Merge pull request #54013 from vladimirvivien/scaleio-secret-multi-tenancy

Automatic merge from submit-queue (batch tested with PRs 49865, 53731, 54013, 54513, 51502). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

ScaleIO - Ability to specify Secret's name and namespace 

**What this PR does / why we need it**:
This PR is to decouple the ScaleIO secret from the same namespace as that of the StorageClass/PVC/PV that uses it (#53619). Currently, authorized non-admin k8s user, who creates volumes, may end up having unauthorized access to ScaleIO secret information.  This PR introduces secret parameter that allows specification of secret's namespace.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #53619 

**Release note**:
```release-note
ScaleIO persistent volumes now support referencing a secret in a namespace other than the bound persistent volume claim's namespace; this is controlled during provisioning with the `secretNamespace` storage class parameter; StoragePool and ProtectionDomain attributes no longer defaults to the value `default`
```

api/openapi-spec/swagger.json

@@ -68785,7 +68785,7 @@
      },
      "scaleIO": {
       "description": "ScaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.",
-      "$ref": "#/definitions/io.k8s.api.core.v1.ScaleIOVolumeSource"
+      "$ref": "#/definitions/io.k8s.api.core.v1.ScaleIOPersistentVolumeSource"
      },
      "storageClassName": {
       "description": "Name of StorageClass to which this persistent volume belongs. Empty value means that this volume does not belong to any StorageClass.",
@@ -69839,6 +69839,56 @@
      }
     }
    },
+   "io.k8s.api.core.v1.ScaleIOPersistentVolumeSource": {
+    "description": "ScaleIOPersistentVolumeSource represents a persistent ScaleIO volume",
+    "required": [
+     "gateway",
+     "system",
+     "secretRef"
+    ],
+    "properties": {
+     "fsType": {
+      "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+      "type": "string"
+     },
+     "gateway": {
+      "description": "The host address of the ScaleIO API Gateway.",
+      "type": "string"
+     },
+     "protectionDomain": {
+      "description": "The name of the ScaleIO Protection Domain for the configured storage.",
+      "type": "string"
+     },
+     "readOnly": {
+      "description": "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+      "type": "boolean"
+     },
+     "secretRef": {
+      "description": "SecretRef references to the secret for ScaleIO user and other sensitive information. If this is not provided, Login operation will fail.",
+      "$ref": "#/definitions/io.k8s.api.core.v1.SecretReference"
+     },
+     "sslEnabled": {
+      "description": "Flag to enable/disable SSL communication with Gateway, default false",
+      "type": "boolean"
+     },
+     "storageMode": {
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.",
+      "type": "string"
+     },
+     "storagePool": {
+      "description": "The ScaleIO Storage Pool associated with the protection domain.",
+      "type": "string"
+     },
+     "system": {
+      "description": "The name of the storage system as configured in ScaleIO.",
+      "type": "string"
+     },
+     "volumeName": {
+      "description": "The name of a volume already created in the ScaleIO system that is associated with this volume source.",
+      "type": "string"
+     }
+    }
+   },
    "io.k8s.api.core.v1.ScaleIOVolumeSource": {
     "description": "ScaleIOVolumeSource represents a persistent ScaleIO volume",
     "required": [
@@ -69856,7 +69906,7 @@
       "type": "string"
      },
      "protectionDomain": {
-      "description": "The name of the Protection Domain for the configured storage (defaults to \"default\").",
+      "description": "The name of the ScaleIO Protection Domain for the configured storage.",
       "type": "string"
      },
      "readOnly": {
@@ -69872,11 +69922,11 @@
       "type": "boolean"
      },
      "storageMode": {
-      "description": "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\").",
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.",
       "type": "string"
      },
      "storagePool": {
-      "description": "The Storage Pool associated with the protection domain (defaults to \"default\").",
+      "description": "The ScaleIO Storage Pool associated with the protection domain.",
       "type": "string"
      },
      "system": {

