kubernetes-sigs · mskanth972 · Jun 21, 2022 · Jun 21, 2022 · Jun 21, 2022 · Jun 24, 2022
diff --git a/.travis.yml b/.travis.yml
diff --git a/CHANGELOG-1.x.md b/CHANGELOG-1.x.md
@@ -1,11 +1,99 @@
-# V1.4.1
-* EFS-CSI pod impersonation implementation ([#710](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/710), [@lmouhib](https://github.com/lmouhib))
-* Changelog/Version/Readme udpate of v1.4.0 ([#730](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/730), [@Ashley-wenyizha](https://github.com/Ashley-wenyizha))
+# V1.7.2
+* Fixed the GID allocator work with the cross account feature. ([#1199](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1199), [@RomanBednar](https://github.com/RomanBednar))
+* Added Startup Taint Removal Feature to alleviate potential race conditions. ([#1197](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1197), [@mskanth972](https://github.com/mskanth972))
+* Updated the apiversion in StaticProvisioning storageclass.yaml example file. ([#1193](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1193), [@Rajit11](https://github.com/Rajit11))
+* README Update: Update Static Provisioning README.md on mounttargetip option. ([#1192](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1192), [@seanzatzdev-amazon](https://github.com/seanzatzdev-amazon))
+* Updated the GID allocator to allocate GIDs in increasing order. ([#1182](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1182), [@RomanBednar](https://github.com/RomanBednar))
+* Updated the sidecar tags to the latest. ([#1161](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1161), [@mskanth972](https://github.com/mskanth972))
+# V1.7.1
+* Fixed Posixuser nil pointer dereference issue. ([#1180](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1180), [@mskanth972](https://github.com/mskanth972))
+* Fixed CVE-2023-45142: bump k8s and opentelemetry. ([#1176](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1176), [@jsafrane](https://github.com/jsafrane))
+* README Update: Fix typo in installation with public manifest. ([#1168](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1168), [@ysam12345](https://github.com/ysam12345))
+* README Update: Updating README for 'noresvport' mount option. ([#1158](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1158), [@mskanth972](https://github.com/mskanth972))
+# V1.7.0
+* Added Storage Class features to allow more control of the directory structure of Access Points under Dynamic Provisioning. ([#640](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/640), [@jonathanrainer](https://github.com/jonathanrainer))
+* Added Storage Class feature to allow access points to be replicated across different clusters. ([#1026](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1026), [@mskanth972](https://github.com/mskanth972))
+* Fixed GID allocator. ([#850](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/850), [@RomanBednar](https://github.com/RomanBednar))
+* Added unit test for subpath patterns with repeated elements. ([#1117](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1117), [@seanzatzdev-amazon](https://github.com/seanzatzdev-amazon))
+* Updated manifest paths in aws-efs-csi-driver/vendor/k8s.io/kubernetes/test/e2e/storage/testsuites/provisioning.go. ([#1118](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1118), [@seanzatzdev-amazon](https://github.com/seanzatzdev-amazon))
+* Added e2e test for dynamic provisioning. ([#1120](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1120), [@seanzatzdev-amazon](https://github.com/seanzatzdev-amazon))
+* Added CSI_NODE_NAME to node Daemonset. ([#1124](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1124), [@RyanStan](https://github.com/RyanStan))
+* Removed old TravisCI config file. ([#1129](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1129), [@jacobwolfaws](https://github.com/jacobwolfaws))
+* Added hostnetwork back to Node Daemonset. ([#1130](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1130), [@RyanStan](https://github.com/RyanStan))
+* Fixed ensureUniqueDirectory parameter in docs. ([#1133](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1133), [@wilkerlucio](https://github.com/wilkerlucio))
