Remove CSINodeInfo

pkg/features/kube_features.go

@@ -148,11 +148,6 @@ const (
 	// Enable mount/attachment of Container Storage Interface (CSI) backed PVs
 	CSIPersistentVolume utilfeature.Feature = "CSIPersistentVolume"
 
-	// owner: @verult
-	// alpha: v1.12
-	// Enable all logic related to the CSINodeInfo API object in csi.storage.k8s.io
-	CSINodeInfo utilfeature.Feature = "CSINodeInfo"
-
 	// owner @MrHohn
 	// beta: v1.10
 	//
@@ -360,7 +355,6 @@ var defaultKubernetesFeatureGates = map[utilfeature.Feature]utilfeature.FeatureS
 	CPUManager:                                  {Default: true, PreRelease: utilfeature.Beta},
 	VolumeScheduling:                            {Default: true, PreRelease: utilfeature.GA},
 	CSIPersistentVolume:                         {Default: true, PreRelease: utilfeature.GA},
-	CSINodeInfo:                                 {Default: false, PreRelease: utilfeature.Alpha},
 	CustomPodDNS:                                {Default: true, PreRelease: utilfeature.Beta},
 	BlockVolume:                                 {Default: true, PreRelease: utilfeature.Beta},
 	StorageObjectInUseProtection:                {Default: true, PreRelease: utilfeature.GA},

pkg/volume/csi/nodeinfomanager/nodeinfomanager.go

@@ -21,21 +21,15 @@ package nodeinfomanager // import "k8s.io/kubernetes/pkg/volume/csi/nodeinfomana
 import (
 	"encoding/json"
 	"fmt"
-	"strings"
-
 	"time"
 
 	"k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
-	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apimachinery/pkg/util/wait"
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
-	csiv1alpha1 "k8s.io/csi-api/pkg/apis/csi/v1alpha1"
-	csiclientset "k8s.io/csi-api/pkg/client/clientset/versioned"
 	"k8s.io/klog"
 	"k8s.io/kubernetes/pkg/features"
 	nodeutil "k8s.io/kubernetes/pkg/util/node"
@@ -49,7 +43,6 @@ const (
 )
 
 var (
-	nodeKind      = v1.SchemeGroupVersion.WithKind("Node")
 	updateBackoff = wait.Backoff{
 		Steps:    4,
 		Duration: 10 * time.Millisecond,
@@ -70,8 +63,6 @@ type nodeUpdateFunc func(*v1.Node) (newNode *v1.Node, updated bool, err error)
 
 // Interface implements an interface for managing labels of a node
 type Interface interface {
-	CreateCSINodeInfo() (*csiv1alpha1.CSINodeInfo, error)
-
 	// Record in the cluster the given node information from the CSI driver with the given name.
 	// Concurrent calls to InstallCSIDriver() is allowed, but they should not be intertwined with calls
 	// to other methods in this interface.
@@ -106,10 +97,6 @@ func (nim *nodeInfoManager) InstallCSIDriver(driverName string, driverNodeID str
 		updateNodeIDInNode(driverName, driverNodeID),
 	}
 
-	if utilfeature.DefaultFeatureGate.Enabled(features.CSINodeInfo) {
-		nodeUpdateFuncs = append(nodeUpdateFuncs, updateTopologyLabels(topology))
-	}
-
 	if utilfeature.DefaultFeatureGate.Enabled(features.AttachVolumeLimit) {
 		nodeUpdateFuncs = append(nodeUpdateFuncs, updateMaxAttachLimit(driverName, maxAttachLimit))
 	}
@@ -119,12 +106,6 @@ func (nim *nodeInfoManager) InstallCSIDriver(driverName string, driverNodeID str
 		return fmt.Errorf("error updating Node object with CSI driver node info: %v", err)
 	}
 
-	if utilfeature.DefaultFeatureGate.Enabled(features.CSINodeInfo) {
-		err = nim.updateCSINodeInfo(driverName, driverNodeID, topology)
-		if err != nil {
-			return fmt.Errorf("error updating CSINodeInfo object with CSI driver node info: %v", err)
-		}
-	}
 	return nil
 }
 
