STOR-1856: add STS hook for EFS credentials request controller

[RomanBednar]

PR #237 for migrating EFS operator to csi-operator repo was missing credentials request hook - as a result EFS operator was not working in STS clusters due to missing secret:

MountVolume.SetUp failed for volume "aws-credentials" : secret "aws-efs-cloud-credentials" not found

Patch was tested to verify EFS dynamic provisioning on STS cluster and correct handling of role ARN provided via Operator Hub:

1. check provided ARN

$ oc -n openshift-cluster-csi-drivers get subscription/aws-efs-csi-driver-operator -o json | jq '.spec.config.env'
[
  {
    "name": "ROLEARN",
    "value": "arn:aws:iam::269733383066:role/rbednar-aws-efs-openshift-cluster-csi-drivers-aws-efs-cloud-cred"
  }
]

2. validate ARN propagated to cred. request by the hook

$ oc -n openshift-cloud-credential-operator get credentialsrequest/openshift-aws-efs-csi-driver -o json | jq '.spec.providerSpec.stsIAMRoleARN'
"arn:aws:iam::269733383066:role/rbednar-aws-efs-openshift-cluster-csi-drivers-aws-efs-cloud-cred"

3. verify secret was created by CCO

$ oc -n openshift-cluster-csi-drivers get secret/aws-efs-cloud-credentials
NAME                        TYPE     DATA   AGE
aws-efs-cloud-credentials   Opaque   1      48m

4. test dynamic provisioning with EFS

$ oc get pvc
NAME    STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   VOLUMEATTRIBUTESCLASS   AGE
pvc-1   Bound    pvc-32f11702-80db-4c3c-b52a-8ccce73e486a   1Gi        RWO            efs-sc         <unset>                 61s

$ oc get pv
NAME                                       CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM           STORAGECLASS   VOLUMEATTRIBUTESCLASS   REASON   AGE
pvc-32f11702-80db-4c3c-b52a-8ccce73e486a   1Gi        RWO            Delete           Bound    default/pvc-1   efs-sc         <unset>                          14s

[openshift-ci-robot]

@RomanBednar: This pull request references STOR-1856 which is a valid jira issue.

In response to this:

PR #237 for migrating EFS operator to csi-operator repo was missing credentials request hook - as a result EFS operator was not working in STS clusters due to missing secret:

MountVolume.SetUp failed for volume "aws-credentials" : secret "aws-efs-cloud-credentials" not found

Patch was tested to verify EFS dynamic provisioning on STS cluster and correct handling of role ARN provided via Operator Hub:

1. check provided ARN

$ oc -n openshift-cluster-csi-drivers get subscription/aws-efs-csi-driver-operator -o json | jq '.spec.config.env'
[
 {
   "name": "ROLEARN",
   "value": "arn:aws:iam::269733383066:role/rbednar-aws-efs-openshift-cluster-csi-drivers-aws-efs-cloud-cred"
 }
]

2. validate ARN propagated to cred. request by the hook

$ oc -n openshift-cloud-credential-operator get credentialsrequest/openshift-aws-efs-csi-driver -o json | jq '.spec.providerSpec.stsIAMRoleARN'
"arn:aws:iam::269733383066:role/rbednar-aws-efs-openshift-cluster-csi-drivers-aws-efs-cloud-cred"

3. verify secret was created by CCO

$ oc -n openshift-cluster-csi-drivers get secret/aws-efs-cloud-credentials
NAME                        TYPE     DATA   AGE
aws-efs-cloud-credentials   Opaque   1      48m

4. test dynamic provisioning with EFS

$ oc get pvc
NAME    STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   VOLUMEATTRIBUTESCLASS   AGE
pvc-1   Bound    pvc-32f11702-80db-4c3c-b52a-8ccce73e486a   1Gi        RWO            efs-sc         <unset>                 61s

$ oc get pv
NAME                                       CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM           STORAGECLASS   VOLUMEATTRIBUTESCLASS   REASON   AGE
pvc-32f11702-80db-4c3c-b52a-8ccce73e486a   1Gi        RWO            Delete           Bound    default/pvc-1   efs-sc         <unset>                          14s

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: RomanBednar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [RomanBednar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[RomanBednar]

/cc @openshift/storage

[openshift-ci]

@RomanBednar: GitHub didn't allow me to request PR reviews from the following users: openshift/storage.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/cc @openshift/storage

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[RomanBednar]

/retest-required

[openshift-ci]

@RomanBednar: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-azurestack-csi	1e80562	link	false	/test e2e-azurestack-csi
ci/prow/e2e-azure-csi-extended	1e80562	link	false	/test e2e-azure-csi-extended

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[Phaow]

/retest-required

[RomanBednar]

/label docs-approved
/label px-approved

[jsafrane]

/lgtm

[Phaow]

/label qe-approved
Pre merge test passed with registry.build05.ci.openshift.org/ci-ln-mb4xqi2/stable:aws-efs-csi-driver-operator(build 4.17,openshift/csi-operator#251)

Regression E2E test record

# Check the role ARN propagated to credentialsrequest
$ oc -n openshift-cloud-credential-operator get credentialsrequest/openshift-aws-efs-csi-driver -o json | jq '.spec.providerSpec.stsIAMRoleARN'
"arn:aws:iam::301721915996:role/pewang-0806sts-p2ksf-efs-operator-role"

# Regression e2e test all passed

54 pass, 15 skip (29m10s)

[openshift-ci-robot]

@RomanBednar: This pull request references STOR-1856 which is a valid jira issue.

In response to this:

PR #237 for migrating EFS operator to csi-operator repo was missing credentials request hook - as a result EFS operator was not working in STS clusters due to missing secret:

MountVolume.SetUp failed for volume "aws-credentials" : secret "aws-efs-cloud-credentials" not found

Patch was tested to verify EFS dynamic provisioning on STS cluster and correct handling of role ARN provided via Operator Hub:

1. check provided ARN

$ oc -n openshift-cluster-csi-drivers get subscription/aws-efs-csi-driver-operator -o json | jq '.spec.config.env'
[
 {
   "name": "ROLEARN",
   "value": "arn:aws:iam::269733383066:role/rbednar-aws-efs-openshift-cluster-csi-drivers-aws-efs-cloud-cred"
 }
]

2. validate ARN propagated to cred. request by the hook

$ oc -n openshift-cloud-credential-operator get credentialsrequest/openshift-aws-efs-csi-driver -o json | jq '.spec.providerSpec.stsIAMRoleARN'
"arn:aws:iam::269733383066:role/rbednar-aws-efs-openshift-cluster-csi-drivers-aws-efs-cloud-cred"

3. verify secret was created by CCO

$ oc -n openshift-cluster-csi-drivers get secret/aws-efs-cloud-credentials
NAME                        TYPE     DATA   AGE
aws-efs-cloud-credentials   Opaque   1      48m

4. test dynamic provisioning with EFS

$ oc get pvc
NAME    STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   VOLUMEATTRIBUTESCLASS   AGE
pvc-1   Bound    pvc-32f11702-80db-4c3c-b52a-8ccce73e486a   1Gi        RWO            efs-sc         <unset>                 61s

$ oc get pv
NAME                                       CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM           STORAGECLASS   VOLUMEATTRIBUTESCLASS   REASON   AGE
pvc-32f11702-80db-4c3c-b52a-8ccce73e486a   1Gi        RWO            Delete           Bound    default/pvc-1   efs-sc         <unset>                          14s

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

Distgit: ose-aws-efs-csi-driver-operator
This PR has been included in build ose-aws-efs-csi-driver-operator-container-v4.17.0-202408060844.p0.g8b88a33.assembly.stream.el9.
All builds following this will include this PR.

[openshift-bot]

[ART PR BUILD NOTIFIER]

Distgit: ose-azure-disk-csi-driver-operator
This PR has been included in build ose-azure-disk-csi-driver-operator-container-v4.17.0-202408060844.p0.g8b88a33.assembly.stream.el9.
All builds following this will include this PR.

[openshift-bot]

[ART PR BUILD NOTIFIER]

Distgit: azure-file-csi-driver-operator
This PR has been included in build ose-azure-file-csi-driver-operator-container-v4.17.0-202408060844.p0.g8b88a33.assembly.stream.el9.
All builds following this will include this PR.

[openshift-bot]

[ART PR BUILD NOTIFIER]

Distgit: ose-aws-ebs-csi-driver-operator
This PR has been included in build ose-aws-ebs-csi-driver-operator-container-v4.17.0-202408060844.p0.g8b88a33.assembly.stream.el9.
All builds following this will include this PR.

[openshift-bot]

[ART PR BUILD NOTIFIER]

Distgit: ose-smb-csi-driver-operator
This PR has been included in build ose-smb-csi-driver-operator-container-v4.17.0-202408060844.p0.g8b88a33.assembly.stream.el9.
All builds following this will include this PR.