Add GCNV ONTAP-mode HTTP transport for SAN and NAS drivers

Author: onkarganjewar

logging/context.go

@@ -74,6 +74,7 @@ const (
 	ContextRequestTargetTrident    ContextRequestTarget = "trident"
 	ContextRequestTargetKubernetes ContextRequestTarget = "kubernetes"
 	ContextRequestTargetONTAP      ContextRequestTarget = "ontap"
+	ContextRequestTargetGCNV       ContextRequestTarget = "gcnv"
 )
 
 // Misc. context request values. These can be used with incoming and outgoing requests.

logging/patterns.go

@@ -50,3 +50,21 @@ var backendAuthorization = redactedPattern{
 	re:  regexp.MustCompile(`\\*"username\\*":\\*"([^\\"])*\\*"`),
 	rep: []byte("\\\"username\\\":<REDACTED>"),
 }
+
+// backendMapOneLevelNested matches map[...] in %+#v logs with at most one nested map[...]
+// (e.g. credentialSource:map[file:...]). [^\]]* alone stops at the first ']' and leaks trailing fields.
+const backendMapOneLevelNested = `(?:[^\[\]]|map\[[^\]]*\])*`
+
+// backendSensitiveMap redacts backend credential maps in map-formatted logs (%+#v).
+// Examples:
+//
+//	credentials:map[name:my-secret type:secret]
+//	apiKey:map[private_key:... private_key_id:...]
+//	wipCredentialConfig:map[audience:... credentialSource:map[file:...] ...]
+//	wipCredential:map[audience:... credentialSource:map[file:...] ...]
+var backendSensitiveMap = redactedPattern{
+	re: regexp.MustCompile(
+		`(credentials|apiKey|wipCredentialConfig|wipCredential):map\[` + backendMapOneLevelNested + `\]`,
+	),
+	rep: []byte("$1:<REDACTED>"),
+}

logging/patterns_test.go

@@ -226,3 +226,57 @@ func TestBackendAuthorizationRedactor(t *testing.T) {
 		})
 	}
 }
+
+func TestBackendSensitiveMapRedactor(t *testing.T) {
+	tests := []struct {
+		name     string
+		line     string
+		expected string
+	}{
+		{
+			name:     "credentials map",
+			line:     "credentials:map[name:my-secret type:secret]",
+			expected: "credentials:<REDACTED>",
+		},
+		{
+			name:     "apiKey map",
+			line:     "apiKey:map[private_key:abc private_key_id:123]",
+			expected: "apiKey:<REDACTED>",
+		},
+		{
+			name:     "wipCredentialConfig simple",
+			line:     "wipCredentialConfig:map[audience:a tokenURL:https://example/token]",
+			expected: "wipCredentialConfig:<REDACTED>",
+		},
+		{
+			name: "wipCredentialConfig nested map",
+			line: "wipCredentialConfig:map[audience:a credentialSource:map[file:/var/run/secrets/token] " +
+				"subjectTokenType:urn:ietf:params:oauth:token-type:jwt tokenURL:https://sts.googleapis.com type:external_account]",
+			expected: "wipCredentialConfig:<REDACTED>",
+		},
+		{
+			name:     "wipCredential simple",
+			line:     "wipCredential:map[audience:a tokenURL:https://example/token]",
+			expected: "wipCredential:<REDACTED>",
+		},
+		{
+			name: "wipCredential nested map",
+			line: "wipCredential:map[audience:a credentialSource:map[file:/var/run/secrets/token] " +
+				"subjectTokenType:urn:ietf:params:oauth:token-type:jwt tokenURL:https://sts.googleapis.com type:external_account]",
+			expected: "wipCredential:<REDACTED>",
+		},
+		{
+			name:     "wrong key unchanged",
+			line:     "wipCredentialConfigs:map[audience:a]",
+			expected: "wipCredentialConfigs:map[audience:a]",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			input := []byte(test.line)
+			actual := backendSensitiveMap.re.ReplaceAll(input, backendSensitiveMap.rep)
+			assert.Equal(t, test.expected, string(actual))
+		})
+	}
+}

logging/redactor.go

@@ -20,6 +20,7 @@ var redactedPatterns = []redactedPattern{
 	backendCreateCHAPSecrets,
 	backendCreateCHAPUsername,
 	backendAuthorization,
+	backendSensitiveMap,
 }
 
 // Redactor is a formatter that redacts pre-defined regex patterns
@@ -32,6 +33,16 @@ func (r *Redactor) Format(entry *log.Entry) ([]byte, error) {
 	return redactAllPatterns(line), err
 }
 
+// RedactBytes applies all configured logging redaction patterns to raw bytes.
+func RedactBytes(line []byte) []byte {
+	return redactAllPatterns(line)
+}
+
+// RedactString applies all configured logging redaction patterns to a string.
+func RedactString(line string) string {
+	return string(redactAllPatterns([]byte(line)))
+}
+
 func redactAllPatterns(line []byte) []byte {
 	for _, rp := range redactedPatterns {
 		line = rp.re.ReplaceAll(line, rp.rep)

logging/transport.go

@@ -61,7 +61,8 @@ func (m *MetricsTransport) RoundTrip(req *http.Request) (*http.Response, error)
 		recErr = err
 		// Handle the special ONTAP case where the API may return EOF instead of
 		// an HTTP backpressure status when the server gives up.
-		if errors.Is(err, io.EOF) && m.target == ContextRequestTargetONTAP {
+		if errors.Is(err, io.EOF) &&
+			(m.target == ContextRequestTargetONTAP || m.target == ContextRequestTargetGCNV) {
 			recErr = errors.WrapWithServerBackPressureError(err, "received EOF from server")
 		}
 		return res, recErr
@@ -77,10 +78,10 @@ func (m *MetricsTransport) RoundTrip(req *http.Request) (*http.Response, error)
 		recErr = errors.ServerBackPressureError("received status: %d from the server", res.StatusCode)
 
 		switch m.target {
-		case ContextRequestTargetONTAP:
+		case ContextRequestTargetONTAP, ContextRequestTargetGCNV:
 			// This breaks the standard RoundTripper semantics but is necessary to handle
-			// the special case where ONTAP returns an EOF error when the API is too busy.
-			// ONTAP callers gate on err != nil and may not inspect the HTTP status code,
+			// the special case where ONTAP/GCNV proxy returns an EOF error when the API is too busy.
+			// Callers gate on err != nil and may not inspect the HTTP status code,
 			// so return a non-nil backpressure error.
 			return res, recErr
 		case ContextRequestTargetKubernetes:

persistent_store/crd/apis/netapp/v1/backendconfig.go

@@ -84,10 +84,7 @@ func (s *TridentBackendConfigSpec) ToString() string {
 		return ""
 	}
 
-	// Redact the credentials information
-	backendConfigSpec["credentials"] = "<REDACTED>"
-
-	return fmt.Sprintf("backendConfig: %+v", backendConfigSpec)
+	return RedactString(fmt.Sprintf("backendConfig: %+v", backendConfigSpec))
 }
 
