cloud-provider-openstack Adds Cinder CSI Knobs And Hardens Charts

cloud-provider-openstack is the out of tree OpenStack provider for Kubernetes: OCCM, Cinder CSI, Manila CSI, the Keystone webhook, and magnum-auto-healer. Master took 23 commits this week, 85 files, 1219 insertions and 226 deletions. The operator visible work is Cinder snapshot and format knobs, tighter chart defaults, and a Keystone reload bug that could wipe live policy.

Cinder CSI picked up two knobs data platforms actually use. Incremental backups add an incremental VolumeSnapshotClass parameter. It maps to gophercloud backups.CreateOpts.Incremental, defaults to false, and only applies when type is backup. A bad boolean is logged at V(5) and treated as a full backup, so a typo does not fail the create, it silently does more I/O than you asked for. pkg/csi/cinder/controllerserver.go forwards openstack.SnapshotIncremental the same way it already forwarded force-create.

mkfs-options is the other one. CreateVolume copies a whitespace separated StorageClass parameter into VolumeContext on both the new volume path and the idempotent “already exists” return. NodeStageVolume splits it with strings.Fields and passes it to FormatAndMountSensitiveWithFormatOptions. Unset keeps the old FormatAndMount path. The motivating case is Ceph backed ext4, where -E nodiscard skips discard on a device that will not benefit from it.

apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshotClass
metadata:
  name: cinder-backup-incr
driver: cinder.csi.openstack.org
parameters:
  type: backup
  incremental: "true"

The Helm chart can now put those parameters on the StorageClasses it owns. Optional storageClass.delete.parameters and storageClass.retain.parameters landed in charts/cinder-csi-plugin/values.yaml. Default is {}, so rendered YAML stays the same until you set something. Docs in docs/cinder-csi-plugin/using-cinder-csi-plugin.md list both flags.

Topology wiring moved. The chart now passes --with-topology to both driver containers and dropped --feature-gates=Topology= from the external provisioner sidecar. Helm still keys off .Values.csi.provisioner.topology (default "true"). A sidecar patch that used to disable topology no longer does anything.

OCCM, Cinder CSI, and Manila CSI got the same hardening pass. OCCM manifests and charts drop every Linux capability, set readOnlyRootFilesystem, allowPrivilegeEscalation: false, runAsNonRoot: true, and default priorityClassName to system-node-critical. OCCM only talks to the Kubernetes and OpenStack APIs. If it is evicted, new nodes stay NotReady.

The node plugin still has to mount, so it stays privileged. Sidecars that only speak the CSI socket, and the whole controller plugin, get a tight securityContext. Cinder images still use distroless/static:latest as root, so runAsNonRoot is not set on those containers yet.

charts/openstack-cloud-controller-manager/values.yaml now looks like this:

securityContext:
  capabilities:
    drop:
      - ALL
  readOnlyRootFilesystem: true
  seccompProfile:
    type: RuntimeDefault
  allowPrivilegeEscalation: false
  runAsNonRoot: true

hostNetwork is a chart value instead of a hardcoded true on the DaemonSet. Default stays true. You need host net for the metadata service on CNIs that cannot route 169.254.169.254, or when the OpenStack control plane sits on a management network pods cannot reach. If you only run the Octavia service controller, you can turn it off. dnsPolicy default flipped to ClusterFirstWithHostNet to match. Disable host net and set dnsPolicy: ClusterFirst yourself. The template in charts/openstack-cloud-controller-manager/templates/daemonset.yaml no longer derives one from the other.

The Bitnami common subchart is gone. Labels come from occm.labels.standard. ServiceMonitor matchLabels now use app.kubernetes.io/name and app.kubernetes.io/instance only. Matching on helm.sh/chart or app.kubernetes.io/version dropped the Prometheus scrape target on every chart bump. The DaemonSet and Service still use the old app / release / component labels. Changing those is a breaking selector change and is deferred.

Chart versions on master: OCCM 2.36.5, Cinder CSI 2.36.5, Manila CSI 2.36.3. appVersion is still v1.36.0. This is chart and master code, not a new tagged binary.

The Keystone webhook used to apply a ConfigMap even when parse failed. updatePolicies unmarshaled JSON, logged the error with runtimeutil.HandleError, then still wrote k.authz.pl. A typo in the policy ConfigMap left the webhook with an empty policy list. updateSyncConfig did the same for YAML and skipped validate() before swapping k.syncer.syncConfig.

Both helpers now return error. processItem returns that error and does not replace the live structs. Tests cover malformed JSON, malformed YAML, and a sync config with an unsupported data type. Valid updates still replace the previous value.

magnum-auto-healer had the opposite default. Endpoint health checks hardcoded InsecureSkipVerify: true. The check now loads a CA from ca-file, default /var/run/secrets/kubernetes.io/serviceaccount/ca.crt. tls-insecure: true is the escape hatch. Modern Magnum CAPI drivers use kubeadm, which puts the node internal IP in the SAN. Older Heat based clusters with a cert that does not match will fail the Endpoint check until you set tls-insecure.

OCCM instance lookup got a one line fix in the same window. getServerByName now returns cloudprovider.InstanceNotFound instead of errors.ErrNotFound when Nova returns an empty list. The cloud provider interface treats InstanceNotFound as “this node is gone”. The internal error type did not.

--nodeid and --nodeaz were marked deprecated and ignored. They are optional overrides again. Set both and the driver uses a static metadata provider and never talks to 169.254.169.254. Set one and the other still comes from the metadata service. Set neither and behavior is unchanged.

That matters on bare metal and edge nodes that are not OpenStack VMs. Manila CSI still has to report a node ID and, with topology on, an AZ. The metadata service is not there. SetupNodeService now takes (nodeID, nodeAZ, md) and picks staticMetadata, overrideMetadata, or the real provider. Metadata search order is only validated when a flag is missing and the fallback is required.

The Manila chart hardening does not wire those flags. Pass them through extraArgs on the node plugin until the chart grows values for them.

Helm upgrades from charts before 2.36.5 change pod securityContext, priorityClassName, and OCCM dnsPolicy. The surprise is priorityClassName: system-node-critical appearing on OCCM and CSI node DaemonSets that did not have it.

Topology disable does nothing if you still patch --feature-gates=Topology=false on csi-provisioner. Pass --with-topology=false on both Cinder CSI driver containers, or set .Values.csi.provisioner.topology: "false".

ServiceMonitor selectors that match helm.sh/chart or app.kubernetes.io/version will miss OCCM after this bump. Use name and instance. DaemonSet selector labels are still the old set. Do not “fix” those by hand or the DaemonSet will not roll.

Magnum Endpoint checks now verify TLS. A cluster that was healthy only because skip verify was baked in will look unhealthy until you set tls-insecure: true or fix the cert SAN. On the Keystone side, a bad policy edit no longer takes down the live authorizer. The webhook retries and logs until the ConfigMap is valid again.