commented Jun 24, 2021

liggitt commented Jun 26, 2021

k8s-ci-robot commented Jun 26, 2021

fejta-bot commented Jun 27, 2021

CSIServiceAccountToken ga #103001

CSIServiceAccountToken ga #103001

Conversation

zshihang commented Jun 18, 2021

What type of PR is this?

What this PR does / why we need it:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

zshihang commented Jun 18, 2021

zshihang commented Jun 18, 2021

fejta-bot commented Jun 18, 2021

msau42 Jun 18, 2021

Choose a reason for hiding this comment

zshihang Jun 21, 2021

Choose a reason for hiding this comment

msau42 Jun 18, 2021

Choose a reason for hiding this comment

zshihang Jun 21, 2021

Choose a reason for hiding this comment

msau42 Jun 24, 2021

Choose a reason for hiding this comment

zshihang Jun 25, 2021

Choose a reason for hiding this comment

zshihang commented Jun 21, 2021

zshihang commented Jun 21, 2021

msau42 commented Jun 24, 2021

liggitt commented Jun 26, 2021

k8s-ci-robot commented Jun 26, 2021

fejta-bot commented Jun 27, 2021