Sync with upstream

.github/dependabot.yaml

@@ -9,6 +9,14 @@ updates:
     - "release-note-none"
     - "ok-to-test"
   open-pull-requests-limit: 1
+  groups:
+    k8s:
+      applies-to: version-updates
+      patterns:
+      - "k8s.io*"
+      update-types:
+      - "patch"
+      - "minor"
 - package-ecosystem: "github-actions"
   directory: "/"
   schedule:

.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Set up Go 1.x
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v5
       with:
         go-version: ^1.18
       id: go
@@ -48,7 +48,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -63,4 +63,4 @@ jobs:
         make all
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

.github/workflows/darwin.yaml

@@ -8,7 +8,7 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Set up Go 1.x
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
           go-version: ^1.16
         id: go

.github/workflows/static.yaml

@@ -8,12 +8,12 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Set up Go 1.x
-              uses: actions/setup-go@v4
+              uses: actions/setup-go@v5
               with:
                 go-version: ^1.19
             - uses: actions/checkout@master
             - name: Run linter
-              uses: golangci/golangci-lint-action@v3
+              uses: golangci/golangci-lint-action@v6
               with:
                   version: v1.54
                   args: -E=gofmt,unused,ineffassign,revive,misspell,exportloopref,asciicheck,bodyclose,depguard,dogsled,durationcheck,errname,forbidigo -D=staticcheck --timeout=30m0s

.github/workflows/trivy.yaml

@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Go 1.x
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
-          go-version: ^1.16
+          go-version: 1.22.3
         id: go
 
       - name: Checkout code

.github/workflows/windows.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ${{ matrix.platform }}
     steps:
       - name: Set up Go 1.x
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
           go-version: ^1.16
         id: go

.trivyignore

@@ -0,0 +1 @@
+CVE-2023-45288

BLOB_CSI_VERSION

@@ -1 +1 @@
-BLOB_CSI_VERSION=v4.9.0
+BLOB_CSI_VERSION=v4.10.0

Makefile

@@ -17,7 +17,7 @@ GIT_COMMIT ?= $(shell git rev-parse HEAD)
 REGISTRY ?= andyzhangx
 REGISTRY_NAME ?= $(shell echo $(REGISTRY) | sed "s/.azurecr.io//g")
 IMAGE_NAME ?= blob-csi
-IMAGE_VERSION ?= v1.24.0
+IMAGE_VERSION ?= v1.25.0
 CLOUD ?= AzurePublicCloud
 # Use a custom version for E2E tests if we are in Prow
 ifdef CI
@@ -71,10 +71,6 @@ unit-test:
 sanity-test: blob
 	go test -v -timeout=30m ./test/sanity
 
-.PHONY: integration-test
-integration-test: blob
-	go test -v -timeout=30m ./test/integration
-
 .PHONY: e2e-test
 e2e-test: install-ginkgo
 	if [ ! -z "$(EXTERNAL_E2E_TEST_BLOBFUSE)" ] || [ ! -z "$(EXTERNAL_E2E_TEST_BLOBFUSE_v2)" ] || [ ! -z "$(EXTERNAL_E2E_TEST_NFS)" ]; then \

README.md

@@ -2,6 +2,7 @@
 ![linux build status](https://github.com/kubernetes-sigs/blob-csi-driver/actions/workflows/linux.yaml/badge.svg)
 [![Coverage Status](https://coveralls.io/repos/github/kubernetes-sigs/blob-csi-driver/badge.svg?branch=master)](https://coveralls.io/github/kubernetes-sigs/blob-csi-driver?branch=master)
 [![FOSSA Status](https://app.fossa.io/api/projects/git%2Bgithub.com%2Fkubernetes-sigs%2Fblob-csi-driver.svg?type=shield)](https://app.fossa.io/projects/git%2Bgithub.com%2Fkubernetes-sigs%2Fblob-csi-driver?ref=badge_shield)
+[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/blob-csi-driver)](https://artifacthub.io/packages/search?repo=blob-csi-driver)
 
