[release-4.17] OCPBUGS-62974: Add withCABundleDaemonSetHook() to AWS EFS operator #449

Phaow · 2025-10-13T08:24:39Z

This is an manual cherry-pick of #444 the automatic compile failed issue).

We do not have the https://github.com/openshift/csi-operator/pull/294/files in release-4.17, use the c.ControlPlaneNamespace instead.

The hook adds the custom CA bundle mount (non-standard-root-system-trust-ca-bundle). This CA bundle is critical for clusters running in the secure AWS regions (C2S/SC2S) because EFS requires these custom certificates to establish trust

openshift-ci-robot · 2025-10-13T08:24:47Z

@Phaow: This pull request references Jira Issue OCPBUGS-62974, which is invalid:

expected dependent Jira Issue OCPBUGS-62926 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ON_QA instead
expected dependent Jira Issue OCPBUGS-62926 to target a version in 4.18.0, 4.18.z, but it targets "4.19.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This is an manual cherry-pick of #444 the automatic compile failed issue).

We do not have the https://github.com/openshift/csi-operator/pull/294/files in release-4.17, use the c.ControlPlaneNamespace instead.

/assign @mpatlasov

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Phaow · 2025-10-13T13:21:59Z

/retest-required

openshift-ci · 2025-10-13T16:07:59Z

@Phaow: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

mpatlasov · 2025-10-13T23:30:46Z

pkg/driver/aws-efs/aws_efs.go

+// withCABundleDaemonSetHook projects custom CA bundle ConfigMap into the CSI driver container
+func withCABundleDaemonSetHook(c *clients.Clients) (csidrivernodeservicecontroller.DaemonSetHookFunc, []factory.Informer) {
+	hook := csidrivernodeservicecontroller.WithCABundleDaemonSetHook(
+		c.ControlPlaneNamespace,


I think it must be clients.CSIDriverNamespace (similarly to what we have in aws-ebs withCABundleDaemonSetHook).

I also investigate to use clients.CSIDriverNamespace, but for efs is a bit different, ebs csi driver operator is level2 operator managed by CSO, so it has no chance to install to another namespace(not the openshift-cluster-csi-dirvers), while efs csi driver operator is a 3rd operator, it could be installed in other namespaces(non openshift-), so I think using the c.ControlPlaneNamespace (the operator installed namespace) will be better than clients.CSIDriverNamespace (const as openshift-cluster-csi-dirvers), wdyt?

The replcaer replaces all ${NAMESPACE} with controlPlaneNamespace.

https://github.com/openshift/csi-operator/blob/release-4.17/assets/overlays/aws-efs/generated/standalone/cabundle_cm.yaml#L13

https://github.com/openshift/csi-operator/blob/release-4.17/pkg/driver/common/operator/replacer.go#L67

OK, I agree, thank you for insights!

mpatlasov · 2025-10-13T23:31:03Z

pkg/driver/aws-efs/aws_efs.go

+	hook := csidrivernodeservicecontroller.WithCABundleDaemonSetHook(
+		c.ControlPlaneNamespace,
+		trustedCAConfigMap,
+		c.GetConfigMapInformer(c.ControlPlaneNamespace),


same as above

mpatlasov · 2025-10-13T23:31:09Z

pkg/driver/aws-efs/aws_efs.go

+		c.GetConfigMapInformer(c.ControlPlaneNamespace),
+	)
+	informers := []factory.Informer{
+		c.GetConfigMapInformer(c.ControlPlaneNamespace).Informer(),


same as above

mpatlasov · 2025-10-13T23:32:46Z

Thanks for a quick fix, @Phaow ! See please my inline comments about namespace.

mpatlasov · 2025-10-13T23:35:25Z

/jira refresh

mpatlasov · 2025-10-15T02:23:16Z

/lgtm
/approve
/label backport-risk-assessed

openshift-ci · 2025-10-15T02:23:35Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mpatlasov, Phaow

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [mpatlasov]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Phaow · 2025-10-15T14:13:13Z

The CI looks good and the patch works as expected. I tried to launch a aws C2S cluster reproduce the origin issue to double checking but the cluster failed to mirror the images, will try again tomorrow. If it still failed, we could go ahead merge it trust the CI and RCA.

mpatlasov · 2025-10-15T22:46:58Z

/jira refresh

openshift-ci-robot · 2025-10-15T22:47:04Z

@mpatlasov: This pull request references Jira Issue OCPBUGS-62974, which is valid.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.17.z) matches configured target version for branch (4.17.z)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
release note text is set and does not match the template
dependent bug Jira Issue OCPBUGS-62973 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
dependent Jira Issue OCPBUGS-62973 targets the "4.18.z" version, which is one of the valid target versions: 4.18.0, 4.18.z
bug has dependents

Requesting review from QA contact:
/cc @Phaow

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2025-10-15T22:47:10Z

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: Phaow.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

@mpatlasov: This pull request references Jira Issue OCPBUGS-62974, which is valid.

