Add provisioner-aware VolumeSnapshotClass selection and RWO access mode for DataImportCron by noamasu · Pull Request #3991 · kubevirt/containerized-data-importer

noamasu · 2025-12-23T13:27:28Z

Add support for provisioner-specific requirements when creating snapshots and PVCs for DataImportCron. Some provisioners have specific needs:

GKE Persistent Disk requires snapshot-type: images parameter in VSC for DataImportCron snapshots
GKE Persistent Disk requires RWO access mode for DataImportCron PVCs

What this PR does / why we need it:

Standard GCP snapshots (using pd.csi.storage.gke.io) are limited to 6 restores per hour per snapshot. Using a VolumeSnapshotClass with snapshot-type: images enables unlimited restores, but these snapshots cannot be created from ReadWriteMany (RWX) PVCs. More details can be found here

This PR adds provisioner-aware DataImportCron configuration via StorageProfile annotations:

StorageProfile Controller: Automatically detects provisioner requirements and sets:
- cdi.kubevirt.io/useReadWriteOnceForDataImportCron: Signals RWO access mode for DataImportCron PVCs when not explicitly configured.
  Automatically populated for pd.csi.storage.gke.io/* driver.
- cdi.kubevirt.io/snapshotClassForDataImportCron: Specifies the VolumeSnapshotClass name (auto-discovers matching VSC with required parameters)
DataImportCron Controller:
- Applies RWO access mode to DataVolume PVCs when annotation is set and no access modes are configured (preserves existing configurations)
- Uses the specified VolumeSnapshotClass from annotation when creating snapshots
- edit: The Controller monitors these annotations for changes and triggers re-creation automatically to ensure the correct VSC is used.

This ensures snapshot creation succeeds without restore rate limits for GKE, while still allowing the final volume to be restored with the desired access mode. The approach is extensible - new provisioner requirements can be added by updating the storage capabilities configuration.

Which issue(s) this PR fixes:

Jira: https://issues.redhat.com/browse/CNV-73302

Release note:

Add provisioner-aware VolumeSnapshotClass selection and RWO access mode for DataImportCron

noamasu · 2025-12-23T13:34:37Z

/cc @arnongilboa @akalenyu

akalenyu

Apologies for not being present in the technical discussion, really appreciate the effort on this! and ofc I understand that I am outnumbered here.

It just feels wrong to me to have all sorts of backwards (essentially) APIs in CDI to work around this

akalenyu · 2025-12-23T13:49:00Z

+// DataImportCronAccessModesByProvisionerKey defines required access modes for DataImportCron PVCs
+// Some provisioners require specific access modes for DataImportCron-created PVCs
+var DataImportCronAccessModesByProvisionerKey = map[string][]v1.PersistentVolumeAccessMode{
+	"pd.csi.storage.gke.io":           {rwo},
+	"pd.csi.storage.gke.io/hyperdisk": {rwo},
+}
+
+// DataImportCronSnapshotClassParametersByProvisionerKey defines required VolumeSnapshotClass parameters for DataImportCron.
+// Some provisioners require specific parameters in the VolumeSnapshotClass for DataImportCron snapshots.
+var DataImportCronSnapshotClassParametersByProvisionerKey = map[string]map[string]string{
+	// https://docs.cloud.google.com/kubernetes-engine/docs/how-to/persistent-volumes/backup-pd-volume-snapshots#restore-snapshot
+	"pd.csi.storage.gke.io": {
+		"snapshot-type": "images",
+	},
+	"pd.csi.storage.gke.io/hyperdisk": {
+		"snapshot-type": "images",
+	},
+}


To me, the fact that this degree of handling is required in CDI screams
that for that provider, there is a need for a separate storage class for cron purposes.

That provider would then represent itself internally as

"pd.csi.storage.gke.io/hyperdisk-crons": {{rwo, block}},

somewhat similar to

containerized-data-importer/pkg/storagecapabilities/storagecapabilities.go

Line 412 in c186a42

if sc.Parameters["migratable"] == "true" {

but I think this can remain vague like "rwo" since that is really the only capability of their golden image storage class

And we would be using the "correct" volumesnapshotclass via storageProfile.Status.SnapshotClass
(the special storage class would hint us which one to choose via snapclass parameter or something)

Thanks Alex, I completely agree with that approach.. tbh it would eliminate the need for most of these changes.
Trying to avoid adding an extra SC by forcing two VSCs to work with a single SC is too problematic.

we need to see how to reflect that need to create that dedicated SC for golden images.

regardless, working on your suggested changes asap :)

we need to see how to reflect that need to create that dedicated SC for golden images.

yeah that's the tough bit. I am not against adding convenience APIs under HCO for example if that helps them
(hco.spec field instead of going over each cron and adding a storage class name)

akalenyu · 2025-12-23T13:56:27Z

/cc @awels @arnongilboa @Acedus
I am totally ready to get challenged on this 🙏

akalenyu · 2025-12-23T15:03:27Z

If we absolutely MUST go this path then I think we should start discussing an API extension for StorageProfiles;
Either we introduce a new overload for dataImportCronSourceFormat or a new field entirely, something along the lines of
dataImportCronSourceSpec

