STOR-2931: Rebase to upstream v6.3.0 for OCP 5.0

[dfajmon]

STOR-2931: Rebase to upstream v6.3.0 for OCP 5.0

Issue link
https://redhat.atlassian.net/browse/STOR-2931

Diff to upstream v6.3.0
kubernetes-csi/external-provisioner@v6.3.0...dfajmon:rebase-v6.3.0

Notes for reviewers

Summary of changes

Breaking Changes

• Kubernetes 1.34 is now required; VolumeAttributesClass is now GA using the storage/v1 API

Major Features

• Add SnapshotFinalizerController to clean up orphaned snapshot source-protection finalizers (#1519)
• VolumeAttributesClass promoted to GA; no feature gate required

Notable Bug Fixes

• capacity: fix duplicate topology (#1450)
• fix: fallback to API server on missing Node topology key (e2250644a)
• fix: improve errors when looking at VolumeSnapshotContent (52adfdee2)

CVE Fixes

CVE-2026-33186, CVE-2026-35469

Cherry-picked commits

Commit	Subject	Author
a187a7f8f	UPSTREAM: <carry>: Add OpenShift files	Maxim Patlasov
39ed24798	UPSTREAM: 1495: CVE-2026-33186 Bump grpc to 1.79.3	Super User
b7742e95b	UPSTREAM: <carry>: Updating csi-provisioner-container image to be consistent with ART for 5.0	AOS Automation Release Team
0948c3ab0	UPSTREAM: <carry>: NO-ISSUE: Bump github.com/moby/spdystream to v0.5.1	Jaspreet Kaur

Upstream changelogs

• v6.3.0

Full changelog

kubernetes-csi/external-provisioner@v6.2.0...v6.3.0

Last rebase

#121

@openshift/storage

---

Co-authored by Claude

Summary by CodeRabbit

• New Features
  • Added optional periodic cleanup of orphaned snapshot protection finalizers.
  • Added detection for VolumeSnapshot v1 support and the --snapshot-orphan-sweep-interval configuration option.
• Bug Fixes
  • Improved snapshot error messages for missing, mismatched, or incompatible snapshot content.
  • Improved topology handling when node labels are initially incomplete.
  • Improved capacity topology synchronization during startup.
• Documentation
  • Documented snapshot cleanup configuration and clarified related permissions.
  • Added release notes for version 6.3.0.

[openshift-ci-robot]

@dfajmon: This pull request references STOR-2931 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target only the "5.0.0" version, but multiple target versions were set.

Details

In response to this:

STOR-2931: Rebase to upstream v6.3.0 for OCP 5.0

Issue link
https://redhat.atlassian.net/browse/STOR-2931

Diff to upstream v6.3.0
kubernetes-csi/external-provisioner@v6.3.0...dfajmon:rebase-v6.3.0

Notes for reviewers

Summary of changes

Breaking Changes

• Kubernetes 1.34 is now required; VolumeAttributesClass is now GA using the storage/v1 API

Major Features

• Add SnapshotFinalizerController to clean up orphaned snapshot source-protection finalizers (#1519)
• VolumeAttributesClass promoted to GA; no feature gate required

Notable Bug Fixes

• capacity: fix duplicate topology (#1450)
• fix: fallback to API server on missing Node topology key (e2250644a)
• fix: improve errors when looking at VolumeSnapshotContent (52adfdee2)

CVE Fixes

CVE-2026-33186, CVE-2026-35469

Cherry-picked commits

Commit	Subject	Author
a187a7f8f	UPSTREAM: <carry>: Add OpenShift files	Maxim Patlasov
39ed24798	UPSTREAM: 1495: CVE-2026-33186 Bump grpc to 1.79.3	Super User
b7742e95b	UPSTREAM: <carry>: Updating csi-provisioner-container image to be consistent with ART for 5.0	AOS Automation Release Team
0948c3ab0	UPSTREAM: <carry>: NO-ISSUE: Bump github.com/moby/spdystream to v0.5.1	Jaspreet Kaur

Upstream changelogs

• v6.3.0

Full changelog

kubernetes-csi/external-provisioner@v6.2.0...v6.3.0

Last rebase

#121

@openshift/storage

---

Co-authored by Claude

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The provisioner moves from the external-provisioner v5 module to v6, updates Kubernetes and Go dependencies, changes topology synchronization, and adds an optional controller for removing orphaned VolumeSnapshot source-protection finalizers.