7 validation(s) were run on this bug

bug is open, matching expected state (open)

bug target version (4.17.z) matches configured target version for branch (4.17.z)

bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

release note text is set and does not match the template

dependent bug Jira Issue OCPBUGS-62973 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))

dependent Jira Issue OCPBUGS-62973 targets the "4.18.z" version, which is one of the valid target versions: 4.18.0, 4.18.z

bug has dependents

Requesting review from QA contact:
/cc @Phaow

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Phaow · 2025-10-16T09:21:49Z

/verified by CI.
I could see the withCABundleDaemonSetHook hook works that the driver node daemonset pods mount the ca bundle comfigmap as expected. Without the patch the driver node missed the ca-bundle cm -> https://gcsweb-qe-private-deck-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/qe-private-deck/logs/periodic-ci-openshift-openshift-tests-private-release-4.17-multi-nightly-aws-ipi-byo-iam-role-efs-arm-f14-custom-cert/1977578340537602048/artifacts/aws-ipi-byo-iam-role-efs-arm-f14-custom-cert/gather-extra/artifacts/inspect/namespaces/openshift-cluster-csi-drivers/pods/aws-efs-csi-driver-node-4ctws/aws-efs-csi-driver-node-4ctws.yaml . Though install the C2S cluster still failed at mirror operator images, we could go ahead merge it trust the CI and RCA.

openshift-ci-robot · 2025-10-16T09:22:00Z

@Phaow: This PR has been marked as verified by CI..

In response to this:

/verified by CI.
I could see the withCABundleDaemonSetHook hook works that the driver node daemonset pods mount the ca bundle comfigmap as expected. Without the patch the driver node missed the ca-bundle cm -> https://gcsweb-qe-private-deck-ci.apps.ci.l2s4.p1.openshiftapps.com/gcs/qe-private-deck/logs/periodic-ci-openshift-openshift-tests-private-release-4.17-multi-nightly-aws-ipi-byo-iam-role-efs-arm-f14-custom-cert/1977578340537602048/artifacts/aws-ipi-byo-iam-role-efs-arm-f14-custom-cert/gather-extra/artifacts/inspect/namespaces/openshift-cluster-csi-drivers/pods/aws-efs-csi-driver-node-4ctws/aws-efs-csi-driver-node-4ctws.yaml . Though install the C2S cluster still failed at mirror operator images, we could go ahead merge it trust the CI and RCA.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-10-16T09:27:32Z

@Phaow: Jira Issue Verification Checks: Jira Issue OCPBUGS-62974
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-62974 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

In response to this:

This is an manual cherry-pick of #444 the automatic compile failed issue).

We do not have the https://github.com/openshift/csi-operator/pull/294/files in release-4.17, use the c.ControlPlaneNamespace instead.

/assign @mpatlasov

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci bot assigned mpatlasov Oct 13, 2025

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 13, 2025

Phaow mentioned this pull request Oct 13, 2025

[release-4.17] OCPBUGS-62974: Add withCABundleDaemonSetHook() to AWS EFS operator #448

Closed

openshift-ci bot requested review from dobsonj and gnufied October 13, 2025 08:25

mpatlasov reviewed Oct 13, 2025

View reviewed changes

openshift-ci bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Oct 15, 2025

openshift-ci bot assigned chao007, duanwei33, Phaow and radeore Oct 15, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 15, 2025

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 15, 2025

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 15, 2025

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Oct 16, 2025

openshift-merge-bot bot merged commit ffa8db8 into openshift:release-4.17 Oct 16, 2025
18 checks passed

[release-4.17] OCPBUGS-62974: Add withCABundleDaemonSetHook() to AWS EFS operator #449

[release-4.17] OCPBUGS-62974: Add withCABundleDaemonSetHook() to AWS EFS operator #449

Uh oh!

Conversation

Phaow commented Oct 13, 2025

Uh oh!

openshift-ci-robot commented Oct 13, 2025

Uh oh!

Phaow commented Oct 13, 2025

Uh oh!

openshift-ci bot commented Oct 13, 2025

Uh oh!

mpatlasov Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

Phaow Oct 14, 2025

Choose a reason for hiding this comment

Uh oh!

Phaow Oct 14, 2025

Choose a reason for hiding this comment

Uh oh!

mpatlasov Oct 15, 2025

Choose a reason for hiding this comment

Uh oh!

mpatlasov Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

mpatlasov Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

mpatlasov commented Oct 13, 2025

Uh oh!

mpatlasov commented Oct 13, 2025

Uh oh!

mpatlasov commented Oct 15, 2025

Uh oh!

openshift-ci bot commented Oct 15, 2025

Uh oh!

Phaow commented Oct 15, 2025

Uh oh!

mpatlasov commented Oct 15, 2025

Uh oh!

openshift-ci-robot commented Oct 15, 2025

Uh oh!

openshift-ci bot commented Oct 15, 2025

Uh oh!

Phaow commented Oct 16, 2025

Uh oh!

openshift-ci-robot commented Oct 16, 2025

Uh oh!

Uh oh!

openshift-ci-robot commented Oct 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants