Merge pull request #4011 from ks-ci-bot/cherry-pick-3965-to-release-3.1

[release-3.1] Improve the s3 uploader for better performance.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,30 +1,54 @@
-**What type of PR is this?**
-> Uncomment only one ` /kind <>` line, hit enter to put that in a new line, and remove leading whitespaces from that line:
->
-> /kind api-change
-> /kind bug
-> /kind cleanup
-> /kind design
-> /kind documentation
-> /kind failing-test
-> /kind feature
-> /kind flake
+<!-- Thanks for sending a pull request! Here are some tips for you:
 
-**What this PR does / why we need it**:
+1. If you want **faster** PR reviews, read how: https://github.com/kubesphere/community/blob/master/developer-guide/development/the-pr-author-guide-to-getting-through-code-review.md
+2. In case you want to know how your PR got reviewed, read: https://github.com/kubesphere/community/blob/master/developer-guide/development/code-review-guide.md
+3. Here are some coding convetions followed by KubeSphere community: https://github.com/kubesphere/community/blob/master/developer-guide/development/coding-conventions.md
+-->
 
-**Which issue(s) this PR fixes**:
+### What type of PR is this?
+<!-- 
+Add one of the following kinds:
+/kind bug
+/kind cleanup
+/kind documentation
+/kind feature
+/kind design
+
+Optionally add one or more of the following kinds if applicable:
+/kind api-change
+/kind deprecation
+/kind failing-test
+/kind flake
+/kind regression
+-->
+
+
+### What this PR does / why we need it:
+
+### Which issue(s) this PR fixes:
 <!--
 Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
 _If PR is about `failing-tests or flakes`, please post the related issues/tests in a comment and do not use `Fixes`_*
 -->
 Fixes #
 
-**Special notes for reviewers**:
+### Special notes for reviewers:
 ```
 ```
 
-**Additional documentation, usage docs, etc.**:
+### Does this PR introduced a user-facing change?
+<!--
+If no, just write "None" in the release-note block below.
+If yes, a release note is required:
+Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".
 
+For more information on release notes see: https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md
+-->
+```release-note
+
+```
+
+### Additional documentation, usage docs, etc.:
 <!--
 This section can be blank if this pull request does not require a release note.
 Please use the following format for linking documentation or pass the

OWNERS

@@ -1,6 +1,9 @@
 approvers:
     - zryfish #oncall
     - rayzhou2017
+    - wansir
+    - zheng1
+    - benjaminhuo
 
 reviewers:
     - rayzhou2017
@@ -8,16 +11,16 @@ reviewers:
     - benjaminhuo
     - calvinyv
     - FeynmanZhou
-    - huanggze
-    - huojiao2006
-    - Ma-Dan
-    - magicsong
     - pixiake
-    - runzexia
     - wansir
-    - wnxn
     - zheng1
-    - soulseen
-    - shaowenchen
     - stoneshi-yunify
     - linuxsuren
+    - RolandMa1986
+    - wanjunlei
+    - xyz-li
+    - junotx
+    - yuswift
+    - zhu733756
+    - JohnNiang
+    - dkeven

cmd/controller-manager/app/controllers.go

@@ -140,7 +140,6 @@ func addControllers(
 		capability.SnapshotSupported(client.Kubernetes().Discovery()),
 		client.Snapshot().SnapshotV1beta1().VolumeSnapshotClasses(),
 		informerFactory.SnapshotSharedInformerFactory().Snapshot().V1beta1().VolumeSnapshotClasses(),
-		kubernetesInformer.Storage().V1beta1().CSIDrivers(),
 	)
 
 	volumeExpansionController := expansion.NewVolumeExpansionController(

config/default/provisonercapability/disk-csi-qingcloud-com.yaml

@@ -0,0 +1,20 @@
+apiVersion: storage.kubesphere.io/v1alpha1
+kind: ProvisionerCapability
+metadata:
+  name: disk-csi-qingcloud-com
+spec:
+  pluginInfo:
+    name: disk.csi.qingcloud.com
+    version: ""
+  features:
+    topology: true
+    snapshot:
+      create: true
+      list: false
+    volume:
+      attach: true
+      clone: true
+      create: true
+      expandMode: OFFLINE
+      list: false
+      stats: true

config/default/provisonercapability/neonsan-csi-qingstor-com.yaml

@@ -0,0 +1,20 @@
+apiVersion: storage.kubesphere.io/v1alpha1
+kind: ProvisionerCapability
+metadata:
+  name: neonsan-csi-qingstor-com
+spec:
+  pluginInfo:
+    name: neonsan.csi.qingstor.com
+    version: ""
+  features:
+    topology: false
+    snapshot:
+      create: true
+      list: false
+    volume:
+      attach: true
+      clone: true
+      create: true
+      expandMode: OFFLINE
+      list: false
+      stats: true

go.mod

@@ -15,12 +15,10 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20200428143746-21a406dcc535
 	github.com/aws/aws-sdk-go v1.33.12
 	github.com/beevik/etree v1.1.0
-	github.com/container-storage-interface/spec v1.2.0
 	github.com/containernetworking/cni v0.8.0
 	github.com/coreos/go-oidc v2.1.0+incompatible
 	github.com/davecgh/go-spew v1.1.1
 	github.com/deckarep/golang-set v1.7.1 // indirect
-	github.com/dgrijalva/jwt-go v3.2.0+incompatible
 	github.com/docker/distribution v2.7.1+incompatible
 	github.com/docker/docker v1.4.2-0.20200203170920-46ec8731fbce
 	github.com/docker/spdystream v0.0.0-20181023171402-6480d4af844c // indirect
@@ -32,6 +30,7 @@ require (
 	github.com/emicklei/go-restful-openapi v1.4.1
 	github.com/emirpasic/gods v1.12.0 // indirect
 	github.com/fatih/structs v1.1.0
+	github.com/form3tech-oss/jwt-go v3.2.2+incompatible
 	github.com/ghodss/yaml v1.0.0
 	github.com/go-ldap/ldap v3.0.3+incompatible
 	github.com/go-logr/logr v0.3.0
@@ -42,6 +41,7 @@ require (
 	github.com/go-redis/redis v6.15.2+incompatible
 	github.com/go-sql-driver/mysql v1.5.0
 	github.com/gocraft/dbr v0.0.0-20180507214907-a0fd650918f6
+	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/example v0.0.0-20170904185048-46695d81d1fa
 	github.com/google/go-cmp v0.5.0
 	github.com/google/uuid v1.1.1
@@ -292,6 +292,7 @@ replace (
 	github.com/felixge/httpsnoop => github.com/felixge/httpsnoop v1.0.1
 	github.com/flynn/go-shlex => github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568
 	github.com/fogleman/gg => github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90
+	github.com/form3tech-oss/jwt-go => github.com/form3tech-oss/jwt-go v3.2.2+incompatible
 	github.com/franela/goblin => github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db
 	github.com/franela/goreq => github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8
 	github.com/fsnotify/fsnotify => github.com/fsnotify/fsnotify v1.4.9
@@ -347,7 +348,7 @@ replace (
 	github.com/gofrs/flock => github.com/gofrs/flock v0.7.1
 	github.com/gofrs/uuid => github.com/gofrs/uuid v3.2.0+incompatible
 	github.com/gogo/googleapis => github.com/gogo/googleapis v1.1.0
-	github.com/gogo/protobuf => github.com/gogo/protobuf v1.3.1
+	github.com/gogo/protobuf => github.com/gogo/protobuf v1.3.2
 	github.com/gogo/status => github.com/gogo/status v1.0.3
 	github.com/golang-migrate/migrate/v4 => github.com/golang-migrate/migrate/v4 v4.7.0
 	github.com/golang/example => github.com/golang/example v0.0.0-20170904185048-46695d81d1fa

go.sum

@@ -235,6 +235,8 @@ github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSw
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 h1:BHsljHzVlRcyQhjrss6TZTdY2VfCqZPbv5k3iBFa2ZQ=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
+github.com/form3tech-oss/jwt-go v3.2.2+incompatible h1:TcekIExNqud5crz4xD2pavyTgWiPvpYe4Xau31I0PRk=
+github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
 github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
@@ -317,8 +319,8 @@ github.com/gofrs/flock v0.7.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14j
 github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/googleapis v1.1.0 h1:kFkMAZBNAn4j7K0GiZr8cRYzejq68VbheufiV3YuyFI=
 github.com/gogo/googleapis v1.1.0/go.mod h1:gf4bu3Q80BeJ6H1S1vYPm8/ELATdvryBaNFGgqEef3s=
-github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
-github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gogo/status v1.0.3/go.mod h1:SavQ51ycCLnc7dGyJxp8YAmudx8xqiVrRf+6IXRsugc=
 github.com/golang-migrate/migrate/v4 v4.7.0/go.mod h1:Qvut3N4xKWjoH3sokBccML6WyHSnggXm/DvMMnTsQIc=
 github.com/golang/example v0.0.0-20170904185048-46695d81d1fa h1:iqCQC2Z53KkwGgTN9szyL4q0OQHmuNjeoNnMT6lk66k=

pkg/api/alerting/v2alpha1/types.go

@@ -24,7 +24,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"github.com/pkg/errors"
 	prommodel "github.com/prometheus/common/model"
 	"github.com/prometheus/prometheus/pkg/timestamp"

pkg/api/auditing/v1alpha1/types.go

@@ -20,7 +20,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 
 	"kubesphere.io/kubesphere/pkg/simple/client/auditing"
 )

pkg/api/events/v1alpha1/types.go

@@ -20,7 +20,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 
 	"kubesphere.io/kubesphere/pkg/simple/client/events"
 )

pkg/api/logging/v1alpha2/types.go

@@ -20,7 +20,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 
 	"kubesphere.io/kubesphere/pkg/simple/client/logging"
 )

pkg/api/metering/v1alpha1/types.go

@@ -3,7 +3,7 @@ package v1alpha1
 import (
 	"time"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 
 	"kubesphere.io/kubesphere/pkg/apiserver/query"
 	model "kubesphere.io/kubesphere/pkg/models/monitoring"

pkg/api/utils.go

@@ -21,7 +21,7 @@ import (
 	"runtime"
 	"strings"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/klog"
 )

pkg/apis/auditing/v1alpha1/zz_generated.deepcopy.go

@@ -23,7 +23,7 @@ package v1alpha1
 import (
 	auditregistrationv1alpha1 "k8s.io/api/auditregistration/v1alpha1"
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 

pkg/apis/devops/v1alpha1/zz_generated.deepcopy.go

@@ -21,7 +21,7 @@ limitations under the License.
 package v1alpha1
 
 import (
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 

pkg/apis/iam/v1alpha2/zz_generated.deepcopy.go

@@ -21,7 +21,7 @@ limitations under the License.
 package v1alpha2
 
 import (
-	"k8s.io/api/rbac/v1"
+	v1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 )
 

pkg/apis/network/v1alpha1/zz_generated.deepcopy.go

@@ -21,7 +21,7 @@ limitations under the License.
 package v1alpha1
 
 import (
-	"k8s.io/api/networking/v1"
+	v1 "k8s.io/api/networking/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 

pkg/apis/notification/v2beta1/zz_generated.deepcopy.go

@@ -21,7 +21,7 @@ limitations under the License.
 package v2beta1
 
 import (
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )

pkg/apis/servicemesh/v1alpha2/zz_generated.deepcopy.go

@@ -21,7 +21,7 @@ limitations under the License.
 package v1alpha2
 
 import (
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
 

pkg/apis/types/v1beta1/zz_generated.deepcopy.go

@@ -21,7 +21,7 @@ limitations under the License.
 package v1beta1
 
 import (
-	"k8s.io/api/rbac/v1"
+	v1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 )

pkg/apiserver/apiserver.go

@@ -30,7 +30,7 @@ import (
 
 	"strconv"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	urlruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apimachinery/pkg/util/sets"
@@ -219,8 +219,8 @@ func (s *APIServer) installKubeSphereAPIs() {
 
 	urlruntime.Must(configv1alpha2.AddToContainer(s.container, s.Config))
 	urlruntime.Must(resourcev1alpha3.AddToContainer(s.container, s.InformerFactory, s.RuntimeCache))
-	urlruntime.Must(monitoringv1alpha3.AddToContainer(s.container, s.KubernetesClient.Kubernetes(), s.MonitoringClient, s.MetricsClient, s.InformerFactory, s.KubernetesClient.KubeSphere()))
-	urlruntime.Must(meteringv1alpha1.AddToContainer(s.container, s.KubernetesClient.Kubernetes(), s.MonitoringClient, s.InformerFactory, s.KubernetesClient.KubeSphere(), s.RuntimeCache, s.Config.MeteringOptions))
+	urlruntime.Must(monitoringv1alpha3.AddToContainer(s.container, s.KubernetesClient.Kubernetes(), s.MonitoringClient, s.MetricsClient, s.InformerFactory, s.KubernetesClient.KubeSphere(), s.Config.OpenPitrixOptions))
+	urlruntime.Must(meteringv1alpha1.AddToContainer(s.container, s.KubernetesClient.Kubernetes(), s.MonitoringClient, s.InformerFactory, s.KubernetesClient.KubeSphere(), s.RuntimeCache, s.Config.MeteringOptions, nil))
 	urlruntime.Must(openpitrixv1.AddToContainer(s.container, s.InformerFactory, s.KubernetesClient.KubeSphere(), s.Config.OpenPitrixOptions))
 	urlruntime.Must(openpitrixv2alpha1.AddToContainer(s.container, s.InformerFactory, s.KubernetesClient.KubeSphere(), s.Config.OpenPitrixOptions))
 	urlruntime.Must(operationsv1alpha2.AddToContainer(s.container, s.KubernetesClient.Kubernetes()))
@@ -228,7 +228,7 @@ func (s *APIServer) installKubeSphereAPIs() {
 		s.KubernetesClient.Master()))
 	urlruntime.Must(tenantv1alpha2.AddToContainer(s.container, s.InformerFactory, s.KubernetesClient.Kubernetes(),
 		s.KubernetesClient.KubeSphere(), s.EventsClient, s.LoggingClient, s.AuditingClient, amOperator, rbacAuthorizer, s.MonitoringClient, s.RuntimeCache, s.Config.MeteringOptions))
-	urlruntime.Must(terminalv1alpha2.AddToContainer(s.container, s.KubernetesClient.Kubernetes(), s.KubernetesClient.Config()))
+	urlruntime.Must(terminalv1alpha2.AddToContainer(s.container, s.KubernetesClient.Kubernetes(), rbacAuthorizer, s.KubernetesClient.Config()))
 	urlruntime.Must(clusterkapisv1alpha1.AddToContainer(s.container,
 		s.InformerFactory.KubernetesSharedInformerFactory(),
 		s.InformerFactory.KubeSphereSharedInformerFactory(),
@@ -447,8 +447,6 @@ func (s *APIServer) waitForResourceSync(stopCh <-chan struct{}) error {
 		{Group: "iam.kubesphere.io", Version: "v1alpha2", Resource: "workspaceroles"},
 		{Group: "iam.kubesphere.io", Version: "v1alpha2", Resource: "workspacerolebindings"},
 		{Group: "iam.kubesphere.io", Version: "v1alpha2", Resource: "loginrecords"},
-		{Group: "iam.kubesphere.io", Version: "v1alpha2", Resource: "groups"},
-		{Group: "iam.kubesphere.io", Version: "v1alpha2", Resource: "groupbindings"},
 		{Group: "cluster.kubesphere.io", Version: "v1alpha1", Resource: "clusters"},
 		{Group: "devops.kubesphere.io", Version: "v1alpha3", Resource: "devopsprojects"},
 		{Group: "network.kubesphere.io", Version: "v1alpha1", Resource: "ippools"},

pkg/apiserver/authentication/identityprovider/aliyunidaas/idaas_test.go

@@ -21,7 +21,7 @@ import (
 	"testing"
 
 	"golang.org/x/oauth2"
-	"gopkg.in/yaml.v3"
+	yaml "gopkg.in/yaml.v3"
 
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"

pkg/apiserver/authentication/identityprovider/github/github_test.go

@@ -30,7 +30,7 @@ import (
 	. "github.com/onsi/gomega"
 	"github.com/onsi/gomega/gexec"
 	"golang.org/x/oauth2"
-	"gopkg.in/yaml.v3"
+	yaml "gopkg.in/yaml.v3"
 
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"

pkg/apiserver/authentication/identityprovider/ldap/ldap_test.go

@@ -22,7 +22,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"gopkg.in/yaml.v3"
+	yaml "gopkg.in/yaml.v3"
 
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
 )

pkg/apiserver/authentication/identityprovider/oidc/oidc.go

@@ -27,8 +27,8 @@ import (
 
 	"kubesphere.io/kubesphere/pkg/utils/sliceutil"
 
-	"github.com/coreos/go-oidc"
-	"github.com/dgrijalva/jwt-go"
+	oidc "github.com/coreos/go-oidc"
+	jwt "github.com/dgrijalva/jwt-go"
 	"github.com/mitchellh/mapstructure"
 	"golang.org/x/oauth2"
 

pkg/apiserver/authentication/identityprovider/oidc/oidc_test.go

@@ -32,11 +32,11 @@ import (
 	"testing"
 	"time"
 
-	"github.com/dgrijalva/jwt-go"
+	jwt "github.com/dgrijalva/jwt-go"
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 	"github.com/onsi/gomega/gexec"
-	"gopkg.in/square/go-jose.v2"
+	jose "gopkg.in/square/go-jose.v2"
 
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"

pkg/apiserver/authentication/oauth/oauth_options_test.go

@@ -22,7 +22,7 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
-	"gopkg.in/yaml.v3"
+	yaml "gopkg.in/yaml.v3"
 )
 
 func TestDefaultAuthOptions(t *testing.T) {

pkg/apiserver/authentication/token/jwt.go

@@ -20,7 +20,7 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/dgrijalva/jwt-go"
+	jwt "github.com/dgrijalva/jwt-go"
 	"k8s.io/apiserver/pkg/authentication/user"
 	"k8s.io/klog"
 )

pkg/apiserver/config/config_test.go

@@ -24,7 +24,7 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
-	"gopkg.in/yaml.v2"
+	yaml "gopkg.in/yaml.v2"
 
 	networkv1alpha1 "kubesphere.io/kubesphere/pkg/apis/network/v1alpha1"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"

pkg/apiserver/query/types.go

@@ -19,7 +19,7 @@ package query
 import (
 	"strconv"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/labels"
 
 	"kubesphere.io/kubesphere/pkg/utils/sliceutil"

pkg/apiserver/query/types_test.go

@@ -21,7 +21,7 @@ import (
 	"net/http"
 	"testing"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"github.com/google/go-cmp/cmp"
 )
 

pkg/apiserver/runtime/runtime.go

@@ -17,7 +17,7 @@ limitations under the License.
 package runtime
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 )
 

pkg/controller/devopscredential/devopscredential_controller.go

@@ -24,7 +24,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

pkg/controller/devopsproject/devopsproject_controller.go

@@ -23,7 +23,7 @@ import (
 	"reflect"
 	"time"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

pkg/controller/group/group_controller.go

@@ -21,6 +21,8 @@ import (
 	"fmt"
 	"reflect"
 
+	"k8s.io/apimachinery/pkg/util/validation"
+
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -237,10 +239,13 @@ func (c *Controller) reconcile(key string) error {
 }
 
 func (c *Controller) deleteGroupBindings(group *iam1alpha2.Group) error {
-
+	if len(group.Name) > validation.LabelValueMaxLength {
+		// ignore invalid label value error
+		return nil
+	}
 	// Groupbindings that created by kubesphere will be deleted directly.
 	listOptions := metav1.ListOptions{
-		LabelSelector: labels.SelectorFromSet(labels.Set{iam1alpha2.GroupReferenceLabel: group.Name}).String(),
+		LabelSelector: labels.SelectorFromValidatedSet(labels.Set{iam1alpha2.GroupReferenceLabel: group.Name}).String(),
 	}
 	if err := c.ksClient.IamV1alpha2().GroupBindings().
 		DeleteCollection(context.Background(), *metav1.NewDeleteOptions(0), listOptions); err != nil {
@@ -252,8 +257,12 @@ func (c *Controller) deleteGroupBindings(group *iam1alpha2.Group) error {
 
 // remove all RoleBindings.
 func (c *Controller) deleteRoleBindings(group *iam1alpha2.Group) error {
+	if len(group.Name) > validation.LabelValueMaxLength {
+		// ignore invalid label value error
+		return nil
+	}
 	listOptions := metav1.ListOptions{
-		LabelSelector: labels.SelectorFromSet(labels.Set{iam1alpha2.GroupReferenceLabel: group.Name}).String(),
+		LabelSelector: labels.SelectorFromValidatedSet(labels.Set{iam1alpha2.GroupReferenceLabel: group.Name}).String(),
 	}
 	deleteOptions := *metav1.NewDeleteOptions(0)
 

pkg/controller/pipeline/pipeline_controller.go

@@ -23,7 +23,7 @@ import (
 	"reflect"
 	"time"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

pkg/controller/storage/capability/capability_controller.go

@@ -35,42 +35,36 @@ import (
 	snapinformers "github.com/kubernetes-csi/external-snapshotter/client/v3/informers/externalversions/volumesnapshot/v1beta1"
 	snapshotlisters "github.com/kubernetes-csi/external-snapshotter/client/v3/listers/volumesnapshot/v1beta1"
 	storagev1 "k8s.io/api/storage/v1"
-	storagev1beta1 "k8s.io/api/storage/v1beta1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apimachinery/pkg/util/wait"
 	storageinformersv1 "k8s.io/client-go/informers/storage/v1"
-	storageinformersv1beta1 "k8s.io/client-go/informers/storage/v1beta1"
 	"k8s.io/client-go/kubernetes/scheme"
 	storageclient "k8s.io/client-go/kubernetes/typed/storage/v1"
 	storagelistersv1 "k8s.io/client-go/listers/storage/v1"
-	storagelistersv1beta1 "k8s.io/client-go/listers/storage/v1beta1"
 	"k8s.io/client-go/tools/cache"
 	"k8s.io/client-go/util/workqueue"
 	"k8s.io/klog"
 
-	capability "kubesphere.io/kubesphere/pkg/apis/storage/v1alpha1"
+	ksstorage "kubesphere.io/kubesphere/pkg/apis/storage/v1alpha1"
 	crdscheme "kubesphere.io/kubesphere/pkg/client/clientset/versioned/scheme"
-	capabilityclient "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/storage/v1alpha1"
-	capabilityinformers "kubesphere.io/kubesphere/pkg/client/informers/externalversions/storage/v1alpha1"
-	capabilitylisters "kubesphere.io/kubesphere/pkg/client/listers/storage/v1alpha1"
+	ksstorageclient "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/storage/v1alpha1"
+	ksstorageinformers "kubesphere.io/kubesphere/pkg/client/informers/externalversions/storage/v1alpha1"
+	ksstoragelisters "kubesphere.io/kubesphere/pkg/client/listers/storage/v1alpha1"
 )
 
 const (
 	minSnapshotSupportedVersion = "v1.17.0"
-	csiAddressFormat            = "/var/lib/kubelet/plugins/%s/csi.sock"
 	annotationSupportSnapshot   = "storageclass.kubesphere.io/support-snapshot"
 )
 
-type csiAddressGetter func(storageClassProvisioner string) string
-
 type StorageCapabilityController struct {
-	storageClassCapabilityClient capabilityclient.StorageClassCapabilityInterface
-	storageCapabilityLister      capabilitylisters.StorageClassCapabilityLister
+	storageClassCapabilityClient ksstorageclient.StorageClassCapabilityInterface
+	storageClassCapabilityLister ksstoragelisters.StorageClassCapabilityLister
 	storageClassCapabilitySynced cache.InformerSynced
 
-	provisionerCapabilityLister capabilitylisters.ProvisionerCapabilityLister
+	provisionerCapabilityLister ksstoragelisters.ProvisionerCapabilityLister
 	provisionerCapabilitySynced cache.InformerSynced
 
 	storageClassClient storageclient.StorageClassInterface
@@ -82,42 +76,33 @@ type StorageCapabilityController struct {
 	snapshotClassLister snapshotlisters.VolumeSnapshotClassLister
 	snapshotClassSynced cache.InformerSynced
 
-	csiDriverLister storagelistersv1beta1.CSIDriverLister
-	csiDriverSynced cache.InformerSynced
-
-	csiAddressGetter csiAddressGetter
-
 	workQueue workqueue.RateLimitingInterface
 }
 
-// This controller is responsible to watch StorageClass, SnapshotClass.
+// This controller is responsible to watch StorageClass/ProvisionerCapability.
 // And then update StorageClassCapability CRD resource object to the newest status.
 func NewController(
-	capabilityClient capabilityclient.StorageClassCapabilityInterface,
-	capabilityInformer capabilityinformers.Interface,
+	storageClassCapabilityClient ksstorageclient.StorageClassCapabilityInterface,
+	ksStorageInformer ksstorageinformers.Interface,
 	storageClassClient storageclient.StorageClassInterface,
 	storageClassInformer storageinformersv1.StorageClassInformer,
 	snapshotSupported bool,
 	snapshotClassClient snapshotclient.VolumeSnapshotClassInterface,
 	snapshotClassInformer snapinformers.VolumeSnapshotClassInformer,
-	csiDriverInformer storageinformersv1beta1.CSIDriverInformer,
 ) *StorageCapabilityController {
 
 	utilruntime.Must(crdscheme.AddToScheme(scheme.Scheme))
 
 	controller := &StorageCapabilityController{
-		storageClassCapabilityClient: capabilityClient,
-		storageCapabilityLister:      capabilityInformer.StorageClassCapabilities().Lister(),
-		storageClassCapabilitySynced: capabilityInformer.StorageClassCapabilities().Informer().HasSynced,
-		provisionerCapabilityLister:  capabilityInformer.ProvisionerCapabilities().Lister(),
-		provisionerCapabilitySynced:  capabilityInformer.ProvisionerCapabilities().Informer().HasSynced,
+		storageClassCapabilityClient: storageClassCapabilityClient,
+		storageClassCapabilityLister: ksStorageInformer.StorageClassCapabilities().Lister(),
+		storageClassCapabilitySynced: ksStorageInformer.StorageClassCapabilities().Informer().HasSynced,
+		provisionerCapabilityLister:  ksStorageInformer.ProvisionerCapabilities().Lister(),
+		provisionerCapabilitySynced:  ksStorageInformer.ProvisionerCapabilities().Informer().HasSynced,
 		storageClassClient:           storageClassClient,
 		storageClassLister:           storageClassInformer.Lister(),
 		storageClassSynced:           storageClassInformer.Informer().HasSynced,
 		snapshotSupported:            snapshotSupported,
-		csiDriverLister:              csiDriverInformer.Lister(),
-		csiDriverSynced:              csiDriverInformer.Informer().HasSynced,
-		csiAddressGetter:             csiAddress,
 		workQueue:                    workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "StorageClasses"),
 	}
 
@@ -140,12 +125,24 @@ func NewController(
 		DeleteFunc: controller.enqueueStorageClass,
 	})
 
-	csiDriverInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
-		AddFunc: controller.handlerCSIDriver,
+	// ProvisionerCapability acts as a value source of its relevant StorageClassCapabilities
+	// so when a PC is created/updated, the corresponding SCCs should be created(if not exists)/updated
+	// we achive this by simply enqueueing the StorageClasses of the same provisioner
+	// but don't overdo by cascade deleting the SCCs when a PC is deleted
+	// since the role of PCs is more like a template rather than owner to SCCs
+
+	// This is a backward compatible fix to remove the useless auto detection of SCCs
+	// in the future, we will only keep ProvisionerCapability and remove the StorageClassCapability CRD entirely
+	ksStorageInformer.ProvisionerCapabilities().Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc: controller.handleProvisionerCapability,
 		UpdateFunc: func(oldObj, newObj interface{}) {
-			return
+			newPC := newObj.(*ksstorage.ProvisionerCapability)
+			oldPC := oldObj.(*ksstorage.ProvisionerCapability)
+			if newPC.ResourceVersion == oldPC.ResourceVersion {
+				return
+			}
+			controller.handleProvisionerCapability(newObj)
 		},
-		DeleteFunc: controller.handlerCSIDriver,
 	})
 
 	return controller
@@ -165,7 +162,6 @@ func (c *StorageCapabilityController) Run(threadCnt int, stopCh <-chan struct{})
 		c.storageClassCapabilitySynced,
 		c.provisionerCapabilitySynced,
 		c.storageClassSynced,
-		c.csiDriverSynced,
 	}
 
 	if c.snapshotAllowed() {
@@ -185,16 +181,16 @@ func (c *StorageCapabilityController) Run(threadCnt int, stopCh <-chan struct{})
 	return nil
 }
 
-func (c *StorageCapabilityController) handlerCSIDriver(obj interface{}) {
-	csiDriver := obj.(*storagev1beta1.CSIDriver)
+func (c *StorageCapabilityController) handleProvisionerCapability(obj interface{}) {
+	provisionerCapability := obj.(*ksstorage.ProvisionerCapability)
 	storageClasses, err := c.storageClassLister.List(labels.Everything())
 	if err != nil {
-		klog.Error("list StorageClass error when handler csiDriver", err)
+		klog.Error("list StorageClass error when handle provisionerCapability", err)
 		return
 	}
 	for _, storageClass := range storageClasses {
-		if storageClass.Provisioner == csiDriver.Name {
-			klog.V(4).Infof("enqueue StorageClass %s when handling csiDriver", storageClass.Name)
+		if getProvisionerCapabilityName(storageClass.Provisioner) == provisionerCapability.Name {
+			klog.V(4).Infof("enqueue StorageClass %s while handling provisionerCapability", storageClass.Name)
 			c.enqueueStorageClass(storageClass)
 		}
 	}
@@ -277,14 +273,16 @@ func (c *StorageCapabilityController) syncHandler(key string) error {
 	if err != nil {
 		return err
 	}
-	// No capability because csi-plugin not installed
+	// The corresponding ProvisionerCapability Object does not exist
 	if capabilitySpec == nil {
-		klog.Infof("StorageClass %s has no capability", name)
+		klog.Infof("Can't get StorageClass %s's capability", name)
 		err = c.updateStorageClassSnapshotSupported(storageClass, false)
 		if err != nil {
 			return err
 		}
-		return c.deleteStorageCapability(name)
+		// Don't delete the already created SCC
+		// as it might be created manually by user
+		return nil
 	}
 	klog.Infof("StorageClass %s has capability %v", name, capabilitySpec)
 
@@ -315,11 +313,11 @@ func (c *StorageCapabilityController) syncHandler(key string) error {
 	}
 
 	// Handle StorageClassCapability with the same name of StorageClass
-	storageClassCapabilityExist, err := c.storageCapabilityLister.Get(storageClass.Name)
+	storageClassCapabilityExist, err := c.storageClassCapabilityLister.Get(storageClass.Name)
 	if err != nil {
 		if errors.IsNotFound(err) {
 			// If StorageClassCapability doesn't exist, create it
-			storageClassCapabilityCreate := &capability.StorageClassCapability{ObjectMeta: metav1.ObjectMeta{Name: storageClass.Name}}
+			storageClassCapabilityCreate := &ksstorage.StorageClassCapability{ObjectMeta: metav1.ObjectMeta{Name: storageClass.Name}}
 			storageClassCapabilityCreate.Spec = *capabilitySpec
 			klog.Info("Create StorageClassCapability: ", storageClassCapabilityCreate)
 			_, err = c.storageClassCapabilityClient.Create(context.Background(), storageClassCapabilityCreate, metav1.CreateOptions{})
@@ -355,7 +353,7 @@ func (c *StorageCapabilityController) updateStorageClassSnapshotSupported(storag
 }
 
 func (c *StorageCapabilityController) deleteStorageCapability(name string) error {
-	_, err := c.storageCapabilityLister.Get(name)
+	_, err := c.storageClassCapabilityLister.Get(name)
 	if err != nil {
 		if errors.IsNotFound(err) {
 			return nil
@@ -381,7 +379,7 @@ func (c *StorageCapabilityController) deleteSnapshotClass(name string) error {
 	return c.snapshotClassClient.Delete(context.Background(), name, metav1.DeleteOptions{})
 }
 
-func (c *StorageCapabilityController) capabilityFromProvisioner(provisioner string) (*capability.StorageClassCapabilitySpec, error) {
+func (c *StorageCapabilityController) capabilityFromProvisioner(provisioner string) (*ksstorage.StorageClassCapabilitySpec, error) {
 	provisionerCapability, err := c.provisionerCapabilityLister.Get(getProvisionerCapabilityName(provisioner))
 	if err != nil {
 		if errors.IsNotFound(err) {
@@ -390,13 +388,13 @@ func (c *StorageCapabilityController) capabilityFromProvisioner(provisioner stri
 		return nil, err
 	}
 	klog.V(4).Infof("get provisioner capability:%s %s", provisioner, provisionerCapability.Name)
-	capabilitySpec := &capability.StorageClassCapabilitySpec{
+	capabilitySpec := &ksstorage.StorageClassCapabilitySpec{
 		Features: provisionerCapability.Spec.Features,
 	}
 	return capabilitySpec, nil
 }
 
-func (c *StorageCapabilityController) getCapabilitySpec(storageClass *storagev1.StorageClass) (*capability.StorageClassCapabilitySpec, error) {
+func (c *StorageCapabilityController) getCapabilitySpec(storageClass *storagev1.StorageClass) (*ksstorage.StorageClassCapabilitySpec, error) {
 	// get from provisioner capability first
 	klog.V(4).Info("get cap ", storageClass.Provisioner)
 	capabilitySpec, err := c.capabilityFromProvisioner(storageClass.Provisioner)
@@ -404,24 +402,10 @@ func (c *StorageCapabilityController) getCapabilitySpec(storageClass *storagev1.
 		return nil, err
 	}
 
-	// csi of storage capability
-	if capabilitySpec == nil {
-		isCsi, err := c.isCSIStorage(storageClass.Provisioner)
-		if err != nil {
-			return nil, err
-		}
-		if isCsi {
-			capabilitySpec, err = csiCapability(c.csiAddressGetter(storageClass.Provisioner))
-			if err != nil {
-				return nil, err
-			}
-		}
-	}
-
 	if capabilitySpec != nil {
 		capabilitySpec.Provisioner = storageClass.Provisioner
 		if storageClass.AllowVolumeExpansion == nil || !*storageClass.AllowVolumeExpansion {
-			capabilitySpec.Features.Volume.Expand = capability.ExpandModeUnknown
+			capabilitySpec.Features.Volume.Expand = ksstorage.ExpandModeUnknown
 		}
 		if !c.snapshotSupported {
 			capabilitySpec.Features.Snapshot.Create = false
@@ -431,22 +415,6 @@ func (c *StorageCapabilityController) getCapabilitySpec(storageClass *storagev1.
 	return capabilitySpec, nil
 }
 
-func (c *StorageCapabilityController) isCSIStorage(provisioner string) (bool, error) {
-	_, err := c.csiDriverLister.Get(provisioner)
-	if err != nil {
-		if errors.IsNotFound(err) {
-			return false, nil
-		}
-		return false, err
-	}
-	return true, nil
-}
-
-// this is used for test of CSIDriver on windows
-func (c *StorageCapabilityController) setCSIAddressGetter(getter csiAddressGetter) {
-	c.csiAddressGetter = getter
-}
-
 func (c *StorageCapabilityController) snapshotAllowed() bool {
 	return c.snapshotSupported && c.snapshotClassClient != nil && c.snapshotClassLister != nil && c.snapshotClassSynced != nil
 }
@@ -464,10 +432,6 @@ func SnapshotSupported(discoveryInterface discovery.DiscoveryInterface) bool {
 	return ver.AtLeast(minVer)
 }
 
-func csiAddress(provisioner string) string {
-	return fmt.Sprintf(csiAddressFormat, provisioner)
-}
-
 func getProvisionerCapabilityName(provisioner string) string {
 	return strings.NewReplacer(".", "-", "/", "-").Replace(provisioner)
 }

pkg/controller/storage/capability/capability_controller_test.go

@@ -19,11 +19,8 @@
 package capability
 
 import (
-	"math/rand"
-
 	"github.com/google/go-cmp/cmp"
 
-	//"github.com/google/go-cmp/cmp"
 	"reflect"
 	"testing"
 	"time"
@@ -32,7 +29,6 @@ import (
 	snapfake "github.com/kubernetes-csi/external-snapshotter/client/v3/clientset/versioned/fake"
 	snapinformers "github.com/kubernetes-csi/external-snapshotter/client/v3/informers/externalversions"
 	storagev1 "k8s.io/api/storage/v1"
-	storagev1beta1 "k8s.io/api/storage/v1beta1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -59,7 +55,7 @@ type fixture struct {
 	snapshotClassClient *snapfake.Clientset
 	ksClient            *ksfake.Clientset
 	// Objects from here preload into NewSimpleFake.
-	storageObjects       []runtime.Object // include StorageClass and CSIDriver
+	storageObjects       []runtime.Object // include StorageClass
 	snapshotClassObjects []runtime.Object
 	capabilityObjects    []runtime.Object //  include StorageClassCapability and ProvisionerCapability
 	// Objects to put in the store.
@@ -67,19 +63,14 @@ type fixture struct {
 	snapshotClassLister          []*snapbeta1.VolumeSnapshotClass
 	storageClassCapabilityLister []*ksv1alpha1.StorageClassCapability
 	provisionerCapabilityLister  []*ksv1alpha1.ProvisionerCapability
-	csiDriverLister              []*storagev1beta1.CSIDriver
 	// Actions expected to happen on the client.
 	actions []core.Action
-	// CSI server
-	runCSIServer  bool
-	fakeCSIServer *fakeCSIServer
 }
 
-func newFixture(t *testing.T, snapshotSupported bool, runCSIServer bool) *fixture {
+func newFixture(t *testing.T, snapshotSupported bool) *fixture {
 	return &fixture{
 		t:                 t,
 		snapshotSupported: snapshotSupported,
-		runCSIServer:      runCSIServer,
 	}
 }
 
@@ -104,21 +95,11 @@ func (f *fixture) newController() (*StorageCapabilityController,
 		f.snapshotSupported,
 		f.snapshotClassClient.SnapshotV1beta1().VolumeSnapshotClasses(),
 		snapshotInformers.Snapshot().V1beta1().VolumeSnapshotClasses(),
-		k8sInformers.Storage().V1beta1().CSIDrivers(),
 	)
-	if f.runCSIServer {
-		port := 30000 + rand.Intn(100)
-		fakeCSIServer, address := newTestCSIServer(port)
-		f.fakeCSIServer = fakeCSIServer
-		c.setCSIAddressGetter(func(storageClassProvisioner string) string { return address })
-	}
 
 	for _, storageClass := range f.storageClassLister {
 		_ = k8sInformers.Storage().V1().StorageClasses().Informer().GetIndexer().Add(storageClass)
 	}
-	for _, csiDriver := range f.csiDriverLister {
-		_ = k8sInformers.Storage().V1beta1().CSIDrivers().Informer().GetIndexer().Add(csiDriver)
-	}
 	for _, snapshotClass := range f.snapshotClassLister {
 		_ = snapshotInformers.Snapshot().V1beta1().VolumeSnapshotClasses().Informer().GetIndexer().Add(snapshotClass)
 	}
@@ -135,11 +116,6 @@ func (f *fixture) newController() (*StorageCapabilityController,
 func (f *fixture) runController(scName string, startInformers bool, expectError bool) {
 	c, k8sI, crdI, snapI := f.newController()
 
-	if f.runCSIServer {
-		f.fakeCSIServer.run()
-		defer f.fakeCSIServer.stop()
-	}
-
 	if startInformers {
 		stopCh := make(chan struct{})
 		defer close(stopCh)
@@ -276,6 +252,26 @@ func newStorageClass(name string, provisioner string) *storagev1.StorageClass {
 	}
 }
 
+func newStorageClassCapabilitySpec() *ksv1alpha1.StorageClassCapabilitySpec {
+	return &ksv1alpha1.StorageClassCapabilitySpec{
+		Features: ksv1alpha1.CapabilityFeatures{
+			Topology: false,
+			Volume: ksv1alpha1.VolumeFeature{
+				Create: true,
+				Attach: false,
+				List:   false,
+				Clone:  true,
+				Stats:  true,
+				Expand: ksv1alpha1.ExpandModeOffline,
+			},
+			Snapshot: ksv1alpha1.SnapshotFeature{
+				Create: true,
+				List:   false,
+			},
+		},
+	}
+}
+
 func newStorageClassCapability(storageClass *storagev1.StorageClass) *ksv1alpha1.StorageClassCapability {
 	storageClassCapability := &ksv1alpha1.StorageClassCapability{}
 	storageClassCapability.Name = storageClass.Name
@@ -289,17 +285,9 @@ func newProvisionerCapability(storageClass *storagev1.StorageClass) *ksv1alpha1.
 	provisionerCapability.Name = getProvisionerCapabilityName(storageClass.Provisioner)
 	provisionerCapability.Spec.PluginInfo.Name = storageClass.Provisioner
 	provisionerCapability.Spec.Features = newStorageClassCapabilitySpec().Features
-	// ProvisionerCapability snapshot is always false
-	provisionerCapability.Spec.Features.Snapshot.Create = false
 	return provisionerCapability
 }
 
-func newCSIDriver(storageClass *storagev1.StorageClass) *storagev1beta1.CSIDriver {
-	csiDriver := &storagev1beta1.CSIDriver{}
-	csiDriver.Name = storageClass.Provisioner
-	return csiDriver
-}
-
 func newSnapshotClass(storageClass *storagev1.StorageClass) *snapbeta1.VolumeSnapshotClass {
 	return &snapbeta1.VolumeSnapshotClass{
 		ObjectMeta: v1.ObjectMeta{
@@ -320,18 +308,19 @@ func getKey(sc *storagev1.StorageClass, t *testing.T) string {
 }
 
 func TestCreateStorageClass(t *testing.T) {
-	fixture := newFixture(t, true, true)
+	fixture := newFixture(t, true)
 	storageClass := newStorageClass("csi-example", "csi.example.com")
 	storageClassUpdate := storageClass.DeepCopy()
 	storageClassUpdate.Annotations = map[string]string{annotationSupportSnapshot: "true"}
+	provisionerCapability := newProvisionerCapability(storageClass)
 	snapshotClass := newSnapshotClass(storageClass)
 	storageClassCapability := newStorageClassCapability(storageClass)
-	csiDriver := newCSIDriver(storageClass)
 
 	// Objects exist
-	fixture.storageObjects = append(fixture.storageObjects, storageClass, csiDriver)
+	fixture.storageObjects = append(fixture.storageObjects, storageClass)
 	fixture.storageClassLister = append(fixture.storageClassLister, storageClass)
-	fixture.csiDriverLister = append(fixture.csiDriverLister, csiDriver)
+	fixture.capabilityObjects = append(fixture.capabilityObjects, provisionerCapability)
+	fixture.provisionerCapabilityLister = append(fixture.provisionerCapabilityLister, provisionerCapability)
 
 	// Action expected
 	fixture.expectCreateSnapshotClassAction(snapshotClass)
@@ -342,28 +331,69 @@ func TestCreateStorageClass(t *testing.T) {
 	fixture.run(getKey(storageClass, t))
 }
 
+func TestCreateStorageClassWithoutProvisionerCapability(t *testing.T) {
+	fixture := newFixture(t, true)
+	storageClass := newStorageClass("csi-example", "csi.example.com")
+
+	// Objects exist
+	fixture.storageObjects = append(fixture.storageObjects, storageClass)
+	fixture.storageClassLister = append(fixture.storageClassLister, storageClass)
+
+	storageClassUpdate := storageClass.DeepCopy()
+	storageClassUpdate.Annotations = map[string]string{annotationSupportSnapshot: "false"}
+	fixture.expectUpdateStorageClassAction(storageClassUpdate)
+
+	// Run test
+	fixture.run(getKey(storageClass, t))
+}
+
 func TestUpdateStorageClass(t *testing.T) {
 	storageClass := newStorageClass("csi-example", "csi.example.com")
 	storageClass.Annotations = map[string]string{annotationSupportSnapshot: "true"}
 	snapshotClass := newSnapshotClass(storageClass)
 	storageClassCapabilityUpdate := newStorageClassCapability(storageClass)
 	storageClassCapability := newStorageClassCapability(storageClass)
+	provisionerCapability := newProvisionerCapability(storageClass)
 	//old and new should have deference
 	storageClassCapability.Spec.Features.Volume.Create = !storageClassCapability.Spec.Features.Volume.Create
-	csiDriver := newCSIDriver(storageClass)
 
-	fixture := newFixture(t, true, true)
+	fixture := newFixture(t, true)
 	// Object exist
-	fixture.storageObjects = append(fixture.storageObjects, storageClass, csiDriver)
+	fixture.storageObjects = append(fixture.storageObjects, storageClass)
+	fixture.storageClassLister = append(fixture.storageClassLister, storageClass)
+	fixture.snapshotClassObjects = append(fixture.snapshotClassObjects, snapshotClass)
+	fixture.snapshotClassLister = append(fixture.snapshotClassLister, snapshotClass)
+	fixture.capabilityObjects = append(fixture.capabilityObjects, storageClassCapability, provisionerCapability)
+	fixture.storageClassCapabilityLister = append(fixture.storageClassCapabilityLister, storageClassCapability)
+	fixture.provisionerCapabilityLister = append(fixture.provisionerCapabilityLister, provisionerCapability)
+
+	// Action expected
+	fixture.expectUpdateStorageClassCapabilitiesAction(storageClassCapabilityUpdate)
+
+	// Run test
+	fixture.run(getKey(storageClass, t))
+}
+
+func TestUpdateStorageClassWithoutProvisionerCapability(t *testing.T) {
+	storageClass := newStorageClass("csi-example", "csi.example.com")
+	storageClass.Annotations = map[string]string{annotationSupportSnapshot: "true"}
+	storageClassUpdate := storageClass.DeepCopy()
+	storageClassUpdate.Annotations[annotationSupportSnapshot] = "false"
+	snapshotClass := newSnapshotClass(storageClass)
+	storageClassCapability := newStorageClassCapability(storageClass)
+	//old and new should have deference
+	storageClassCapability.Spec.Features.Volume.Create = !storageClassCapability.Spec.Features.Volume.Create
+
+	fixture := newFixture(t, true)
+	// Object exist
+	fixture.storageObjects = append(fixture.storageObjects, storageClass)
 	fixture.storageClassLister = append(fixture.storageClassLister, storageClass)
-	fixture.csiDriverLister = append(fixture.csiDriverLister, csiDriver)
 	fixture.snapshotClassObjects = append(fixture.snapshotClassObjects, snapshotClass)
 	fixture.snapshotClassLister = append(fixture.snapshotClassLister, snapshotClass)
 	fixture.capabilityObjects = append(fixture.capabilityObjects, storageClassCapability)
 	fixture.storageClassCapabilityLister = append(fixture.storageClassCapabilityLister, storageClassCapability)
 
-	// Action expected
-	fixture.expectUpdateStorageClassCapabilitiesAction(storageClassCapabilityUpdate)
+	fixture.expectUpdateStorageClassAction(storageClassUpdate)
 
 	// Run test
 	fixture.run(getKey(storageClass, t))
@@ -374,12 +404,9 @@ func TestDeleteStorageClass(t *testing.T) {
 	snapshotClass := newSnapshotClass(storageClass)
 	storageClassCapability := newStorageClassCapability(storageClass)
 
-	csiDriver := newCSIDriver(storageClass)
-
-	fixture := newFixture(t, true, true)
+	fixture := newFixture(t, true)
 	// Object exist
-	fixture.storageObjects = append(fixture.storageObjects, csiDriver)
-	fixture.csiDriverLister = append(fixture.csiDriverLister, csiDriver)
+	fixture.storageObjects = append(fixture.storageObjects, storageClass)
 	fixture.snapshotClassObjects = append(fixture.snapshotClassObjects, snapshotClass)
 	fixture.snapshotClassLister = append(fixture.snapshotClassLister, snapshotClass)
 	fixture.capabilityObjects = append(fixture.capabilityObjects, storageClassCapability)
@@ -394,7 +421,8 @@ func TestDeleteStorageClass(t *testing.T) {
 }
 
 func TestCreateStorageClassNotSupportSnapshot(t *testing.T) {
-	fixture := newFixture(t, false, true)
+	// K8S version < 1.17.0
+	fixture := newFixture(t, false)
 	storageClass := newStorageClass("csi-example", "csi.example.com")
 	storageClassUpdate := storageClass.DeepCopy()
 	storageClassUpdate.Annotations = map[string]string{annotationSupportSnapshot: "false"}
@@ -402,32 +430,31 @@ func TestCreateStorageClassNotSupportSnapshot(t *testing.T) {
 	storageClassCapability.Spec.Features.Snapshot.Create = false
 	storageClassCapability.Spec.Features.Snapshot.List = false
 	provisionerCapability := newProvisionerCapability(storageClass)
-	csiDriver := newCSIDriver(storageClass)
-
-	// Objects exist
-	fixture.storageObjects = append(fixture.storageObjects, storageClass, csiDriver)
-	fixture.storageClassLister = append(fixture.storageClassLister, storageClass)
-	fixture.csiDriverLister = append(fixture.csiDriverLister, csiDriver)
-	fixture.capabilityObjects = append(fixture.capabilityObjects, provisionerCapability)
-	fixture.provisionerCapabilityLister = append(fixture.provisionerCapabilityLister, provisionerCapability)
-
-	// Action expected
-	fixture.expectUpdateStorageClassAction(storageClassUpdate)
-	fixture.expectCreateStorageClassCapabilitiesAction(storageClassCapability)
-
-	// Run test
-	fixture.run(getKey(storageClass, t))
-}
-
-func TestCreateStorageClassInTree(t *testing.T) {
-	// InTree Storage has no snapshot capability
-	fixture := newFixture(t, true, true)
-	storageClass := newStorageClass("csi-example", "csi.example.com")
-	storageClassUpdate := storageClass.DeepCopy()
-	storageClassUpdate.Annotations = map[string]string{annotationSupportSnapshot: "false"}
-	storageClassCapability := newStorageClassCapability(storageClass)
-	storageClassCapability.Spec.Features.Snapshot.Create = false
-	provisionerCapability := newProvisionerCapability(storageClass)
+
+	// Objects exist
+	fixture.storageObjects = append(fixture.storageObjects, storageClass)
+	fixture.storageClassLister = append(fixture.storageClassLister, storageClass)
+	fixture.capabilityObjects = append(fixture.capabilityObjects, provisionerCapability)
+	fixture.provisionerCapabilityLister = append(fixture.provisionerCapabilityLister, provisionerCapability)
+
+	// Action expected
+	fixture.expectUpdateStorageClassAction(storageClassUpdate)
+	fixture.expectCreateStorageClassCapabilitiesAction(storageClassCapability)
+
+	// Run test
+	fixture.run(getKey(storageClass, t))
+}
+
+func TestCreateStorageClassNotHaveSnapshotCap(t *testing.T) {
+	// Storage has no snapshot capability
+	fixture := newFixture(t, true)
+	storageClass := newStorageClass("csi-example", "csi.example.com")
+	storageClassUpdate := storageClass.DeepCopy()
+	storageClassUpdate.Annotations = map[string]string{annotationSupportSnapshot: "false"}
+	storageClassCapability := newStorageClassCapability(storageClass)
+	storageClassCapability.Spec.Features.Snapshot.Create = false
+	provisionerCapability := newProvisionerCapability(storageClass)
+	provisionerCapability.Spec.Features.Snapshot.Create = false
 
 	// Objects exist
 	fixture.storageObjects = append(fixture.storageObjects, storageClass)

pkg/controller/storage/capability/csi_capability.go

@@ -1,168 +0,0 @@
-/*
-
- Copyright 2020 The KubeSphere Authors.
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
-
-*/
-package capability
-
-import (
-	"context"
-	"errors"
-	"net"
-	"net/url"
-	"time"
-
-	"github.com/container-storage-interface/spec/lib/go/csi"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/connectivity"
-	"google.golang.org/grpc/keepalive"
-
-	"kubesphere.io/kubesphere/pkg/apis/storage/v1alpha1"
-)
-
-const (
-	dialDuration    = time.Second * 5
-	requestDuration = time.Second * 10
-)
-
-func csiCapability(csiAddress string) (*v1alpha1.StorageClassCapabilitySpec, error) {
-	csiConn, err := connect(csiAddress)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = csiConn.Close() }()
-
-	ctx, cancel := context.WithTimeout(context.Background(), requestDuration)
-	defer cancel()
-
-	spec := &v1alpha1.StorageClassCapabilitySpec{}
-	err = addPluginCapabilities(ctx, csiConn, spec)
-	if err != nil {
-		return nil, err
-	}
-	err = addControllerCapabilities(ctx, csiConn, spec)
-	if err != nil {
-		return nil, err
-	}
-	err = addNodeCapabilities(ctx, csiConn, spec)
-	if err != nil {
-		return nil, err
-	}
-	return spec, nil
-
-}
-
-func addPluginCapabilities(ctx context.Context, conn *grpc.ClientConn, spec *v1alpha1.StorageClassCapabilitySpec) error {
-	identityClient := csi.NewIdentityClient(conn)
-	pluginCapabilitiesResponse, err := identityClient.GetPluginCapabilities(ctx, &csi.GetPluginCapabilitiesRequest{})
-	if err != nil {
-		return err
-	}
-
-	for _, capability := range pluginCapabilitiesResponse.GetCapabilities() {
-		if capability == nil {
-			continue
-		}
-		if capability.GetService().GetType() == csi.PluginCapability_Service_VOLUME_ACCESSIBILITY_CONSTRAINTS {
-			spec.Features.Topology = true
-		}
-		volumeExpansion := capability.GetVolumeExpansion()
-		if volumeExpansion != nil {
-			switch volumeExpansion.GetType() {
-			case csi.PluginCapability_VolumeExpansion_ONLINE:
-				spec.Features.Volume.Expand = v1alpha1.ExpandModeOnline
-			case csi.PluginCapability_VolumeExpansion_OFFLINE:
-				spec.Features.Volume.Expand = v1alpha1.ExpandModeOffline
-			}
-		}
-	}
-	return nil
-}
-
-func addControllerCapabilities(ctx context.Context, conn *grpc.ClientConn, spec *v1alpha1.StorageClassCapabilitySpec) error {
-	controllerClient := csi.NewControllerClient(conn)
-	controllerCapabilitiesResponse, err := controllerClient.ControllerGetCapabilities(ctx, &csi.ControllerGetCapabilitiesRequest{})
-	if err != nil {
-		return err
-	}
-	for _, capability := range controllerCapabilitiesResponse.GetCapabilities() {
-		switch capability.GetRpc().GetType() {
-		case csi.ControllerServiceCapability_RPC_CREATE_DELETE_VOLUME:
-			spec.Features.Volume.Create = true
-		case csi.ControllerServiceCapability_RPC_PUBLISH_UNPUBLISH_VOLUME:
-			spec.Features.Volume.Attach = true
-		case csi.ControllerServiceCapability_RPC_LIST_VOLUMES:
-			spec.Features.Volume.List = true
-		case csi.ControllerServiceCapability_RPC_CLONE_VOLUME:
-			spec.Features.Volume.Clone = true
-		case csi.ControllerServiceCapability_RPC_CREATE_DELETE_SNAPSHOT:
-			spec.Features.Snapshot.Create = true
-		case csi.ControllerServiceCapability_RPC_LIST_SNAPSHOTS:
-			spec.Features.Snapshot.List = true
-		}
-	}
-	return nil
-}
-
-func addNodeCapabilities(ctx context.Context, conn *grpc.ClientConn, spec *v1alpha1.StorageClassCapabilitySpec) error {
-	nodeClient := csi.NewNodeClient(conn)
-	controllerCapabilitiesResponse, err := nodeClient.NodeGetCapabilities(ctx, &csi.NodeGetCapabilitiesRequest{})
-	if err != nil {
-		return err
-	}
-	for _, capability := range controllerCapabilitiesResponse.GetCapabilities() {
-		switch capability.GetRpc().GetType() {
-		case csi.NodeServiceCapability_RPC_GET_VOLUME_STATS:
-			spec.Features.Volume.Stats = true
-		}
-	}
-	return nil
-}
-
-// Connect address by GRPC
-func connect(address string) (*grpc.ClientConn, error) {
-	dialOptions := []grpc.DialOption{
-		grpc.WithInsecure(),
-	}
-	u, err := url.Parse(address)
-	if err == nil && (!u.IsAbs() || u.Scheme == "unix") {
-		dialOptions = append(dialOptions,
-			grpc.WithDialer(
-				func(addr string, timeout time.Duration) (net.Conn, error) {
-					return net.DialTimeout("unix", u.Path, timeout)
-				}))
-	}
-	// This is necessary when connecting via TCP and does not hurt
-	// when using Unix domain sockets. It ensures that gRPC detects a dead connection
-	// in a timely manner.
-	dialOptions = append(dialOptions,
-		grpc.WithKeepaliveParams(keepalive.ClientParameters{PermitWithoutStream: true}))
-
-	conn, err := grpc.Dial(address, dialOptions...)
-	if err != nil {
-		return nil, err
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), dialDuration)
-	defer cancel()
-	for {
-		if !conn.WaitForStateChange(ctx, conn.GetState()) {
-			return conn, errors.New("connection timed out")
-		}
-		if conn.GetState() == connectivity.Ready {
-			return conn, nil
-		}
-	}
-}

pkg/controller/storage/capability/csi_capability_test.go

@@ -1,190 +0,0 @@
-/*
-
- Copyright 2020 The KubeSphere Authors.
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
-
-*/
-package capability
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/container-storage-interface/spec/lib/go/csi"
-	"github.com/google/go-cmp/cmp"
-	"google.golang.org/grpc"
-	"k8s.io/apimachinery/pkg/util/rand"
-	"k8s.io/klog"
-
-	"kubesphere.io/kubesphere/pkg/apis/storage/v1alpha1"
-)
-
-var DefaultControllerRPCType = []csi.ControllerServiceCapability_RPC_Type{
-	csi.ControllerServiceCapability_RPC_CREATE_DELETE_VOLUME,
-	csi.ControllerServiceCapability_RPC_CREATE_DELETE_SNAPSHOT,
-	csi.ControllerServiceCapability_RPC_EXPAND_VOLUME,
-	csi.ControllerServiceCapability_RPC_CLONE_VOLUME,
-}
-
-var DefaultNodeRPCType = []csi.NodeServiceCapability_RPC_Type{
-	csi.NodeServiceCapability_RPC_STAGE_UNSTAGE_VOLUME,
-	csi.NodeServiceCapability_RPC_EXPAND_VOLUME,
-	csi.NodeServiceCapability_RPC_GET_VOLUME_STATS,
-}
-
-var DefaultPluginCapability = []*csi.PluginCapability{
-	{
-		Type: &csi.PluginCapability_Service_{
-			Service: &csi.PluginCapability_Service{
-				Type: csi.PluginCapability_Service_CONTROLLER_SERVICE,
-			},
-		},
-	},
-	{
-		Type: &csi.PluginCapability_VolumeExpansion_{
-			VolumeExpansion: &csi.PluginCapability_VolumeExpansion{
-				Type: csi.PluginCapability_VolumeExpansion_OFFLINE,
-			},
-		},
-	},
-}
-
-type fakeCSIServer struct {
-	csi.UnimplementedIdentityServer
-	csi.UnimplementedControllerServer
-	csi.UnimplementedNodeServer
-	network string
-	address string
-	server  *grpc.Server
-}
-
-func newTestCSIServer(port int) (csiServer *fakeCSIServer, address string) {
-	if runtime.GOOS == "windows" {
-		address = fmt.Sprintf("localhost:%d", +port)
-		csiServer = newFakeCSIServer("tcp", address)
-	} else {
-		address = filepath.Join(os.TempDir(), "csi.sock"+rand.String(4))
-		csiServer = newFakeCSIServer("unix", address)
-		address = "unix://" + address
-	}
-	return csiServer, address
-}
-
-func newFakeCSIServer(network, address string) *fakeCSIServer {
-	return &fakeCSIServer{
-		network: network,
-		address: address,
-	}
-}
-
-func (f *fakeCSIServer) run() {
-	listener, err := net.Listen(f.network, f.address)
-	if err != nil {
-		klog.Error("fake CSI server listen failed, ", err)
-		return
-	}
-	server := grpc.NewServer()
-	csi.RegisterIdentityServer(server, f)
-	csi.RegisterControllerServer(server, f)
-	csi.RegisterNodeServer(server, f)
-	go func() {
-		err = server.Serve(listener)
-		if err != nil && !strings.Contains(err.Error(), "stopped") {
-			klog.Error("fake CSI server serve failed, ", err)
-		}
-	}()
-	f.server = server
-}
-
-func (f *fakeCSIServer) stop() {
-	if f.server != nil {
-		f.server.Stop()
-	}
-}
-
-func (*fakeCSIServer) GetPluginCapabilities(ctx context.Context, req *csi.GetPluginCapabilitiesRequest) (*csi.GetPluginCapabilitiesResponse, error) {
-	return &csi.GetPluginCapabilitiesResponse{Capabilities: DefaultPluginCapability}, nil
-}
-
-func (*fakeCSIServer) ControllerGetCapabilities(ctx context.Context, req *csi.ControllerGetCapabilitiesRequest) (*csi.ControllerGetCapabilitiesResponse, error) {
-	var capabilities []*csi.ControllerServiceCapability
-	for _, rpcType := range DefaultControllerRPCType {
-		capability := &csi.ControllerServiceCapability{
-			Type: &csi.ControllerServiceCapability_Rpc{
-				Rpc: &csi.ControllerServiceCapability_RPC{
-					Type: rpcType,
-				},
-			},
-		}
-		capabilities = append(capabilities, capability)
-	}
-	return &csi.ControllerGetCapabilitiesResponse{Capabilities: capabilities}, nil
-}
-
-func (*fakeCSIServer) NodeGetCapabilities(ctx context.Context, req *csi.NodeGetCapabilitiesRequest) (*csi.NodeGetCapabilitiesResponse, error) {
-	var capabilities []*csi.NodeServiceCapability
-	for _, rpcType := range DefaultNodeRPCType {
-		capability := &csi.NodeServiceCapability{
-			Type: &csi.NodeServiceCapability_Rpc{
-				Rpc: &csi.NodeServiceCapability_RPC{
-					Type: rpcType,
-				},
-			},
-		}
-		capabilities = append(capabilities, capability)
-	}
-	return &csi.NodeGetCapabilitiesResponse{Capabilities: capabilities}, nil
-}
-
-func Test_CSICapability(t *testing.T) {
-	fakeCSIServer, address := newTestCSIServer(30087)
-	fakeCSIServer.run()
-	defer fakeCSIServer.stop()
-
-	specGot, err := csiCapability(address)
-	if err != nil {
-		t.Error(err)
-	}
-
-	specExpected := newStorageClassCapabilitySpec()
-	if diff := cmp.Diff(specGot, specExpected); diff != "" {
-		t.Errorf("%T differ (-got, +want): %s", specExpected, diff)
-	}
-}
-
-func newStorageClassCapabilitySpec() *v1alpha1.StorageClassCapabilitySpec {
-	return &v1alpha1.StorageClassCapabilitySpec{
-		Features: v1alpha1.CapabilityFeatures{
-			Topology: false,
-			Volume: v1alpha1.VolumeFeature{
-				Create: true,
-				Attach: false,
-				List:   false,
-				Clone:  true,
-				Stats:  true,
-				Expand: v1alpha1.ExpandModeOffline,
-			},
-			Snapshot: v1alpha1.SnapshotFeature{
-				Create: true,
-				List:   false,
-			},
-		},
-	}
-}

pkg/controller/user/user_controller.go

@@ -23,6 +23,8 @@ import (
 	"reflect"
 	"time"
 
+	"k8s.io/apimachinery/pkg/util/validation"
+
 	utilwait "k8s.io/apimachinery/pkg/util/wait"
 
 	"kubesphere.io/kubesphere/pkg/controller/utils/controller"
@@ -486,8 +488,12 @@ func (c *userController) deleteGroupBindings(user *iamv1alpha2.User) error {
 }
 
 func (c *userController) deleteRoleBindings(user *iamv1alpha2.User) error {
+	if len(user.Name) > validation.LabelValueMaxLength {
+		// ignore invalid label value error
+		return nil
+	}
 	listOptions := metav1.ListOptions{
-		LabelSelector: labels.SelectorFromSet(labels.Set{iamv1alpha2.UserReferenceLabel: user.Name}).String(),
+		LabelSelector: labels.SelectorFromValidatedSet(labels.Set{iamv1alpha2.UserReferenceLabel: user.Name}).String(),
 	}
 	deleteOptions := *metav1.NewDeleteOptions(0)
 	if err := c.ksClient.IamV1alpha2().GlobalRoleBindings().

pkg/kapis/alerting/v1/register.go

@@ -17,7 +17,7 @@ limitations under the License.
 package v1
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
 	"kubesphere.io/kubesphere/pkg/kapis/generic"

pkg/kapis/alerting/v2alpha1/handler.go

@@ -17,7 +17,7 @@ limitations under the License.
 package v2alpha1
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	promresourcesclient "github.com/prometheus-operator/prometheus-operator/pkg/client/versioned"
 	"k8s.io/klog"
 

pkg/kapis/alerting/v2alpha1/register.go

@@ -19,7 +19,7 @@ package v2alpha1
 import (
 	"net/http"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 	promresourcesclient "github.com/prometheus-operator/prometheus-operator/pkg/client/versioned"
 	"k8s.io/apimachinery/pkg/runtime/schema"

pkg/kapis/cluster/v1alpha1/handler.go

@@ -28,8 +28,8 @@ import (
 	"strings"
 	"time"
 
-	"github.com/emicklei/go-restful"
-	"gopkg.in/yaml.v2"
+	restful "github.com/emicklei/go-restful"
+	yaml "gopkg.in/yaml.v2"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"

pkg/kapis/cluster/v1alpha1/register.go

@@ -19,7 +19,7 @@ package v1alpha1
 import (
 	"net/http"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	k8sinformers "k8s.io/client-go/informers"

pkg/kapis/config/v1alpha2/register.go

@@ -17,7 +17,7 @@ limitations under the License.
 package v1alpha2
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
 	kubesphereconfig "kubesphere.io/kubesphere/pkg/apiserver/config"

pkg/kapis/devops/v1alpha2/devops.go

@@ -23,7 +23,7 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apiserver/pkg/authentication/user"
 	log "k8s.io/klog"
 	"k8s.io/klog/v2"

pkg/kapis/devops/v1alpha2/pipeline_sonar.go

@@ -17,7 +17,7 @@ limitations under the License.
 package v1alpha2
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/klog"
 
 	"kubesphere.io/kubesphere/pkg/api"

pkg/kapis/devops/v1alpha2/register.go

@@ -22,7 +22,7 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/proxy"

pkg/kapis/devops/v1alpha2/s2ibinary.go

@@ -21,7 +21,7 @@ import (
 	"net/http"
 
 	"code.cloudfoundry.org/bytefmt"
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/klog"
 
 	"kubesphere.io/kubesphere/pkg/api"

pkg/kapis/devops/v1alpha3/handler.go

@@ -17,7 +17,7 @@ limitations under the License.
 package v1alpha3
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/client-go/informers"

pkg/kapis/devops/v1alpha3/register.go

@@ -21,7 +21,7 @@ package v1alpha3
 import (
 	"net/http"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"

pkg/kapis/generic/generic.go

@@ -22,7 +22,7 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/proxy"
 	"k8s.io/klog"

pkg/kapis/generic/generic_test.go

@@ -21,7 +21,7 @@ import (
 	"net/url"
 	"testing"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"github.com/google/go-cmp/cmp"
 )
 

pkg/kapis/iam/v1alpha2/handler.go

@@ -25,7 +25,7 @@ import (
 	"kubesphere.io/kubesphere/pkg/apiserver/request"
 	"kubesphere.io/kubesphere/pkg/models/auth"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	rbacv1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/klog"

pkg/kapis/iam/v1alpha2/register.go

@@ -21,7 +21,7 @@ import (
 
 	"kubesphere.io/kubesphere/pkg/apiserver/authorization/authorizer"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 	rbacv1 "k8s.io/api/rbac/v1"
 	v1 "k8s.io/api/rbac/v1"

pkg/kapis/kubeedge/v1alpha1/register.go

@@ -17,7 +17,7 @@ limitations under the License.
 package v1
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
 	"kubesphere.io/kubesphere/pkg/kapis/generic"

pkg/kapis/metering/v1alpha1/handler.go

@@ -19,9 +19,11 @@
 package v1alpha1
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/client-go/kubernetes"
 
+	openpitrixoptions "kubesphere.io/kubesphere/pkg/simple/client/openpitrix"
+
 	"kubesphere.io/kubesphere/pkg/client/clientset/versioned"
 	"kubesphere.io/kubesphere/pkg/informers"
 	monitorhle "kubesphere.io/kubesphere/pkg/kapis/monitoring/v1alpha3"
@@ -43,6 +45,6 @@ type meterHandler interface {
 	HandlePVCMeterQuery(req *restful.Request, resp *restful.Response)
 }
 
-func newHandler(k kubernetes.Interface, m monitoring.Interface, f informers.InformerFactory, ksClient versioned.Interface, resourceGetter *resourcev1alpha3.ResourceGetter, meteringOptions *meteringclient.Options) meterHandler {
-	return monitorhle.NewHandler(k, m, nil, f, ksClient, resourceGetter, meteringOptions)
+func newHandler(k kubernetes.Interface, m monitoring.Interface, f informers.InformerFactory, ksClient versioned.Interface, resourceGetter *resourcev1alpha3.ResourceGetter, meteringOptions *meteringclient.Options, opOptions *openpitrixoptions.Options) meterHandler {
+	return monitorhle.NewHandler(k, m, nil, f, ksClient, resourceGetter, meteringOptions, opOptions)
 }

pkg/kapis/metering/v1alpha1/register.go

@@ -20,9 +20,11 @@ package v1alpha1
 import (
 	"net/http"
 
+	openpitrixoptions "kubesphere.io/kubesphere/pkg/simple/client/openpitrix"
+
 	"kubesphere.io/kubesphere/pkg/client/clientset/versioned"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/kubernetes"
@@ -45,10 +47,10 @@ const (
 
 var GroupVersion = schema.GroupVersion{Group: groupName, Version: "v1alpha1"}
 
-func AddToContainer(c *restful.Container, k8sClient kubernetes.Interface, meteringClient monitoring.Interface, factory informers.InformerFactory, ksClient versioned.Interface, cache cache.Cache, meteringOptions *meteringclient.Options) error {
+func AddToContainer(c *restful.Container, k8sClient kubernetes.Interface, meteringClient monitoring.Interface, factory informers.InformerFactory, ksClient versioned.Interface, cache cache.Cache, meteringOptions *meteringclient.Options, opOptions *openpitrixoptions.Options) error {
 	ws := runtime.NewWebService(GroupVersion)
 
-	h := newHandler(k8sClient, meteringClient, factory, ksClient, resourcev1alpha3.NewResourceGetter(factory, cache), meteringOptions)
+	h := newHandler(k8sClient, meteringClient, factory, ksClient, resourcev1alpha3.NewResourceGetter(factory, cache), meteringOptions, opOptions)
 
 	ws.Route(ws.GET("/cluster").
 		To(h.HandleClusterMeterQuery).

pkg/kapis/monitoring/v1alpha3/handler.go

@@ -23,10 +23,15 @@ import (
 	"regexp"
 	"strings"
 
+	restful "github.com/emicklei/go-restful"
+	"k8s.io/klog"
+
+	openpitrixoptions "kubesphere.io/kubesphere/pkg/simple/client/openpitrix"
+	"kubesphere.io/kubesphere/pkg/simple/client/s3"
+
 	"kubesphere.io/kubesphere/pkg/client/clientset/versioned"
 	"kubesphere.io/kubesphere/pkg/models/openpitrix"
 
-	"github.com/emicklei/go-restful"
 	"k8s.io/client-go/kubernetes"
 
 	"kubesphere.io/kubesphere/pkg/api"
@@ -44,10 +49,18 @@ type handler struct {
 	meteringOptions *meteringclient.Options
 }
 
-func NewHandler(k kubernetes.Interface, monitoringClient monitoring.Interface, metricsClient monitoring.Interface, f informers.InformerFactory, ksClient versioned.Interface, resourceGetter *resourcev1alpha3.ResourceGetter, meteringOptions *meteringclient.Options) *handler {
+func NewHandler(k kubernetes.Interface, monitoringClient monitoring.Interface, metricsClient monitoring.Interface, f informers.InformerFactory, ksClient versioned.Interface, resourceGetter *resourcev1alpha3.ResourceGetter, meteringOptions *meteringclient.Options, opOptions *openpitrixoptions.Options) *handler {
 	var opRelease openpitrix.Interface
+	var s3Client s3.Interface
+	if opOptions != nil && opOptions.S3Options != nil && len(opOptions.S3Options.Endpoint) != 0 {
+		var err error
+		s3Client, err = s3.NewS3Client(opOptions.S3Options)
+		if err != nil {
+			klog.Errorf("failed to connect to storage, please check storage service status, error: %v", err)
+		}
+	}
 	if ksClient != nil {
-		opRelease = openpitrix.NewOpenpitrixOperator(f, ksClient, nil)
+		opRelease = openpitrix.NewOpenpitrixOperator(f, ksClient, s3Client)
 	}
 	if meteringOptions == nil || meteringOptions.RetentionDay == "" {
 		meteringOptions = &meteringclient.DefaultMeteringOption
@@ -55,7 +68,7 @@ func NewHandler(k kubernetes.Interface, monitoringClient monitoring.Interface, m
 
 	return &handler{
 		k:               k,
-		mo:              model.NewMonitoringOperator(monitoringClient, metricsClient, k, f, resourceGetter),
+		mo:              model.NewMonitoringOperator(monitoringClient, metricsClient, k, f, resourceGetter, opRelease),
 		opRelease:       opRelease,
 		meteringOptions: meteringOptions,
 	}

pkg/kapis/monitoring/v1alpha3/helper.go

@@ -29,7 +29,7 @@ import (
 
 	"github.com/jszwec/csvutil"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"github.com/pkg/errors"
 	corev1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 

pkg/kapis/monitoring/v1alpha3/helper_test.go

@@ -331,7 +331,7 @@ func TestParseRequestParams(t *testing.T) {
 
 			fakeInformerFactory.KubeSphereSharedInformerFactory()
 
-			handler := NewHandler(client, nil, nil, fakeInformerFactory, ksClient, nil, nil)
+			handler := NewHandler(client, nil, nil, fakeInformerFactory, ksClient, nil, nil, nil)
 
 			result, err := handler.makeQueryOptions(tt.params, tt.lvl)
 			if err != nil {

pkg/kapis/monitoring/v1alpha3/meter.go

@@ -7,7 +7,7 @@ import (
 	"kubesphere.io/kubesphere/pkg/models/openpitrix"
 	"kubesphere.io/kubesphere/pkg/server/params"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/klog"
 

pkg/kapis/monitoring/v1alpha3/register.go

@@ -20,9 +20,11 @@ package v1alpha3
 import (
 	"net/http"
 
+	openpitrixoptions "kubesphere.io/kubesphere/pkg/simple/client/openpitrix"
+
 	"kubesphere.io/kubesphere/pkg/client/clientset/versioned"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/kubernetes"
@@ -41,10 +43,10 @@ const (
 
 var GroupVersion = schema.GroupVersion{Group: groupName, Version: "v1alpha3"}
 
-func AddToContainer(c *restful.Container, k8sClient kubernetes.Interface, monitoringClient monitoring.Interface, metricsClient monitoring.Interface, factory informers.InformerFactory, ksClient versioned.Interface) error {
+func AddToContainer(c *restful.Container, k8sClient kubernetes.Interface, monitoringClient monitoring.Interface, metricsClient monitoring.Interface, factory informers.InformerFactory, ksClient versioned.Interface, opOptions *openpitrixoptions.Options) error {
 	ws := runtime.NewWebService(GroupVersion)
 
-	h := NewHandler(k8sClient, monitoringClient, metricsClient, factory, ksClient, nil, nil)
+	h := NewHandler(k8sClient, monitoringClient, metricsClient, factory, ksClient, nil, nil, opOptions)
 
 	ws.Route(ws.GET("/kubesphere").
 		To(h.handleKubeSphereMetricsQuery).

pkg/kapis/network/v1alpha2/handler.go

@@ -22,7 +22,7 @@ import (
 	"net/http"
 	"net/url"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/klog"
 
 	"kubesphere.io/kubesphere/pkg/api"

pkg/kapis/notification/v1/register.go

@@ -17,7 +17,7 @@ limitations under the License.
 package v1
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 
 	"kubesphere.io/kubesphere/pkg/kapis/generic"

pkg/kapis/notification/v2beta1/handler.go

@@ -17,7 +17,7 @@ limitations under the License.
 package v2beta1
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/klog"

pkg/kapis/notification/v2beta1/register.go

@@ -21,7 +21,7 @@ package v2beta1
 import (
 	"net/http"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	openapi "github.com/emicklei/go-restful-openapi"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/kubernetes"

pkg/kapis/oauth/handler.go

@@ -23,7 +23,7 @@ import (
 
 	"kubesphere.io/kubesphere/pkg/server/errors"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apiserver/pkg/authentication/user"

pkg/kapis/oauth/register.go

@@ -19,7 +19,7 @@ package oauth
 import (
 	"net/http"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 
 	"kubesphere.io/kubesphere/pkg/api"

pkg/kapis/operations/v1alpha2/handler.go

@@ -20,7 +20,7 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	k8serr "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/client-go/kubernetes"
 

pkg/kapis/operations/v1alpha2/register.go

@@ -19,7 +19,7 @@ package v1alpha2
 import (
 	"net/http"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/kubernetes"
 

pkg/kapis/resources/v1alpha2/handler.go

@@ -22,7 +22,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	v1 "k8s.io/api/core/v1"
 	k8serr "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/client-go/kubernetes"

pkg/kapis/resources/v1alpha2/register.go

@@ -19,7 +19,7 @@ package v1alpha2
 import (
 	"net/http"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"

pkg/kapis/resources/v1alpha3/handler.go

@@ -19,7 +19,7 @@ package v1alpha3
 import (
 	"strings"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/klog"
 
 	"kubesphere.io/kubesphere/pkg/api"

pkg/kapis/resources/v1alpha3/register.go

@@ -17,7 +17,7 @@ limitations under the License.
 package v1alpha3
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"sigs.k8s.io/controller-runtime/pkg/cache"

pkg/kapis/servicemesh/metrics/install/install.go

@@ -17,7 +17,7 @@ limitations under the License.
 package install
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	urlruntime "k8s.io/apimachinery/pkg/util/runtime"
 
 	"kubesphere.io/kubesphere/pkg/apiserver/runtime"

pkg/kapis/servicemesh/metrics/v1alpha2/handler.go

@@ -21,7 +21,7 @@ import (
 	"io/ioutil"
 	"net/http"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/klog"
 
 	"kubesphere.io/kubesphere/pkg/api"

pkg/kapis/servicemesh/metrics/v1alpha2/register.go

@@ -19,7 +19,7 @@ package v1alpha2
 import (
 	"net/http"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 

pkg/kapis/tenant/v1alpha2/handler.go

@@ -20,7 +20,7 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

pkg/kapis/tenant/v1alpha2/metering.go

@@ -3,7 +3,7 @@ package v1alpha2
 import (
 	"fmt"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/klog"
 
 	"strconv"

pkg/kapis/tenant/v1alpha2/register.go

@@ -23,7 +23,7 @@ import (
 
 	"kubesphere.io/kubesphere/pkg/models/metering"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"

pkg/kapis/terminal/v1alpha2/handler.go

@@ -17,9 +17,14 @@ limitations under the License.
 package v1alpha2
 
 import (
+	"errors"
 	"net/http"
 
-	"github.com/emicklei/go-restful"
+	"kubesphere.io/kubesphere/pkg/api"
+	"kubesphere.io/kubesphere/pkg/apiserver/authorization/authorizer"
+	requestctx "kubesphere.io/kubesphere/pkg/apiserver/request"
+
+	restful "github.com/emicklei/go-restful"
 	"github.com/gorilla/websocket"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
@@ -37,10 +42,12 @@ var upgrader = websocket.Upgrader{
 
 type terminalHandler struct {
 	terminaler terminal.Interface
+	authorizer authorizer.Authorizer
 }
 
-func newTerminalHandler(client kubernetes.Interface, config *rest.Config) *terminalHandler {
+func newTerminalHandler(client kubernetes.Interface, authorizer authorizer.Authorizer, config *rest.Config) *terminalHandler {
 	return &terminalHandler{
+		authorizer: authorizer,
 		terminaler: terminal.NewTerminaler(client, config),
 	}
 }
@@ -51,6 +58,29 @@ func (t *terminalHandler) handleTerminalSession(request *restful.Request, respon
 	containerName := request.QueryParameter("container")
 	shell := request.QueryParameter("shell")
 
+	user, _ := requestctx.UserFrom(request.Request.Context())
+
+	createPodsExec := authorizer.AttributesRecord{
+		User:            user,
+		Verb:            "create",
+		Resource:        "pods",
+		Subresource:     "exec",
+		Namespace:       namespace,
+		ResourceRequest: true,
+		ResourceScope:   requestctx.NamespaceScope,
+	}
+
+	decision, reason, err := t.authorizer.Authorize(createPodsExec)
+	if err != nil {
+		api.HandleInternalError(response, request, err)
+		return
+	}
+
+	if decision != authorizer.DecisionAllow {
+		api.HandleForbidden(response, request, errors.New(reason))
+		return
+	}
+
 	conn, err := upgrader.Upgrade(response.ResponseWriter, request.Request, nil)
 	if err != nil {
 		klog.Warning(err)

pkg/kapis/terminal/v1alpha2/register.go

@@ -17,12 +17,14 @@ limitations under the License.
 package v1alpha2
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	restfulspec "github.com/emicklei/go-restful-openapi"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 
+	"kubesphere.io/kubesphere/pkg/apiserver/authorization/authorizer"
+
 	"kubesphere.io/kubesphere/pkg/apiserver/runtime"
 	"kubesphere.io/kubesphere/pkg/constants"
 	"kubesphere.io/kubesphere/pkg/models"
@@ -34,11 +36,11 @@ const (
 
 var GroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha2"}
 
-func AddToContainer(c *restful.Container, client kubernetes.Interface, config *rest.Config) error {
+func AddToContainer(c *restful.Container, client kubernetes.Interface, authorizer authorizer.Authorizer, config *rest.Config) error {
 
 	webservice := runtime.NewWebService(GroupVersion)
 
-	handler := newTerminalHandler(client, config)
+	handler := newTerminalHandler(client, authorizer, config)
 
 	webservice.Route(webservice.GET("/namespaces/{namespace}/pods/{pod}/exec").
 		To(handler.handleTerminalSession).

pkg/kapis/version/register.go

@@ -17,7 +17,7 @@ limitations under the License.
 package version
 
 import (
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/discovery"
 	"k8s.io/klog"

pkg/models/devops/project_pipeline_sonar_handler.go

@@ -19,7 +19,7 @@ package devops
 import (
 	"net/http"
 
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	"k8s.io/klog"
 
 	"kubesphere.io/kubesphere/pkg/server/errors"

pkg/models/devops/s2ibinary_handler.go

@@ -26,7 +26,7 @@ import (
 	"code.cloudfoundry.org/bytefmt"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	awsS3 "github.com/aws/aws-sdk-go/service/s3"
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/util/retry"
 	"k8s.io/klog"
@@ -103,7 +103,7 @@ func (s *s2iBinaryUploader) UploadS2iBinary(namespace, name, md5 string, fileHea
 	copy.Spec.FileName = fileHeader.Filename
 	copy.Spec.DownloadURL = fmt.Sprintf(GetS2iBinaryURL, namespace, name, copy.Spec.FileName)
 
-	err = s.s3Client.Upload(fmt.Sprintf("%s-%s", namespace, name), copy.Spec.FileName, binFile)
+	err = s.s3Client.Upload(fmt.Sprintf("%s-%s", namespace, name), copy.Spec.FileName, binFile, int(fileHeader.Size))
 	if err != nil {
 		if aerr, ok := err.(awserr.Error); ok {
 			switch aerr.Code() {

pkg/models/git/git.go

@@ -19,7 +19,7 @@ package git
 import (
 	"fmt"
 
-	"gopkg.in/src-d/go-git.v4"
+	git "gopkg.in/src-d/go-git.v4"
 	"gopkg.in/src-d/go-git.v4/config"
 	"gopkg.in/src-d/go-git.v4/plumbing/transport/http"
 	"gopkg.in/src-d/go-git.v4/storage/memory"

pkg/models/monitoring/monitoring.go

@@ -73,13 +73,14 @@ type monitoringOperator struct {
 	resourceGetter *resourcev1alpha3.ResourceGetter
 }
 
-func NewMonitoringOperator(monitoringClient monitoring.Interface, metricsClient monitoring.Interface, k8s kubernetes.Interface, factory informers.InformerFactory, resourceGetter *resourcev1alpha3.ResourceGetter) MonitoringOperator {
+func NewMonitoringOperator(monitoringClient monitoring.Interface, metricsClient monitoring.Interface, k8s kubernetes.Interface, factory informers.InformerFactory, resourceGetter *resourcev1alpha3.ResourceGetter, op openpitrix.Interface) MonitoringOperator {
 	return &monitoringOperator{
 		prometheus:     monitoringClient,
 		metricsserver:  metricsClient,
 		k8s:            k8s,
 		ks:             factory.KubeSphereSharedInformerFactory(),
 		resourceGetter: resourceGetter,
+		op:             op,
 	}
 }
 

pkg/models/openpitrix/applications.go

@@ -115,7 +115,7 @@ func (c *applicationOperator) createApp(app *v1alpha1.HelmApplication, iconData
 	if len(iconData) != 0 {
 		// save icon attachment
 		iconId := idutils.GetUuid(v1alpha1.HelmAttachmentPrefix)
-		err = c.backingStoreClient.Upload(iconId, iconId, bytes.NewBuffer(iconData))
+		err = c.backingStoreClient.Upload(iconId, iconId, bytes.NewBuffer(iconData), len(iconData))
 		if err != nil {
 			klog.Errorf("save icon attachment failed, error: %s", err)
 			return nil, err
@@ -498,7 +498,7 @@ func (c *applicationOperator) modifyAppAttachment(app *v1alpha1.HelmApplication,
 				// add attachment to app
 				add := idutils.GetUuid("att-")
 				*attachments = append(*attachments, add)
-				err = c.backingStoreClient.Upload(add, add, bytes.NewBuffer(request.AttachmentContent))
+				err = c.backingStoreClient.Upload(add, add, bytes.NewBuffer(request.AttachmentContent), len(request.AttachmentContent))
 				if err != nil {
 					return "", err
 				} else {
@@ -517,7 +517,7 @@ func (c *applicationOperator) modifyAppAttachment(app *v1alpha1.HelmApplication,
 	}
 	if len(request.AttachmentContent) != 0 {
 		add := idutils.GetUuid("att-")
-		err = c.backingStoreClient.Upload(add, add, bytes.NewBuffer(request.AttachmentContent))
+		err = c.backingStoreClient.Upload(add, add, bytes.NewBuffer(request.AttachmentContent), len(request.AttachmentContent))
 		if err != nil {
 			return "", err
 		} else {

pkg/models/openpitrix/applicationversions.go

@@ -202,7 +202,7 @@ func (c *applicationOperator) ModifyAppVersion(id string, request *ModifyAppVers
 		spec.Created = &now
 
 		// 3. save chart data to s3 storage, just overwrite the legacy data
-		err = c.backingStoreClient.Upload(dataKeyInStorage(versionCopy.GetWorkspace(), versionCopy.Name), versionCopy.Name, bytes.NewReader(request.Package))
+		err = c.backingStoreClient.Upload(dataKeyInStorage(versionCopy.GetWorkspace(), versionCopy.Name), versionCopy.Name, bytes.NewBuffer(request.Package), len(request.Package))
 		if err != nil {
 			klog.Errorf("upload chart for app version: %s/%s failed, error: %s", versionCopy.GetWorkspace(),
 				versionCopy.GetTrueName(), err)
@@ -490,7 +490,7 @@ func (c *applicationOperator) createApplicationVersion(ver *v1alpha1.HelmApplica
 		klog.Errorf("decode error: %s", err)
 		return nil, err
 	} else {
-		err = c.backingStoreClient.Upload(dataKeyInStorage(ver.GetWorkspace(), ver.Name), ver.Name, bytes.NewReader(ver.Spec.Data))
+		err = c.backingStoreClient.Upload(dataKeyInStorage(ver.GetWorkspace(), ver.Name), ver.Name, bytes.NewBuffer(ver.Spec.Data), len(ver.Spec.Data))
 		if err != nil {
 			klog.Errorf("upload chart for app version: %s/%s failed, error: %s", ver.GetWorkspace(),
 				ver.GetTrueName(), err)

pkg/models/openpitrix/attachments.go

@@ -65,7 +65,7 @@ func (c *attachmentOperator) CreateAttachment(data []byte) (*Attachment, error)
 	}
 	id := idutils.GetUuid36(v1alpha1.HelmAttachmentPrefix)
 
-	err := c.backingStoreClient.Upload(id, id, bytes.NewBuffer(data))
+	err := c.backingStoreClient.Upload(id, id, bytes.NewBuffer(data), len(data))
 	if err != nil {
 		klog.Errorf("upload attachment failed, err: %s", err)
 		return nil, err

pkg/models/registries/image.go

@@ -22,7 +22,7 @@ import (
 	"strings"
 
 	"github.com/docker/distribution/reference"
-	"github.com/opencontainers/go-digest"
+	digest "github.com/opencontainers/go-digest"
 	log "k8s.io/klog"
 )
 

pkg/models/registries/image_type.go

@@ -19,7 +19,7 @@ package registries
 import (
 	"time"
 
-	"github.com/opencontainers/go-digest"
+	digest "github.com/opencontainers/go-digest"
 )
 
 // ImageBlobInfo describes the info of an image.

pkg/models/registries/manifest.go

@@ -22,7 +22,7 @@ import (
 	"net/http"
 
 	"github.com/docker/distribution/manifest/schema2"
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	log "k8s.io/klog"
 )
 

pkg/models/registries/registries.go

@@ -25,7 +25,7 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/client"
-	"github.com/emicklei/go-restful"
+	restful "github.com/emicklei/go-restful"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/client-go/informers"
 	"k8s.io/klog"

pkg/models/resources/v1alpha3/workspacerolebinding/workspacerolebindings.go

@@ -26,6 +26,8 @@ import (
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3"
 )
 
+const RoleName = "rolename"
+
 type workspacerolebindingsGetter struct {
 	sharedInformers informers.SharedInformerFactory
 }
@@ -75,6 +77,10 @@ func (d *workspacerolebindingsGetter) filter(object runtime.Object, filter query
 	if !ok {
 		return false
 	}
-
-	return v1alpha3.DefaultObjectMetaFilter(role.ObjectMeta, filter)
+	switch filter.Field {
+	case RoleName:
+		return role.RoleRef.Name == string(filter.Value)
+	default:
+		return v1alpha3.DefaultObjectMetaFilter(role.ObjectMeta, filter)
+	}
 }

pkg/models/tenant/metering.go

@@ -926,11 +926,12 @@ func (t *tenantOperator) collectOpenPitrixComponents(cluster, ns string) map[str
 		}
 		for _, object := range app.ReleaseInfo {
 			unstructuredObj := object.(*unstructured.Unstructured)
-			if unstructuredObj.GetKind() == "Service" ||
-				unstructuredObj.GetKind() == "Deployment" ||
-				unstructuredObj.GetKind() == "Daemonset" ||
-				unstructuredObj.GetKind() == "Statefulset" {
-				opComponentsMap[op+":"+unstructuredObj.GetKind()] = append(opComponentsMap[unstructuredObj.GetKind()], unstructuredObj.GetName())
+			kind := unstructuredObj.GetKind()
+			if kind == "Service" ||
+				kind == "Deployment" ||
+				kind == "DaemonSet" ||
+				kind == "StatefulSet" {
+				opComponentsMap[op+":"+strings.ToLower(kind)] = append(opComponentsMap[kind], unstructuredObj.GetName())
 			}
 		}
 	}
@@ -949,7 +950,7 @@ func (t *tenantOperator) isOpenPitrixComponent(cluster, ns, kind, componentName
 			return false, ""
 		}
 		opName := kk[0]
-		if kk[1] == strings.Title(kind) {
+		if kk[1] == kind {
 			for _, svc := range v {
 				if componentName == svc {
 					return true, opName

pkg/models/tenant/tenant.go

@@ -127,7 +127,7 @@ func New(informers informers.InformerFactory, k8sclient kubernetes.Interface, ks
 		events:         events.NewEventsOperator(evtsClient),
 		lo:             logging.NewLoggingOperator(loggingClient),
 		auditing:       auditing.NewEventsOperator(auditingclient),
-		mo:             monitoring.NewMonitoringOperator(monitoringclient, nil, k8sclient, informers, resourceGetter),
+		mo:             monitoring.NewMonitoringOperator(monitoringclient, nil, k8sclient, informers, resourceGetter, nil),
 		opRelease:      openpitrixRelease,
 	}
 }