Changes

Provisioner v6 and release alignment

Layer / File(s)	Summary
Module and release alignment go.mod, pkg/..., test/e2e/..., .prow.sh, deploy/..., release-tools/..., CHANGELOG/...	The module, imports, dependency pins, deployment image, E2E paths, release tooling, workflows, and 6.3.0 changelog are updated for v6 and newer build components.

Topology synchronization

Layer / File(s)	Summary
Topology synchronization and fallback pkg/capacity/topology/..., pkg/controller/topology.go, pkg/controller/topology_test.go	Node topology readiness is tracked after worker synchronization, and incomplete cached node labels can be refreshed from the node lister. Tests cover synchronization and label fallback.

Snapshot finalizer cleanup

Layer / File(s)	Summary
Snapshot finalizer controller pkg/controller/snapshot_finalizer_controller.go, pkg/controller/snapshot_finalizer_controller_test.go	Adds periodic orphaned-finalizer cleanup based on pending PVC snapshot references, with capability checks, update handling, and comprehensive tests.

Controller integration and snapshot errors

Layer / File(s)	Summary
Controller wiring and snapshot behavior cmd/csi-provisioner/..., pkg/controller/controller.go, README.md, deploy/kubernetes/rbac.yaml	Wires topology and snapshot controllers into startup paths, adds specific snapshot-source errors, and documents the sweep interval and VolumeSnapshot permissions.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant csi-provisioner
  participant SnapshotFinalizerController
  participant VolumeSnapshotInformer
  participant PersistentVolumeClaimLister
  participant SnapshotClient
  csi-provisioner->>SnapshotFinalizerController: configure optional sweep
  SnapshotFinalizerController->>VolumeSnapshotInformer: synchronize VolumeSnapshots
  SnapshotFinalizerController->>PersistentVolumeClaimLister: find pending snapshot references
  SnapshotFinalizerController->>SnapshotClient: remove orphaned finalizer

Loading

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: rebasing to upstream v6.3.0 for OCP 5.0.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Changed tests use static, descriptive names only; no Ginkgo DSL or dynamic values appear in test titles.
Test Structure And Quality	✅ Passed	No Ginkgo blocks were changed; the added tests use standard testing, clean up with defer, and use bounded sync/wait patterns with clear assertions.
Microshift Test Compatibility	✅ Passed	No new e2e Ginkgo tests were added; the e2e change is only an import-path bump, and the storage suite uses standard K8s APIs with no MicroShift-blocked OpenShift APIs.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The only e2e change is a blank import path update in test/e2e/e2e_test.go; no new Ginkgo specs or multi-node/HA assumptions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Touched manifests only bump images/comments; no new affinity, spread, selector, toleration, PDB, or control-plane/worker targeting was added.
Ote Binary Stdout Contract	✅ Passed	No stdout writes found in the OTE e2e process path; TestMain redirects klog to GinkgoWriter and suite/setup code uses no fmt.Print/log to stdout.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only e2e change is a blank-import path update in test/e2e/e2e_test.go; no new Ginkgo specs or IPv4/external-network code were added.
No-Weak-Crypto	✅ Passed	No weak-crypto primitives or secret/token comparisons were added in touched files; only benign DeepEqual/FNV usage appears.
Container-Privileges	✅ Passed	No changed manifest/config file sets privileged, hostPID/Network/IPC, SYS_ADMIN, allowPrivilegeEscalation, or root user settings.
No-Sensitive-Data-In-Logs	✅ Passed	Added logs only report controller status and snapshot namespace/name; no secrets, tokens, PII, or hostnames are logged in the PR changes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

deploy/kubernetes/rbac.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

deploy/kubernetes/storage-capacity.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

go.mod

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

• 3 others

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 16: Update the google.golang.org/grpc dependency to a release containing
the xDS RBAC/HTTP/2 security fix, then refresh module checksums as needed and
rerun the project’s vulnerability checks to confirm the finding is resolved.

In `@pkg/controller/snapshot_finalizer_controller_test.go`:
- Around line 22-27: Update newFakeClaimLister to handle the error returned by
indexer.Add for each PVC, failing the test immediately when insertion fails
instead of ignoring it; use the test context or failure mechanism available to
this helper and preserve the existing lister construction on successful
insertions.

In `@pkg/controller/snapshot_finalizer_controller.go`:
- Around line 62-69: Update the snapshot informer’s ListWatch callbacks to use
the controller context: replace ListFunc with ListWithContextFunc and WatchFunc
with WatchFuncWithContext, passing ctx into the SnapshotV1 VolumeSnapshots list
and watch requests so they cancel during shutdown.

In `@release-tools/.github/workflows/trivy.yaml`:
- Around line 6-7: Update the Trivy workflow triggers to include a pull_request
event alongside the existing push and scheduled triggers, ensuring every pull
request runs the vulnerability scan before merging.

In `@release-tools/prow.sh`:
- Line 89: Update the CSI_PROW_GO_VERSION_BUILD configuration value in prow.sh
from Go 1.26.3 to the latest available Go 1.26 patch release, preserving the
existing build-version configuration and description.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

curl -fsSL https://api.osv.dev/v1/query \
  -H 'Content-Type: application/json' \
  --data '{"package":{"ecosystem":"Go","name":"google.golang.org/grpc"},"version":"1.81.1"}' |
  jq '.vulns[]? | {id, summary, affected}'

go mod verify
go run golang.org/x/vuln/cmd/govulncheck@latest ./...

Repository: openshift/csi-external-provisioner

Length of output: 50391

---

Upgrade google.golang.org/grpc
google.golang.org/grpc v1.81.1 is flagged for a high-severity xDS RBAC/HTTP/2 issue. Bump to a fixed release and rerun vulnerability checks.

🧰 Tools

🪛 OSV Scanner (2.4.0)

[HIGH] 16-16: google.golang.org/grpc 1.81.1: gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

(GHSA-hrxh-6v49-42gf)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 16, Update the google.golang.org/grpc dependency to a release
containing the xDS RBAC/HTTP/2 security fix, then refresh module checksums as
needed and rerun the project’s vulnerability checks to confirm the finding is
resolved.

Sources: Path instructions, Linters/SAST tools

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Handle cache fixture insertion failures.

Indexer.Add and Store.Add return errors, but both are ignored. Fail the test helper when insertion fails so a malformed fixture cannot silently change test coverage. As per path instructions, “Never ignore error returns.”

Also applies to: 55-57

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controller/snapshot_finalizer_controller_test.go` around lines 22 - 27,
Update newFakeClaimLister to handle the error returned by indexer.Add for each
PVC, failing the test immediately when insertion fails instead of ignoring it;
use the test context or failure mechanism available to this helper and preserve
the existing lister construction on successful insertions.

Source: Path instructions

[coderabbitai]

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

In k8s.io/client-go v0.36.1, does cache.ListWatch provide ListWithContextFunc and WatchFuncWithContextFunc for propagating a controller context into List and Watch requests?

💡 Result:

Yes, in k8s.io/client-go v0.36.1, the cache.ListWatch struct provides support for propagating a context into List and Watch operations via the ListWithContextFunc and WatchFuncWithContext fields [1][2][3]. These fields are specifically designed to allow users to pass a context.Context to their list and watch implementations [1]. While they are present and functional in version 0.36.1, it is important to note that the naming is intentionally inconsistent due to historical reasons: 1. ListWithContextFunc: Uses the WithContext infix [4]. 2. WatchFuncWithContext: Uses the WithContext suffix [4]. The Kubernetes project has explicitly noted this inconsistency in the source code comments, stating that it was unintentional but that fixing it would require a breaking API change which they have deemed not worth the cost [1][2][3]. Consequently, both names exist in the v0.36.1 API [1][3]. Note that while WatchFuncWithContext is present in v0.36.1, there has been ongoing discussion in the community regarding adding a WatchWithContextFunc (to align with the ListWithContextFunc naming convention) and deprecating the existing WatchFuncWithContext to resolve this inconsistency [4]. Regardless of the naming, both fields provide the necessary mechanism for context propagation [1].

Citations:

• 1: https://github.com/kubernetes/client-go/blob/master/tools/cache/listwatch.go
• 2: https://github.com/kubernetes/client-go/blob/v0.35.2/tools/cache/listwatch.go
• 3: https://github.com/kubernetes/client-go/blob/v0.35.3/tools/cache/listwatch.go
• 4: client-go listwatch: Add WatchWithContextFunc and deprecate WatchFuncWithContext kubernetes/kubernetes#131529

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the controller and nearby symbols.
file="pkg/controller/snapshot_finalizer_controller.go"
wc -l "$file"
sed -n '1,220p' "$file"

printf '\n--- search for Run/context usage ---\n'
rg -n "func .*Run|context\.Background\(\)|ListWithContextFunc|WatchFuncWithContext|WatchWithContext|ListWatch" pkg/controller -n

printf '\n--- inspect client-go listwatch API if vendored or referenced in go.sum/go.mod ---\n'
rg -n "k8s\.io/client-go|client-go" go.mod go.sum vendor/ -g '!**/*.sum' || true

