Drop ephemeral CSI volume (CSIVolumeSource) support

[nightkr]

This means that the following form would no longer be supported:

volumes:
  - csi: # ...

This has been deprecated since 0.4.0 because it doesn't support pod stickiness (#125).

Ephemeral PersistentVolumes that use CSI would still be supported (and the recommended syntax):

volumes:
  - ephemeral:
      volumeClaimTemplate: # ...

[sbernauer]

First I looked around the code, added a few debug statements and tried the old and new way on kind.
I was confused, as old only called SecretProvisionerNode::node_publish_volume. New additonally calls SecretProvisionerNode::node_publish_volume.

So I was questioning myself what code to remove.
But if I understood correctly, they motivation here is to prevent accidential use of the old way, which we can prevent by removing the Ephemeral entry from CSIDriver.spec.volumeLifecycleModes.
I did exactly this and Pods using the old way didn't start any more, so from my perspective this looks sufficient.

For the record here the old Pod:

# secret-opera… │ [csi-node-service] 2025-12-04T11:36:25.583360Z ERROR stackable_secret_operator::csi_server::node: Called SecretProvisionerNode::node_publish_volume request=Request { metadata: MetadataMap { headers: {"content-type": "application/grpc", "user-agent": "grpc-go/1.72.1", "te": "trailers", "grpc-accept-encoding": "gzip", "grpc-timeout": "119996m"} }, message: NodePublishVolumeRequest { volume_id: "csi-1f77c7afba35ad8929a7efb4942366e17a9824af387338f89ce8fc8ca158959e", publish_context: {}, staging_target_path: "", target_path: "/var/lib/kubelet/pods/33512c04-07e7-4db1-9950-44b142ee09fa/volumes/kubernetes.io~csi/tls/mount", volume_capability: Some(VolumeCapability { access_mode: Some(AccessMode { mode: SingleNodeWriter }), access_type: Some(Mount(MountVolume { fs_type: "", mount_flags: [], volume_mount_group: "" })) }), readonly: false, secrets: {}, volume_context: {"csi.storage.k8s.io/pod.name": "example-secret-consumer", "csi.storage.k8s.io/pod.namespace": "default", "secrets.stackable.tech/scope": "node,pod,service=secret-consumer-nginx", "csi.storage.k8s.io/pod.uid": "33512c04-07e7-4db1-9950-44b142ee09fa", "csi.storage.k8s.io/serviceAccount.name": "default", "csi.storage.k8s.io/ephemeral": "true", "secrets.stackable.tech/class": "tls"} }, extensions: Extensions }

apiVersion: v1
kind: Pod
metadata:
  name: example-secret-consumer-old
spec:
  volumes:
    - name: tls
      csi:
        driver: secrets.stackable.tech
        volumeAttributes:
          secrets.stackable.tech/class: tls
          secrets.stackable.tech/scope: node,pod,service=secret-consumer-nginx
  containers:
    - name: ubuntu
      image: ubuntu
      stdin: true
      tty: true
      volumeMounts:
        - name: tls
          mountPath: /tls

And the new Pod:

# secret-opera… │ [csi-node-service] 2025-12-04T11:35:38.723850Z ERROR stackable_secret_operator::csi_server::controller: Got Controller::create_volume request=Request { metadata: MetadataMap { headers: {"content-type": "application/grpc", "user-agent": "grpc-go/1.72.1", "te": "trailers", "grpc-timeout": "9999974u"} }, message: CreateVolumeRequest { name: "pvc-ad174299-c400-4ff1-870f-b04c4e4d3d30", capacity_range: Some(CapacityRange { required_bytes: 1, limit_bytes: 0 }), volume_capabilities: [VolumeCapability { access_mode: Some(AccessMode { mode: SingleNodeWriter }), access_type: Some(Mount(MountVolume { fs_type: "", mount_flags: [], volume_mount_group: "" })) }], parameters: {"csi.storage.k8s.io/pvc/name": "example-secret-consumer-tls", "csi.storage.k8s.io/pv/name": "pvc-ad174299-c400-4ff1-870f-b04c4e4d3d30", "csi.storage.k8s.io/pvc/namespace": "default"}, secrets: {}, volume_content_source: None, accessibility_requirements: Some(TopologyRequirement { requisite: [Topology { segments: {"secrets.stackable.tech/node": "kind-control-plane"} }], preferred: [Topology { segments: {"secrets.stackable.tech/node": "kind-control-plane"} }] }), mutable_parameters: {} }, extensions: Extensions }
# AND
# secret-opera… │ [csi-node-service] 2025-12-04T11:35:38.910344Z ERROR stackable_secret_operator::csi_server::node: Called SecretProvisionerNode::node_publish_volume request=Request { metadata: MetadataMap { headers: {"content-type": "application/grpc", "user-agent": "grpc-go/1.72.1", "te": "trailers", "grpc-accept-encoding": "gzip", "grpc-timeout": "119996m"} }, message: NodePublishVolumeRequest { volume_id: "05ec50ba-4dd3-4498-8b30-d81b48322e93", publish_context: {}, staging_target_path: "", target_path: "/var/lib/kubelet/pods/8092dae1-f638-4945-b4f1-e8b3e06b0302/volumes/kubernetes.io~csi/pvc-ad174299-c400-4ff1-870f-b04c4e4d3d30/mount", volume_capability: Some(VolumeCapability { access_mode: Some(AccessMode { mode: SingleNodeWriter }), access_type: Some(Mount(MountVolume { fs_type: "", mount_flags: [], volume_mount_group: "" })) }), readonly: false, secrets: {}, volume_context: {"secrets.stackable.tech/class": "tls", "volume.kubernetes.io/storage-provisioner": "secrets.stackable.tech", "secrets.stackable.tech/scope": "node,pod,service=secret-consumer-nginx", "csi.storage.k8s.io/pod.namespace": "default", "volume.beta.kubernetes.io/storage-provisioner": "secrets.stackable.tech", "storage.kubernetes.io/csiProvisionerIdentity": "1764848125771-7235-secrets.stackable.tech", "csi.storage.k8s.io/serviceAccount.name": "default", "secrets.stackable.tech/internal.pvc.name": "example-secret-consumer-tls", "csi.storage.k8s.io/ephemeral": "false", "csi.storage.k8s.io/pod.uid": "8092dae1-f638-4945-b4f1-e8b3e06b0302", "csi.storage.k8s.io/pod.name": "example-secret-consumer"} }, extensions: Extensions }
apiVersion: v1
kind: Pod
metadata:
  name: example-secret-consumer-new
spec:
  volumes:
    - name: tls
      ephemeral:
        volumeClaimTemplate:
          metadata:
            annotations:
              secrets.stackable.tech/class: tls
              secrets.stackable.tech/scope: node,pod,service=secret-consumer-nginx
          spec:
            storageClassName: secrets.stackable.tech
            accessModes:
              - ReadWriteOnce
            resources:
              requests:
                storage: "1"
  containers:
    - name: ubuntu
      image: ubuntu
      stdin: true
      tty: true
      volumeMounts:
        - name: tls
          mountPath: /tls

[nightkr]

Yep, that should do the trick. From what I remember there might be some legacy code that could be cleaned up after, but that's secondary.

[sbernauer]

Many thanks for checking back on this @nightkr! Happy new year!