fix: use leases for ref count of snapshot

charts/warm-metal-csi-driver/templates/nodeplugin.yaml

@@ -46,6 +46,7 @@ spec:
           args:
             - "--csi-address=/csi/csi.sock"
             - "--http-endpoint=:9809"
+            - "--probe-timeout=3s"
             - "-v={{ .Values.logLevel }}"
           {{- with .Values.csiLivenessProbe.resources }}
           resources:
@@ -68,6 +69,13 @@ spec:
             {{- end }}
             - "-v={{ .Values.logLevel }}"
             - "--mode=node"
+            {{- if eq .Values.runtime.engine "containerd" }}
+            - "--containerd-mount-rate={{ .Values.containerd.mountRate }}"
+            - "--containerd-mount-burst={{ .Values.containerd.mountBurst }}"
+            - "--containerd-umount-rate={{ .Values.containerd.umountRate }}"
+            - "--containerd-umount-burst={{ .Values.containerd.umountBurst }}"
+            - "--containerd-startup-timeout={{ .Values.containerd.startupTimeout }}"
+            {{- end }}
           env:
             - name: CSI_ENDPOINT
               value: unix:///csi/csi.sock
@@ -150,7 +158,12 @@ spec:
             path: {{ .Values.snapshotRoot }}
             type: Directory
           name: snapshot-root-0
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+

charts/warm-metal-csi-driver/values.yaml

@@ -51,3 +51,10 @@ podMonitor:
   enabled: true
   interval: 30s
   timeout: 10s
+
+containerd:
+  mountRate: 5
+  mountBurst: 5
+  umountRate: 10
+  umountBurst: 10
+  startupTimeout: 20s

cmd/plugin/main.go

@@ -53,9 +53,14 @@ var (
 			"If set to false, secrets will be fetched from the API server on every image pull.")
 	asyncImagePullMount = flag.Bool("async-pull-mount", false,
 		"Whether to pull images asynchronously (helps prevent timeout for larger images)")
-	watcherResyncPeriod = flag.Duration("watcher-resync-period", 30*time.Minute, "The resync period of the pvc watcher.")
-	mode                = flag.String("mode", "", "The mode of the driver. Valid values are: node, controller")
-	nodePluginSA        = flag.String("node-plugin-sa", "csi-image-warm-metal", "The name of the ServiceAccount used by the node plugin.")
+	watcherResyncPeriod      = flag.Duration("watcher-resync-period", 30*time.Minute, "The resync period of the pvc watcher.")
+	mode                     = flag.String("mode", "", "The mode of the driver. Valid values are: node, controller")
+	nodePluginSA             = flag.String("node-plugin-sa", "csi-image-warm-metal", "The name of the ServiceAccount used by the node plugin.")
+	containerDMountRate      = flag.Int("containerd-mount-rate", 5, "The rate limit of containerd mount operations per second.")
+	containerDUmountRate     = flag.Int("containerd-umount-rate", 10, "The rate limit of containerd umount operations per second.")
+	containerDMountBurst     = flag.Int("containerd-mount-burst", 5, "The burst of containerd mount operations.")
+	containerDUmountBurst    = flag.Int("containerd-umount-burst", 10, "The burst of containerd umount operations.")
+	contaienrDStartupTimeout = flag.Duration("containerd-startup-timeout", 20*time.Second, "The timeout for containerd startup.")
 )
 
 func main() {
@@ -108,9 +113,18 @@ func main() {
 			klog.Infof("runtime %s at %q", addr.Scheme, addr.Path)
 			switch addr.Scheme {
 			case containerdScheme:
-				mounter = containerd.NewMounter(addr.Path)
+				mounter = containerd.NewMounter(&containerd.Options{
+					SocketPath:     addr.Path,
+					MountRate:      *containerDMountRate,
+					MountBurst:     *containerDMountBurst,
+					UmountRate:     *containerDUmountRate,
+					UmountBurst:    *containerDUmountBurst,
+					StartupTimeout: *contaienrDStartupTimeout,
+				})
 			case criOScheme:
-				mounter = crio.NewMounter(addr.Path)
+				mounter = crio.NewMounter(&crio.Options{
+					SocketPath: addr.Path,
+				})
 			default:
 				klog.Fatalf("unknown container runtime %q", addr.Scheme)
 			}

cmd/plugin/node_server.go

@@ -47,6 +47,7 @@ func NewNodeServer(driver *csicommon.CSIDriver, mounter backend.Mounter, imageSv
 			SecretStore:        secretStore,
 			Mounter:            mounter,
 		}),
+		k8smounter: k8smount.New(""),
 	}
 }
 
@@ -57,6 +58,7 @@ type NodeServer struct {
 	asyncImagePullMount bool
 	mountExecutor       *mountexecutor.MountExecutor
 	pullExecutor        *pullexecutor.PullExecutor
+	k8smounter          k8smount.Interface
 }
 
 func (n NodeServer) NodePublishVolume(ctx context.Context, req *csi.NodePublishVolumeRequest) (resp *csi.NodePublishVolumeResponse, err error) {
@@ -94,7 +96,7 @@ func (n NodeServer) NodePublishVolume(ctx context.Context, req *csi.NodePublishV
 		return
 	}
 
-	notMnt, err := k8smount.New("").IsLikelyNotMountPoint(req.TargetPath)
+	notMnt, err := n.k8smounter.IsLikelyNotMountPoint(req.TargetPath)
 	if err != nil {
 		if !os.IsNotExist(err) {
 			err = status.Error(codes.Internal, err.Error())
@@ -188,7 +190,12 @@ func (n NodeServer) NodeUnpublishVolume(ctx context.Context, req *csi.NodeUnpubl
 		return
 	}
 
-	mnt, err := k8smount.New("").IsMountPoint(req.TargetPath)
+	mnt, err := n.k8smounter.IsMountPoint(req.TargetPath)
+	if !mnt || !os.IsNotExist(err) {
+		klog.Warningf("mount cleanup skipped: %s is not a mount point", req.TargetPath)
+		return &csi.NodeUnpublishVolumeResponse{}, nil
+	}
+
 	if err != nil || !mnt {
 		return &csi.NodeUnpublishVolumeResponse{}, err
 	}

cmd/plugin/node_server_test.go

@@ -294,7 +294,13 @@ func TestMetrics(t *testing.T) {
 	assert.NoError(t, err)
 	assert.NotNil(t, criClient)
 
-	mounter := containerd.NewMounter(addr.Path)
+	mounter := containerd.NewMounter(&containerd.Options{
+		SocketPath:  addr.Path,
+		MountRate:   10,
+		MountBurst:  10,
+		UmountRate:  10,
+		UmountBurst: 10,
+	})
 	assert.NotNil(t, mounter)
 
 	driver := csicommon.NewCSIDriver(driverName, driverVersion, "fake-node")