labeler: add centralized metadata labeler

build/build-all-multi.sh

@@ -1,22 +1,26 @@
 #!/usr/bin/env bash
 set -ex
 
+PLATFORMS=${PLATFORMS:-"linux/amd64,linux/arm64"}
+IMAGE=${IMAGE:-"alibaba-cloud-csi-driver:latest"}
+PUSH=${PUSH:-"false"}
+
 BUILD_ARGS=(
     --frontend dockerfile.v0
     --local context=.
     --local dockerfile=build/multi
     --opt filename=Dockerfile.multi
-    --opt "platform=linux/amd64,linux/arm64"
-    --opt "build-arg:CSI_VERSION=$(git describe --tags --always --dirty)"
+    --opt "platform=${PLATFORMS}"
+    --opt "build-arg:CSI_VERSION=$(git describe --tags --match='v*' --always --dirty)"
     --opt "build-arg:SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)"
 )
 BUILD_ARGS+=("$@")
 
 buildctl build "${BUILD_ARGS[@]}" \
-    --output type=image,name=alibaba-cloud-csi-driver:latest
+    --output "type=image,push=$PUSH,name=${IMAGE}"
 buildctl build "${BUILD_ARGS[@]}" \
     --opt target=csi-controller \
-    --output type=image,name=alibaba-cloud-csi-driver:latest-controller
+    --output "type=image,push=$PUSH,name=${IMAGE}-controller"
 buildctl build "${BUILD_ARGS[@]}" \
     --opt target=init \
-    --output type=image,name=alibaba-cloud-csi-driver:latest-init
+    --output "type=image,push=$PUSH,name=${IMAGE}-init"

deploy/charts/alibaba-cloud-csi-driver/templates/controller.yaml

@@ -620,6 +620,70 @@ spec:
             requests:
               cpu: 100m
               memory: 128Mi
+{{- if and .Values.csi.disk.enabled .Values.csi.disk.controller.enabled .Values.deploy.labeler.enabled }}
+        - name: csi-metadata-labeler
+          image: {{ include "imageSpec" (list .Values "controller") }}
+          args:
+            - --run-labeler=true
+            - --run-controller-service=false
+            - --run-node-service=false
+            - --driver=disk
+            - --kube-api-qps=50
+            - --kube-api-burst=100
+            - --v=2
+            - --logging-format={{ .Values.logging.format }}
+{{- if .Values.deploy.featureGates }}
+            - "--feature-gates={{ .Values.deploy.featureGates }}"
+{{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+          env:
+            {{- include "networkEnv" .Values.deploy | nindent 12 }}
+            - name: SERVICE_PORT
+              value: "11272"
+{{- if .Values.deploy.regionID }}
+            - name: REGION_ID
+              value: {{ .Values.deploy.regionID | quote }}
+{{- end }}
+{{- if .Values.deploy.ecsEndpoint }}
+            - name: ECS_ENDPOINT
+              value: {{ .Values.deploy.ecsEndpoint | quote }}
+{{- end }}
+{{- if .Values.deploy.privateCloud }}
+            - name: ALICLOUD_CLIENT_SCHEME
+              value: HTTP
+            - name: PRIVATE_CLOUD_TAG
+              value: "true"
+            - name: ALIBABA_CLOUD_HTTP_HEADERS
+              value: |
+                X-Acsproxy-Ascm-Context: {{ .Values.deploy.acsProxyASCMContext }}
+{{- end }}
+{{- include "akEnv" .Values.deploy.accessKey | nindent 12 }}
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: labeler-http
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+          ports:
+            - name: labeler-http
+              containerPort: 11272
+          volumeMounts:
+{{- if .Values.deploy.ack }}
+            - mountPath: /var/addon
+              name: addon-token
+              readOnly: true
+{{- end }}
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 64Mi
+{{- end }}
 {{- if .Values.csi.local.enabled }}
         - name: local-csi-provisioner
           image: {{ include "imageSpec" (list .Values "localController") }}