@@ -133,13 +114,6 @@ func (nim *nodeInfoManager) InstallCSIDriver(driverName string, driverNodeID str
 // If multiple calls to UninstallCSIDriver() are made in parallel, some calls might receive Node or
 // CSINodeInfo update conflicts, which causes the function to retry the corresponding update.
 func (nim *nodeInfoManager) UninstallCSIDriver(driverName string) error {
-	if utilfeature.DefaultFeatureGate.Enabled(features.CSINodeInfo) {
-		err := nim.uninstallDriverFromCSINodeInfo(driverName)
-		if err != nil {
-			return fmt.Errorf("error uninstalling CSI driver from CSINodeInfo object %v", err)
-		}
-	}
-
 	err := nim.updateNode(
 		removeMaxAttachLimit(driverName),
 		removeNodeIDFromNode(driverName),
@@ -320,245 +294,6 @@ func removeNodeIDFromNode(csiDriverName string) nodeUpdateFunc {
 	}
 }
 
-// updateTopologyLabels returns a function that updates labels of a Node object with the given
-// topology information.
-func updateTopologyLabels(topology map[string]string) nodeUpdateFunc {
-	return func(node *v1.Node) (*v1.Node, bool, error) {
-		if topology == nil || len(topology) == 0 {
-			return node, false, nil
-		}
-
-		for k, v := range topology {
-			if curVal, exists := node.Labels[k]; exists && curVal != v {
-				return nil, false, fmt.Errorf("detected topology value collision: driver reported %q:%q but existing label is %q:%q", k, v, k, curVal)
-			}
-		}
-
-		if node.Labels == nil {
-			node.Labels = make(map[string]string)
-		}
-		for k, v := range topology {
-			node.Labels[k] = v
-		}
-		return node, true, nil
-	}
-}
-
-func (nim *nodeInfoManager) updateCSINodeInfo(
-	driverName string,
-	driverNodeID string,
-	topology map[string]string) error {
-
-	csiKubeClient := nim.volumeHost.GetCSIClient()
-	if csiKubeClient == nil {
-		return fmt.Errorf("error getting CSI client")
-	}
-
-	var updateErrs []error
-	err := wait.ExponentialBackoff(updateBackoff, func() (bool, error) {
-		if err := nim.tryUpdateCSINodeInfo(csiKubeClient, driverName, driverNodeID, topology); err != nil {
-			updateErrs = append(updateErrs, err)
-			return false, nil
-		}
-		return true, nil
-	})
-	if err != nil {
-		return fmt.Errorf("error updating CSINodeInfo: %v; caused by: %v", err, utilerrors.NewAggregate(updateErrs))
-	}
-	return nil
-}
-
-func (nim *nodeInfoManager) tryUpdateCSINodeInfo(
-	csiKubeClient csiclientset.Interface,
-	driverName string,
-	driverNodeID string,
-	topology map[string]string) error {
-
-	nodeInfo, err := csiKubeClient.CsiV1alpha1().CSINodeInfos().Get(string(nim.nodeName), metav1.GetOptions{})
-	if nodeInfo == nil || errors.IsNotFound(err) {
-		nodeInfo, err = nim.CreateCSINodeInfo()
-	}
-	if err != nil {
-		return err
-	}
-
-	return nim.installDriverToCSINodeInfo(nodeInfo, driverName, driverNodeID, topology)
-}
-
-func (nim *nodeInfoManager) CreateCSINodeInfo() (*csiv1alpha1.CSINodeInfo, error) {
-
-	kubeClient := nim.volumeHost.GetKubeClient()
-	if kubeClient == nil {
-		return nil, fmt.Errorf("error getting kube client")
-	}
-
-	csiKubeClient := nim.volumeHost.GetCSIClient()
-	if csiKubeClient == nil {
-		return nil, fmt.Errorf("error getting CSI client")
-	}
-
-	node, err := kubeClient.CoreV1().Nodes().Get(string(nim.nodeName), metav1.GetOptions{})
-	if err != nil {
-		return nil, err
-	}
-
-	nodeInfo := &csiv1alpha1.CSINodeInfo{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: string(nim.nodeName),
-			OwnerReferences: []metav1.OwnerReference{
-				{
-					APIVersion: nodeKind.Version,
-					Kind:       nodeKind.Kind,
-					Name:       node.Name,
-					UID:        node.UID,
-				},
-			},
-		},
-		Spec: csiv1alpha1.CSINodeInfoSpec{
-			Drivers: []csiv1alpha1.CSIDriverInfoSpec{},
-		},
-		Status: csiv1alpha1.CSINodeInfoStatus{
-			Drivers: []csiv1alpha1.CSIDriverInfoStatus{},
-		},
-	}
-
-	return csiKubeClient.CsiV1alpha1().CSINodeInfos().Create(nodeInfo)
-}
-
-func (nim *nodeInfoManager) installDriverToCSINodeInfo(
-	nodeInfo *csiv1alpha1.CSINodeInfo,
-	driverName string,
-	driverNodeID string,
-	topology map[string]string) error {
-
-	csiKubeClient := nim.volumeHost.GetCSIClient()
-	if csiKubeClient == nil {
-		return fmt.Errorf("error getting CSI client")
-	}
-
-	topologyKeys := make(sets.String)
-	for k := range topology {
-		topologyKeys.Insert(k)
-	}
-
-	specModified := true
-	statusModified := true
-	// Clone driver list, omitting the driver that matches the given driverName
-	newDriverSpecs := []csiv1alpha1.CSIDriverInfoSpec{}
-	for _, driverInfoSpec := range nodeInfo.Spec.Drivers {
-		if driverInfoSpec.Name == driverName {
-			if driverInfoSpec.NodeID == driverNodeID &&
-				sets.NewString(driverInfoSpec.TopologyKeys...).Equal(topologyKeys) {
-				specModified = false
-			}
-		} else {
-			// Omit driverInfoSpec matching given driverName
-			newDriverSpecs = append(newDriverSpecs, driverInfoSpec)
-		}
-	}
-	newDriverStatuses := []csiv1alpha1.CSIDriverInfoStatus{}
-	for _, driverInfoStatus := range nodeInfo.Status.Drivers {
-		if driverInfoStatus.Name == driverName {
-			if driverInfoStatus.Available &&
-				/* TODO(https://github.com/kubernetes/enhancements/issues/625): Add actual migration status */
-				driverInfoStatus.VolumePluginMechanism == csiv1alpha1.VolumePluginMechanismInTree {
-				statusModified = false
-			}
-		} else {
-			// Omit driverInfoSpec matching given driverName
-			newDriverStatuses = append(newDriverStatuses, driverInfoStatus)
-		}
-	}
-
-	if !specModified && !statusModified {
-		return nil
-	}
-
-	// Append new driver
-	driverSpec := csiv1alpha1.CSIDriverInfoSpec{
-		Name:         driverName,
-		NodeID:       driverNodeID,
-		TopologyKeys: topologyKeys.List(),
-	}
-	driverStatus := csiv1alpha1.CSIDriverInfoStatus{
-		Name:      driverName,
-		Available: true,
-		// TODO(https://github.com/kubernetes/enhancements/issues/625): Add actual migration status
-		VolumePluginMechanism: csiv1alpha1.VolumePluginMechanismInTree,
-	}
-
-	newDriverSpecs = append(newDriverSpecs, driverSpec)
-	newDriverStatuses = append(newDriverStatuses, driverStatus)
-	nodeInfo.Spec.Drivers = newDriverSpecs
-	nodeInfo.Status.Drivers = newDriverStatuses
-
-	err := validateCSINodeInfo(nodeInfo)
-	if err != nil {
-		return err
-	}
-	_, err = csiKubeClient.CsiV1alpha1().CSINodeInfos().Update(nodeInfo)
-	return err
-}
-
-func (nim *nodeInfoManager) uninstallDriverFromCSINodeInfo(
-	csiDriverName string) error {
-
-	csiKubeClient := nim.volumeHost.GetCSIClient()
-	if csiKubeClient == nil {
-		return fmt.Errorf("error getting CSI client")
-	}
-
-	var updateErrs []error
-	err := wait.ExponentialBackoff(updateBackoff, func() (bool, error) {
-		if err := nim.tryUninstallDriverFromCSINodeInfo(csiKubeClient, csiDriverName); err != nil {
-			updateErrs = append(updateErrs, err)
-			return false, nil
-		}
-		return true, nil
-	})
-	if err != nil {
-		return fmt.Errorf("error updating CSINodeInfo: %v; caused by: %v", err, utilerrors.NewAggregate(updateErrs))
-	}
-	return nil
-}
-
-func (nim *nodeInfoManager) tryUninstallDriverFromCSINodeInfo(
-	csiKubeClient csiclientset.Interface,
-	csiDriverName string) error {
-
-	nodeInfoClient := csiKubeClient.CsiV1alpha1().CSINodeInfos()
-	nodeInfo, err := nodeInfoClient.Get(string(nim.nodeName), metav1.GetOptions{})
-	if err != nil {
-		return err // do not wrap error
-	}
-
-	hasModified := false
-	newDriverStatuses := []csiv1alpha1.CSIDriverInfoStatus{}
-	for _, driverStatus := range nodeInfo.Status.Drivers {
-		if driverStatus.Name == csiDriverName {
-			// Uninstall the driver if we find it
-			hasModified = driverStatus.Available
-			driverStatus.Available = false
-		}
-		newDriverStatuses = append(newDriverStatuses, driverStatus)
-	}
-
-	nodeInfo.Status.Drivers = newDriverStatuses
-
-	if !hasModified {
-		// No changes, don't update
-		return nil
-	}
-
-	err = validateCSINodeInfo(nodeInfo)
-	if err != nil {
-		return err
-	}
-	_, updateErr := nodeInfoClient.Update(nodeInfo)
-	return updateErr // do not wrap error
-
-}
-
 func updateMaxAttachLimit(driverName string, maxLimit int64) nodeUpdateFunc {
 	return func(node *v1.Node) (*v1.Node, bool, error) {
 		if maxLimit <= 0 {
@@ -611,50 +346,3 @@ func removeMaxAttachLimit(driverName string) nodeUpdateFunc {
 		return node, true, nil
 	}
 }
-
-// validateCSINodeInfo ensures members of CSINodeInfo object satisfies map and set semantics.
-// Before calling CSINodeInfoInterface.Update(), validateCSINodeInfo() should be invoked to
-// make sure the CSINodeInfo is compliant
-func validateCSINodeInfo(nodeInfo *csiv1alpha1.CSINodeInfo) error {
-	if len(nodeInfo.Status.Drivers) < 1 {
-		return fmt.Errorf("at least one Driver entry is required in driver statuses")
-	}
-	if len(nodeInfo.Spec.Drivers) < 1 {
-		return fmt.Errorf("at least one Driver entry is required in driver specs")
-	}
-	if len(nodeInfo.Status.Drivers) != len(nodeInfo.Spec.Drivers) {
-		return fmt.Errorf("")
-	}
-	// check for duplicate entries for the same driver in statuses
-	var errors []string
-	driverNamesInStatuses := make(sets.String)
-	for _, driverInfo := range nodeInfo.Status.Drivers {
-		if driverNamesInStatuses.Has(driverInfo.Name) {
-			errors = append(errors, fmt.Sprintf("duplicate entries found for driver: %s in driver statuses", driverInfo.Name))
-		}
-		driverNamesInStatuses.Insert(driverInfo.Name)
-	}
-	// check for duplicate entries for the same driver in specs
-	driverNamesInSpecs := make(sets.String)
-	for _, driverInfo := range nodeInfo.Spec.Drivers {
-		if driverNamesInSpecs.Has(driverInfo.Name) {
-			errors = append(errors, fmt.Sprintf("duplicate entries found for driver: %s in driver specs", driverInfo.Name))
-		}
-		driverNamesInSpecs.Insert(driverInfo.Name)
-		topoKeys := make(sets.String)
-		for _, key := range driverInfo.TopologyKeys {
-			if topoKeys.Has(key) {
-				errors = append(errors, fmt.Sprintf("duplicate topology keys %s found for driver %s in driver specs", key, driverInfo.Name))
-			}
-			topoKeys.Insert(key)
-		}
-	}
-	// check all entries in specs and status match
-	if !driverNamesInSpecs.Equal(driverNamesInStatuses) {
-		errors = append(errors, fmt.Sprintf("list of drivers in specs: %v does not match list of drivers in statuses: %v", driverNamesInSpecs.List(), driverNamesInStatuses.List()))
-	}
-	if len(errors) == 0 {
-		return nil
-	}
-	return fmt.Errorf(strings.Join(errors, ", "))
-}