+* Increased the AccessPoint MAX limit from 120 to 1000. ([#1135](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1135), [@seanzatzdev-amazon](https://github.com/seanzatzdev-amazon))
+* Moved to new s3 bucket. ([#1137](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1137), [@dims](https://github.com/dims))
+# V1.6.0
+* Bump golang.org/x/net/html to fix CVE-2023-3978. ([#1089](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1089), [@jsafrane](https://github.com/jsafrane))
+* Set efs-plugin container security context to `true` which can solve the deleteAccessPointRootDir issues. ([#1096](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1096),
+  [@seanzatzdev-amazon](https://github.com/seanzatzdev-amazon))
+* Updated all the necessary components to enable running kOps / EKS e2e CI jobs in the latest version of K8s without `hostNetwork: true`. ([#1088](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1088), [@torredil](https://github.com/torredil))
+# V1.5.9
+* Addressed CVEs (CVE-2023-2602, CVE-2019-15167, CVE-2-23-2431, CVE-2023-2727).
+* updated go and k8s packages and removed SSH from CI as it is unnecessary and introduces a potential flake point. ([#1007](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1007), [@mskanth972](https://github.com/mskanth972))
+* Remove usage of 'echo' from log collector script. ([#1071](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1071), [@RyanStan](https://github.com/RyanStan))
+# V1.5.8
+* Addressed CVEs (CVE-2023-29491, CVE-2023-32731).
+* Updated the security context parameter of the efs-plugin container. ([#1055](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1055), [@mskanth972](https://github.com/mskanth972))
+# V1.5.7
+* Addressed CVEs (CVE-2023-0464, CVE-2023-0466, CVE-2023-2650, CVE-2023-0465, CVE-2015-8390, CVE-2015-8394)
+* Added a e2e test to make sure that side-car images are located in Private ECR repository. ([#1018](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1018), [@mskanth972](https://github.com/mskanth972))
+* Upgraded golang to v1.20. ([#992](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/992), [@kalpanathanneeru21](https://github.com/kalpanathanneeru21))
+* Validate fstype on CreateVolume rather than NodePublishVolume. ([#1027](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1027), [@jingxu97](https://github.com/jingxu97))
+# V1.5.6
+* Added the SecurityContext for Driver ([#1001](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1001), [@mskanth972](https://github.com/mskanth972))
+* Updated Side-cars to address pull back error in private manifest ([#1009](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1009), [@mskanth972](https://github.com/mskanth972))
+* Add reminder to always update weaveworks when updating policy ([#1002](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1002), [@Ashley-wenyizha](https://github.com/Ashley-wenyizha))
+* Updating README on how to delete access point when deleting PVC ([#1004](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1004), [@mskanth972](https://github.com/mskanth972))
+* Updated the README with information on mountOptions that can be provided while mounting ([#1006](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/1006), [@mskanth972](https://github.com/mskanth972))
+# V1.5.5
+* Updated the K8s packages to 1.22.16 to mitigate the CVE-2022-3294 ([#984](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/984), [@mskanth972](https://github.com/mskanth972)) 
+* Upgrade k8s and eksctl version for Test cluster failure fix ([#987](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/987), [@Ashley-wenyizha](https://github.com/Ashley-wenyizha)) 
+* Bumped the side-cars version to the latest ([#993](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/993), [@mskanth972](https://github.com/mskanth972)) 
+# V1.5.4
+* Mitigated golang CVE-2022-41723 ([#961](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/961), [@RyanStan](https://github.com/RyanStan))
+* Updated the example IAM policy by adding `elasticfilesystem:TagResource` permission for tagging EFS resources. ([#964](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/964), [@mskanth972](https://github.com/mskanth972))
+# V1.5.3
