Use credentials when calling ControllerModifyVolume

Storage providers expect to obtain secrets from the
ControllerMoodifyVolume CSI procedure. Without these credentials, it may
not be possible to apply the parameters of a VolumeAttributeClass.

A CSIPersistentVolumeSource does not have ControllerModifySecretRef
(like ControllerExpandSecretRef). This workaround, uses the parameters
to resolve the secrets by itself.

Author: nixpanic

pkg/modifier/csi_modifier.go

@@ -24,6 +24,7 @@ import (
 
 	"github.com/kubernetes-csi/external-resizer/pkg/csi"
 	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/informers"
 	"k8s.io/client-go/kubernetes"
 )
@@ -81,18 +82,43 @@ func (r *csiModifier) Modify(pv *v1.PersistentVolume, mutableParameters map[stri
 		return errors.New("empty volume handle")
 	}
 
-	var secrets map[string]string
+	secrets, err := r.getModifyCredentials(source.VolumeAttributes)
+	if err != nil {
+		return err
+	}
 
 	ctx, cancel := timeoutCtx(r.timeout)
-
 	defer cancel()
-	err := r.client.Modify(ctx, volumeID, secrets, mutableParameters)
+
+	err = r.client.Modify(ctx, volumeID, secrets, mutableParameters)
 	if err != nil {
 		return err
 	}
+
 	return nil
 }
 
+// getModifyCredentials fetches the credential from the referenced secret in the VolumeAtttributes. A
+// CSIPersistentVolumeSource does not have ControllerModifySecretRef (like ControllerExpandSecretRef).
+func (r *csiModifier) getModifyCredentials(attrs map[string]string) (map[string]string, error) {
+	secretName := attrs["csi.storage.k8s.io/controller-modify-secret-name"]
+	secretNamespace := attrs["csi.storage.k8s.io/controller-modify-secret-namespace"]
+	if secretNamespace == "" && secretName == "" {
+		return nil, nil
+	}
+
+	secret, err := r.k8sClient.CoreV1().Secrets(secretNamespace).Get(context.TODO(), secretName, metav1.GetOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("error getting secret %s in namespace %s: %v", secretName, secretNamespace, err)
+	}
+
+	credentials := map[string]string{}
+	for key, value := range secret.Data {
+		credentials[key] = string(value)
+	}
+	return credentials, nil
+}
+
 func supportsControllerModify(client csi.Client, timeout time.Duration) (bool, error) {
 	ctx, cancel := timeoutCtx(timeout)
 	defer cancel()