feat(driver): add validation for RWX block volume attachments by kvaps · Pull Request #403 · piraeusdatastore/linstor-csi

kvaps · 2026-01-07T14:56:54Z

Summary

Add controller-side validation to prevent misuse of allow-two-primaries for RWX block volumes:

Validates that all pods using the volume belong to the same VM
Support for KubeVirt hotplug disks (via ownerReferences resolution)

Note: This validation applies ONLY to RWX block volumes (volumeMode: Block). Filesystem RWX volumes (including NFS) are not affected.

Implementation Details

Controller-Side Validation (ControllerPublishVolume)

When attaching a RWX block volume:

Query Kubernetes API for all pods using the target PVC
Filter out non-active pods (Succeeded/Failed status)
Extract VM names from pods:
- Direct: read vm.kubevirt.io/name label from virt-launcher pods
- Hotplug: follow ownerReferences from hotplug-disk pods to virt-launcher pod
Validate that all pods belong to the same VM
Reject if pods from different VMs are found

Error example:

Warning  FailedAttachVolume  attachdetach-controller  
AttachVolume.Attach failed for volume "pvc-xxx" : rpc error: code = FailedPrecondition 
desc = ControllerPublishVolume failed for pvc-xxx: RWX block volume tenant-ns/vm-pvc 
is being used by pods from different VMs (vm1 and vm2); this is not supported - 
RWX block volumes with allow-two-primaries are only for live migration of a single VM

Why Controller-Only Validation?

Node-side validation was considered but rejected because:

CSI node pods have no Kubernetes API access (by design)
Passing VM name via publish_context doesn't work for existing VolumeAttachments
Filesystem-based tracking creates issues with stale directories

Controller validation is sufficient because:

ControllerPublishVolume is called for each new VolumeAttachment
It has full access to Kubernetes API to verify pod ownership
It blocks before the volume is attached, providing clear error messages

Known Limitations

No Node-Level Validation

Node-side validation is not implemented. This means the driver does not protect against multi-attach of RWX block volumes to different VMs on the same node when VolumeAttachment already exists.

However, this implementation does protect against misuse of allow-two-primaries in DRBD - the controller validation ensures that the DRBD option is only enabled when all pods belong to the same VM (live migration scenario).

Migration Blocked by Failed Pods

If VM2 attempts to start but is blocked by controller validation (because VM1 is using the volume), VM2 will remain in Pending state with FailedAttachVolume. If VM1 then attempts to migrate to the same node as VM2, the migration will also be blocked because:

VM2 pod is in Pending with nodeName set (already scheduled)
Controller validation sees both VM1 and VM2 pods using the PVC
Migration is rejected with the same error

Workaround: Delete the blocked VM2 pod before migrating VM1.

Test plan

Run unit tests: go test ./pkg/driver/... --run TestValidateRWX -v
Test different VMs on different nodes - blocked correctly
Test live migration scenario with KubeVirt VM
Test hotplug disk attachment/detachment

Add custom linstor-csi image build to packages/system/linstor: - Add Dockerfile based on upstream linstor-csi - Import patch from upstream PR #403 for RWX block volume validation (prevents misuse of allow-two-primaries in KubeVirt live migration) - Update Makefile to build both piraeus-server and linstor-csi images - Configure LinstorCluster CR to use custom linstor-csi image in CSI controller and node pods The RWX validation patch ensures that RWX block volumes with allow-two-primaries are only used by pods belonging to the same KubeVirt VM during live migration. Upstream PR: piraeusdatastore/linstor-csi#403 Co-Authored-By: Claude <[email protected]> Signed-off-by: Andrei Kvapil <[email protected]>