Repository: openshift/csi-external-provisioner

Length of output: 50391

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# If vendor or module cache exposes the API, inspect the listwatch declaration.
# This stays read-only and only reads local files if present.
paths=$(fd -a 'listwatch.go' . 2>/dev/null | head -n 20)
printf '%s\n' "$paths"

for p in $paths; do
  echo "--- $p ---"
  sed -n '1,220p' "$p"
done

Repository: openshift/csi-external-provisioner

Length of output: 8195

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
file="pkg/controller/snapshot_finalizer_controller.go"
echo "--- $file ---"
sed -n '1,220p' "$file"

echo
echo "--- Run/context references ---"
rg -n "func .*Run|context\.Background\(\)|ListWithContextFunc|WatchFuncWithContext|WatchWithContext|ListWatch" pkg/controller -n

echo
echo "--- go.mod client-go version ---"
rg -n 'k8s\.io/client-go' go.mod go.sum

Repository: openshift/csi-external-provisioner

Length of output: 14260

---

Propagate the controller context into the informer callbacks. context.Background() keeps the initial list/watch alive after shutdown starts; switch to ListWithContextFunc and WatchFuncWithContext so these requests cancel with ctx.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/controller/snapshot_finalizer_controller.go` around lines 62 - 69, Update
the snapshot informer’s ListWatch callbacks to use the controller context:
replace ListFunc with ListWithContextFunc and WatchFunc with
WatchFuncWithContext, passing ctx into the SnapshotV1 VolumeSnapshots list and
watch requests so they cancel during shutdown.

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Keep a required pull-request vulnerability scan.

Replacing the pull_request trigger with only push and a daily schedule means changes can merge without this Trivy check running. Restore the pull-request trigger or provide an equivalent required pre-merge vulnerability gate.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@release-tools/.github/workflows/trivy.yaml` around lines 6 - 7, Update the
Trivy workflow triggers to include a pull_request event alongside the existing
push and scheduled triggers, ensuring every pull request runs the vulnerability
scan before merging.

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

declared="$(sed -n 's/^configvar CSI_PROW_GO_VERSION_BUILD "\([^"]*\)".*/\1/p' release-tools/prow.sh)"
printf 'Declared build Go version: %s\n' "$declared"

curl -fsSL 'https://go.dev/dl/?mode=json' |
  jq -r '.[].version' |
  grep -Fx 'go1.26.4'

Repository: openshift/csi-external-provisioner

Length of output: 206

---

🌐 Web query:

Go 1.26.4 release security fixes go.dev

💡 Result:

Go 1.26.4 was released on June 2, 2026, and included three specific security fixes [1][2]. While it is a past release (the current version as of July 22, 2026, is 1.26.5) [3][4], the security patches provided in 1.26.4 addressed the following vulnerabilities: 1. mime: Fixed a quadratic complexity issue in WordDecoder.DecodeHeader (CVE-2026-42504), where maliciously-crafted MIME headers containing many invalid encoded-words could consume excessive CPU [2][5]. 2. net/textproto: Fixed an issue where arbitrary input was included in errors without escaping (CVE-2026-42507), potentially allowing attackers to inject misleading content or terminal control bytes into logs or output [2][6]. 3. crypto/x509: Fixed an issue where the candidate hostname was split multiple times in VerifyHostname (CVE-2026-27145), which caused verification costs to scale quadratically based on the number of DNS Subject Alternative Name (SAN) entries [2][5]. In addition to these security fixes, Go 1.26.4 included bug fixes to the compiler, the runtime, the go fix command, and the crypto/fips140 package [1][4]. Users are encouraged to run the latest version, Go 1.26.5, which includes all previous fixes [7][4].

Citations:

• 1: https://go.dev/doc/devel/release
• 2: https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
• 3: https://go.dev/VERSION
• 4: https://tip.golang.org/doc/devel/release
• 5: https://www.openwall.com/lists/oss-security/2026/06/03/2
• 6: https://seclists.org/oss-sec/2026/q2/789
• 7: https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc/m/G9tnwhteAAAJ

---

Use the latest Go 1.26 patch release.

release-tools/prow.sh still pins release builds to Go 1.26.3. Bump this to the latest Go 1.26 patch release so release builds pick up the security fixes in the newer toolchain.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@release-tools/prow.sh` at line 89, Update the CSI_PROW_GO_VERSION_BUILD
configuration value in prow.sh from Go 1.26.3 to the latest available Go 1.26
patch release, preserving the existing build-version configuration and
description.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dfajmon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dfajmon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@dfajmon: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-vsphere	a20758c	link	true	/test e2e-vsphere
ci/prow/unit	a20758c	link	true	/test unit

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.