api/swagger-spec/apps_v1.json

@@ -2674,15 +2674,15 @@
      },
      "protectionDomain": {
       "type": "string",
-      "description": "The name of the Protection Domain for the configured storage (defaults to \"default\")."
+      "description": "The name of the ScaleIO Protection Domain for the configured storage."
      },
      "storagePool": {
       "type": "string",
-      "description": "The Storage Pool associated with the protection domain (defaults to \"default\")."
+      "description": "The ScaleIO Storage Pool associated with the protection domain."
      },
      "storageMode": {
       "type": "string",
-      "description": "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\")."
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned."
      },
      "volumeName": {
       "type": "string",

api/swagger-spec/apps_v1beta1.json

@@ -5344,15 +5344,15 @@
      },
      "protectionDomain": {
       "type": "string",
-      "description": "The name of the Protection Domain for the configured storage (defaults to \"default\")."
+      "description": "The name of the ScaleIO Protection Domain for the configured storage."
      },
      "storagePool": {
       "type": "string",
-      "description": "The Storage Pool associated with the protection domain (defaults to \"default\")."
+      "description": "The ScaleIO Storage Pool associated with the protection domain."
      },
      "storageMode": {
       "type": "string",
-      "description": "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\")."
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned."
      },
      "volumeName": {
       "type": "string",

api/swagger-spec/apps_v1beta2.json

@@ -7709,15 +7709,15 @@
      },
      "protectionDomain": {
       "type": "string",
-      "description": "The name of the Protection Domain for the configured storage (defaults to \"default\")."
+      "description": "The name of the ScaleIO Protection Domain for the configured storage."
      },
      "storagePool": {
       "type": "string",
-      "description": "The Storage Pool associated with the protection domain (defaults to \"default\")."
+      "description": "The ScaleIO Storage Pool associated with the protection domain."
      },
      "storageMode": {
       "type": "string",
-      "description": "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\")."
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned."
      },
      "volumeName": {
       "type": "string",

api/swagger-spec/batch_v1.json

@@ -2684,15 +2684,15 @@
      },
      "protectionDomain": {
       "type": "string",
-      "description": "The name of the Protection Domain for the configured storage (defaults to \"default\")."
+      "description": "The name of the ScaleIO Protection Domain for the configured storage."
      },
      "storagePool": {
       "type": "string",
-      "description": "The Storage Pool associated with the protection domain (defaults to \"default\")."
+      "description": "The ScaleIO Storage Pool associated with the protection domain."
      },
      "storageMode": {
       "type": "string",
-      "description": "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\")."
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned."
      },
      "volumeName": {
       "type": "string",

api/swagger-spec/batch_v1beta1.json

@@ -2739,15 +2739,15 @@
      },
      "protectionDomain": {
       "type": "string",
-      "description": "The name of the Protection Domain for the configured storage (defaults to \"default\")."
+      "description": "The name of the ScaleIO Protection Domain for the configured storage."
      },
      "storagePool": {
       "type": "string",
-      "description": "The Storage Pool associated with the protection domain (defaults to \"default\")."
+      "description": "The ScaleIO Storage Pool associated with the protection domain."
      },
      "storageMode": {
       "type": "string",
-      "description": "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\")."
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned."
      },
      "volumeName": {
       "type": "string",

api/swagger-spec/batch_v2alpha1.json

@@ -2739,15 +2739,15 @@
      },
      "protectionDomain": {
       "type": "string",
-      "description": "The name of the Protection Domain for the configured storage (defaults to \"default\")."
+      "description": "The name of the ScaleIO Protection Domain for the configured storage."
      },
      "storagePool": {
       "type": "string",
-      "description": "The Storage Pool associated with the protection domain (defaults to \"default\")."
+      "description": "The ScaleIO Storage Pool associated with the protection domain."
      },
      "storageMode": {
       "type": "string",
-      "description": "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\")."
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned."
      },
      "volumeName": {
       "type": "string",

