OCPBUGS-100071: csi-driver-smb: DeleteVolume call fails to mkdir under /tmp

[dobsonj]

https://redhat.atlassian.net/browse/OCPBUGS-100071

readOnlyRootFilesystem still applies when the driver attempts to create subdirectories under /tmp even though it's mounted as emptydir. Adding medium: Memory to the tmp-dir volume though allows new directories to be created under /tmp and allows the DeleteVolume call to succeed.

Manual testing: ran the operator with these changes locally and followed the "steps to reproduce" in the bug to verify the PV is deleted successfully.

/verified by @dobsonj
/cherry-pick release-4.22 release-4.21

/cc @openshift/storage

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@dobsonj: This pull request references Jira Issue OCPBUGS-100071, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

https://redhat.atlassian.net/browse/OCPBUGS-100071

readOnlyRootFilesystem still applies when the driver attempts to create subdirectories under /tmp even though it's mounted as emptydir. Adding medium: Memory to the tmp-dir volume though allows new directories to be created under /tmp and allows the DeleteVolume call to succeed.

Manual testing: ran the operator with these changes locally and followed the "steps to reproduce" in the bug to verify the PV is deleted successfully.

/verified by @dobsonj
/cherry-pick release-4.22 release-4.21

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@dobsonj: GitHub didn't allow me to request PR reviews from the following users: openshift/storage.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

https://redhat.atlassian.net/browse/OCPBUGS-100071

readOnlyRootFilesystem still applies when the driver attempts to create subdirectories under /tmp even though it's mounted as emptydir. Adding medium: Memory to the tmp-dir volume though allows new directories to be created under /tmp and allows the DeleteVolume call to succeed.

Manual testing: ran the operator with these changes locally and followed the "steps to reproduce" in the bug to verify the PV is deleted successfully.

/verified by @dobsonj
/cherry-pick release-4.22 release-4.21

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Samba controller and node tmp-dir volumes now use emptyDir with medium: Memory instead of the default storage medium.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	The changed Samba manifests declare privileged: true and hostNetwork: true; both settings match the container-privileges check.	Remove these settings where possible, or document the required CSI privileges and apply the narrowest security context.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the SMB CSI driver failure and the affected DeleteVolume operation.
Description check	✅ Passed	The description explains the /tmp volume issue, the medium: Memory fix, and the manual verification.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes only Samba YAML volume definitions and generated manifests; it adds no Ginkgo or other test titles to assess.
Test Structure And Quality	✅ Passed	The PR changes only four Samba YAML manifests to set emptyDir.medium; it adds no Ginkgo It blocks or test code, so these test-structure checks do not apply.
Microshift Test Compatibility	✅ Passed	The commit changes only four YAML deployment manifests and adds no Ginkgo e2e tests or test declarations, so MicroShift compatibility checks do not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only four YAML manifests to set tmp-dir emptyDir medium to Memory; no Ginkgo e2e tests or multi-node assumptions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	The commit changes only emptyDir medium to Memory in two patches and their generated manifests; it introduces no scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The commit changes only four Samba YAML assets, adding emptyDir.medium: Memory; it changes no OTE binary, main function, or suite setup that could write stdout.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only Samba YAML manifests and generated YAML; it adds no Ginkgo e2e tests or external connectivity logic.
No-Weak-Crypto	✅ Passed	The commit only changes four YAML manifests to set tmp-dir emptyDir medium to Memory; no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, or crypto implementation was added.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only changes four YAML volume definitions to use emptyDir.medium: Memory; it adds no logging statements or sensitive data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[dobsonj]

/pipeline required

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-csi
/test e2e-aws-ovn-upgrade
/test e2e-azure
/test e2e-azure-csi
/test e2e-azure-file-csi
/test e2e-azure-file-nfs-csi
/test e2e-azure-ovn-upgrade
/test e2e-gcp
/test e2e-gcp-csi
/test e2e-gcp-ovn-upgrade

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dobsonj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dobsonj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dobsonj]

/test ?

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@assets/overlays/samba/patches/controller_add_driver.yaml`:
- Around line 83-84: In controller_add_driver.yaml and node_add_driver.yaml at
the memory-backed emptyDir volumes, add validated sizeLimit values for both
tmp-dir volumes. Complete resource limits by adding CPU limits to the controller
and node csi-driver containers and controller csi-provisioner, plus both CPU and
memory limits to the node sidecar containers.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 58451c2e-6ca8-4bf8-b4d4-57da100b1321

📥 Commits

Reviewing files that changed from the base of the PR and between 756f6b8 and 0a28a64.

⛔ Files ignored due to path filters (2)

• assets/overlays/samba/generated/standalone/controller.yaml is excluded by !**/generated/**
• assets/overlays/samba/generated/standalone/node.yaml is excluded by !**/generated/**

📒 Files selected for processing (2)

• assets/overlays/samba/patches/controller_add_driver.yaml
• assets/overlays/samba/patches/node_add_driver.yaml

[dobsonj]

/test smb-operator-e2e
/test smb-operator-e2e-extended
/test smb-win2019-operator-e2e
/test smb-win2022-operator-e2e

[dobsonj]

/retest
/verified by @dobsonj
/cherry-pick release-4.22 release-4.21

[openshift-cherrypick-robot]

@dobsonj: once the present PR merges, I will cherry-pick it on top of release-4.22 in a new PR and assign it to you.

Details

In response to this:

/retest
/verified by @dobsonj
/cherry-pick release-4.22 release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci-robot]

@dobsonj: This PR has been marked as verified by @dobsonj.

Details

In response to this:

/retest
/verified by @dobsonj
/cherry-pick release-4.22 release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@dobsonj: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/smb-win2022-operator-e2e	0a28a64	link	false	/test smb-win2022-operator-e2e
ci/prow/smb-win2019-operator-e2e	0a28a64	link	false	/test smb-win2019-operator-e2e

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.