 ### About
 This driver allows Kubernetes to access Azure Storage through one of following methods:
@@ -18,9 +19,9 @@ Disclaimer: Deploying this driver manually is not an officially supported Micros
 |driver version  |Image                                                 | supported k8s version |
 |----------------|------------------------------------------------------|-----------------------|
 |master branch   |mcr.microsoft.com/k8s/csi/blob-csi:latest             | 1.21+                 |
-|v1.23.2         |mcr.microsoft.com/oss/kubernetes-csi/blob-csi:v1.23.2 | 1.21+                 |
-|v1.22.4         |mcr.microsoft.com/oss/kubernetes-csi/blob-csi:v1.22.4 | 1.21+                 |
-|v1.21.6         |mcr.microsoft.com/oss/kubernetes-csi/blob-csi:v1.21.6 | 1.21+                 |
+|v1.24.0         |mcr.microsoft.com/oss/kubernetes-csi/blob-csi:v1.24.0 | 1.21+                 |
+|v1.23.3         |mcr.microsoft.com/oss/kubernetes-csi/blob-csi:v1.23.3 | 1.21+                 |
+|v1.22.5         |mcr.microsoft.com/oss/kubernetes-csi/blob-csi:v1.22.5 | 1.21+                 |
 
 ### Driver parameters
 Please refer to `blob.csi.azure.com` [driver parameters](./docs/driver-parameters.md)
@@ -42,7 +43,7 @@ This option does not depend on cloud provider config file, supports cross subscr
 >
 > Execute following command to install a specific version of blobfuse v2 once driver is running on the agent node:
 > ```console
-> kubectl patch daemonset csi-blob-node -n kube-system -p '{"spec":{"template":{"spec":{"initContainers":[{"env":[{"name":"INSTALL_BLOBFUSE2","value":"true"},{"name":"BLOBFUSE2_VERSION","value":"2.1.2"}],"name":"install-blobfuse-proxy"}]}}}}'
+> kubectl patch daemonset csi-blob-node -n kube-system -p '{"spec":{"template":{"spec":{"initContainers":[{"env":[{"name":"INSTALL_BLOBFUSE2","value":"true"},{"name":"BLOBFUSE2_VERSION","value":"2.2.1"}],"name":"install-blobfuse-proxy"}]}}}}'
 > ```
 >
 > Execute following command to install a specific version of blobfuse v1 once driver is running on the agent node:
@@ -58,12 +59,14 @@ This option does not depend on cloud provider config file, supports cross subscr
  - install managed CSI driver on following platforms:
    - [AKS](https://learn.microsoft.com/en-us/azure/aks/azure-blob-csi)
 
-### Usage
+### Examples
  - [Basic usage](./deploy/example/e2e_usage.md)
+
+### Usage
  - [NFSv3](./deploy/example/nfs)
  - [fsGroupPolicy](./deploy/example/fsgroup)
  - [Volume cloning](./deploy/example/cloning)
- - [Workload identity](./docs/workload-identity.md)
+ - [Workload identity](./docs/workload-identity-static-pv-mount.md)
 
