Merge pull request #11 from SovereignCloudStack/feat/fixup-csicinder

Work around cinder-CSI cacert issues.

Author: garloff

09-fixup-cinder.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+#
+# 09-fixup-cinder.sh: Patch Cinder-CSI config path from /etc/kubernetes/
+# de
+#  to /etc/config/, so the reference ca-file=/etc/config/cacert in the
+#  file cloud.conf points to an existing place again.
+#
+# This is required in case we use a custom CA file and inject it.
+#
+# (c) Kurt Garloff <s7n@garloff.de>, 5/2025
+# SPDX-License-Identifier: CC-BY-SA-4.0
+set -e
+THISDIR=$(dirname 0)
+# We need settings
+if test -n "$1"; then
+	SET="$1"
+else
+	if test -e cluster-settings.env; then SET=cluster-settings.env;
+	else echo "You need to pass a cluster-settings.env file as parameter"; exit 1
+	fi
+fi
+# Read settings -- make sure you can trust it
+source "$SET"
+# Do this on the workload cluster, ensure we have a config
+clusterctl get kubeconfig -n $CS_NAMESPACE $CL_NAME > ~/.kube/config-$CS_NAMESPACE.$CL_NAME
+export KUBECONFIG=~/.kube/config-$CS_NAMESPACE.$CL_NAME
+# Get cinder-csi-controllerplugin deployment and patch it
+kubectl get -n kube-system deployment openstack-cinder-csi-controllerplugin -o yaml > ~/tmp/cinder-csi-controllerplugin.yaml
+patch ~/tmp/cinder-csi-controllerplugin.yaml <$THISDIR/csi-cinder-controller-deployment.diff 
+kubectl get -n kube-system daemonset openstack-cinder-csi-nodeplugin -o yaml > ~/tmp/cinder-csi-nodeplugin.yaml
+patch ~/tmp/cinder-csi-nodeplugin.yaml <$THISDIR/csi-cinder-nodeplugin-daemonset.diff
+kubectl apply -f ~/tmp/cinder-csi-controllerplugin.yaml
+kubectl apply -f ~/tmp/cinder-csi-nodeplugin.yaml
+

README.md

@@ -42,5 +42,14 @@ copy, fill it in, and pass it to the scripts.
 
 * 17-delete-cluster.sh: Remove cluster again.
 
-
-  
+### CSI Cinder fixup
+The `cloud.conf` generated by the helm openstack-csp-helper in step 04
+references a `ca-file=/etc/config/cacert` if a custom CA file is being
+detected. This works for the OpenStack Cloud Controller Manager (OCCM)
+that is deployed into the workload cluster, but not for the CSI Cinder
+driver which mounts the `cloud-config` secrets at `/etc/kubernetes`
+and not `/etc/config/` by default, so the `ca-file=` reference points
+to a non-existing file, see [ClusterStacks issue #188](https://github.com/SovereignCloudStack/cluster-stacks/issues/188).
+This results in a `CrashLoopBackup` state for
+the openstack-cinder-csi-* pods in the workload cluster. Until this
+is fixed up upstream, it can be patched using the `09-fixup-cinder.sh`.

csi-cinder-controller-deployment.diff

@@ -0,0 +1,16 @@
+--- cinder-controller.old.yaml	2025-05-21 15:06:02.729428914 +0000
++++ cinder-controller.yaml	2025-05-21 15:14:06.215467738 +0000
+@@ -147,5 +147,5 @@ spec:
+           value: unix://csi/csi.sock
+         - name: CLOUD_CONFIG
+-          value: /etc/kubernetes/cloud.conf
++          value: /etc/config/cloud.conf
+         - name: CLUSTER_NAME
+           value: kgcluster131
+@@ -177,5 +177,5 @@ spec:
+           name: cacert
+           readOnly: true
+-        - mountPath: /etc/kubernetes
++        - mountPath: /etc/config
+           name: cloud-config
+           readOnly: true

csi-cinder-nodeplugin-daemonset.diff

@@ -0,0 +1,16 @@
+--- cinder-csi-nodeplugin.old.yaml	2025-05-21 15:17:10.849200731 +0000
++++ cinder-csi-nodeplugin.yaml	2025-05-21 15:17:37.264876651 +0000
+@@ -85,5 +85,5 @@ spec:
+           value: unix://csi/csi.sock
+         - name: CLOUD_CONFIG
+-          value: /etc/kubernetes/cloud.conf
++          value: /etc/config/cloud.conf
+         image: registry.k8s.io/provider-os/cinder-csi-plugin:v1.31.3
+         imagePullPolicy: IfNotPresent
+@@ -124,5 +124,5 @@ spec:
+           name: cacert
+           readOnly: true
+-        - mountPath: /etc/kubernetes
++        - mountPath: /etc/config
+           name: cloud-config
+           readOnly: true