Remove CSINodeInfo

pkg/features/kube_features.go

@@ -125,11 +125,6 @@ const (
 	// Enable mount/attachment of Container Storage Interface (CSI) backed PVs
 	CSIPersistentVolume utilfeature.Feature = "CSIPersistentVolume"
 
-	// owner: @verult
-	// alpha: v1.12
-	// Enable all logic related to the CSINodeInfo API object in csi.storage.k8s.io
-	CSINodeInfo utilfeature.Feature = "CSINodeInfo"
-
 	// owner @MrHohn
 	// beta: v1.10
 	//
@@ -319,7 +314,6 @@ var defaultKubernetesFeatureGates = map[utilfeature.Feature]utilfeature.FeatureS
 	CPUManager:                                  {Default: true, PreRelease: utilfeature.Beta},
 	VolumeScheduling:                            {Default: true, PreRelease: utilfeature.Beta},
 	CSIPersistentVolume:                         {Default: true, PreRelease: utilfeature.Beta},
-	CSINodeInfo:                                 {Default: false, PreRelease: utilfeature.Alpha},
 	CustomPodDNS:                                {Default: true, PreRelease: utilfeature.Beta},
 	BlockVolume:                                 {Default: false, PreRelease: utilfeature.Alpha},
 	StorageObjectInUseProtection:                {Default: true, PreRelease: utilfeature.GA},

pkg/volume/csi/nodeinfomanager/nodeinfomanager.go

@@ -91,10 +91,6 @@ func (nim *nodeInfoManager) AddNodeInfo(driverName string, driverNodeID string,
 		updateNodeIDInNode(driverName, driverNodeID),
 	}
 
-	if utilfeature.DefaultFeatureGate.Enabled(features.CSINodeInfo) {
-		nodeUpdateFuncs = append(nodeUpdateFuncs, updateTopologyLabels(topology))
-	}
-
 	if utilfeature.DefaultFeatureGate.Enabled(features.AttachVolumeLimit) {
 		nodeUpdateFuncs = append(nodeUpdateFuncs, updateMaxAttachLimit(driverName, maxAttachLimit))
 	}
@@ -104,12 +100,6 @@ func (nim *nodeInfoManager) AddNodeInfo(driverName string, driverNodeID string,
 		return fmt.Errorf("error updating Node object with CSI driver node info: %v", err)
 	}
 
-	if utilfeature.DefaultFeatureGate.Enabled(features.CSINodeInfo) {
-		err = nim.updateCSINodeInfo(driverName, driverNodeID, topology)
-		if err != nil {
-			return fmt.Errorf("error updating CSINodeInfo object with CSI driver node info: %v", err)
-		}
-	}
 	return nil
 }
 
@@ -292,57 +282,6 @@ func removeNodeIDFromNode(csiDriverName string) nodeUpdateFunc {
 	}
 }
 
-// updateTopologyLabels returns a function that updates labels of a Node object with the given
-// topology information.
-func updateTopologyLabels(topology *csipb.Topology) nodeUpdateFunc {
-	return func(node *v1.Node) (*v1.Node, bool, error) {
-		if topology == nil || len(topology.Segments) == 0 {
-			return node, false, nil
-		}
-
-		for k, v := range topology.Segments {
-			if curVal, exists := node.Labels[k]; exists && curVal != v {
-				return nil, false, fmt.Errorf("detected topology value collision: driver reported %q:%q but existing label is %q:%q", k, v, k, curVal)
-			}
-		}
-
-		if node.Labels == nil {
-			node.Labels = make(map[string]string)
-		}
-		for k, v := range topology.Segments {
-			node.Labels[k] = v
-		}
-		return node, true, nil
-	}
-}
-
-func (nim *nodeInfoManager) updateCSINodeInfo(
-	driverName string,
-	driverNodeID string,
-	topology *csipb.Topology) error {
-
-	csiKubeClient := nim.volumeHost.GetCSIClient()
-	if csiKubeClient == nil {
-		return fmt.Errorf("error getting CSI client")
-	}
-
-	retryErr := retry.RetryOnConflict(retry.DefaultRetry, func() error {
-		nodeInfo, err := csiKubeClient.CsiV1alpha1().CSINodeInfos().Get(string(nim.nodeName), metav1.GetOptions{})
-		if nodeInfo == nil || errors.IsNotFound(err) {
-			return nim.createNodeInfoObject(driverName, driverNodeID, topology)
-		}
-		if err != nil {
-			return err // do not wrap error
-		}
-
-		return nim.updateNodeInfoObject(nodeInfo, driverName, driverNodeID, topology)
-	})
-	if retryErr != nil {
-		return fmt.Errorf("CSINodeInfo update failed: %v", retryErr)
-	}
-	return nil
-}
-
 func (nim *nodeInfoManager) createNodeInfoObject(
 	driverName string,
 	driverNodeID string,

