Skip to content

Use credentials when calling ControllerModifyVolume #544

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nixpanic wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Use credentials when calling ControllerModifyVolume #544

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c5bec27
Use credentials when calling ControllerModifyVolume
nixpanic Nov 7, 2025
9c8a388
Pass context from the ModifyController to Modifier.Modify()
nixpanic Dec 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 41 additions & 4 deletions pkg/modifier/csi_modifier.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,17 @@ import (

"github.com/kubernetes-csi/external-resizer/pkg/csi"
v1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/client-go/informers"
"k8s.io/client-go/kubernetes"
)

const (
// annotations set by the external-provisioner when a modify secret is configured
modifySecretNameAnn = "volume.kubernetes.io/controller-modify-secret-name"
modifySecretNamespaceAnn = "volume.kubernetes.io/controller-modify-secret-namespace"
)

var ModifyNotSupportErr = errors.New("CSI driver does not support controller modify")

func NewModifierFromClient(
Expand Down Expand Up @@ -69,7 +76,7 @@ func (r *csiModifier) Name() string {
return r.name
}

func (r *csiModifier) Modify(pv *v1.PersistentVolume, mutableParameters map[string]string) error {
func (r *csiModifier) Modify(ctx context.Context, pv *v1.PersistentVolume, mutableParameters map[string]string) error {

var volumeID string
var source *v1.CSIPersistentVolumeSource
Expand All @@ -86,18 +93,48 @@ func (r *csiModifier) Modify(pv *v1.PersistentVolume, mutableParameters map[stri
return errors.New("empty volume handle")
}

var secrets map[string]string
secrets, err := r.getModifyCredentials(ctx, source.ControllerExpandSecretRef, pv.Annotations)
if err != nil {
return err
}

ctx, cancel := timeoutCtx(r.timeout)

defer cancel()
err := r.client.Modify(ctx, volumeID, secrets, mutableParameters)

err = r.client.Modify(ctx, volumeID, secrets, mutableParameters)
if err != nil {
return err
}

return nil
}

// getModifyCredentials fetches the credential from the secret referenced in the annotations. When missing,
// the default secretRef (CSIPersistentVolumeSource.ControllerExpandSecretRef) is used.
func (r *csiModifier) getModifyCredentials(ctx context.Context, secretRef *v1.SecretReference, annotations map[string]string) (map[string]string, error) {
secretName := annotations[modifySecretNameAnn]
secretNamespace := annotations[modifySecretNamespaceAnn]
if secretNamespace == "" || secretName == "" {
if secretRef == nil {
return nil, nil
}

secretName = secretRef.Name
secretNamespace = secretRef.Namespace
}

secret, err := r.k8sClient.CoreV1().Secrets(secretNamespace).Get(ctx, secretName, metav1.GetOptions{})
if err != nil {
return nil, fmt.Errorf("error getting secret %s in namespace %s: %v", secretName, secretNamespace, err)
}

credentials := map[string]string{}
for key, value := range secret.Data {
credentials[key] = string(value)
}
return credentials, nil
}

func supportsControllerModify(client csi.Client, timeout time.Duration) (bool, error) {
ctx, cancel := timeoutCtx(timeout)
defer cancel()
Expand Down
4 changes: 3 additions & 1 deletion pkg/modifier/modifier.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ limitations under the License.
package modifier

import (
"context"

v1 "k8s.io/api/core/v1"
)

Expand All @@ -25,5 +27,5 @@ type Modifier interface {
// Name returns the modifier's name.
Name() string
// Modify executes the modify operation of this PVC.
Modify(pv *v1.PersistentVolume, mutableParameters map[string]string) error
Modify(ctx context.Context, pv *v1.PersistentVolume, mutableParameters map[string]string) error
}
15 changes: 10 additions & 5 deletions pkg/modifycontroller/modify_volume.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ limitations under the License.
package modifycontroller

import (
"context"
"fmt"
"maps"
"slices"
Expand Down Expand Up @@ -73,6 +74,7 @@ func (ctrl *modifyController) modify(pvc *v1.PersistentVolumeClaim, pv *v1.Persi
return pvc, pv, err, false
}

