kubernetes-sigs / azurefile-csi-driver / 30645492515

75%

master: 75%

Pull #3308

github

fix: ephemeral inline volume improvements (backport of #3296)

Cherry-picked #3296 onto release-1.35.

Includes:
- caseCollidingKey helper + case-collision guard for ephemeral volume attrs
- Ephemeral volume rejection of NFS protocol and VHD disk feature
- validateInlineVolumeMountSource / findLocalMountModeOption guards
- authorizeInlineVolumeSecret (SubjectAccessReview-based) with new
  --inline-volume-secret-authz off|warn|enforce flag
- validateVolumeIDSegment + validateDiskIsRegularFile hardening on VHD stage
- Drop CIFS mfsymlinks option for VHD-on-CIFS mounts
- Reorder NodePublishVolume so the ephemeral guard runs before the
  serviceAccountToken fast-path (prevents a bare clientID bypassing the
  ephemeral OAuth/MI rejections)

Adapted for release-1.35: the serviceAccountToken fast-path keeps
release-1.35's getValueInMap(context, serviceAccountTokenField) form
rather than master's getServiceAccountTokens/hasStorageAccountCredentials
secrets refactor (not part of #3296).

121 of 131 new or added lines in 4 files covered. (92.37%)

3897 of 5226 relevant lines covered (74.57%)

11.26 hits per line