fix: add finalizer to prevent volume leakage

kubernetes-csi · Mar 29, 2024 · f5528e4 · f5528e4
1 parent 16254e5
commit f5528e4
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 11 deletions.
diff --git a/cmd/csi-provisioner/csi-provisioner.go b/cmd/csi-provisioner/csi-provisioner.go
@@ -84,6 +84,8 @@ var (
 	capacityThreads              = flag.Uint("capacity-threads", 1, "Number of simultaneously running threads, handling CSIStorageCapacity objects")
 	operationTimeout             = flag.Duration("timeout", 10*time.Second, "Timeout for waiting for volume operation (creation, deletion, capacity queries)")
 
+	provisioningFinalizerThreads = flag.Uint("provisioning-protection-threads", 1, "Number of simultaneously running threads, handling provisioning finalizer removal")
+
 	enableLeaderElection = flag.Bool("leader-election", false, "Enables leader election. If leader election is enabled, additional RBAC rules are required. Please refer to the Kubernetes CSI documentation for instructions on setting up these RBAC rules.")
 
 	leaderElectionNamespace = flag.String("leader-election-namespace", "", "Namespace where the leader election resource lives. Defaults to the pod namespace if not set.")

diff --git a/pkg/controller/controller.go b/pkg/controller/controller.go
@@ -1012,31 +1012,35 @@ func (p *csiProvisioner) setCloneFinalizer(ctx context.Context, pvc *v1.Persiste
 	return nil
 }
 
-func (p *csiProvisioner) setProvisioningFinalizer(ctx context.Context, claim *v1.PersistentVolumeClaim) error {
-	if !checkFinalizer(claim, pvcProvisioningFinalizer) {
-		claim.Finalizers = append(claim.Finalizers, pvcProvisioningFinalizer)
-		_, err := p.client.CoreV1().PersistentVolumeClaims(claim.Namespace).Update(ctx, claim, metav1.UpdateOptions{})
+func (p *csiProvisioner) setProvisioningFinalizer(ctx context.Context, claim *v1.PersistentVolumeClaim) (err error) {
+	clone := claim.DeepCopy()
+	if !checkFinalizer(clone, pvcProvisioningFinalizer) {
+		clone.Finalizers = append(clone.Finalizers, pvcProvisioningFinalizer)
+		claim, err = p.client.CoreV1().PersistentVolumeClaims(clone.Namespace).Update(ctx, clone, metav1.UpdateOptions{})
+		klog.V(5).Infof("successfully set PVC ProvisioningFinalizer %+v", claim.Name)
 		return err
 	}
 
 	return nil
 }
 
-func (p *csiProvisioner) removeProvisioningFinalizer(ctx context.Context, claim *v1.PersistentVolumeClaim) error {
-	if !checkFinalizer(claim, pvcProvisioningFinalizer) {
+func (p *csiProvisioner) removeProvisioningFinalizer(ctx context.Context, claim *v1.PersistentVolumeClaim) (err error) {
+	clone := claim.DeepCopy()
+	if !checkFinalizer(clone, pvcProvisioningFinalizer) {
 		return nil
 	}
 
 	newFinalizers := make([]string, 0)
-	for _, f := range claim.GetFinalizers() {
+	for _, f := range clone.GetFinalizers() {
 		if f == pvcProvisioningFinalizer {
 			continue
 		}
 		newFinalizers = append(newFinalizers, f)
 	}
 
-	claim.Finalizers = newFinalizers
-	_, err := p.client.CoreV1().PersistentVolumeClaims(claim.Namespace).Update(ctx, claim, metav1.UpdateOptions{})
+	clone.Finalizers = newFinalizers
+	claim, err = p.client.CoreV1().PersistentVolumeClaims(clone.Namespace).Update(ctx, clone, metav1.UpdateOptions{})
+	klog.V(5).Infof("successfully remove PVC ProvisioningFinalizer %+v", claim.Name)
 	return err
 }
 

diff --git a/pkg/controller/provisioning_controller.go b/pkg/controller/provisioning_controller.go
@@ -164,9 +164,10 @@ func (p *ProvisioningProtectionController) syncClaim(ctx context.Context, claim
 			finalizers = append(finalizers, finalizer)
 		}
 	}
-	claim.ObjectMeta.Finalizers = finalizers
 
-	if _, err := p.client.CoreV1().PersistentVolumeClaims(claim.Namespace).Update(ctx, claim, metav1.UpdateOptions{}); err != nil {
+	clone := claim.DeepCopy()
+	clone.Finalizers = finalizers
+	if _, err := p.client.CoreV1().PersistentVolumeClaims(clone.Namespace).Update(ctx, clone, metav1.UpdateOptions{}); err != nil {
 		return err
 	}
 	return nil