+* Updated the Dockerfile to move python packages to location on sys.path ([#951](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/951), [@RyanStan](https://github.com/RyanStan))
+# V1.5.2
+* Golang.org/x/net version update ([#897](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/897), [@RomanBednar](https://github.com/RomanBednar))
+* New image based on minimal EKS Distro images ([#903](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/903), [@RyanStan](https://github.com/RyanStan))
+* feat(node/controller): allow to set updateStrategy ([#740](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/740), [@lefterisALEX](https://github.com/lefterisALEX))
+* Revised and passed volume related arguments in the daemonset instead of controller ([#942](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/942), [@mskanth972](https://github.com/mskanth972))
+* README update on `delete-access-point-root-dir` argument 
+* README update on DNS name resolving issue
+# V1.5.1
+* Upgrade AL2 version and address CVEs ( CVE-2022-4304, CVE-2023-0215, CVE-2023-0286 )
+# V1.5.0
+* Upgrade to latest sidecars versions
+* Upgrade AL2 version and address CVEs (CVE-2021-4217, CVE-2022-0529, CVE-2022-0530, CVE-2022-4141, CVE-2023-0049, CVE-2022-45061, CVE-2022-27781, CVE-2022-23521, CVE-2021-46848, CVE-2022-4292, CVE-2022-43551, CVE-2022-35737, CVE-2022-42898, CVE-2022-41903)
+# V1.4.9
+* Bumped up the sidecars version
+* Fixed-AWS EFS CSI Driver crashes if Access Point creation fails and static GID set
+* Update efs-csi-driver to use efs-utils latest release v1.34.5 which Handle invalid mount point name, Avoid redundant get_target_region call, Update man page and Watchdog detect empty private key and regenerate
+# V1.4.8
+* Use efs-utils version v1.34.4 for stunnel fix ([#125](https://github.com/aws/efs-utils/issues/125)
+# V1.4.7
+* Update the efs-utils to v1.34.3 to reduce possibility of multiple mounts starting from same port range.
+* Added following permissions to the policy json at https://raw.githubusercontent.com/kubernetes-sigs/aws-efs-csi-driver/master/examples/kubernetes/cross_account_mount/iam-policy-examples/describe-mount-target-example.json
+# V1.4.6
+* Update efs-utils to stunnel5.
+# V1.4.5
+* upgrade to k8s.io/kubernetes v1.22.3 to mitigate the CVE-2021-25740.
+# V1.4.4
+* Reverting back the efs-utils version from v1.34.1 (latest version) to v1.33.4 (previous version) as in the the new version v1.34.1 stunnel bin is removed in csi-driver.
+# V1.4.3
+* Release-1.4 : post-release files updated ([#782](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/782), [@mskanth972](https://github.com/mskanth972))
+* Mitigated AL2 related CVEs including : CVE-2022-27664, CVE-2018-25032, CVE-2021-4189, CVE-2022-0391, CVE-2021-3999, CVE-2022-30630, CVE-2022-3099, CVE-2022-30631, CVE-2022-2982, CVE-2022-29526, CVE-2022-2287, CVE-2021-3737, CVE-2021-3733, CVE-2019-12900
+* Update deprecated NodeSelector ([#743](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/743), [@dschunack](https://github.com/dschunack))
+# V1.4.2
 * Update golang.org/x/text/language for CVE-2021-38561 ([#738](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/738), [@RomanBednar](https://github.com/RomanBednar))
 * Update uid/gid Readme ([#752](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/752), [@Ashley-wenyizha](https://github.com/Ashley-wenyizha))
 * Should not pass in mount option of awscredsuri ([#755](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/755), [@Ashley-wenyizha](https://github.com/Ashley-wenyizha))
 * Added support for FIPS ([#760](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/760), [@dima618](https://github.com/dima618))
 * Revise awscredsuri validation to prefix check ([#762](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/762), [@Ashley-wenyizha](https://github.com/Ashley-wenyizha))
+# V1.4.1 
+* Latest AL2 base image update
 # V1.4.0
 * Conditionally added AWS_STS_REGIONAL_ENDPOINTS flag ([#585](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/585), [@holmesb](https://github.com/holmesb))
 * Removing Dependency on IMDS, allowing `hostNetwork: true` to be removed ([#681](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/681), [@jonathanrainer](https://github.com/jonathanrainer))