plugin/pkg/auth/authorizer/node/node_authorizer.go

@@ -25,7 +25,6 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
-	csiv1alpha1 "k8s.io/csi-api/pkg/apis/csi/v1alpha1"
 	api "k8s.io/kubernetes/pkg/apis/core"
 	storageapi "k8s.io/kubernetes/pkg/apis/storage"
 	"k8s.io/kubernetes/pkg/auth/nodeidentifier"
@@ -73,7 +72,6 @@ var (
 	pvResource          = api.Resource("persistentvolumes")
 	vaResource          = storageapi.Resource("volumeattachments")
 	svcAcctResource     = api.Resource("serviceaccounts")
-	csiNodeInfoResource = csiv1alpha1.Resource("csinodeinfos")
 )
 
 func (r *NodeAuthorizer) Authorize(attrs authorizer.Attributes) (authorizer.Decision, string, error) {
@@ -115,11 +113,6 @@ func (r *NodeAuthorizer) Authorize(attrs authorizer.Attributes) (authorizer.Deci
 				return r.authorizeCreateToken(nodeName, serviceAccountVertexType, attrs)
 			}
 			return authorizer.DecisionNoOpinion, fmt.Sprintf("disabled by feature gate %s", features.TokenRequest), nil
-		case csiNodeInfoResource:
-			if r.features.Enabled(features.KubeletPluginsWatcher) && r.features.Enabled(features.CSINodeInfo) {
-				return r.authorizeCSINodeInfo(nodeName, attrs)
-			}
-			return authorizer.DecisionNoOpinion, fmt.Sprintf("disabled by feature gates %s and %s", features.KubeletPluginsWatcher, features.CSINodeInfo), nil
 		}
 
 	}
@@ -253,35 +246,6 @@ func (r *NodeAuthorizer) authorizeLease(nodeName string, attrs authorizer.Attrib
 	return authorizer.DecisionAllow, "", nil
 }
 
-// authorizeCSINodeInfo authorizes node requests to CSINodeInfo csi.storage.k8s.io/csinodeinfos
-func (r *NodeAuthorizer) authorizeCSINodeInfo(nodeName string, attrs authorizer.Attributes) (authorizer.Decision, string, error) {
-	// allowed verbs: get, create, update, patch, delete
-	verb := attrs.GetVerb()
-	if verb != "get" &&
-		verb != "create" &&
-		verb != "update" &&
-		verb != "patch" &&
-		verb != "delete" {
-		glog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
-		return authorizer.DecisionNoOpinion, "can only get, create, update, patch, or delete a CSINodeInfo", nil
-	}
-
-	if len(attrs.GetSubresource()) > 0 {
-		glog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
-		return authorizer.DecisionNoOpinion, "cannot authorize CSINodeInfo subresources", nil
-	}
-
-	// the request must come from a node with the same name as the CSINodeInfo
-	// note we skip this check for create, since the authorizer doesn't know the name on create
-	// the noderestriction admission plugin is capable of performing this check at create time
-	if verb != "create" && attrs.GetName() != nodeName {
-		glog.V(2).Infof("NODE DENY: %s %#v", nodeName, attrs)
-		return authorizer.DecisionNoOpinion, "can only access CSINodeInfo with the same name as the requesting node", nil
-	}
-
-	return authorizer.DecisionAllow, "", nil
-}
-
 // hasPathFrom returns true if there is a directed path from the specified type/namespace/name to the specified Node
 func (r *NodeAuthorizer) hasPathFrom(nodeName string, startingType vertexType, startingNamespace, startingName string) (bool, error) {
 	r.graph.lock.RLock()

plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go

@@ -156,11 +156,6 @@ func NodeRules() []rbacv1.PolicyRule {
 		volAttachRule := rbacv1helpers.NewRule("get").Groups(storageGroup).Resources("volumeattachments").RuleOrDie()
 		nodePolicyRules = append(nodePolicyRules, volAttachRule)
 	}
-	if utilfeature.DefaultFeatureGate.Enabled(features.KubeletPluginsWatcher) &&
-		utilfeature.DefaultFeatureGate.Enabled(features.CSINodeInfo) {
-		csiNodeInfoRule := rbacv1helpers.NewRule("get", "create", "update", "patch", "delete").Groups("csi.storage.k8s.io").Resources("csinodeinfos").RuleOrDie()
-		nodePolicyRules = append(nodePolicyRules, csiNodeInfoRule)
-	}
 
 	// RuntimeClass
 	if utilfeature.DefaultFeatureGate.Enabled(features.RuntimeClass) {
@@ -473,9 +468,6 @@ func ClusterRoles() []rbacv1.ClusterRole {
 		rbacv1helpers.NewRule("get", "list", "watch", "create", "update", "patch").Groups(legacyGroup).Resources("events").RuleOrDie(),
 		rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("nodes").RuleOrDie(),
 	}
-	if utilfeature.DefaultFeatureGate.Enabled(features.CSINodeInfo) {
-		externalProvisionerRules = append(externalProvisionerRules, rbacv1helpers.NewRule("get", "watch", "list").Groups("csi.storage.k8s.io").Resources("csinodeinfos").RuleOrDie())
-	}
 	roles = append(roles, rbacv1.ClusterRole{
 		// a role for the csi external provisioner
 		ObjectMeta: metav1.ObjectMeta{Name: "system:csi-external-provisioner"},