Acedus · 2025-12-23T15:11:35Z

If we absolutely MUST go this path then I think we should start discussing an API extension for StorageProfiles; Either we introduce a new overload for dataImportCronSourceFormat or a new field entirely, something along the lines of dataImportCronSourceSpec

+1, CDI should remain as oblivious as possible to quirks of the storage providers it has to work with, this is no exception.

coveralls · 2026-01-14T14:44:02Z

coverage: 49.485% (+0.03%) from 49.454%
when pulling b75c27d on noamasu:provisioner-aware-vsc-selection-for-dic
into f064590 on kubevirt:main.

akalenyu · 2026-01-21T17:53:31Z

/approve

kubevirt-bot · 2026-01-21T17:54:02Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: akalenyu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [akalenyu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

akalenyu · 2026-01-21T17:59:41Z

/retest
unrelated. nfs lane really a pain. ooms in CI

akalenyu · 2026-01-21T18:01:09Z

@arnongilboa please lgtm if you're happy 🙏

arnongilboa · 2026-01-22T09:52:59Z

+		return false, err
+	}
+	actualVSC := snapshot.Spec.VolumeSnapshotClassName
+	if desiredVSC == nil || ptr.Equal(actualVSC, desiredVSC) {


why ptr.Equal() and not reflect.DeepEqual()?

arnongilboa · 2026-01-22T09:55:25Z

+
+// getSnapshotClassForDataImportCron returns the VolumeSnapshotClass name to use for DataImportCron snapshots.
+func (r *DataImportCronReconciler) getSnapshotClassForDataImportCron(pvc *corev1.PersistentVolumeClaim, storageProfile *cdiv1.StorageProfile) (*string, error) {
+	if storageProfile.Annotations != nil {


don't need to check != nil

arnongilboa · 2026-01-22T10:01:52Z

+				Expect(dv.Spec.Storage.AccessModes).To(BeEmpty())
+			})
+
+			It("Should apply RWO access mode to PVC spec when using PVC instead of Storage", func() {


Missed that point. Are you sure we want this behavior? afaik we shouldn't allow PVC without accessMode and should also not override it when it's set.

noamasu · 2026-01-22T13:20:33Z

/retest

arnongilboa · 2026-01-22T14:37:45Z

+	if snapshot.Spec.VolumeSnapshotClassName != nil {
+		actualVSC = *snapshot.Spec.VolumeSnapshotClassName
+	}
+	if desiredVSC == "" || actualVSC == desiredVSC {


shouldn't return true when actualVSC != "" && desiredVSC == "" ?

yes, but why delete a working snapshot when no VSC is available?

When VSC is not available is says you can't create a snapshot, so not sure about keeping an existing one. @akalenyu ?

yeah it probably won't be able to restore from the volumesnap, but we don't handle this case today prior to this PR. I don't think it's much of a concern if everything converges eventually when it becomes available

… annotations Some storage provisioners have specific requirements when creating boot source snapshots. For example, GKE Persistent Disk needs a VolumeSnapshotClass with snapshot-type: images parameter, and snapshots must be taken from an RWO PVC. This change makes CDI automatically detect these provisioner-specific needs and configure DataImportCron accordingly. The StorageProfile controller now reconciles two new annotations based on the underlying provisioner: cdi.kubevirt.io/useReadWriteOnceForDataImportCron signals that RWO should be used for access mode, and cdi.kubevirt.io/snapshotClassForDataImportCron specifies which VolumeSnapshotClass to use for boot source snapshots. The DataImportCron controller watches these annotations and ensures the correct VolumeSnapshotClass and access mode are used. Signed-off-by: Noam Assouline <[email protected]>

noamasu · 2026-01-25T16:21:10Z

/test pull-containerized-data-importer-e2e-upg

akalenyu · 2026-01-25T17:26:42Z

/test pull-containerized-data-importer-e2e-nfs
also unrelated

I believe we're waiting for @arnongilboa lgtm

arnongilboa · 2026-01-26T07:46:45Z

/lgtm

noamasu · 2026-01-26T13:20:20Z

/test pull-containerized-data-importer-e2e-ceph-wffc
[FAIL] Clone Populator tests Clone from Snapshot Fallback to host assisted [It] should finish the clone after creating the source snapshot
this looks like a cluster-level infrastructure problems..
[It] [test_id:10033] with snapshot sources
looks like this one is historically flaky. also setDataImportCronResourceLabels and CopyAllowedLabels calls remain unchanged, i dont see how it is related to my change.

akalenyu · 2026-01-26T14:28:12Z

/override pull-containerized-data-importer-e2e-ceph-wffc

kubevirt-bot · 2026-01-26T14:28:20Z

@akalenyu: Overrode contexts on behalf of akalenyu: pull-containerized-data-importer-e2e-ceph-wffc

