From 39a60d1fa13d1bc492f620873418fa8c9def2a63 Mon Sep 17 00:00:00 2001 From: Roman Bednar Date: Wed, 5 Aug 2026 11:16:02 +0200 Subject: [PATCH] UPSTREAM: : Create TLS secret in PrepareTest when CapSnapshotMetadata is enabled When CSI_PROW_ENABLE_SNAPSHOT_METADATA=true, PrepareTest() keeps the csi-snapshot-metadata sidecar and its volume but never creates the TLS secret the volume references. Only the 2 CBT-specific tests create it via CreateSnapshotMetadataResources(), so all other CSI hostpath tests fail with FailedMount on the missing secret. Add CreateSnapshotMetadataTLSSecret() that creates only the TLS secret (CA + server cert + secret) without the Service and SnapshotMetadataService CR that only CBT tests need. Call it from PrepareTest() after deploying manifests when CapSnapshotMetadata is true. Make createTLSSecret() idempotent by handling AlreadyExists so that CBT tests calling CreateSnapshotMetadataResources() after PrepareTest() don't fail on the duplicate secret. Apply the same snapshot metadata support to the OCP-specific csi-hostpath-groupsnapshot driver: add CSI_PROW_ENABLE_SNAPSHOT_METADATA env var check, snapshot-metadata RBAC manifest, --enable-snapshot-metadata arg patch, and TLS secret creation in PrepareTest(). --- .../test/e2e/storage/drivers/csi.go | 6 ++++ .../openshift_group_snapshot_driver.go | 18 ++++++++++++ .../e2e/storage/utils/snapshot-metadata.go | 29 ++++++++++++++++++- 3 files changed, 52 insertions(+), 1 deletion(-) diff --git a/vendor/k8s.io/kubernetes/test/e2e/storage/drivers/csi.go b/vendor/k8s.io/kubernetes/test/e2e/storage/drivers/csi.go index d25f3a367483..ff487f42c2db 100644 --- a/vendor/k8s.io/kubernetes/test/e2e/storage/drivers/csi.go +++ b/vendor/k8s.io/kubernetes/test/e2e/storage/drivers/csi.go @@ -376,6 +376,12 @@ func (h *hostpathCSIDriver) PrepareTest(ctx context.Context, f *framework.Framew framework.Failf("deploying %s driver: %v", h.driverInfo.Name, err) } + if h.driverInfo.Capabilities[storageframework.CapSnapshotMetadata] { + if err := utils.CreateSnapshotMetadataTLSSecret(ctx, f, driverns); err != nil { + framework.Failf("creating snapshot metadata TLS secret: %v", err) + } + } + cleanupFunc := generateDriverCleanupFunc( f, h.driverInfo.Name, diff --git a/vendor/k8s.io/kubernetes/test/e2e/storage/drivers/openshift_group_snapshot_driver.go b/vendor/k8s.io/kubernetes/test/e2e/storage/drivers/openshift_group_snapshot_driver.go index 379f62d55f29..4a76c36bdb4f 100644 --- a/vendor/k8s.io/kubernetes/test/e2e/storage/drivers/openshift_group_snapshot_driver.go +++ b/vendor/k8s.io/kubernetes/test/e2e/storage/drivers/openshift_group_snapshot_driver.go @@ -3,6 +3,7 @@ package drivers import ( "context" "fmt" + "os" "time" "github.com/onsi/ginkgo/v2" @@ -106,6 +107,9 @@ func InitGroupSnapshotHostpathCSIDriver() storageframework.TestDriver { // added when patching the deployment. storageframework.CapVolumeLimits: true, } + if os.Getenv("CSI_PROW_ENABLE_SNAPSHOT_METADATA") == "true" { + capabilities[storageframework.CapSnapshotMetadata] = true + } // OCP specific code: a different driver name (csi-hostpath-groupsnapshot) return initGroupSnapshotHostpathCSIDriver("csi-hostpath-groupsnapshot", capabilities, @@ -115,6 +119,7 @@ func InitGroupSnapshotHostpathCSIDriver() storageframework.TestDriver { }, "test/e2e/testing-manifests/storage-csi/external-attacher/rbac.yaml", "test/e2e/testing-manifests/storage-csi/external-provisioner/rbac.yaml", + "test/e2e/testing-manifests/storage-csi/external-snapshot-metadata/rbac.yaml", "test/e2e/testing-manifests/storage-csi/external-snapshotter/csi-snapshotter/rbac-csi-snapshotter.yaml", "test/e2e/testing-manifests/storage-csi/external-health-monitor/external-health-monitor-controller/rbac.yaml", "test/e2e/testing-manifests/storage-csi/external-resizer/rbac.yaml", @@ -236,6 +241,13 @@ func (h *groupSnapshotHostpathCSIDriver) PrepareTest(ctx context.Context, f *fra DriverContainerArguments: []string{"--feature-gates=CSIVolumeGroupSnapshot=true"}, }) + if os.Getenv("CSI_PROW_ENABLE_SNAPSHOT_METADATA") == "true" { + patches = append(patches, utils.PatchCSIOptions{ + DriverContainerName: "hostpath", + DriverContainerArguments: []string{"--enable-snapshot-metadata"}, + }) + } + err = utils.CreateFromManifests(ctx, config.Framework, driverNamespace, func(item interface{}) error { for _, o := range patches { if err := utils.PatchCSIDeployment(config.Framework, o, item); err != nil { @@ -289,6 +301,12 @@ func (h *groupSnapshotHostpathCSIDriver) PrepareTest(ctx context.Context, f *fra framework.Failf("deploying %s driver: %v", h.driverInfo.Name, err) } + if h.driverInfo.Capabilities[storageframework.CapSnapshotMetadata] { + if err := utils.CreateSnapshotMetadataTLSSecret(ctx, f, driverns); err != nil { + framework.Failf("creating snapshot metadata TLS secret: %v", err) + } + } + cleanupFunc := generateDriverCleanupFunc( f, h.driverInfo.Name, diff --git a/vendor/k8s.io/kubernetes/test/e2e/storage/utils/snapshot-metadata.go b/vendor/k8s.io/kubernetes/test/e2e/storage/utils/snapshot-metadata.go index a272044e7ec9..c574ed2f0fcf 100644 --- a/vendor/k8s.io/kubernetes/test/e2e/storage/utils/snapshot-metadata.go +++ b/vendor/k8s.io/kubernetes/test/e2e/storage/utils/snapshot-metadata.go @@ -29,6 +29,7 @@ import ( "github.com/onsi/ginkgo/v2" v1 "k8s.io/api/core/v1" + apierrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" "k8s.io/apimachinery/pkg/runtime/schema" @@ -145,7 +146,11 @@ func createTLSSecret(ctx context.Context, f *framework.Framework, driverNamespac client := f.ClientSet.CoreV1().Secrets(driverNamespace) if _, err := client.Create(ctx, tlsSecret, metav1.CreateOptions{}); err != nil { - return fmt.Errorf("failed to create or update TLS secret: %w", err) + if apierrors.IsAlreadyExists(err) { + framework.Logf("TLS secret already exists: %s", tlsSecret.Name) + return nil + } + return fmt.Errorf("failed to create TLS secret: %w", err) } framework.Logf("TLS secret created successfully: %s", tlsSecret.Name) @@ -216,6 +221,28 @@ func createSnapshotMetdataServiceCR(ctx context.Context, f *framework.Framework, return nil } +// CreateSnapshotMetadataTLSSecret creates only the TLS secret needed by the +// csi-snapshot-metadata sidecar. Use this in PrepareTest when CapSnapshotMetadata +// is enabled so the driver pod can mount the secret without requiring the full +// set of snapshot metadata resources (Service, SnapshotMetadataService CR). +func CreateSnapshotMetadataTLSSecret(ctx context.Context, f *framework.Framework, driverNamespace string) error { + caCert, caPrivateKey, err := generateCA() + if err != nil { + return fmt.Errorf("failed to generate CA certificate: %w", err) + } + + serverCertBytes, serverKeyBytes, err := generateServerCert(driverNamespace, caCert, caPrivateKey) + if err != nil { + return fmt.Errorf("failed to generate server certificate: %w", err) + } + + if err := createTLSSecret(ctx, f, driverNamespace, serverCertBytes, serverKeyBytes); err != nil { + return fmt.Errorf("failed to create TLS secret: %w", err) + } + + return nil +} + // CreateSnapshotMetadataResources sets up the snapshot metadata resources. // CRD creation is handled separately by the test runner script. func CreateSnapshotMetadataResources(ctx context.Context, f *framework.Framework, driverName, driverNamespace string) error {