## What this PR does This PR adds custom linstor-csi image build to the linstor package with an important upstream patch for RWX block volume validation. **Changes:** - Add linstor-csi Dockerfile based on upstream linstor-csi master - Import patch from upstream PR piraeusdatastore/linstor-csi#403 for RWX block volume validation - Update Makefile to build both piraeus-server and linstor-csi images - Configure LinstorCluster CR to use custom linstor-csi image in CSI controller and node pods **RWX Validation Patch:** The imported patch prevents misuse of DRBD allow-two-primaries by ensuring RWX block volumes are only used by pods belonging to the same KubeVirt VM during live migration. This prevents data corruption when multiple non-related pods attempt to use the same RWX block volume. **Upstream PR:** piraeusdatastore/linstor-csi#403 ### Release note ```release-note [linstor] Add custom linstor-csi image build with RWX block volume validation patch that prevents data corruption during KubeVirt live migration ```  ## Summary by CodeRabbit * **New Features** * Integrated LINSTOR CSI with deployable CSI components and node init helpers; packaged as a production-ready image. * **Updates** * Added build/publish flow for Piraeus server and LINSTOR CSI images; chart values updated with new image references and tags. * **Behavior changes** * Node-side RWX block-volume pre-validation to prevent conflicting multi-node/multi-writer access. * **Tests** * Comprehensive RWX validation tests covering multi-pod and VM scenarios. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub>

Add controller-side validation to prevent misuse of allow-two-primaries for RWX block volumes. Controller-side validation (ControllerPublishVolume): - Query K8s API for all pods using the target PVC - Extract VM names from virt-launcher pods or via ownerReferences for hotplug disks - Validate all pods belong to the same VM - Block attachment if pods from different VMs are found Co-Authored-By: Claude <[email protected]> Signed-off-by: Andrei Kvapil <[email protected]>

kvaps · 2026-01-12T22:13:12Z

Hey @WanzenBug I decided to remove node-level validation because it is blocking KubeVirt logic for hotplug volumes, at least this patch protects from misuse of allow-to-primaries

PR description updated

WanzenBug · 2026-01-13T08:53:20Z

+	}
+
+	// Get PV to find PVC reference (volumeID == PV name in CSI)
+	pv, err := d.kubeClient.Resource(pvGVR).Get(ctx, volumeID, metav1.GetOptions{})


Strictly speaking, this is not always true. You need to check spec.csi.volumeHandle instead. I guess its not really worth to fully check for that, but we should at least check the PV that it has the correct volumeHandle.

fixed, thanks

WanzenBug · 2026-01-13T08:55:41Z

+				continue
+			}
+
+			claimName, _, _ := unstructured.NestedString(pvc, "claimName")


I think you can combine this with the line above, no need to unpack the pvc part?

WanzenBug · 2026-01-13T09:01:22Z

Perhaps move the added validation to a seperate package/file? There is already a pkg/utils, where we could have a free-standing function ValidateRWXBlockAttachment(), which takes the necessary kube client, logs etc...

RWX Block validation moved to pkg/utils/rwx_validation.go

WanzenBug · 2026-01-13T09:03:11Z

 	rwxBlock := req.VolumeCapability.AccessMode.GetMode() == csi.VolumeCapability_AccessMode_MULTI_NODE_MULTI_WRITER && req.VolumeCapability.GetBlock() != nil

+	// Validate RWX block attachment to prevent misuse of allow-two-primaries
+	if rwxBlock {


Can we have a switch/option that disables this check? I don't think there would be any valid use cases outside of kubevirt, but perhaps there is some obscure custom virtualization-on-k8s platform that would be stopped by this patch.

Added new flag --disable-rwx-block-validation=false

Add custom linstor-csi image build to packages/system/linstor: - Add Dockerfile based on upstream linstor-csi - Import patch from upstream PR #403 for RWX block volume validation (prevents misuse of allow-two-primaries in KubeVirt live migration) - Update Makefile to build both piraeus-server and linstor-csi images - Configure LinstorCluster CR to use custom linstor-csi image in CSI controller and node pods The RWX validation patch ensures that RWX block volumes with allow-two-primaries are only used by pods belonging to the same KubeVirt VM during live migration. Upstream PR: piraeusdatastore/linstor-csi#403 Co-Authored-By: Claude <[email protected]> Signed-off-by: Andrei Kvapil <[email protected]>

