Skip to content

Commit 34f02c5

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #1318 from Sneha-at/automated-cherry-pick-of-#1291-upstream-release-1.9
[1.9]Added support for confidential storage to disk parameters and metric
2 parents 719626b + 597af36 commit 34f02c5

File tree

299 files changed

+137465
-87228
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

299 files changed

+137465
-87228
lines changed

‎go.mod

+17-17
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,21 @@ module sigs.k8s.io/gcp-compute-persistent-disk-csi-driver
33
go 1.20
44

55
require (
6-
cloud.google.com/go/compute v1.7.0
7-
cloud.google.com/go/kms v1.4.0
6+
cloud.google.com/go/compute/metadata v0.2.3
7+
cloud.google.com/go/kms v1.6.0
88
github.com/GoogleCloudPlatform/k8s-cloud-provider v1.18.0
99
github.com/container-storage-interface/spec v1.6.0
1010
github.com/google/uuid v1.3.0
1111
github.com/kubernetes-csi/csi-proxy/client v1.1.1
1212
github.com/kubernetes-csi/csi-test/v4 v4.4.0
1313
github.com/onsi/ginkgo/v2 v2.7.1
1414
github.com/onsi/gomega v1.25.0
15-
golang.org/x/oauth2 v0.0.0-20220722155238-128564f6959c
16-
golang.org/x/sys v0.4.0
17-
google.golang.org/api v0.86.0
18-
google.golang.org/genproto v0.0.0-20220720214146-176da50484ac
19-
google.golang.org/grpc v1.48.0
20-
google.golang.org/protobuf v1.28.0
15+
golang.org/x/oauth2 v0.5.0
16+
golang.org/x/sys v0.5.0
17+
google.golang.org/api v0.111.0
18+
google.golang.org/genproto v0.0.0-20230223222841-637eb2293923
19+
google.golang.org/grpc v1.53.0
20+
google.golang.org/protobuf v1.28.1
2121
gopkg.in/gcfg.v1 v1.2.3
2222
k8s.io/apimachinery v0.24.1
2323
k8s.io/client-go v11.0.1-0.20190805182717-6502b5e7b1b5+incompatible
@@ -31,14 +31,14 @@ require (
3131
)
3232

3333
require (
34-
cloud.google.com/go v0.103.0 // indirect
35-
cloud.google.com/go/iam v0.3.0 // indirect
34+
cloud.google.com/go/compute v1.18.0 // indirect
35+
cloud.google.com/go/iam v0.11.0 // indirect
3636
github.com/Microsoft/go-winio v0.4.17 // indirect
3737
github.com/PuerkitoBio/purell v1.1.1 // indirect
3838
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
3939
github.com/beorn7/perks v1.0.1 // indirect
4040
github.com/blang/semver/v4 v4.0.0 // indirect
41-
github.com/cespare/xxhash/v2 v2.1.2 // indirect
41+
github.com/cespare/xxhash/v2 v2.2.0 // indirect
4242
github.com/davecgh/go-spew v1.1.1 // indirect
4343
github.com/emicklei/go-restful v2.9.5+incompatible // indirect
4444
github.com/fsnotify/fsnotify v1.5.4 // indirect
@@ -52,8 +52,8 @@ require (
5252
github.com/google/gnostic v0.5.7-v3refs // indirect
5353
github.com/google/go-cmp v0.5.9 // indirect
5454
github.com/google/gofuzz v1.2.1-0.20210504230335-f78f29fc09ea // indirect
55-
github.com/googleapis/enterprise-certificate-proxy v0.1.0 // indirect
56-
github.com/googleapis/gax-go/v2 v2.4.0 // indirect
55+
github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
56+
github.com/googleapis/gax-go/v2 v2.7.0 // indirect
5757
github.com/hashicorp/errwrap v1.0.0 // indirect
5858
github.com/hashicorp/go-multierror v1.1.0 // indirect
5959
github.com/imdario/mergo v0.3.12 // indirect
@@ -73,11 +73,11 @@ require (
7373
github.com/prometheus/procfs v0.7.3 // indirect
7474
github.com/sirupsen/logrus v1.8.1 // indirect
7575
github.com/spf13/pflag v1.0.5 // indirect
76-
go.opencensus.io v0.23.0 // indirect
76+
go.opencensus.io v0.24.0 // indirect
7777
go4.org v0.0.0-20201209231011-d4a079459e60 // indirect
78-
golang.org/x/net v0.5.0 // indirect
79-
golang.org/x/term v0.4.0 // indirect
80-
golang.org/x/text v0.6.0 // indirect
78+
golang.org/x/net v0.7.0 // indirect
79+
golang.org/x/term v0.5.0 // indirect
80+
golang.org/x/text v0.7.0 // indirect
8181
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
8282
google.golang.org/appengine v1.6.7 // indirect
8383
gopkg.in/inf.v0 v0.9.1 // indirect

‎go.sum

+42-121
Large diffs are not rendered by default.

‎pkg/common/parameters.go

+19
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ const (
2929
ParameterKeyLabels = "labels"
3030
ParameterKeyProvisionedIOPSOnCreate = "provisioned-iops-on-create"
3131
ParameterKeyProvisionedThroughputOnCreate = "provisioned-throughput-on-create"
32+
ParameterKeyEnableConfidentialCompute = "enable-confidential-storage"
3233

3334
// Parameters for VolumeSnapshotClass
3435
ParameterKeyStorageLocations = "storage-locations"
@@ -83,6 +84,9 @@ type DiskParameters struct {
8384
// Values: {int64}
8485
// Default: none
8586
ProvisionedThroughputOnCreate int64
87+
// Values: {bool}
88+
// Default: false
89+
EnableConfidentialCompute bool
8690
}
8791

8892
// SnapshotParameters contains normalized and defaulted parameters for snapshots
@@ -155,6 +159,21 @@ func ExtractAndDefaultParameters(parameters map[string]string, driverName string
155159
return p, fmt.Errorf("parameters contain invalid provisionedThroughputOnCreate parameter: %w", err)
156160
}
157161
p.ProvisionedThroughputOnCreate = paramProvisionedThroughputOnCreate
162+
case ParameterKeyEnableConfidentialCompute:
163+
paramEnableConfidentialCompute, err := ConvertStringToBool(v)
164+
if err != nil {
165+
return p, fmt.Errorf("parameters contain invalid value for enable-confidential-storage parameter: %w", err)
166+
}
167+
168+
if paramEnableConfidentialCompute {
169+
// DiskEncryptionKmsKey is needed to enable confidentialStorage
170+
if val, ok := parameters[ParameterKeyDiskEncryptionKmsKey]; !ok || !isValidDiskEncryptionKmsKey(val) {
171+
return p, fmt.Errorf("Valid %v is required to enbale ConfidentialStorage", ParameterKeyDiskEncryptionKmsKey)
172+
}
173+
}
174+
175+
p.EnableConfidentialCompute = paramEnableConfidentialCompute
176+
158177
default:
159178
return p, fmt.Errorf("parameters contains invalid option %q", k)
160179
}

‎pkg/common/utils.go

+17
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,17 @@ func ConvertMiBStringToInt64(str string) (int64, error) {
292292
return volumehelpers.RoundUpToMiB(quantity)
293293
}
294294

295+
// ConvertStringToBool converts a string to a boolean.
296+
func ConvertStringToBool(str string) (bool, error) {
297+
switch strings.ToLower(str) {
298+
case "true":
299+
return true, nil
300+
case "false":
301+
return false, nil
302+
}
303+
return false, fmt.Errorf("Unexpected boolean string %s", str)
304+
}
305+
295306
// ParseMachineType returns an extracted machineType from a URL, or empty if not found.
296307
// machineTypeUrl: Full or partial URL of the machine type resource, in the format:
297308
//
@@ -364,3 +375,9 @@ func LoggedError(msg string, err error) error {
364375
klog.Errorf(msg+"%v", err.Error())
365376
return status.Errorf(CodeForError(err), msg+"%v", err.Error())
366377
}
378+
379+
func isValidDiskEncryptionKmsKey(DiskEncryptionKmsKey string) bool {
380+
// Validate key against default kmskey pattern
381+
kmsKeyPattern := regexp.MustCompile("projects/[^/]+/locations/([^/]+)/keyRings/[^/]+/cryptoKeys/[^/]+")
382+
return kmsKeyPattern.MatchString(DiskEncryptionKmsKey)
383+
}

‎pkg/common/utils_test.go

+80
Original file line numberDiff line numberDiff line change
@@ -800,6 +800,60 @@ func TestConvertMiBStringToInt64(t *testing.T) {
800800
}
801801
}
802802

803+
func TestConvertStringToBool(t *testing.T) {
804+
tests := []struct {
805+
desc string
806+
inputStr string
807+
expected bool
808+
expectError bool
809+
}{
810+
{
811+
desc: "valid true",
812+
inputStr: "true",
813+
expected: true,
814+
expectError: false,
815+
},
816+
{
817+
desc: "valid mixed case true",
818+
inputStr: "True",
819+
expected: true,
820+
expectError: false,
821+
},
822+
{
823+
desc: "valid false",
824+
inputStr: "false",
825+
expected: false,
826+
expectError: false,
827+
},
828+
{
829+
desc: "valid mixed case false",
830+
inputStr: "False",
831+
expected: false,
832+
expectError: false,
833+
},
834+
{
835+
desc: "invalid",
836+
inputStr: "yes",
837+
expected: false,
838+
expectError: true,
839+
},
840+
}
841+
for _, tc := range tests {
842+
t.Run(tc.desc, func(t *testing.T) {
843+
got, err := ConvertStringToBool(tc.inputStr)
844+
if err != nil && !tc.expectError {
845+
t.Errorf("Got error %v converting string to bool %s; expect no error", err, tc.inputStr)
846+
}
847+
if err == nil && tc.expectError {
848+
t.Errorf("Got no error converting string to bool %s; expect an error", tc.inputStr)
849+
}
850+
if err == nil && got != tc.expected {
851+
t.Errorf("Got %v for converting string to bool; expect %v", got, tc.expected)
852+
}
853+
})
854+
}
855+
}
856+
803857
func TestParseMachineType(t *testing.T) {
804858
tests := []struct {
805859
desc string
@@ -955,3 +1009,29 @@ func TestIsContextError(t *testing.T) {
9551009
}
9561010
}
9571011
}
1012+
1013+
func TestIsValidDiskEncryptionKmsKey(t *testing.T) {
1014+
cases := []struct {
1015+
diskEncryptionKmsKey string
1016+
expectedIsValid bool
1017+
}{
1018+
{
1019+
diskEncryptionKmsKey: "projects/my-project/locations/us-central1/keyRings/TestKeyRing/cryptoKeys/test-key",
1020+
expectedIsValid: true,
1021+
},
1022+
{
1023+
diskEncryptionKmsKey: "projects/my-project/locations/global/keyRings/TestKeyRing/cryptoKeys/test-key",
1024+
expectedIsValid: true,
1025+
},
1026+
{
1027+
diskEncryptionKmsKey: "projects/my-project/locations/keyRings/TestKeyRing/cryptoKeys/test-key",
1028+
expectedIsValid: false,
1029+
},
1030+
}
1031+
for _, tc := range cases {
1032+
isValid := isValidDiskEncryptionKmsKey(tc.diskEncryptionKmsKey)
1033+
if tc.expectedIsValid != isValid {
1034+
t.Errorf("test failed: the provided key %s expected to be %v bu tgot %v", tc.diskEncryptionKmsKey, tc.expectedIsValid, isValid)
1035+
}
1036+
}
1037+
}

‎pkg/gce-cloud-provider/compute/cloud-disk.go

+11
Original file line numberDiff line numberDiff line change
@@ -223,3 +223,14 @@ func (d *CloudDisk) GetMultiWriter() bool {
223223
return false
224224
}
225225
}
226+
227+
func (d *CloudDisk) GetEnableConfidentialCompute() bool {
228+
switch {
229+
case d.disk != nil:
230+
return false
231+
case d.betaDisk != nil:
232+
return d.betaDisk.EnableConfidentialCompute
233+
default:
234+
return false
235+
}
236+
}

‎pkg/gce-cloud-provider/compute/cloud-disk_test.go

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
/*
2+
Copyright 2023 The Kubernetes Authors.
3+
4+
5+
Licensed under the Apache License, Version 2.0 (the "License");
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
*/
17+
18+
package gcecloudprovider
19+
20+
import (
21+
"testing"
22+
23+
computebeta "google.golang.org/api/compute/v0.beta"
24+
computev1 "google.golang.org/api/compute/v1"
25+
)
26+
27+
func CreateDiskWithConfidentialCompute(betaDisk bool, confidentialCompute bool, diskType string) *CloudDisk {
28+
if betaDisk {
29+
return &CloudDisk{
30+
betaDisk: &computebeta.Disk{
31+
EnableConfidentialCompute: confidentialCompute,
32+
Type: diskType,
33+
},
34+
}
35+
}
36+
return &CloudDisk{
37+
disk: &computev1.Disk{},
38+
}
39+
}
40+
41+
func TestGetEnableConfidentialCompute(t *testing.T) {
42+
testCases := []struct {
43+
name string
44+
diskVersion *CloudDisk
45+
expectedEnableConfidentialCompute bool
46+
}{
47+
{
48+
name: "test betaDisk with enableConfidentialCompute=false",
49+
diskVersion: CreateDiskWithConfidentialCompute(true, false, "hyperdisk-balanced"),
50+
expectedEnableConfidentialCompute: false,
51+
},
52+
{
53+
name: "test betaDisk with enableConfidentialCompute=true",
54+
diskVersion: CreateDiskWithConfidentialCompute(true, true, "hyperdisk-balanced"),
55+
expectedEnableConfidentialCompute: true,
56+
},
57+
{
58+
name: "test disk withpit enableConfidentialCompute",
59+
diskVersion: CreateDiskWithConfidentialCompute(false, false, "hyperdisk-balanced"),
60+
expectedEnableConfidentialCompute: false,
61+
},
62+
{
63+
name: "test disk withpit enableConfidentialCompute",
64+
diskVersion: CreateDiskWithConfidentialCompute(false, false, "pd-standard"),
65+
expectedEnableConfidentialCompute: false,
66+
},
67+
}
68+
69+
for _, tc := range testCases {
70+
t.Logf("Running test: %v", tc.name)
71+
confidentialCompute := tc.diskVersion.GetEnableConfidentialCompute()
72+
if confidentialCompute != tc.expectedEnableConfidentialCompute {
73+
t.Fatalf("Got confidentialCompute value %t expected %t", confidentialCompute, tc.expectedEnableConfidentialCompute)
74+
}
75+
if confidentialCompute != tc.expectedEnableConfidentialCompute {
76+
t.Fatalf("Got confidentialCompute value %t expected %t", confidentialCompute, tc.expectedEnableConfidentialCompute)
77+
}
78+
}
79+
}

‎pkg/gce-cloud-provider/compute/fake-gce.go

+7-1
Original file line numberDiff line numberDiff line change
@@ -237,7 +237,13 @@ func (cloud *FakeCloudProvider) InsertDisk(ctx context.Context, project string,
237237
return fmt.Errorf("could not create disk, key was neither zonal nor regional, instead got: %v", volKey.String())
238238
}
239239

240-
cloud.disks[volKey.Name] = CloudDiskFromV1(computeDisk)
240+
if containsBetaDiskType(hyperdiskTypes, params.DiskType) {
241+
betaDisk := convertV1DiskToBetaDisk(computeDisk, params.ProvisionedThroughputOnCreate)
242+
betaDisk.EnableConfidentialCompute = params.EnableConfidentialCompute
243+
cloud.disks[volKey.Name] = CloudDiskFromBeta(betaDisk)
244+
} else {
245+
cloud.disks[volKey.Name] = CloudDiskFromV1(computeDisk)
246+
}
241247
return nil
242248
}
243249

‎pkg/gce-cloud-provider/compute/gce-compute.go

+13-2
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ const (
4343
pdDiskTypeUnsupportedPattern = `\[([a-z-]+)\] features are not compatible for creating instance`
4444
)
4545

46-
var hyperdiskTypes = []string{"hyperdisk-extreme", "hyperdisk-throughput"}
46+
var hyperdiskTypes = []string{"hyperdisk-extreme", "hyperdisk-throughput", "hyperdisk-balanced"}
4747
var pdDiskTypeUnsupportedRegex = regexp.MustCompile(pdDiskTypeUnsupportedPattern)
4848

4949
type GCEAPIVersion string
@@ -258,6 +258,9 @@ func (cloud *CloudProvider) ListSnapshots(ctx context.Context, filter string) ([
258258

259259
func (cloud *CloudProvider) GetDisk(ctx context.Context, project string, key *meta.Key, gceAPIVersion GCEAPIVersion) (*CloudDisk, error) {
260260
klog.V(5).Infof("Getting disk %v", key)
261+
262+
// Override GCEAPIVersion as hyperdisk is only available in beta and we cannot get the disk-type with get disk call.
263+
gceAPIVersion = GCEAPIVersionBeta
261264
switch key.Type() {
262265
case meta.Zonal:
263266
if gceAPIVersion == GCEAPIVersionBeta {
@@ -416,8 +419,16 @@ func convertV1DiskToBetaDisk(v1Disk *computev1.Disk, provisionedThroughputOnCrea
416419
Description: v1Disk.Description,
417420
Type: v1Disk.Type,
418421
SourceSnapshot: v1Disk.SourceSnapshot,
422+
SourceImage: v1Disk.SourceImage,
423+
SourceImageId: v1Disk.SourceImageId,
424+
SourceSnapshotId: v1Disk.SourceSnapshotId,
425+
SourceDisk: v1Disk.SourceDisk,
419426
ReplicaZones: v1Disk.ReplicaZones,
420427
DiskEncryptionKey: dek,
428+
Zone: v1Disk.Zone,
429+
Region: v1Disk.Region,
430+
Status: v1Disk.Status,
431+
SelfLink: v1Disk.SelfLink,
421432
}
422433
if v1Disk.ProvisionedIops > 0 {
423434
betaDisk.ProvisionedIops = v1Disk.ProvisionedIops
@@ -558,7 +569,6 @@ func (cloud *CloudProvider) insertZonalDisk(
558569
opName string
559570
gceAPIVersion = GCEAPIVersionV1
560571
)
561-
562572
if multiWriter || containsBetaDiskType(hyperdiskTypes, params.DiskType) {
563573
gceAPIVersion = GCEAPIVersionBeta
564574
}
@@ -600,6 +610,7 @@ func (cloud *CloudProvider) insertZonalDisk(
600610
var insertOp *computebeta.Operation
601611
betaDiskToCreate := convertV1DiskToBetaDisk(diskToCreate, params.ProvisionedThroughputOnCreate)
602612
betaDiskToCreate.MultiWriter = multiWriter
613+
betaDiskToCreate.EnableConfidentialCompute = params.EnableConfidentialCompute
603614
insertOp, err = cloud.betaService.Disks.Insert(project, volKey.Zone, betaDiskToCreate).Context(ctx).Do()
604615
if insertOp != nil {
605616
opName = insertOp.Name

0 commit comments

Comments
 (0)