diff --git a/Dockerfile b/Dockerfile
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.17 as builder
+FROM public.ecr.aws/eks-distro-build-tooling/golang:1.20 as go-builder
 WORKDIR /go/src/github.com/kubernetes-sigs/aws-efs-csi-driver
 
 ARG TARGETOS
@@ -28,40 +28,69 @@ ENV EFS_CLIENT_SOURCE=$client_source
 
 RUN OS=${TARGETOS} ARCH=${TARGETARCH} make $TARGETOS/$TARGETARCH
 
-FROM amazonlinux:2 as linux-amazon
-RUN yum update -y
+FROM public.ecr.aws/eks-distro-build-tooling/python:3.9-gcc-al2 as rpm-provider
+
 # Install efs-utils from github by default. It can be overriden to `yum` with --build-arg when building the Docker image.
 # If value of `EFSUTILSSOURCE` build arg is overriden with `yum`, docker will install efs-utils from Amazon Linux 2's yum repo.
 ARG EFSUTILSSOURCE=github
-RUN if [ "$EFSUTILSSOURCE" = "yum" ]; \
+RUN mkdir -p /tmp/rpms && \
+    if [ "$EFSUTILSSOURCE" = "yum" ]; \
     then echo "Installing efs-utils from Amazon Linux 2 yum repo" && \
-         yum -y install amazon-efs-utils-1.31.1-1.amzn2.noarch; \
+         yum -y install --downloadonly --downloaddir=/tmp/rpms amazon-efs-utils-1.35.0-1.amzn2.noarch; \
     else echo "Installing efs-utils from github using the latest git tag" && \
          yum -y install git rpm-build make && \
          git clone https://github.com/aws/efs-utils && \
          cd efs-utils && \
          git checkout $(git describe --tags $(git rev-list --tags --max-count=1)) && \
-         make rpm && yum -y install build/amazon-efs-utils*rpm && \
+         make rpm && mv build/amazon-efs-utils*rpm /tmp/rpms && \
          # clean up efs-utils folder after install
          cd .. && rm -rf efs-utils && \
          yum clean all; \
     fi
 
 # Install botocore required by efs-utils for cross account mount
-RUN yum -y install wget && \
-    wget https://bootstrap.pypa.io/get-pip.py -O /tmp/get-pip.py && \
-    python3 /tmp/get-pip.py && \
-    pip3 install botocore || /usr/local/bin/pip3 install botocore && \
-    rm -rf /tmp/get-pip.py
+RUN pip3 install --user botocore
+
+# This image is equivalent to the eks-distro-minimal-base-python image but with pip installed as well
+FROM public.ecr.aws/eks-distro-build-tooling/eks-distro-minimal-base-python-builder:3.9-al2 as rpm-installer
+
+COPY --from=rpm-provider /tmp/rpms/* /tmp/download/
+
+# second param indicates to skip installing dependency rpms, these will be installed manually
+# cd, ls, cat, vim, tcpdump, are for debugging
+RUN clean_install amazon-efs-utils true && \
+    install_binary \
+        /usr/bin/cat \
+        /usr/bin/cd \
+        /usr/bin/df \
+        /usr/bin/env \
+        /usr/bin/find \
+        /usr/bin/grep \
+        /usr/bin/ls \
+        /usr/bin/mount \
+        /usr/bin/umount \
+        /sbin/mount.nfs4 \
+        /usr/bin/openssl \
+        /usr/bin/sed \
+        /usr/bin/stat \
+        /usr/bin/stunnel5 \
+        /usr/sbin/tcpdump \
+        /usr/bin/which && \
+    cleanup "efs-csi"
 
 # At image build time, static files installed by efs-utils in the config directory, i.e. CAs file, need
 # to be saved in another place so that the other stateful files created at runtime, i.e. private key for
 # client certificate, in the same config directory can be persisted to host with a host path volume.
 # Otherwise creating a host path volume for that directory will clean up everything inside at the first time.
 # Those static files need to be copied back to the config directory when the driver starts up.
-RUN mv /etc/amazon/efs /etc/amazon/efs-static-files
+RUN mv /newroot/etc/amazon/efs /newroot/etc/amazon/efs-static-files
+
+FROM public.ecr.aws/eks-distro-build-tooling/eks-distro-minimal-base-python:3.9.14-al2 AS linux-amazon
+
+COPY --from=rpm-installer /newroot /
+COPY --from=rpm-provider /root/.local/lib/python3.9/site-packages/ /usr/lib/python3.9/site-packages/
 
-COPY --from=builder /go/src/github.com/kubernetes-sigs/aws-efs-csi-driver/bin/aws-efs-csi-driver /bin/aws-efs-csi-driver
+COPY --from=go-builder /go/src/github.com/kubernetes-sigs/aws-efs-csi-driver/bin/aws-efs-csi-driver /bin/aws-efs-csi-driver
 COPY THIRD-PARTY /
 
 ENTRYPOINT ["/bin/aws-efs-csi-driver"]
diff --git a/Makefile b/Makefile
@@ -13,7 +13,7 @@
 # limitations under the License.
 #
 
-VERSION=v1.4.1
+VERSION=v1.7.2
 
 PKG=github.com/kubernetes-sigs/aws-efs-csi-driver
 GIT_COMMIT?=$(shell git rev-parse HEAD)
@@ -123,12 +123,13 @@ test-e2e:
 	AWS_AVAILABILITY_ZONES=us-west-2a,us-west-2b,us-west-2c \
 	TEST_PATH=./test/e2e/... \
 	GINKGO_FOCUS="\[efs-csi\]" \
+	GINKGO_SKIP="\[Disruptive\]|\[Serial\]" \
 	./hack/e2e/run.sh
 
 .PHONY: test-e2e-external-eks
 test-e2e-external-eks:
 	CLUSTER_TYPE=eksctl \
-	K8S_VERSION="1.20" \
+	K8S_VERSION="1.25" \
 	DRIVER_NAME=aws-efs-csi-driver \
 	HELM_VALUES_FILE="./hack/values_eksctl.yaml" \
 	CONTAINER_NAME=efs-plugin \
@@ -137,6 +138,7 @@ test-e2e-external-eks:
 	AWS_AVAILABILITY_ZONES=us-west-2a,us-west-2b,us-west-2c \
 	TEST_PATH=./test/e2e/... \
 	GINKGO_FOCUS="\[efs-csi\]" \
+	GINKGO_SKIP="\[Disruptive\]|\[Serial\]" \
 	EKSCTL_ADMIN_ROLE="Infra-prod-KopsDeleteAllLambdaServiceRoleF1578477-1ELDFIB4KCMXV" \
 	./hack/e2e/run.sh
 

diff --git a/OWNERS b/OWNERS
@@ -9,3 +9,4 @@ approvers:
 - nckturner
 - jqmichael
 - Ashley-wenyizha
+- mskanth972
diff --git a/charts/aws-efs-csi-driver/CHANGELOG.md b/charts/aws-efs-csi-driver/CHANGELOG.md
@@ -1,4 +1,58 @@
 # Helm chart
+# v2.5.2
+* Bump app/driver version to `v1.7.2`
+# v2.5.1
+* Bump app/driver version to `v1.7.1`
+# v2.5.0
+* Bump app/driver version to `v1.7.0`
+# v2.4.9
+* Bump app/driver version to `v1.6.0`
+# v2.4.8
+* Bump app/driver version to `v1.5.9`
+# v2.4.7
+* Bump app/driver version to `v1.5.8`
+# v2.4.6
+* Bump app/driver version to `v1.5.7`
+# v2.4.5
+* Bump helm version for change of state-dir path to avoid losing track of state files which exists already to `v2.4.5`
+# v2.4.4
+* Bump helm version to pick the latest side-car images `v2.4.4`
+# V2.4.3
+* Bump app/driver version to `v1.5.6`
+# V2.4.2
+* Bump app/driver version to `v1.5.5` 
+# v2.4.1
+* Bump app/driver version to `v1.5.4`
+# v2.4.0
+* Bump app/driver version to `v1.5.3`
+# v2.3.9
+* Bump app/driver version to `v1.5.2`
+# v2.3.8
+* Bump app/driver version to `v1.5.1`
+# v2.3.7
+* Bump app/driver version to `v1.5.0`
+# v2.3.6
+* Bump app/driver version to `v1.4.9`
+# v2.3.5
+* Bump app/driver version to `v1.4.8`
+
+# v2.3.4
+* Bump app/driver version to `v1.4.7`
+
+# v2.3.3
+* Bump app/driver version to `v1.4.6`
+
+# v2.3.2
+* Bump app/driver version to `v1.4.5`
+
+# v2.3.1
+* Bump app/driver version to `v1.4.4`
+
+# v2.3.0
+* Bump app/driver version to `v1.4.3`
+
+# v2.2.9
+* Bump app/driver version to `v1.4.2`
 
 # v2.2.8
 * Bump app/driver version to `v1.4.1`

diff --git a/charts/aws-efs-csi-driver/Chart.yaml b/charts/aws-efs-csi-driver/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: aws-efs-csi-driver
-version: 2.2.8
-appVersion: 1.4.1
+version: 2.5.2
+appVersion: 1.7.2
 kubeVersion: ">=1.17.0-0"
 description: "A Helm chart for AWS EFS CSI Driver"
 home: https://github.com/kubernetes-sigs/aws-efs-csi-driver