external-snapshotter should not allow annotation in template for snapshotter-secret-name

[saad-ali]

external-snapshotter supports ${volumesnapshot.annotations['ANNOTATION_KEY']} as a template for csi.storage.k8s.io/snapshotter-secret-name. It should not. It is ok for all other secrets (e.g. ListSnapshot secret) but not for the CreateSnapshot secret.

external-snapshotter/pkg/controller/util.go

Lines 216 to 220 in a1b3374

	// supported tokens for name resolution:
	// - ${volumesnapshotcontent.name}
	// - ${volumesnapshot.namespace}
	// - ${volumesnapshot.name}
	// - ${volumesnapshot.annotations['ANNOTATION_KEY']} (e.g. ${pvc.annotations['example.com/snapshot-create-secret-name']})

CC @msau42 @jingxu97 @xing-yang

[xing-yang]

Hi @saad-ali, the secret handling logic in external-snapshotter is modeled after the code in external-provisioner. We do strip prefixed parameters before calling create snapshot. See here:

https://github.com/kubernetes-csi/external-snapshotter/blob/master/pkg/controller/csi_handler.go#L70

I'll add comments to clarify that. Is that okay? Thanks.

[msau42]

@saad-ali's comment is not about stripping the k8s csi prefix. It's about allowing volumesnapshot.annotations as a template value. For Volume Create/Delete, we do not allow PVC annotations to be used in the StorageClass secret template. Very long discussion here: kubernetes-csi/external-provisioner#86

[xing-yang]

Thanks @msau42! I'll take a look of the discussion.

[msau42]

Some more discussion: kubernetes-csi/external-provisioner#170

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[xing-yang]

This is fixed.