STOR-2996: Sync gcp pd csi driver operator to legacy subdir (2)

[mpatlasov]

Since PR#570 one more PR merged in openshift/gcp-pd-csi-driver-operator:

• OCPBUGS-88299: Avoid controller pods run as root

This PR brings corresponding commits to csi-operator repo by command:

$ git subtree pull --prefix=legacy/gcp-pd-csi-driver-operator --squash https://github.com/openshift/gcp-pd-csi-driver-operator main

https://redhat.atlassian.net/browse/STOR-2996

[openshift-ci-robot]

@mpatlasov: This pull request references STOR-2996 which is a valid jira issue.

Details

In response to this:

Since PR#570 one more PR merged in openshift/gcp-pd-csi-driver-operator:

• OCPBUGS-88299: Avoid controller pods run as root

This PR brings corresponding commits to csi-operator repo by command:

$ git subtree pull --prefix=legacy/gcp-pd-csi-driver-operator --squash https://github.com/openshift/gcp-pd-csi-driver-operator main

https://redhat.atlassian.net/browse/STOR-2996

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 9e844aec-970c-4ec1-abb6-72aea6230353

📥 Commits

Reviewing files that changed from the base of the PR and between 2fc1e7d and ce89ffa.

📒 Files selected for processing (5)

• legacy/gcp-pd-csi-driver-operator/assets/controller.yaml
• legacy/gcp-pd-csi-driver-operator/assets/rbac/controller_hostnetwork_binding.yaml
• legacy/gcp-pd-csi-driver-operator/assets/rbac/hostnetwork_role.yaml
• legacy/gcp-pd-csi-driver-operator/assets/rbac/old_controller_privileged_binding.yaml
• legacy/gcp-pd-csi-driver-operator/pkg/operator/starter.go

---

📝 Walkthrough

Walkthrough

This PR migrates the GCP PD CSI driver controller pod from the privileged security context constraint to hostnetwork-v2. It adds a new ClusterRole (gcp-pd-hostnetwork-role) granting use of the hostnetwork-v2 SCC and node read access, along with a ClusterRoleBinding connecting this role to the controller's service account. The operator's static resources controller is updated to install these new RBAC manifests in place of the old privileged binding, and a new conditional static resources controller is added to remove the legacy controller_privileged_binding.yaml resource.

Changes

Cohort / File(s)	Summary
SCC migration legacy/gcp-pd-csi-driver-operator/assets/controller.yaml	Updated openshift.io/required-scc annotation from privileged to hostnetwork-v2
legacy/gcp-pd-csi-driver-operator/assets/rbac/hostnetwork_role.yaml	Added new ClusterRole for hostnetwork-v2 SCC use and node get access
legacy/gcp-pd-csi-driver-operator/assets/rbac/controller_hostnetwork_binding.yaml	Added new ClusterRoleBinding for the controller service account
legacy/gcp-pd-csi-driver-operator/pkg/operator/starter.go	Updated static resource manifest list; added conditional controller to remove old privileged binding

Sequence Diagram(s)

Not applicable — changes are declarative manifest and controller wiring updates without a new runtime interaction flow.

Related PRs: None identified.

Suggested labels: rbac, gcp-pd-csi-driver, operator

Suggested reviewers: None identified.

🥕 A hop, a skip, a role rebound,
No more privileged, hostnetwork found,
Old bindings swept clean away,
New RBAC rules here to stay,
Carrots of access, precisely scoped around.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	Fail: the manifests still declare hostNetwork: true in controller.yaml and privileged: true in node.yaml, which the check explicitly flags.	Remove the flagged privilege settings from the manifests, or add an approved exception/justification for any required hostNetwork or privileged use.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly reflects the subtree sync of the gcp-pd-csi-driver-operator legacy subdir.
Description check	✅ Passed	The description directly explains the upstream sync and the specific changes brought in.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR changes only YAML assets and operator RBAC wiring; no Ginkgo test titles were added or modified.
Test Structure And Quality	✅ Passed	No Ginkgo test files were changed; this PR only updates manifests and operator wiring, so the test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	No Ginkgo/e2e test declarations or test files were added; the diff only changes manifests and operator wiring, so this check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; the PR only changes manifests and operator static-resource wiring.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The patch only swaps SCC/RBAC manifests; no new replicas, topology spread, node selectors, or anti-affinity were introduced.
Ote Binary Stdout Contract	✅ Passed	No process-level stdout writes were added; the only Go change updates static RBAC resources and a cleanup controller, and the entrypoint remains stdout-free.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; this PR only updates manifests/operator wiring, so the IPv4/disconnected-network test check is not applicable.
No-Weak-Crypto	✅ Passed	Touched files only change SCC/RBAC wiring; no MD5/SHA1/DES/RC4/3DES, custom crypto, or secret/token comparisons found.
No-Sensitive-Data-In-Logs	✅ Passed	Changed files only adjust SCC/RBAC and static resource wiring; no new log statements or log payloads with passwords/tokens/PII were added.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mpatlasov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• legacy/gcp-pd-csi-driver-operator/OWNERS [mpatlasov]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mpatlasov]

/test aws-efs-operator-e2e

[dobsonj]

/lgtm
/retest

[mpatlasov]

/retest

[mpatlasov]

/test e2e-gcp-ovn-upgrade

[mpatlasov]

/verified by mpatlasov

[openshift-ci-robot]

@mpatlasov: This PR has been marked as verified by mpatlasov.

Details

In response to this:

/verified by mpatlasov

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD a986bde and 2 for PR HEAD ce89ffa in total

[mpatlasov]

/test hypershift-aws-e2e-external

[mpatlasov]

/override ci/prow/hypershift-aws-e2e-external
The test fails to create cluster:

hypershift_framework.go:518: failed to create cluster, tearing down: failed to create infra: failed to create VPC: operation error EC2: CreateVpc, https response error StatusCode: 400, RequestID: 0c34be31-45e6-4cc5-8eb6-d3bf1bbcad1a, api error VpcLimitExceeded: The maximum number of VPCs has been reached.

It is not relevant to GCP PD CSI operator.

[openshift-ci]

@mpatlasov: Overrode contexts on behalf of mpatlasov: ci/prow/hypershift-aws-e2e-external

Details

In response to this:

/override ci/prow/hypershift-aws-e2e-external
The test fails to create cluster:

hypershift_framework.go:518: failed to create cluster, tearing down: failed to create infra: failed to create VPC: operation error EC2: CreateVpc, https response error StatusCode: 400, RequestID: 0c34be31-45e6-4cc5-8eb6-d3bf1bbcad1a, api error VpcLimitExceeded: The maximum number of VPCs has been reached.

It is not relevant to GCP PD CSI operator.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@mpatlasov: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.