ctx := context.TODO()
inUncertainState := false
if inProgress {
_, inUncertainState = ctrl.uncertainPVCs.Load(pvcKey)
Expand All @@ -89,10 +91,10 @@ func (ctrl *modifyController) modify(pvc *v1.PersistentVolumeClaim, pv *v1.Persi
if err != nil {
return pvc, pv, err, false
}
return ctrl.controllerModifyVolumeWithTarget(pvc, pv, vac)
return ctrl.controllerModifyVolumeWithTarget(ctx, pvc, pv, vac)
}

return ctrl.validateVACAndModifyVolumeWithTarget(pvc, pv)
return ctrl.validateVACAndModifyVolumeWithTarget(ctx, pvc, pv)
}

func (ctrl *modifyController) rolledBack(pvc *v1.PersistentVolumeClaim) (*v1.PersistentVolumeClaim, error) {
Expand Down Expand Up @@ -123,6 +125,7 @@ func (ctrl *modifyController) getTargetVAC(pvc *v1.PersistentVolumeClaim, vacNam
// func validateVACAndModifyVolumeWithTarget validate the VAC. The function sets pvc.Status.ModifyVolumeStatus
// to Pending if VAC does not exist and proceeds to trigger ModifyVolume if VAC exists
func (ctrl *modifyController) validateVACAndModifyVolumeWithTarget(
ctx context.Context,
pvc *v1.PersistentVolumeClaim,
pv *v1.PersistentVolume) (*v1.PersistentVolumeClaim, *v1.PersistentVolume, error, bool) {

Expand All @@ -141,18 +144,19 @@ func (ctrl *modifyController) validateVACAndModifyVolumeWithTarget(
// Record an event to indicate that external resizer is modifying this volume.
ctrl.eventRecorder.Event(pvc, v1.EventTypeNormal, util.VolumeModify,
fmt.Sprintf("external resizer is modifying volume %s with vac %s", pvc.Name, vac.Name))
return ctrl.controllerModifyVolumeWithTarget(pvc, pv, vac)
return ctrl.controllerModifyVolumeWithTarget(ctx, pvc, pv, vac)
}

// func controllerModifyVolumeWithTarget trigger the CSI ControllerModifyVolume API call
// and handle both success and error scenarios
func (ctrl *modifyController) controllerModifyVolumeWithTarget(
ctx context.Context,
pvc *v1.PersistentVolumeClaim,
pv *v1.PersistentVolume,
vacObj *storagev1.VolumeAttributesClass,
) (*v1.PersistentVolumeClaim, *v1.PersistentVolume, error, bool) {
var err error
pvc, pv, err = ctrl.callModifyVolumeOnPlugin(pvc, pv, vacObj)
pvc, pv, err = ctrl.callModifyVolumeOnPlugin(ctx, pvc, pv, vacObj)
if err == nil {
klog.V(4).Infof("Update volumeAttributesClass of PV %q to %s succeeded", pv.Name, vacObj.Name)
// Record an event to indicate that modify operation is successful.
Expand Down Expand Up @@ -195,6 +199,7 @@ func (ctrl *modifyController) controllerModifyVolumeWithTarget(
}

func (ctrl *modifyController) callModifyVolumeOnPlugin(
ctx context.Context,
pvc *v1.PersistentVolumeClaim,
pv *v1.PersistentVolume,
vac *storagev1.VolumeAttributesClass) (*v1.PersistentVolumeClaim, *v1.PersistentVolume, error) {
Expand All @@ -209,7 +214,7 @@ func (ctrl *modifyController) callModifyVolumeOnPlugin(
parameters[pvcNamespaceKey] = pvc.GetNamespace()
parameters[pvNameKey] = pv.GetName()
}
err := ctrl.modifier.Modify(pv, parameters)
err := ctrl.modifier.Modify(ctx, pv, parameters)

if err != nil {
return pvc, pv, err
Expand Down