deploy/charts/alibaba-cloud-csi-driver/templates/plugin.yaml

@@ -121,6 +121,9 @@ spec:
             - "--driver={{ include "enabledPlugins" $nodePool.csi }}"
             - --run-controller-service=false
             - --run-node-service=true
+{{- if $nodePool.deploy.labeler.enabled }}
+            - --use-labeler=true
+{{- end }}
 {{- if $nodePool.deploy.featureGates }}
             - "--feature-gates={{ $nodePool.deploy.featureGates }}"
 {{- end -}}
@@ -152,7 +155,9 @@ spec:
             - name: PRIVATE_CLOUD_TAG
               value: "true"
 {{- end -}}
+{{- if not $nodePool.deploy.labeler.enabled }}
 {{- include "akEnv" $nodePool.deploy.accessKey | nindent 12 }}
+{{- end }}
 {{- include "kubeletDirEnv" $nodePool.deploy.kubeletRootDir | nindent 12 }}
           resources:
             requests:
@@ -203,7 +208,7 @@ spec:
               mountPropagation: "HostToContainer"
             - mountPath: /run/kata-containers/shared/direct-volumes
               name: kata-direct-volumes
-{{- if $nodePool.deploy.ack }}
+{{- if and $nodePool.deploy.ack (not $nodePool.deploy.labeler.enabled) }}
             - mountPath: /var/addon
               name: addon-token
               readOnly: true

deploy/charts/alibaba-cloud-csi-driver/values.yaml

@@ -102,6 +102,13 @@ deploy:
     idKey: id # the key of AccessKey id in the k8s Secret
     secretkey: secret # the key of AccessKey secret in the k8s Secret
 
+  labeler:
+    # Run centralized node metadata labeler sidecar in csi-provisioner Deployment.
+    # The labeler watches Nodes and patches `node.csi.alibabacloud.com/max-disk`
+    # annotation and `node.csi.alibabacloud.com/disktype.*=available` labels,
+    # so that CSI node plugin does not need OpenAPI credentials on every node.
+    enabled: false
+
 images:
   registry: null
   registryVPC: null

go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/alibabacloud-go/darabonba-openapi v0.1.16
 	github.com/alibabacloud-go/darabonba-openapi/v2 v2.1.13
 	github.com/alibabacloud-go/ecs-20140526/v7 v7.4.2
-	github.com/alibabacloud-go/eflo-controller-20221215/v3 v3.0.0
+	github.com/alibabacloud-go/eflo-controller-20221215/v3 v3.0.4
 	github.com/alibabacloud-go/ens-20171110/v3 v3.0.2
 	github.com/alibabacloud-go/nas-20170626/v4 v4.2.0
 	github.com/alibabacloud-go/sts-20150401/v2 v2.0.4
@@ -26,24 +26,24 @@ require (
 	github.com/kubernetes-csi/csi-lib-utils v0.7.1
 	github.com/kubernetes-csi/external-snapshotter/client/v8 v8.4.0
 	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.19.1
-	github.com/prometheus/common v0.55.0
+	github.com/prometheus/client_golang v1.23.2
+	github.com/prometheus/common v0.66.1
 	github.com/prometheus/procfs v0.19.2
 	github.com/sirupsen/logrus v1.9.4
-	github.com/spf13/pflag v1.0.5
+	github.com/spf13/pflag v1.0.9
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/sys v0.39.0
 	golang.org/x/time v0.14.0
 	google.golang.org/grpc v1.79.3
 	google.golang.org/protobuf v1.36.10
-	k8s.io/api v0.32.6
-	k8s.io/apimachinery v0.32.6
-	k8s.io/client-go v0.32.6
-	k8s.io/component-base v0.32.6
+	k8s.io/api v0.35.4
+	k8s.io/apimachinery v0.35.4
+	k8s.io/client-go v0.35.4
+	k8s.io/component-base v0.35.4
 	k8s.io/klog/v2 v2.130.1
-	k8s.io/kubelet v0.32.6
-	k8s.io/mount-utils v0.32.6
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
+	k8s.io/kubelet v0.35.4
+	k8s.io/mount-utils v0.35.4
+	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
 )
 
 require (
@@ -58,16 +58,14 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/clbanning/mxj/v2 v2.7.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
@@ -77,21 +75,21 @@ require (
 	github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 // indirect
 	github.com/mdlayher/socket v0.5.0 // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
-	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
-	github.com/spf13/cobra v1.8.1 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/spf13/cobra v1.10.0 // indirect
 	github.com/tjfoc/gmsm v1.4.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.opentelemetry.io/otel v1.41.0 // indirect
 	go.opentelemetry.io/otel/trace v1.41.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/mod v0.30.0 // indirect
 	golang.org/x/net v0.48.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
@@ -100,12 +98,13 @@ require (
 	golang.org/x/text v0.32.0 // indirect
 	golang.org/x/tools v0.39.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )