What happened:
The conversion webhook for the groupsnapshot.storage.k8s.io API group refuses any conversion that involves the v1 version. The volumegroupsnapshotcontents CRD serves v1beta1, v1beta2 and v1, with v1beta2 as the storage version and spec.conversion.strategy: Webhook. Because v1 is a served, non-storage version, the API server calls the webhook to convert v1 <-> v1beta2 on every access at v1 (create/get/list). The webhook only implements conversions between v1beta1 and v1beta2 -- it has no case for v1 -- so it rejects the request:
conversion webhook for groupsnapshot.storage.k8s.io/v1, Kind=VolumeGroupSnapshotContent failed:
unexpected conversion version from "groupsnapshot.storage.k8s.io/v1" to "groupsnapshot.storage.k8s.io/v1beta2"
What you expected to happen:
Conversions involving v1 succeed. Since v1 and v1beta2 are structurally identical, the webhook should treat v1 <-> v1beta2 as an identity conversion (and handle v1 <-> v1beta1 the same way it handles v1beta2 <-> v1beta1) rather than returning "unexpected conversion version". Creating/reading a VolumeGroupSnapshotContent at v1 should work whenever it works at v1beta2.
How to reproduce it:
On a cluster with the group snapshot CRDs and the conversion webhook running, submit a VolumeGroupSnapshotContent at the v1 version. Server-side dry run is enough -- nothing is persisted and no CSI call is made (the failure happens in the API server / webhook, before the driver is ever consulted, so it is driver-agnostic):
# vgsc-v1.yaml
apiVersion: groupsnapshot.storage.k8s.io/v1
kind: VolumeGroupSnapshotContent
metadata:
name: conversion-webhook-test
spec:
deletionPolicy: Retain
driver: example.csi.k8s.io # value is irrelevant; driver is never called
source:
groupSnapshotHandles:
volumeGroupSnapshotHandle: test-group-handle
volumeSnapshotHandles:
- test-snapshot-handle
volumeGroupSnapshotRef:
apiVersion: groupsnapshot.storage.k8s.io/v1
kind: VolumeGroupSnapshot
name: conversion-webhook-test-vgs
namespace: default
$ kubectl apply --dry-run=server -f vgsc-v1.yaml
Error from server: … conversion webhook for groupsnapshot.storage.k8s.io/v1, Kind=VolumeGroupSnapshotContent
failed: unexpected conversion version from "groupsnapshot.storage.k8s.io/v1" to "groupsnapshot.storage.k8s.io/v1beta2"
Submitting the same object at v1beta2 (the storage version, no conversion needed) succeeds, confirming the failure is limited to conversions that touch v1.
CRD version setup for reference:
$ kubectl get crd volumegroupsnapshotcontents.groupsnapshot.storage.k8s.io \
-o jsonpath='{range .spec.versions[*]}{.name}{" served="}{.served}{" storage="}{.storage}{"\n"}{end}'
v1 served=true storage=false
v1beta1 served=true storage=false
v1beta2 served=true storage=true
$ kubectl get crd volumegroupsnapshotcontents.groupsnapshot.storage.k8s.io -o jsonpath='{.spec.conversion.strategy}'
Webhook
Environment:
- Driver version: external-snapshotter v8.6.0 -- snapshot-controller, conversion-webhook, and the
csi-snapshotter sidecar all report "Version" version="v8.6.0". (CSI driver in our setup: LINSTOR CSI linstor.csi.linbit.com`, but the bug is driver-independent.)
- Kubernetes version (use
kubectl version): v1.36.2 and v1.33.13 (both affected)
- OS (e.g. from /etc/os-release): AlmaLinux 9
- Install tools: Helm Chart: https://artifacthub.io/packages/helm/piraeus-charts/snapshot-controller
- Others: CRD
volumegroupsnapshotcontents.groupsnapshot.storage.k8s.io serves v1beta1/v1beta2/v1, storage version v1beta2, spec.conversion.strategy: Webhook
What happened:
The conversion webhook for the
groupsnapshot.storage.k8s.ioAPI group refuses any conversion that involves thev1version. ThevolumegroupsnapshotcontentsCRD servesv1beta1,v1beta2andv1, withv1beta2as the storage version andspec.conversion.strategy: Webhook. Becausev1is a served, non-storage version, the API server calls the webhook to convertv1 <-> v1beta2on every access atv1(create/get/list). The webhook only implements conversions betweenv1beta1andv1beta2-- it has no case forv1-- so it rejects the request:What you expected to happen:
Conversions involving
v1succeed. Sincev1andv1beta2are structurally identical, the webhook should treatv1 <-> v1beta2as an identity conversion (and handlev1 <-> v1beta1the same way it handlesv1beta2 <-> v1beta1) rather than returning "unexpected conversion version". Creating/reading a VolumeGroupSnapshotContent atv1should work whenever it works atv1beta2.How to reproduce it:
On a cluster with the group snapshot CRDs and the conversion webhook running, submit a VolumeGroupSnapshotContent at the
v1version. Server-side dry run is enough -- nothing is persisted and no CSI call is made (the failure happens in the API server / webhook, before the driver is ever consulted, so it is driver-agnostic):Submitting the same object at
v1beta2(the storage version, no conversion needed) succeeds, confirming the failure is limited to conversions that touchv1.CRD version setup for reference:
Environment:
csi-snapshottersidecar all report"Version" version="v8.6.0". (CSI driver in our setup: LINSTOR CSI linstor.csi.linbit.com`, but the bug is driver-independent.)kubectl version): v1.36.2 and v1.33.13 (both affected)volumegroupsnapshotcontents.groupsnapshot.storage.k8s.ioserves v1beta1/v1beta2/v1, storage version v1beta2,spec.conversion.strategy: Webhook