CSI ListSnapshots secrets implementation

Signed-off-by: Grant Griffiths <ggriffiths@purestorage.com>

api/csi.go

@@ -137,7 +137,7 @@ func (v *CSIVolumes) DeleteSnapshot(snap *CSISnapshot, w *WriteOptions) error {
 }
 
 // ListSnapshots lists external storage volume snapshots.
-func (v *CSIVolumes) ListSnapshots(pluginID string, q *QueryOptions) (*CSISnapshotListResponse, *QueryMeta, error) {
+func (v *CSIVolumes) ListSnapshots(pluginID string, secrets string, q *QueryOptions) (*CSISnapshotListResponse, *QueryMeta, error) {
 	var resp *CSISnapshotListResponse
 
 	qp := url.Values{}
@@ -150,6 +150,9 @@ func (v *CSIVolumes) ListSnapshots(pluginID string, q *QueryOptions) (*CSISnapsh
 	if q.PerPage != 0 {
 		qp.Set("per_page", fmt.Sprint(q.PerPage))
 	}
+	if secrets != "" {
+		qp.Set("secrets", secrets)
+	}
 
 	qm, err := v.client.query("/v1/volumes/snapshot?"+qp.Encode(), &resp, q)
 	if err != nil {
@@ -406,6 +409,7 @@ type CSISnapshotCreateResponse struct {
 // fields
 type CSISnapshotListRequest struct {
 	PluginID string
+	Secrets  CSISecrets
 	QueryOptions
 }
 

client/csi_endpoint_test.go

@@ -840,6 +840,10 @@ func TestCSIController_ListSnapshots(t *testing.T) {
 				CSIControllerQuery: structs.CSIControllerQuery{
 					PluginID: fakePlugin.Name,
 				},
+				Secrets: map[string]string{
+					"secret-key-1": "secret-val-1",
+					"secret-key-2": "secret-val-2",
+				},
 				StartingToken: "1",
 				MaxEntries:    100,
 			},

client/structs/csi.go

@@ -362,6 +362,7 @@ type ClientCSIControllerListSnapshotsRequest struct {
 	// not Nomad's own fields, for clarity when mapping between the two RPCs
 	MaxEntries    int32
 	StartingToken string
+	Secrets       structs.CSISecrets
 
 	CSIControllerQuery
 }
@@ -370,6 +371,7 @@ func (req *ClientCSIControllerListSnapshotsRequest) ToCSIRequest() *csi.Controll
 	return &csi.ControllerListSnapshotsRequest{
 		MaxEntries:    req.MaxEntries,
 		StartingToken: req.StartingToken,
+		Secrets:       req.Secrets,
 	}
 }
 

command/agent/csi_endpoint.go

@@ -333,6 +333,14 @@ func (s *HTTPServer) csiSnapshotList(resp http.ResponseWriter, req *http.Request
 
 	query := req.URL.Query()
 	args.PluginID = query.Get("plugin_id")
+	secrets := query["secrets"]
+	args.Secrets = make(structs.CSISecrets)
+	for _, raw := range secrets {
+		secret := strings.Split(raw, "=")
+		if len(secret) == 2 {
+			args.Secrets[secret[0]] = secret[1]
+		}
+	}
 
 	var out structs.CSISnapshotListResponse
 	if err := s.agent.RPC("CSIVolume.ListSnapshots", &args, &out); err != nil {

command/volume_snapshot_list.go

@@ -35,6 +35,7 @@ List Options:
 
   -plugin: Display only snapshots managed by a particular plugin. By default
    this command will query all plugins for their snapshots.
+  -secrets: A set of key/value secrets to be used when listing snapshots.
 `
 	return strings.TrimSpace(helpText)
 }
@@ -68,11 +69,13 @@ func (c *VolumeSnapshotListCommand) Name() string { return "volume snapshot list
 func (c *VolumeSnapshotListCommand) Run(args []string) int {
 	var pluginID string
 	var verbose bool
+	var secrets string
 
 	flags := c.Meta.FlagSet(c.Name(), FlagSetClient)
 	flags.Usage = func() { c.Ui.Output(c.Help()) }
 	flags.StringVar(&pluginID, "plugin", "", "")
 	flags.BoolVar(&verbose, "verbose", false, "")
+	flags.StringVar(&secrets, "secrets", "", "")
 
 	if err := flags.Parse(args); err != nil {
 		c.Ui.Error(fmt.Sprintf("Error parsing arguments %s", err))
@@ -121,7 +124,7 @@ func (c *VolumeSnapshotListCommand) Run(args []string) int {
 	q := &api.QueryOptions{PerPage: 30} // TODO: tune page size
 
 	for {
-		resp, _, err := client.CSIVolumes().ListSnapshots(pluginID, q)
+		resp, _, err := client.CSIVolumes().ListSnapshots(pluginID, secrets, q)
 		if err != nil && !errors.Is(err, io.EOF) {
 			c.Ui.Error(fmt.Sprintf(
 				"Error querying CSI external snapshots for plugin %q: %s", pluginID, err))

nomad/csi_endpoint.go

@@ -1247,6 +1247,7 @@ func (v *CSIVolume) ListSnapshots(args *structs.CSISnapshotListRequest, reply *s
 	cReq := &cstructs.ClientCSIControllerListSnapshotsRequest{
 		MaxEntries:    args.PerPage,
 		StartingToken: args.NextToken,
+		Secrets:       args.Secrets,
 	}
 	cReq.PluginID = plugin.ID
 	cResp := &cstructs.ClientCSIControllerListSnapshotsResponse{}

nomad/csi_endpoint_test.go

@@ -1280,6 +1280,9 @@ func TestCSIVolumeEndpoint_ListSnapshots(t *testing.T) {
 	// List snapshots
 
 	req := &structs.CSISnapshotListRequest{
+		Secrets: structs.CSISecrets{
+			"secret-key-1": "secret-val-1",
+		},
 		QueryOptions: structs.QueryOptions{
 			Region:    "global",
 			Namespace: structs.DefaultNamespace,

nomad/structs/csi.go

@@ -897,6 +897,7 @@ type CSISnapshotDeleteResponse struct {
 // fields
 type CSISnapshotListRequest struct {
 	PluginID string
+	Secrets  CSISecrets
 	QueryOptions
 }
 

plugins/csi/plugin.go

@@ -756,12 +756,14 @@ func (r *ControllerDeleteSnapshotRequest) Validate() error {
 type ControllerListSnapshotsRequest struct {
 	MaxEntries    int32
 	StartingToken string
+	Secrets       structs.CSISecrets
 }
 
 func (r *ControllerListSnapshotsRequest) ToCSIRepresentation() *csipbv1.ListSnapshotsRequest {
 	return &csipbv1.ListSnapshotsRequest{
 		MaxEntries:    r.MaxEntries,
 		StartingToken: r.StartingToken,
+		Secrets:       r.Secrets,
 	}
 }