Snapshots cannot be imported across projects

[christian-roggia]

This issue is related to the topic discussed here: #224.

According to the documentation, it should be possible to import pre-existing snapshots across projects: https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/blob/master/docs/kubernetes/user-guides/snapshots.md

But this doesn't seem to be the case:

'Failed to check and update snapshot content: failed to list snapshot for content restored-snapshot-content: "can not find snapshot for snapshotID projects/PROJECT_ID/global/snapshots/SNAPSHOT_ID"'

My first guess was that the CSI driver did not have the right IAM permissions to list or get the snapshots.

I attempted to grant the following permissions:

    "compute.snapshots.list",
    "compute.snapshots.get",
    "compute.snapshots.useReadOnly",

to the following service accounts:

    "serviceAccount:[email protected]",
    "serviceAccount:[email protected]",
    "serviceAccount:service-PROJECT_NUMBER@container-engine-robot.iam.gserviceaccount.com",
    "serviceAccount:pdcsi-workload@PROJECT_ID.iam.gserviceaccount.com",

where

pdcsi-workload@PROJECT_ID.iam.gserviceaccount.com

is an identity workload with service account

PROJECT_ID.svc.id.goog[kube-system/pdcsi-node-sa]

with no success.

---

I am assuming that the CSI driver is not able to import snapshots from another project because of the way it was implemented.

If this was not the case and the CSI driver is supposed (and has been observed) to work cross-projects then any clue would be helpful to understand why it is failing to locate the snapshot in my case (is it because of IAM? did I misconfigure something? is my CSI driver version too old?).

Thank you!

[christian-roggia]

I confirm that the project is currently hardcoded here:

https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/blob/master/pkg/gce-cloud-provider/compute/gce-compute.go#L768..L777

and here:

https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver/blob/master/pkg/common/utils.go#L103...L113

the project is not passed from the full qualified snapshot path down to the Snapshots.Get(project, snapshotName) function.

---

This means that if I try to import the snapshot X from project FOO to project BAR with the FQN

projects/PROJECT_FOO/global/snapshots/SNAPSHOT_ID

it gets imported as

projects/PROJECT_BAR/global/snapshots/SNAPSHOT_ID

thus failing with a NOT FOUND error.