plugin/pkg/auth/authorizer/node/node_authorizer.go

@@ -25,7 +25,6 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
-	csiv1alpha1 "k8s.io/csi-api/pkg/apis/csi/v1alpha1"
 	api "k8s.io/kubernetes/pkg/apis/core"
 	storageapi "k8s.io/kubernetes/pkg/apis/storage"
 	"k8s.io/kubernetes/pkg/auth/nodeidentifier"
@@ -73,7 +72,6 @@ var (
 	pvResource          = api.Resource("persistentvolumes")
 	vaResource          = storageapi.Resource("volumeattachments")
 	svcAcctResource     = api.Resource("serviceaccounts")
-	csiNodeInfoResource = csiv1alpha1.Resource("csinodeinfos")
 )
 
 func (r *NodeAuthorizer) Authorize(attrs authorizer.Attributes) (authorizer.Decision, string, error) {
@@ -115,11 +113,6 @@ func (r *NodeAuthorizer) Authorize(attrs authorizer.Attributes) (authorizer.Deci
 				return r.authorizeCreateToken(nodeName, serviceAccountVertexType, attrs)
 			}
 			return authorizer.DecisionNoOpinion, fmt.Sprintf("disabled by feature gate %s", features.TokenRequest), nil
-		case csiNodeInfoResource:
-			if r.features.Enabled(features.KubeletPluginsWatcher) && r.features.Enabled(features.CSINodeInfo) {
-				return r.authorizeCSINodeInfo(nodeName, attrs)
-			}
-			return authorizer.DecisionNoOpinion, fmt.Sprintf("disabled by feature gates %s and %s", features.KubeletPluginsWatcher, features.CSINodeInfo), nil
 		}
 
 	}
@@ -253,35 +246,6 @@ func (r *NodeAuthorizer) authorizeLease(nodeName string, attrs authorizer.Attrib
 	return authorizer.DecisionAllow, "", nil
 }
 
-// authorizeCSINodeInfo authorizes node requests to CSINodeInfo csi.storage.k8s.io/csinodeinfos
-func (r *NodeAuthorizer) authorizeCSINodeInfo(nodeName string, attrs authorizer.Attributes) (authorizer.Decision, string, error) {
-	// allowed verbs: get, create, update, patch, delete
-	verb := attrs.GetVerb()
-	if verb != "get" &&
-		verb != "create" &&
-		verb != "update" &&
-		verb != "patch" &&
-		verb != "delete" {
-		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
-		return authorizer.DecisionNoOpinion, "can only get, create, update, patch, or delete a CSINodeInfo", nil
-	}
-
-	if len(attrs.GetSubresource()) > 0 {
-		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
-		return authorizer.DecisionNoOpinion, "cannot authorize CSINodeInfo subresources", nil
-	}
-
-	// the request must come from a node with the same name as the CSINodeInfo
-	// note we skip this check for create, since the authorizer doesn't know the name on create
-	// the noderestriction admission plugin is capable of performing this check at create time
-	if verb != "create" && attrs.GetName() != nodeName {
-		klog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
-		return authorizer.DecisionNoOpinion, "can only access CSINodeInfo with the same name as the requesting node", nil
-	}
-
-	return authorizer.DecisionAllow, "", nil
-}
-
 // hasPathFrom returns true if there is a directed path from the specified type/namespace/name to the specified Node
 func (r *NodeAuthorizer) hasPathFrom(nodeName string, startingType vertexType, startingNamespace, startingName string) (bool, error) {
 	r.graph.lock.RLock()

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go

@@ -160,11 +160,6 @@ func NodeRules() []rbacv1.PolicyRule {
 		volAttachRule := rbacv1helpers.NewRule("get").Groups(storageGroup).Resources("volumeattachments").RuleOrDie()
 		nodePolicyRules = append(nodePolicyRules, volAttachRule)
 	}
-	if utilfeature.DefaultFeatureGate.Enabled(features.KubeletPluginsWatcher) &&
-		utilfeature.DefaultFeatureGate.Enabled(features.CSINodeInfo) {
-		csiNodeInfoRule := rbacv1helpers.NewRule("get", "create", "update", "patch", "delete").Groups("csi.storage.k8s.io").Resources("csinodeinfos").RuleOrDie()
-		nodePolicyRules = append(nodePolicyRules, csiNodeInfoRule)
-	}
 
 	// RuntimeClass
 	if utilfeature.DefaultFeatureGate.Enabled(features.RuntimeClass) {
@@ -500,9 +495,6 @@ func ClusterRoles() []rbacv1.ClusterRole {
 		rbacv1helpers.NewRule("get", "list", "watch", "create", "update", "patch").Groups(legacyGroup).Resources("events").RuleOrDie(),
 		rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
 	}
-	if utilfeature.DefaultFeatureGate.Enabled(features.CSINodeInfo) {
-		externalProvisionerRules = append(externalProvisionerRules, rbacv1helpers.NewRule("get", "watch", "list").Groups("csi.storage.k8s.io").Resources("csinodeinfos").RuleOrDie())
-	}
 	roles = append(roles, rbacv1.ClusterRole{
 		// a role for the csi external provisioner
 		ObjectMeta: metav1.ObjectMeta{Name: "system:csi-external-provisioner"},