…able RWX block validation Move RWX block validation logic to a separate package as requested in code review. Also addressed other review comments: - Add volumeHandle check to verify PV matches the requested volumeID - Simplify claimName extraction by combining nested calls Add --disable-rwx-block-validation CLI flag and DisableRWXBlockValidation() driver option. This allows administrators to disable the KubeVirt VM ownership validation for RWX block volumes in environments where the validation causes issues or when using RWX block volumes outside of KubeVirt. Co-Authored-By: Claude <[email protected]> Signed-off-by: Andrei Kvapil <[email protected]>

## What this PR does upstream PR piraeusdatastore/linstor-csi#403 ### Release note  ```release-note [linstor] Refactor node-level RWX validation ```  ## Summary by CodeRabbit * **New Features** * Added a command-line option to disable strict RWX block volume validation for specialized deployments. * Centralized RWX validation into a shared utility used by the driver. * **Improvements** * Improved VM identification and pod/PV handling for RWX block attachments, including hotplug scenarios. * **Tests** * Added comprehensive unit tests covering RWX validation and related pod/PV scenarios. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub>

kvaps force-pushed the feat/rwx-block-validation branch from 3c201f2 to 52ab015 Compare January 7, 2026 15:58

kvaps marked this pull request as ready for review January 7, 2026 20:03

kvaps mentioned this pull request Jan 7, 2026

[linstor] Add linstor-csi image build with RWX validation patch cozystack/cozystack#1828

Merged

kvaps requested a review from WanzenBug January 7, 2026 20:12

kvaps force-pushed the feat/rwx-block-validation branch 5 times, most recently from d3d1393 to 991a9da Compare January 7, 2026 20:37

kvaps force-pushed the feat/rwx-block-validation branch from 00fd08c to a514193 Compare January 12, 2026 21:12

kvaps force-pushed the feat/rwx-block-validation branch from a514193 to acf1719 Compare January 12, 2026 21:59

WanzenBug requested changes Jan 13, 2026

View reviewed changes

kvaps force-pushed the feat/rwx-block-validation branch 2 times, most recently from b42eada to 4a6e0c6 Compare January 13, 2026 12:20

kvaps force-pushed the feat/rwx-block-validation branch from 4a6e0c6 to 28d809e Compare January 13, 2026 12:23

kvaps mentioned this pull request Jan 13, 2026

[linstor] Refactor node-level RWX validation cozystack/cozystack#1856

Merged

kvaps requested a review from WanzenBug January 13, 2026 12:24

WanzenBug approved these changes Jan 13, 2026

View reviewed changes

WanzenBug merged commit ea2cb50 into master Jan 13, 2026
5 of 6 checks passed

WanzenBug deleted the feat/rwx-block-validation branch January 13, 2026 14:39

lexfrei mentioned this pull request Feb 10, 2026

feat: ARM64 support for Generic Kubernetes (non-Talos) cozystack/cozystack#1961

Open

3 of 10 tasks

Navigation Menu

Repository navigation

feat(driver): add validation for RWX block volume attachments - #403

feat(driver): add validation for RWX block volume attachments#403
WanzenBug merged 2 commits into
masterfrom
feat/rwx-block-validation

kvaps commented Jan 7, 2026 •

edited

Loading

Uh oh!

kvaps commented Jan 12, 2026 •

edited

Loading

Uh oh!

WanzenBug Jan 13, 2026

Uh oh!

kvaps Jan 13, 2026

Uh oh!

WanzenBug Jan 13, 2026

Uh oh!

WanzenBug Jan 13, 2026

Uh oh!

kvaps Jan 13, 2026

Uh oh!

WanzenBug Jan 13, 2026

Uh oh!

kvaps Jan 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

kvaps commented Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Implementation Details

Controller-Side Validation (ControllerPublishVolume)

Why Controller-Only Validation?

Known Limitations

No Node-Level Validation

Migration Blocked by Failed Pods

Test plan

Uh oh!

kvaps commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

WanzenBug Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

kvaps Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

WanzenBug Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

WanzenBug Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

kvaps Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

WanzenBug Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

kvaps Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kvaps commented Jan 7, 2026 •

edited

Loading

kvaps commented Jan 12, 2026 •

edited

Loading