 ### Troubleshooting
  - [CSI driver troubleshooting guide](./docs/csi-debug.md)

charts/README.md

@@ -5,7 +5,7 @@
 
 ### Tips
  - configure with [blobfuse-proxy](../deploy/blobfuse-proxy) to make blobfuse mount still available after driver restart
- > Note: [blobfuse-proxy](../deploy/blobfuse-proxy) is supported on CoreOS(OpenShift) from v1.23.2
+ > Note: [blobfuse-proxy](../deploy/blobfuse-proxy) is supported on CoreOS(OpenShift) from v1.23.3
    - specify `node.enableBlobfuseProxy=true` together with [blobfuse-proxy](../deploy/blobfuse-proxy)
  - run controller on control plane node: `--set controller.runOnControlPlane=true`
  - set replica of controller as `1`: `--set controller.replicas=1`
@@ -66,16 +66,16 @@ The following table lists the configurable parameters of the latest Azure Blob S
 | `image.blob.tag`                                      | blob-csi-driver docker image tag                      | `latest`                                                         |
 | `image.blob.pullPolicy`                               | blob-csi-driver image pull policy                     | `IfNotPresent`                                                   |
 | `image.csiProvisioner.repository`                     | csi-provisioner docker image                          | `mcr.microsoft.com/oss/kubernetes-csi/csi-provisioner`           |
-| `image.csiProvisioner.tag`                            | csi-provisioner docker image tag                      | `v3.6.2`                                                         |
+| `image.csiProvisioner.tag`                            | csi-provisioner docker image tag                      | `v4.0.0`                                                         |
 | `image.csiProvisioner.pullPolicy`                     | csi-provisioner image pull policy                     | `IfNotPresent`                                                   |
 | `image.livenessProbe.repository`                      | liveness-probe docker image                           | `mcr.microsoft.com/oss/kubernetes-csi/livenessprobe`             |
-| `image.livenessProbe.tag`                             | liveness-probe docker image tag                       | `v2.11.0`                                                         |
+| `image.livenessProbe.tag`                             | liveness-probe docker image tag                       | `v2.12.0`                                                         |
 | `image.livenessProbe.pullPolicy`                      | liveness-probe image pull policy                      | `IfNotPresent`                                                   |
 | `image.nodeDriverRegistrar.repository`                | csi-node-driver-registrar docker image                | `mcr.microsoft.com/oss/kubernetes-csi/csi-node-driver-registrar` |
-| `image.nodeDriverRegistrar.tag`                       | csi-node-driver-registrar docker image tag            | `v2.9.1`                                                      |
+| `image.nodeDriverRegistrar.tag`                       | csi-node-driver-registrar docker image tag            | `v2.10.0`                                                      |
 | `image.nodeDriverRegistrar.pullPolicy`                | csi-node-driver-registrar image pull policy           | `IfNotPresent`                                                   |
 | `image.csiResizer.repository`                         | csi-resizer docker image                              | `mcr.microsoft.com/oss/kubernetes-csi/csi-resizer`               |
-| `image.csiResizer.tag`                                | csi-resizer docker image tag                          | `v1.9.2`                                                         |
+| `image.csiResizer.tag`                                | csi-resizer docker image tag                          | `v1.9.3`                                                         |
 | `image.csiResizer.pullPolicy`                         | csi-resizer image pull policy                         | `IfNotPresent`                                                   |
 | `imagePullSecrets`                                    | Specify docker-registry secret names as an array      | [] (does not add image pull secrets to deployed pods)          |
 | `cloud`                                               | the cloud environment the driver is running on        | `AzurePublicCloud`                                               |

charts/artifacthub-repo.yml

@@ -0,0 +1,4 @@
+repositoryID: 27852225-ee5d-4ad7-9ee8-0c1f0dc06d4e
+owners:
+  - name: andyzhangx
+    email: [email protected]

charts/index.yaml

@@ -1,6 +1,42 @@
 apiVersion: v1
 entries:
   blob-csi-driver:
+    - apiVersion: v1
+      appVersion: v1.24.1
+      created: "2024-04-12T08:55:58.602497989Z"
+      description: Azure Blob Storage CSI driver
+      digest: 82537068e57177cf6d0697c7c942aaf496de9280fbc7b96ab326776fa4db8481
+      name: blob-csi-driver
+      urls:
+      - https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/charts/v1.24.1/blob-csi-driver-v1.24.1.tgz
+      version: v1.24.1
+    - apiVersion: v1
+      appVersion: v1.24.0
+      created: "2024-04-12T08:55:58.601837129Z"
+      description: Azure Blob Storage CSI driver
+      digest: 3b3b1a4fee786f0c9445da2f35bd1e251265cec8ee03c3cf99fe9f0bf9575e09
+      name: blob-csi-driver
+      urls:
+      - https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/charts/v1.24.0/blob-csi-driver-v1.24.0.tgz
+      version: v1.24.0
+    - apiVersion: v1
+      appVersion: v1.23.4
+      created: "2024-04-12T08:55:58.601188521Z"
+      description: Azure Blob Storage CSI driver
+      digest: 20d0157476ecf0a38b2d3982587b9657b27e1603b2185709faeff73b6d671ceb
+      name: blob-csi-driver
+      urls:
+      - https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/charts/v1.23.4/blob-csi-driver-v1.23.4.tgz
+      version: v1.23.4
+    - apiVersion: v1
+      appVersion: v1.23.3
+      created: "2024-04-12T08:55:58.600377379Z"
+      description: Azure Blob Storage CSI driver
+      digest: 21c8355faf362c527e40ac417b17d3c28fa041941633254358387997b9bee8a6
+      name: blob-csi-driver
+      urls:
+      - https://raw.githubusercontent.com/kubernetes-sigs/blob-csi-driver/master/charts/v1.23.3/blob-csi-driver-v1.23.3.tgz
+      version: v1.23.3
     - apiVersion: v1
       appVersion: v1.23.2
       created: "2023-11-24T09:01:28.995261524Z"
@@ -397,11 +433,20 @@ entries:
       urls:
         - https://raw.githubusercontent.com/avoltz/blob-csi-driver/staging/charts/v4.9.0/blob-csi-driver-v4.9.0.tgz
       version: v4.9.0
+    - apiVersion: v1
+      appVersion: v4.10.0
+      created: "2024-05-14T13:11:15.553036749Z"
+      description: Azure Blob Storage CSI driver
+      digest: b6fb92f75ffdd297e3cd3db5161ab28b29d9a567363b541f550d4480c2d30151
+      name: blob-csi-driver
+      urls:
+        - https://raw.githubusercontent.com/avoltz/blob-csi-driver/staging/charts/v4.10.0/blob-csi-driver-v4.10.0.tgz
+      version: v4.10.0
     - apiVersion: v1
       appVersion: latest
-      created: "2023-12-01T09:01:28.976577418Z"
+      created: "2024-05-14T13:11:15.553036749Z"
       description: Azure Blob Storage CSI driver
-      digest: a41397bb96710cd9e116d7493214130e07e9bad612762aaac0aba84a7d798f4d
+      digest: e464031c96c26f7ba2381a5c0df92736e1240f7e4c4a08197aa277dc50fe0df3
       name: blob-csi-driver
       urls:
         - https://raw.githubusercontent.com/avoltz/blob-csi-driver/staging/charts/latest/blob-csi-driver-v0.0.0.tgz

charts/latest/blob-csi-driver/templates/csi-blob-controller.yaml

@@ -106,7 +106,6 @@ spec:
           args:
             - "--v={{ .Values.controller.logLevel }}"
             - "--endpoint=$(CSI_ENDPOINT)"
-            - "--edgecache-config-endpoint=$(EDGECACHE_CONFIG_ENDPOINT)"
             - "--metrics-address=0.0.0.0:{{ .Values.controller.metricsPort }}"
             - "--drivername={{ .Values.driver.name }}"
             - "--custom-user-agent={{ .Values.driver.customUserAgent }}"
@@ -136,10 +135,16 @@ spec:
                   name: azure-cred-file
                   key: path
                   optional: true
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: KUBERNETES_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
             - name: CSI_ENDPOINT
               value: unix:///csi/csi.sock
-            - name: EDGECACHE_CONFIG_ENDPOINT
-              value: "{{ .Values.edgecache.configEndpoint }}"
             {{- if ne .Values.driver.httpsProxy "" }}
             - name: HTTPS_PROXY
               value: {{ .Values.driver.httpsProxy }}

charts/latest/blob-csi-driver/templates/csi-blob-node.yaml

@@ -66,6 +66,7 @@ spec:
       tolerations:
 {{ toYaml . | indent 8 }}
 {{- end }}
+{{- if .Values.node.enableBlobfuseProxy }}
       initContainers:
         - name: install-blobfuse-proxy
 {{- if hasPrefix "/" .Values.image.blob.repository }}
@@ -89,8 +90,6 @@ spec:
               value: "{{ .Values.node.blobfuseProxy.installBlobfuse2 }}"
             - name: BLOBFUSE2_VERSION
               value: "{{ .Values.node.blobfuseProxy.blobfuse2Version }}"
-            - name: INSTALL_BLOBFUSE_PROXY
-              value: "{{ .Values.node.enableBlobfuseProxy }}"
             - name: SET_MAX_OPEN_FILE_NUM
               value: "{{ .Values.node.blobfuseProxy.setMaxOpenFileNum }}"
             - name: MAX_FILE_NUM
@@ -100,10 +99,9 @@ spec:
           volumeMounts:
             - name: host-usr
               mountPath: /host/usr
-            - name: host-usr-local
-              mountPath: /host/usr/local
             - name: host-etc
               mountPath: /host/etc
+{{- end }}
       containers:
         - name: liveness-probe
           imagePullPolicy: {{ .Values.image.livenessProbe.pullPolicy }}
@@ -160,7 +158,6 @@ spec:
             - "--v={{ .Values.node.logLevel }}"
             - "--endpoint=$(CSI_ENDPOINT)"
             - "--blobfuse-proxy-endpoint=$(BLOBFUSE_PROXY_ENDPOINT)"
-            - "--edgecache-config-endpoint=$(EDGECACHE_CONFIG_ENDPOINT)"
             - "--edgecache-mount-endpoint=$(EDGECACHE_MOUNT_ENDPOINT)"
             - "--enable-blobfuse-proxy={{ .Values.node.enableBlobfuseProxy }}"
             - "--nodeid=$(KUBE_NODE_NAME)"
@@ -193,10 +190,16 @@ spec:
                   name: azure-cred-file
                   key: path
                   optional: true
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: KUBERNETES_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
             - name: CSI_ENDPOINT
               value: unix:///csi/csi.sock
-            - name: EDGECACHE_CONFIG_ENDPOINT
-              value: "{{ .Values.edgecache.configEndpoint }}"
             - name: EDGECACHE_MOUNT_ENDPOINT
               value: unix:///csi/csi_mounts.sock
             - name: BLOBFUSE_PROXY_ENDPOINT
@@ -246,24 +249,16 @@ spec:
               mountPath: /etc/pki/ca-trust/extracted
               readOnly: true
             {{- end }}
-            {{- if .Values.node.enableAznfsMount }}
-            - mountPath: /opt/microsoft/aznfs/data
-              name: aznfs-data
-            - mountPath: /lib/modules
-              name: lib-modules
-              readOnly: true
-            {{- end }}
           resources: {{- toYaml .Values.node.resources.blob | nindent 12 }}
       volumes:
+{{- if .Values.node.enableBlobfuseProxy }}
         - name: host-usr
           hostPath:
             path: /usr
-        - name: host-usr-local
-          hostPath:
-            path: /usr/local
         - name: host-etc
           hostPath:
             path: /etc
+{{- end }}
         - hostPath:
             path: {{ .Values.linux.kubelet }}/plugins/{{ .Values.driver.name }}
             type: DirectoryOrCreate
@@ -296,16 +291,6 @@ spec:
           hostPath:
             path: /etc/pki/ca-trust/extracted
         {{- end }}
-        {{- if .Values.node.enableAznfsMount }}
-        - hostPath:
-            path: /opt/microsoft/aznfs/data
-            type: DirectoryOrCreate
-          name: aznfs-data
-        - name: lib-modules
-          hostPath:
-            path: /lib/modules
-            type: DirectoryOrCreate
-        {{- end }}
       {{- if .Values.securityContext }}
       securityContext: {{- toYaml .Values.securityContext | nindent 8 }}
       {{- end }}

charts/latest/blob-csi-driver/templates/rbac-csi-blob-controller.yaml

@@ -96,6 +96,12 @@ rules:
   - apiGroups: [""]
     resources: ["secrets"]
     verbs: ["get", "create"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
 
 ---
 kind: ClusterRoleBinding