Merge pull request #513 from Rakshith-R/sms-tls-key-trigger

controller: replace SMS CR check with tls-key volume presence trigger

Author: Madhu-1

cmd/main.go

@@ -42,7 +42,6 @@ import (
 	csiv1 "github.com/ceph/ceph-csi-operator/api/v1"
 	"github.com/ceph/ceph-csi-operator/internal/controller"
 	"github.com/ceph/ceph-csi-operator/internal/utils"
-	sm "github.com/kubernetes-csi/external-snapshot-metadata/client/apis/snapshotmetadataservice/v1beta1"
 	//+kubebuilder:scaffold:imports
 )
 
@@ -55,7 +54,6 @@ func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 
 	utilruntime.Must(csiv1.AddToScheme(scheme))
-	utilruntime.Must(sm.AddToScheme(scheme))
 	//+kubebuilder:scaffold:scheme
 }
 

config/rbac/role.yaml

@@ -30,14 +30,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - cbt.storage.k8s.io
-  resources:
-  - snapshotmetadataservices
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - csi.ceph.io
   resources:

deploy/all-in-one/install-openshift.yaml

@@ -15743,14 +15743,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - cbt.storage.k8s.io
-  resources:
-  - snapshotmetadataservices
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - csi.ceph.io
   resources:

deploy/all-in-one/install.yaml

@@ -15729,14 +15729,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - cbt.storage.k8s.io
-  resources:
-  - snapshotmetadataservices
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - csi.ceph.io
   resources:

deploy/charts/ceph-csi-operator/templates/manager-rbac.yaml

@@ -31,14 +31,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - cbt.storage.k8s.io
-  resources:
-  - snapshotmetadataservices
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - csi.ceph.io
   resources:

deploy/multifile/operator.yaml

@@ -288,14 +288,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - cbt.storage.k8s.io
-  resources:
-  - snapshotmetadataservices
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - csi.ceph.io
   resources:

docs/features/rbd-snapshot-metadata.md

@@ -73,28 +73,11 @@ Users need to perform the following manual setup:
    > - Replace `<driver-namespace>` with the namespace where your RBD driver is deployed
    > - Ensure certificates are valid for the domain: `<service-name>.<driver-namespace>` (using the service name from step 2)
 
-4. Create a SnapshotMetadataService CR for the RBD driver that will deploy the `external-snapshot-metadata` sidecar.
-   The name of this CR must match the RBD driver CR name.
+4. Provide the TLS secret as a `tls-key` volume in the RBD Driver CR.
 
-   **Example:**
-
-   ```yaml
-   apiVersion: cbt.storage.k8s.io/v1beta1
-   kind: SnapshotMetadataService
-   metadata:
-     name: <driver-name>
-   spec:
-     address: <service-name>.<driver-namespace>:<service-port>
-     audience: <driver-name>
-     caCert: <ca-bundle>
-   ```
-
-   > **Note:**
-   > - `address`: Should point to the service created in step 2, replace `<service-name>`, `<driver-namespace>`, and `<service-port>` with your actual values from step 2
-   > - `audience`: Recommended to use the CSI driver name for consistency
-   > - `caCert`: Base64-encoded CA certificate bundle
-
-5. Provide the TLS secret required for the `external-snapshot-metadata` sidecar as a volume mount in the RBD driver CR.
+   This is the trigger for sidecar deployment: the operator deploys the
+   `external-snapshot-metadata` sidecar whenever it finds a volume named `tls-key`
+   in `spec.controllerPlugin.volumes` of an RBD Driver CR.
 
    **Example:**
 
@@ -110,25 +93,43 @@ Users need to perform the following manual setup:
        volumes:
        - mount:
            mountPath: /tmp/certificates  # Must be /tmp/certificates - required by sidecar
-           name: tls-key 
+           name: tls-key
          volume:
            name: tls-key # Must be "tls-key"
            secret:
-             secretName: snapshot-metadata-tls  # The TLS secret name
+             secretName: snapshot-metadata-tls  # The TLS secret name from step 3
    ```
 
    > **Note:**
    > - **mountPath must be `/tmp/certificates`**: This path is required by the snapshot metadata sidecar to locate TLS certificates.
-   > - **Volume name and mount name must be `tls-key`**: The operator specifically filters for volumes with this exact name to mount in the snapshot-metadata sidecar container.
+   > - **Volume name and mount name must be `tls-key`**: The operator specifically looks for this name to deploy the sidecar.
    > - Replace `<driver-name>` with your RBD driver name (e.g., `rbd.csi.ceph.com`)
    > - Replace `<driver-namespace>` with the namespace where your RBD driver is deployed
 
+5. Create a SnapshotMetadataService CR for the RBD driver so backup vendors can
+   discover the sidecar endpoint. The name of this CR must match the RBD driver CR name.
+
+   **Example:**
+
+   ```yaml
+   apiVersion: cbt.storage.k8s.io/v1beta1
+   kind: SnapshotMetadataService
+   metadata:
+     name: <driver-name>
+   spec:
+     address: <service-name>.<driver-namespace>:<service-port>
+     audience: <driver-name>
+     caCert: <ca-bundle>
+   ```
+
+   > **Note:**
+   > - `address`: Should point to the service created in step 2, replace `<service-name>`, `<driver-namespace>`, and `<service-port>` with your actual values from step 2
+   > - `audience`: Recommended to use the CSI driver name for consistency
+   > - `caCert`: Base64-encoded CA certificate bundle
+
 ## Ceph-CSI Operator Responsibilities
 
 The operator will perform the following actions for the RBD controller plugin deployment:
 
-- Check for the existence of the SnapshotMetadataService CR (name must be the same as the RBD driver CR)
-- Check for the volume of type SecretVolumeSource (name must be the same as the RBD driver CR)
-
-> ⚠️ **Note**: If the SnapshotMetadataService CR is created after adding the volume configuration
-> in the RBD driver CR, the ceph-csi-operator pod needs to be restarted manually.
+- Check for a volume named `tls-key` in `spec.controllerPlugin.volumes` of the RBD Driver CR
+- If present, inject the `csi-snapshot-metadata` sidecar into the controller plugin deployment and mount the TLS certificates at `/tmp/certificates`

go.mod

@@ -5,7 +5,6 @@ go 1.25.8
 require (
 	github.com/ceph/ceph-csi-operator/api v0.0.0-20260211052505-60308e55e5d9
 	github.com/go-logr/logr v1.4.3
-	github.com/kubernetes-csi/external-snapshot-metadata/client v1.0.0
 	github.com/onsi/ginkgo/v2 v2.31.0
 	github.com/onsi/gomega v1.42.0
 	github.com/stretchr/testify v1.11.1
@@ -26,6 +25,7 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect

go.sum

@@ -111,8 +111,6 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kubernetes-csi/external-snapshot-metadata/client v1.0.0 h1:yRSDNeTNeZq7lSuDKXMv29ejtIRDgmJHCq36EjLQxLU=
-github.com/kubernetes-csi/external-snapshot-metadata/client v1.0.0/go.mod h1:Nufr1PWalLkuIyjS4Zr+ugyYEbK7MzbEUtZQUPeAJF0=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=

internal/controller/driver_controller.go

@@ -34,7 +34,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	storagev1 "k8s.io/api/storage/v1"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/intstr"
@@ -51,7 +50,6 @@ import (
 
 	csiv1 "github.com/ceph/ceph-csi-operator/api/v1"
 	"github.com/ceph/ceph-csi-operator/internal/utils"
-	sm "github.com/kubernetes-csi/external-snapshot-metadata/client/apis/snapshotmetadataservice/v1beta1"
 )
 
 //+kubebuilder:rbac:groups=csi.ceph.io,resources=drivers,verbs=get;list;watch;create;update;patch;delete
@@ -63,7 +61,6 @@ import (
 //+kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=get;list;watch;create;update;patch;delete
 //+kubebuilder:rbac:groups="",resources=services,verbs=get;list;watch;create;update;patch;delete
-//+kubebuilder:rbac:groups="cbt.storage.k8s.io",resources=snapshotmetadataservices,verbs=get;list;watch;
 
 type DriverType string
 
@@ -232,16 +229,6 @@ func (r *DriverReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
 	return ctrl.Result{}, err
 }
 
-func (r *driverReconcile) hasSnapshotMetadataServiceCr() (bool, error) {
-	sms := &sm.SnapshotMetadataService{}
-	sms.Name = r.driver.Name
-	if err := r.Get(r.ctx, client.ObjectKeyFromObject(sms), sms); !meta.IsNoMatchError(err) && client.IgnoreNotFound(err) != nil {
-		return false, fmt.Errorf("failed to get SnapshotMetadataService resource: %w", err)
-	}
-
-	return sms.UID != "", nil
-}
-
 func (r *driverReconcile) reconcile() error {
 	// Load the driver desired state based on driver resource, operator config resource and default values.
 	if err := r.LoadAndValidateDesiredState(); err != nil {
@@ -969,9 +956,10 @@ func (r *driverReconcile) reconcileControllerPluginDeployment() error {
 						}
 						// CSI snapshot-metadata Sidecar Container
 						if r.isRbdDriver() {
-							if deploy, err := r.hasSnapshotMetadataServiceCr(); err != nil {
-								r.log.Error(err, "Failed to check for SnapshotMetadataService CR")
-							} else if deploy {
+							tlsMountIndex := slices.IndexFunc(pluginSpec.Volumes, func(vol csiv1.VolumeSpec) bool {
+								return vol.Volume.Name == "tls-key"
+							})
+							if tlsMountIndex != -1 {
 								containers = append(containers, corev1.Container{
 									Name:            "csi-snapshot-metadata",
 									ImagePullPolicy: imagePullPolicy,
@@ -991,14 +979,8 @@ func (r *driverReconcile) reconcileControllerPluginDeployment() error {
 									},
 									VolumeMounts: utils.Call(func() []corev1.VolumeMount {
 										mounts := []corev1.VolumeMount{}
-										tlsMountIndex := slices.IndexFunc(pluginSpec.Volumes, func(vol csiv1.VolumeSpec) bool {
-											return vol.Volume.Name == "tls-key"
-										})
-										if tlsMountIndex != -1 {
-											mounts = append(mounts, pluginSpec.Volumes[tlsMountIndex].Mount)
-										}
+										mounts = append(mounts, pluginSpec.Volumes[tlsMountIndex].Mount)
 										mounts = append(mounts, utils.SocketDirVolumeMount)
-
 										return mounts
 									}),
 								})