 func (in *TridentBackendConfig) IsSpecValid() bool {

persistent_store/crd/apis/netapp/v1/backendconfig_test.go

@@ -0,0 +1,86 @@
+// Copyright 2026 NetApp, Inc. All Rights Reserved.
+
+package v1
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestTridentBackendConfigSpec_ToString_redactsGCNVAPIKey(t *testing.T) {
+	specJSON := `{
+		"version": 1,
+		"storageDriverName": "ontap-nas",
+		"credentials": {"name": "gcnv-sa-secret", "type": "secret"},
+		"gcnv": {
+			"proxyURL": "https://netapp.googleapis.com",
+			"apiKey": {
+				"type": "service_account",
+				"private_key": "FAKE-PRIVATE-KEY-VALUE",
+				"private_key_id": "key-id-123"
+			},
+			"wipCredential": {"audience": "test", "serviceAccountEmail": "sa@test"}
+		}
+	}`
+
+	spec := &TridentBackendConfigSpec{
+		RawExtension: runtime.RawExtension{Raw: json.RawMessage(specJSON)},
+	}
+	out := spec.ToString()
+
+	require.NotContains(t, out, "SECRET")
+	require.NotContains(t, out, "key-id-123")
+	require.NotContains(t, out, "gcnv-sa-secret")
+	require.Contains(t, out, "credentials:<REDACTED>")
+	require.Contains(t, out, "apiKey:<REDACTED>")
+	require.Contains(t, out, "wipCredential:<REDACTED>")
+	require.Contains(t, out, "proxyURL:https://netapp.googleapis.com")
+}
+
+func TestTridentBackendConfigSpec_ToString_redactsNativeGCNVAPIKey(t *testing.T) {
+	specJSON := `{
+		"version": 1,
+		"storageDriverName": "gcnv-nas",
+		"apiKey": {"private_key": "native-secret", "private_key_id": "native-id"},
+		"wipCredentialConfig": {"audience": "a"}
+	}`
+
+	spec := &TridentBackendConfigSpec{
+		RawExtension: runtime.RawExtension{Raw: json.RawMessage(specJSON)},
+	}
+	out := spec.ToString()
+
+	require.NotContains(t, out, "native-secret")
+	require.NotContains(t, out, "native-id")
+	require.Contains(t, out, "apiKey:<REDACTED>")
+	require.Contains(t, out, "wipCredentialConfig:<REDACTED>")
+}
+
+func TestTridentBackendConfigSpec_ToString_redactsNestedWIPCredential(t *testing.T) {
+	specJSON := `{
+		"version": 1,
+		"storageDriverName": "ontap-nas",
+		"gcnv": {
+			"proxyURL": "https://netapp.googleapis.com",
+			"wipCredential": {
+				"audience": "//iam.googleapis.com/projects/123",
+				"credentialSource": {"file": "/var/run/secrets/token"},
+				"subjectTokenType": "urn:ietf:params:oauth:token-type:jwt",
+				"tokenURL": "https://sts.googleapis.com/v1/token",
+				"type": "external_account"
+			}
+		}
+	}`
+
+	spec := &TridentBackendConfigSpec{
+		RawExtension: runtime.RawExtension{Raw: json.RawMessage(specJSON)},
+	}
+	out := spec.ToString()
+
+	require.NotContains(t, out, "/var/run/secrets/token")
+	require.NotContains(t, out, "sts.googleapis.com")
+	require.Contains(t, out, "wipCredential:<REDACTED>")
+}

storage_drivers/common.go

@@ -34,6 +34,7 @@ import (
 var ontapConfigRedactList = [...]string{
 	"Username", "Password", "ChapUsername", "ChapInitiatorSecret",
 	"ChapTargetUsername", "ChapTargetInitiatorSecret", "ClientPrivateKey",
+	"GCNVConfig",
 }
 
 func GetOntapConfigRedactList() []string {

storage_drivers/ontap/api/abstraction.go

@@ -202,6 +202,11 @@ type OntapAPI interface {
 	VolumeCloneSplitStart(ctx context.Context, cloneName string) error
 
 	VolumeCreate(ctx context.Context, volume Volume) error
+	// VolumeDestroy keeps both flags in the shared abstraction because ZAPI and REST expose
+	// delete semantics differently. ZAPI consumes force directly and may need a follow-up
+	// recovery-queue purge when skipRecoveryQueue is true. REST only exposes one delete flag at
+	// the transport layer, so the REST adapter maps skipRecoveryQueue onto that flag while keeping
+	// this caller-facing signature stable.
 	VolumeDestroy(ctx context.Context, volumeName string, force, skipRecoveryQueue bool) error
 	VolumeModifySnapshotDirectoryAccess(ctx context.Context, name string, enable bool) error
 	VolumeExists(ctx context.Context, volumeName string) (bool, error)

storage_drivers/ontap/api/abstraction_zapi.go

@@ -96,6 +96,15 @@ func (d OntapAPIZAPI) VolumeCreate(ctx context.Context, volume Volume) error {
 	return err
 }
 
+// VolumeDestroy deletes a flexvol via ONTAP ZAPI.
+//
+// force and skipRecoveryQueue are not the same on ZAPI:
+//   - force: passed to ZAPI VolumeDestroy (ONTAP force delete semantics).
+//   - skipRecoveryQueue: when true, after a successful destroy, best-effort purge of the volume
+//     from the recovery queue via separate ZAPI calls (GetIter + Purge).
+//
+// REST/GCNV uses abstraction_rest.VolumeDestroy instead; there skipRecoveryQueue maps to REST
+// DELETE ?force= and there is no post-delete RQ purge in that path.
 func (d OntapAPIZAPI) VolumeDestroy(ctx context.Context, name string, force, skipRecoveryQueue bool) error {
 	volDestroyResponse, err := d.api.VolumeDestroy(name, force)
 	if err != nil {