Skip to content

Commit 3ccc6c8

Browse files
reederc42reederc42
authored
Disables LUKS passphrase tracking to avoid controller lock
1 parent 35ed119 commit 3ccc6c8

File tree

2 files changed

+29
-89
lines changed

2 files changed

+29
-89
lines changed

‎frontend/csi/utils.go‎

Lines changed: 29 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -258,8 +258,8 @@ func performProtocolSpecificReconciliation(ctx context.Context, trackingInfo *mo
258258
// of any possibly in use passphrases. If forceUpdate is true, the Trident controller will be notified of the current
259259
// passphrase name, regardless of a rotation.
260260
func ensureLUKSVolumePassphrase(
261-
ctx context.Context, restClient controllerAPI.TridentController, luksDevice luks.Device,
262-
volumeId string, secrets map[string]string, forceUpdate bool,
261+
ctx context.Context, _ controllerAPI.TridentController, luksDevice luks.Device,
262+
volumeId string, secrets map[string]string, _ bool,
263263
) error {
264264
luksPassphraseName, luksPassphrase, previousLUKSPassphraseName,
265265
previousLUKSPassphrase := luks.GetLUKSPassphrasesFromSecretMap(secrets)
@@ -279,13 +279,14 @@ func ensureLUKSVolumePassphrase(
279279
Logc(ctx).WithFields(LogFields{
280280
"volume": volumeId,
281281
}).Debugf("Current LUKS passphrase name '%s'.", luksPassphraseName)
282-
if forceUpdate {
283-
luksPassphraseNames := []string{luksPassphraseName}
284-
err = restClient.UpdateVolumeLUKSPassphraseNames(ctx, volumeId, luksPassphraseNames)
285-
if err != nil {
286-
return fmt.Errorf("could not update current passphrase name for LUKS volume; %v", err)
287-
}
288-
}
282+
// Disabled in all supported versions until 26.06.0. Users must track LUKS passphrases for volumes.
283+
// if forceUpdate {
284+
// luksPassphraseNames := []string{luksPassphraseName}
285+
// err = restClient.UpdateVolumeLUKSPassphraseNames(ctx, volumeId, luksPassphraseNames)
286+
// if err != nil {
287+
// return fmt.Errorf("could not update current passphrase name for LUKS volume; %v", err)
288+
// }
289+
// }
289290
return nil
290291
}
291292

@@ -307,12 +308,13 @@ func ensureLUKSVolumePassphrase(
307308
"volume": volumeId,
308309
}).Debugf("Current LUKS passphrase name '%s'.", previousLUKSPassphraseName)
309310

311+
// Disabled in all supported versions until 26.06.0. Users must track LUKS passphrases for volumes.
310312
// Send up current and previous passphrase names, if rotation fails
311-
luksPassphraseNames := []string{luksPassphraseName, previousLUKSPassphraseName}
312-
err = restClient.UpdateVolumeLUKSPassphraseNames(ctx, volumeId, luksPassphraseNames)
313-
if err != nil {
314-
return fmt.Errorf("could not update passphrase names for LUKS volume, skipping passphrase rotation; %v", err)
315-
}
313+
// luksPassphraseNames := []string{luksPassphraseName, previousLUKSPassphraseName}
314+
// err = restClient.UpdateVolumeLUKSPassphraseNames(ctx, volumeId, luksPassphraseNames)
315+
// if err != nil {
316+
// return fmt.Errorf("could not update passphrase names for LUKS volume, skipping passphrase rotation; %v", err)
317+
// }
316318

317319
// Rotate
318320
Logc(ctx).WithFields(LogFields{
@@ -331,16 +333,18 @@ func ensureLUKSVolumePassphrase(
331333
}
332334
Logc(ctx).Infof("Rotated LUKS passphrase")
333335

334-
isCurrent, err := luksDevice.CheckPassphrase(ctx, luksPassphrase)
335-
if err != nil {
336-
return fmt.Errorf("could not check current passphrase for LUKS volume; %v", err)
337-
} else if isCurrent {
338-
// Send only current passphrase up
339-
luksPassphraseNames = []string{luksPassphraseName}
340-
err = restClient.UpdateVolumeLUKSPassphraseNames(ctx, volumeId, luksPassphraseNames)
341-
if err != nil {
342-
return fmt.Errorf("could not update passphrase names for LUKS volume after rotation; %v", err)
343-
}
344-
}
336+
// isCurrent, err := luksDevice.CheckPassphrase(ctx, luksPassphrase)
337+
// if err != nil {
338+
// return fmt.Errorf("could not check current passphrase for LUKS volume; %v", err)
339+
// Disabled in all supported versions until 26.06.0. Users must track LUKS passphrases for volumes.
340+
// } else if isCurrent {
341+
// // Send only current passphrase up
342+
// luksPassphraseNames = []string{luksPassphraseName}
343+
// err = restClient.UpdateVolumeLUKSPassphraseNames(ctx, volumeId, luksPassphraseNames)
344+
// if err != nil {
345+
// return fmt.Errorf("could not update passphrase names for LUKS volume after rotation; %v", err)
346+
// }
347+
// }
348+
// }
345349
return nil
346350
}

‎frontend/csi/utils_test.go‎

Lines changed: 0 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,6 @@ func TestEnsureLUKSVolumePassphrase(t *testing.T) {
135135
"luks-passphrase": "passphraseA",
136136
}
137137
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseA").Return(true, nil)
138-
mockClient.EXPECT().UpdateVolumeLUKSPassphraseNames(gomock.Any(), "test-vol", []string{"A"}).Return(nil)
139138
err = ensureLUKSVolumePassphrase(context.TODO(), mockClient, mockLUKSDevice, "test-vol", secrets, true)
140139
assert.NoError(t, err)
141140
mockCtrl.Finish()
@@ -153,10 +152,7 @@ func TestEnsureLUKSVolumePassphrase(t *testing.T) {
153152
}
154153
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseB").Return(false, nil)
155154
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseA").Return(true, nil)
156-
mockClient.EXPECT().UpdateVolumeLUKSPassphraseNames(gomock.Any(), "test-vol", []string{"B", "A"}).Return(nil)
157155
mockLUKSDevice.EXPECT().RotatePassphrase(gomock.Any(), "test-vol", "passphraseA", "passphraseB").Return(nil)
158-
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseB").Return(true, nil)
159-
mockClient.EXPECT().UpdateVolumeLUKSPassphraseNames(gomock.Any(), "test-vol", []string{"B"}).Return(nil)
160156
err = ensureLUKSVolumePassphrase(context.TODO(), mockClient, mockLUKSDevice, "test-vol", secrets, false)
161157
assert.NoError(t, err)
162158
mockCtrl.Finish()
@@ -196,24 +192,6 @@ func TestEnsureLUKSVolumePassphrase_Error(t *testing.T) {
196192
assert.Error(t, err)
197193
mockCtrl.Finish()
198194

199-
// ////////////////////////////////////////////////////////////////////////////////////////////////////////////
200-
// Negative case: Sending pre-rotation passphrases to trident controller fails
201-
mockCtrl = gomock.NewController(t)
202-
mockClient = mockControllerAPI.NewMockTridentController(mockCtrl)
203-
mockLUKSDevice = mock_luks.NewMockDevice(mockCtrl)
204-
secrets = map[string]string{
205-
"luks-passphrase-name": "B",
206-
"luks-passphrase": "passphraseB",
207-
"previous-luks-passphrase-name": "A",
208-
"previous-luks-passphrase": "passphraseA",
209-
}
210-
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseB").Return(false, nil)
211-
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseA").Return(true, nil)
212-
mockClient.EXPECT().UpdateVolumeLUKSPassphraseNames(gomock.Any(), "test-vol", []string{"B", "A"}).Return(fmt.Errorf("test error"))
213-
err = ensureLUKSVolumePassphrase(context.TODO(), mockClient, mockLUKSDevice, "test-vol", secrets, false)
214-
assert.Error(t, err)
215-
mockCtrl.Finish()
216-
217195
// ////////////////////////////////////////////////////////////////////////////////////////////////////////////
218196
// Negative case: Passphrase rotation fails
219197
mockCtrl = gomock.NewController(t)
@@ -227,52 +205,10 @@ func TestEnsureLUKSVolumePassphrase_Error(t *testing.T) {
227205
}
228206
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseB").Return(false, nil)
229207
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseA").Return(true, nil)
230-
mockClient.EXPECT().UpdateVolumeLUKSPassphraseNames(gomock.Any(), "test-vol", []string{"B", "A"}).Return(nil)
231208
mockLUKSDevice.EXPECT().RotatePassphrase(gomock.Any(), "test-vol", "passphraseA", "passphraseB").Return(fmt.Errorf("test error"))
232209
err = ensureLUKSVolumePassphrase(context.TODO(), mockClient, mockLUKSDevice, "test-vol", secrets, false)
233210
assert.Error(t, err)
234211
mockCtrl.Finish()
235-
236-
// ////////////////////////////////////////////////////////////////////////////////////////////////////////////
237-
// Negative case: Verifying passphrase rotation fails
238-
mockCtrl = gomock.NewController(t)
239-
mockClient = mockControllerAPI.NewMockTridentController(mockCtrl)
240-
mockLUKSDevice = mock_luks.NewMockDevice(mockCtrl)
241-
secrets = map[string]string{
242-
"luks-passphrase-name": "B",
243-
"luks-passphrase": "passphraseB",
244-
"previous-luks-passphrase-name": "A",
245-
"previous-luks-passphrase": "passphraseA",
246-
}
247-
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseB").Return(false, nil)
248-
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseA").Return(true, nil)
249-
mockClient.EXPECT().UpdateVolumeLUKSPassphraseNames(gomock.Any(), "test-vol", []string{"B", "A"}).Return(nil)
250-
mockLUKSDevice.EXPECT().RotatePassphrase(gomock.Any(), "test-vol", "passphraseA", "passphraseB").Return(nil)
251-
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseB").Return(true, fmt.Errorf("test error"))
252-
err = ensureLUKSVolumePassphrase(context.TODO(), mockClient, mockLUKSDevice, "test-vol", secrets, false)
253-
assert.Error(t, err)
254-
mockCtrl.Finish()
255-
256-
// ////////////////////////////////////////////////////////////////////////////////////////////////////////////
257-
// Negative case: Sending post-rotation passphrases to trident controller fails
258-
mockCtrl = gomock.NewController(t)
259-
mockClient = mockControllerAPI.NewMockTridentController(mockCtrl)
260-
mockLUKSDevice = mock_luks.NewMockDevice(mockCtrl)
261-
secrets = map[string]string{
262-
"luks-passphrase-name": "B",
263-
"luks-passphrase": "passphraseB",
264-
"previous-luks-passphrase-name": "A",
265-
"previous-luks-passphrase": "passphraseA",
266-
}
267-
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseB").Return(false, nil)
268-
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseA").Return(true, nil)
269-
mockClient.EXPECT().UpdateVolumeLUKSPassphraseNames(gomock.Any(), "test-vol", []string{"B", "A"}).Return(nil)
270-
mockLUKSDevice.EXPECT().RotatePassphrase(gomock.Any(), "test-vol", "passphraseA", "passphraseB").Return(nil)
271-
mockLUKSDevice.EXPECT().CheckPassphrase(gomock.Any(), "passphraseB").Return(true, nil)
272-
mockClient.EXPECT().UpdateVolumeLUKSPassphraseNames(gomock.Any(), "test-vol", []string{"B"}).Return(fmt.Errorf("test error"))
273-
err = ensureLUKSVolumePassphrase(context.TODO(), mockClient, mockLUKSDevice, "test-vol", secrets, false)
274-
assert.Error(t, err)
275-
mockCtrl.Finish()
276212
}
277213

278214
func TestEnsureLUKSVolumePassphrase_InvalidSecret(t *testing.T) {

0 commit comments

Comments
 (0)