Details

In response to this:

/override pull-containerized-data-importer-e2e-ceph-wffc

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

akalenyu · 2026-01-26T14:30:30Z

/cherrypick release-v1.64

kubevirt-bot · 2026-01-26T14:33:06Z

@akalenyu: new pull request created: #4018

Details

In response to this:

/cherrypick release-v1.64

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

1. thanks to kubevirt/containerized-data-importer#3991 sp-balanced-storage-rwo is no longer needed. 2. adding onlineResize and WFFC capabilities Signed-off-by: Noam Assouline <[email protected]>

kubevirt-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. labels Dec 23, 2025

kubevirt-bot requested review from ShellyKa13 and aglitke December 23, 2025 13:27

kubevirt-bot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/L labels Dec 23, 2025

noamasu force-pushed the provisioner-aware-vsc-selection-for-dic branch from 00f6e20 to 19bd66f Compare December 23, 2025 13:30

kubevirt-bot requested review from akalenyu and arnongilboa December 23, 2025 13:34

noamasu changed the title ~~Add provisioner-aware VolumeSnapshotClass selection for DataImportCron~~ WIP: Add provisioner-aware VolumeSnapshotClass selection for DataImportCron Dec 23, 2025

kubevirt-bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 23, 2025

akalenyu reviewed Dec 23, 2025

View reviewed changes

kubevirt-bot requested review from Acedus and awels December 23, 2025 13:56

noamasu force-pushed the provisioner-aware-vsc-selection-for-dic branch from 19bd66f to d406174 Compare January 14, 2026 12:29

kubevirt-bot added size/XL and removed size/L labels Jan 14, 2026

noamasu force-pushed the provisioner-aware-vsc-selection-for-dic branch 2 times, most recently from 5c9a8c0 to 432b4e8 Compare January 14, 2026 14:34

kubevirt-bot added size/L and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/XL labels Jan 14, 2026

noamasu force-pushed the provisioner-aware-vsc-selection-for-dic branch from 432b4e8 to dff9273 Compare January 14, 2026 14:36

noamasu changed the title ~~WIP: Add provisioner-aware VolumeSnapshotClass selection for DataImportCron~~ Add provisioner-aware VolumeSnapshotClass selection and RWO access mode for DataImportCron Jan 14, 2026

kubevirt-bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 14, 2026

kubevirt-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 21, 2026

arnongilboa reviewed Jan 22, 2026

View reviewed changes

noamasu force-pushed the provisioner-aware-vsc-selection-for-dic branch from 84c2375 to 56086e4 Compare January 22, 2026 13:02

kubevirt-bot added size/L and removed size/XL labels Jan 22, 2026

noamasu force-pushed the provisioner-aware-vsc-selection-for-dic branch from 56086e4 to d923fb0 Compare January 22, 2026 13:41

arnongilboa reviewed Jan 22, 2026

View reviewed changes

noamasu force-pushed the provisioner-aware-vsc-selection-for-dic branch from d923fb0 to b75c27d Compare January 22, 2026 15:32

kubevirt-bot assigned arnongilboa Jan 26, 2026

kubevirt-bot added the lgtm Indicates that a PR is ready to be merged. label Jan 26, 2026

kubevirt-bot merged commit 6d28b9a into kubevirt:main Jan 26, 2026
21 checks passed

kubevirt-bot mentioned this pull request Jan 26, 2026

[release-v1.64] Add provisioner-aware VolumeSnapshotClass selection and RWO access mode for DataImportCron #4018

Merged

Conversation

noamasu commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

noamasu commented Dec 23, 2025

Uh oh!

akalenyu left a comment

Choose a reason for hiding this comment

Uh oh!

akalenyu Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akalenyu commented Dec 23, 2025

Uh oh!

akalenyu commented Dec 23, 2025

Uh oh!

Acedus commented Dec 23, 2025

Uh oh!

coveralls commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

akalenyu commented Jan 21, 2026

Uh oh!

kubevirt-bot commented Jan 21, 2026

Uh oh!

akalenyu commented Jan 21, 2026

Uh oh!

akalenyu commented Jan 21, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

noamasu commented Jan 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

noamasu commented Jan 25, 2026

Uh oh!

akalenyu commented Jan 25, 2026

Uh oh!

arnongilboa commented Jan 26, 2026

Uh oh!

noamasu commented Jan 26, 2026

Uh oh!

akalenyu commented Jan 26, 2026

Uh oh!

kubevirt-bot commented Jan 26, 2026

Uh oh!

Uh oh!

akalenyu commented Jan 26, 2026

Uh oh!

kubevirt-bot commented Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

noamasu commented Dec 23, 2025 •

edited

Loading

akalenyu Dec 23, 2025 •

edited

Loading

coveralls commented Jan 14, 2026 •

edited

Loading