api/swagger-spec/extensions_v1beta1.json

@@ -8352,15 +8352,15 @@
      },
      "protectionDomain": {
       "type": "string",
-      "description": "The name of the Protection Domain for the configured storage (defaults to \"default\")."
+      "description": "The name of the ScaleIO Protection Domain for the configured storage."
      },
      "storagePool": {
       "type": "string",
-      "description": "The Storage Pool associated with the protection domain (defaults to \"default\")."
+      "description": "The ScaleIO Storage Pool associated with the protection domain."
      },
      "storageMode": {
       "type": "string",
-      "description": "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\")."
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned."
      },
      "volumeName": {
       "type": "string",

api/swagger-spec/settings.k8s.io_v1alpha1.json

@@ -2492,15 +2492,15 @@
      },
      "protectionDomain": {
       "type": "string",
-      "description": "The name of the Protection Domain for the configured storage (defaults to \"default\")."
+      "description": "The name of the ScaleIO Protection Domain for the configured storage."
      },
      "storagePool": {
       "type": "string",
-      "description": "The Storage Pool associated with the protection domain (defaults to \"default\")."
+      "description": "The ScaleIO Storage Pool associated with the protection domain."
      },
      "storageMode": {
       "type": "string",
-      "description": "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\")."
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned."
      },
      "volumeName": {
       "type": "string",

api/swagger-spec/v1.json

@@ -20581,7 +20581,7 @@
       "description": "PortworxVolume represents a portworx volume attached and mounted on kubelets host machine"
      },
      "scaleIO": {
-      "$ref": "v1.ScaleIOVolumeSource",
+      "$ref": "v1.ScaleIOPersistentVolumeSource",
       "description": "ScaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes."
      },
      "local": {
@@ -21160,9 +21160,9 @@
      }
     }
    },
-   "v1.ScaleIOVolumeSource": {
+   "v1.ScaleIOPersistentVolumeSource": {
-    "id": "v1.ScaleIOVolumeSource",
+    "id": "v1.ScaleIOPersistentVolumeSource",
-    "description": "ScaleIOVolumeSource represents a persistent ScaleIO volume",
+    "description": "ScaleIOPersistentVolumeSource represents a persistent ScaleIO volume",
     "required": [
      "gateway",
      "system",
@@ -21178,7 +21178,7 @@
       "description": "The name of the storage system as configured in ScaleIO."
      },
      "secretRef": {
-      "$ref": "v1.LocalObjectReference",
+      "$ref": "v1.SecretReference",
       "description": "SecretRef references to the secret for ScaleIO user and other sensitive information. If this is not provided, Login operation will fail."
      },
      "sslEnabled": {
@@ -21187,15 +21187,15 @@
      },
      "protectionDomain": {
       "type": "string",
-      "description": "The name of the Protection Domain for the configured storage (defaults to \"default\")."
+      "description": "The name of the ScaleIO Protection Domain for the configured storage."
      },
      "storagePool": {
       "type": "string",
-      "description": "The Storage Pool associated with the protection domain (defaults to \"default\")."
+      "description": "The ScaleIO Storage Pool associated with the protection domain."
      },
      "storageMode": {
       "type": "string",
-      "description": "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\")."
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned."
      },
      "volumeName": {
       "type": "string",
@@ -21979,6 +21979,57 @@
      }
     }
    },
+   "v1.ScaleIOVolumeSource": {
+    "id": "v1.ScaleIOVolumeSource",
+    "description": "ScaleIOVolumeSource represents a persistent ScaleIO volume",
+    "required": [
+     "gateway",
+     "system",
+     "secretRef"
+    ],
+    "properties": {
+     "gateway": {
+      "type": "string",
+      "description": "The host address of the ScaleIO API Gateway."
+     },
+     "system": {
+      "type": "string",
+      "description": "The name of the storage system as configured in ScaleIO."
+     },
+     "secretRef": {
+      "$ref": "v1.LocalObjectReference",
+      "description": "SecretRef references to the secret for ScaleIO user and other sensitive information. If this is not provided, Login operation will fail."
+     },
+     "sslEnabled": {
+      "type": "boolean",
+      "description": "Flag to enable/disable SSL communication with Gateway, default false"
+     },
+     "protectionDomain": {
+      "type": "string",
+      "description": "The name of the ScaleIO Protection Domain for the configured storage."
+     },
+     "storagePool": {
+      "type": "string",
+      "description": "The ScaleIO Storage Pool associated with the protection domain."
+     },
+     "storageMode": {
+      "type": "string",
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned."
+     },
+     "volumeName": {
+      "type": "string",
+      "description": "The name of a volume already created in the ScaleIO system that is associated with this volume source."
+     },
+     "fsType": {
+      "type": "string",
+      "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified."
+     },
+     "readOnly": {
+      "type": "boolean",
+      "description": "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts."
+     }
+    }
+   },
    "v1.StorageOSVolumeSource": {
     "id": "v1.StorageOSVolumeSource",
     "description": "Represents a StorageOS persistent volume resource.",

docs/api-reference/apps/v1/definitions.html

@@ -3826,21 +3826,21 @@ Examples:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">protectionDomain</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the Protection Domain for the configured storage (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the ScaleIO Protection Domain for the configured storage.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storagePool</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The Storage Pool associated with the protection domain (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The ScaleIO Storage Pool associated with the protection domain.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storageMode</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be thick or thin (defaults to "thin").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>

docs/api-reference/apps/v1beta1/definitions.html

@@ -4639,21 +4639,21 @@ Examples:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">protectionDomain</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the Protection Domain for the configured storage (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the ScaleIO Protection Domain for the configured storage.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storagePool</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The Storage Pool associated with the protection domain (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The ScaleIO Storage Pool associated with the protection domain.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storageMode</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be thick or thin (defaults to "thin").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>

docs/api-reference/apps/v1beta2/definitions.html

@@ -5000,21 +5000,21 @@ Examples:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">protectionDomain</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the Protection Domain for the configured storage (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the ScaleIO Protection Domain for the configured storage.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storagePool</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The Storage Pool associated with the protection domain (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The ScaleIO Storage Pool associated with the protection domain.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storageMode</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be thick or thin (defaults to "thin").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>

docs/api-reference/batch/v1/definitions.html

@@ -3813,21 +3813,21 @@ Examples:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">protectionDomain</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the Protection Domain for the configured storage (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the ScaleIO Protection Domain for the configured storage.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storagePool</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The Storage Pool associated with the protection domain (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The ScaleIO Storage Pool associated with the protection domain.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storageMode</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be thick or thin (defaults to "thin").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>

docs/api-reference/batch/v1beta1/definitions.html

@@ -3923,21 +3923,21 @@ Examples:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">protectionDomain</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the Protection Domain for the configured storage (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the ScaleIO Protection Domain for the configured storage.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storagePool</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The Storage Pool associated with the protection domain (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The ScaleIO Storage Pool associated with the protection domain.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storageMode</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be thick or thin (defaults to "thin").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>

docs/api-reference/batch/v2alpha1/definitions.html

@@ -3820,21 +3820,21 @@ Examples:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">protectionDomain</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the Protection Domain for the configured storage (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the ScaleIO Protection Domain for the configured storage.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storagePool</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The Storage Pool associated with the protection domain (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The ScaleIO Storage Pool associated with the protection domain.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storageMode</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be thick or thin (defaults to "thin").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>

docs/api-reference/extensions/v1beta1/definitions.html

@@ -5268,21 +5268,21 @@ Examples:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">protectionDomain</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the Protection Domain for the configured storage (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the ScaleIO Protection Domain for the configured storage.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storagePool</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The Storage Pool associated with the protection domain (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The ScaleIO Storage Pool associated with the protection domain.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storageMode</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be thick or thin (defaults to "thin").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>

docs/api-reference/settings.k8s.io/v1alpha1/definitions.html

@@ -541,21 +541,21 @@ span.icon > [class^="icon-"], span.icon > [class*=" icon-"] { cursor: default; }
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">protectionDomain</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the Protection Domain for the configured storage (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the ScaleIO Protection Domain for the configured storage.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storagePool</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The Storage Pool associated with the protection domain (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The ScaleIO Storage Pool associated with the protection domain.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storageMode</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be thick or thin (defaults to "thin").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>

docs/api-reference/v1/definitions.html

@@ -6475,47 +6475,6 @@ Examples:<br>
 </tbody>
 </table>
 
-</div>
-<div class="sect2">
-<h3 id="_v1_photonpersistentdiskvolumesource">v1.PhotonPersistentDiskVolumeSource</h3>
-<div class="paragraph">
-<p>Represents a Photon Controller persistent disk resource.</p>
-</div>
-<table class="tableblock frame-all grid-all" style="width:100%; ">
-<colgroup>
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;"> 
-</colgroup>
-<thead>
-<tr>
-<th class="tableblock halign-left valign-top">Name</th>
-<th class="tableblock halign-left valign-top">Description</th>
-<th class="tableblock halign-left valign-top">Required</th>
-<th class="tableblock halign-left valign-top">Schema</th>
-<th class="tableblock halign-left valign-top">Default</th>
-</tr>
-</thead>
-<tbody>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">pdID</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">ID that identifies Photon Controller persistent disk</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">fsType</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-</tbody>
-</table>
-
 </div>
 <div class="sect2">
 <h3 id="_v1_scaleiovolumesource">v1.ScaleIOVolumeSource</h3>
@@ -6570,21 +6529,21 @@ Examples:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">protectionDomain</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the Protection Domain for the configured storage (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the ScaleIO Protection Domain for the configured storage.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storagePool</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The Storage Pool associated with the protection domain (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The ScaleIO Storage Pool associated with the protection domain.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storageMode</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be thick or thin (defaults to "thin").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
@@ -6613,6 +6572,47 @@ Examples:<br>
 </tbody>
 </table>
 
+</div>
+<div class="sect2">
+<h3 id="_v1_photonpersistentdiskvolumesource">v1.PhotonPersistentDiskVolumeSource</h3>
+<div class="paragraph">
+<p>Represents a Photon Controller persistent disk resource.</p>
+</div>
+<table class="tableblock frame-all grid-all" style="width:100%; ">
+<colgroup>
+<col style="width:20%;">
+<col style="width:20%;">
+<col style="width:20%;">
+<col style="width:20%;">
+<col style="width:20%;"> 
+</colgroup>
+<thead>
+<tr>
+<th class="tableblock halign-left valign-top">Name</th>
+<th class="tableblock halign-left valign-top">Description</th>
+<th class="tableblock halign-left valign-top">Required</th>
+<th class="tableblock halign-left valign-top">Schema</th>
+<th class="tableblock halign-left valign-top">Default</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">pdID</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">ID that identifies Photon Controller persistent disk</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
+<td class="tableblock halign-left valign-top"></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">fsType</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
+<td class="tableblock halign-left valign-top"></td>
+</tr>
+</tbody>
+</table>
+
 </div>
 <div class="sect2">
 <h3 id="_v1_hostpathtype">v1.HostPathType</h3>
@@ -7727,7 +7727,7 @@ Examples:<br>
 <td class="tableblock halign-left valign-top"><p class="tableblock">scaleIO</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">ScaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_scaleiovolumesource">v1.ScaleIOVolumeSource</a></p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_scaleiopersistentvolumesource">v1.ScaleIOPersistentVolumeSource</a></p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
@@ -10382,6 +10382,103 @@ Examples:<br>
 </tbody>
 </table>
 
+</div>
+<div class="sect2">
+<h3 id="_v1_scaleiopersistentvolumesource">v1.ScaleIOPersistentVolumeSource</h3>
+<div class="paragraph">
+<p>ScaleIOPersistentVolumeSource represents a persistent ScaleIO volume</p>
+</div>
+<table class="tableblock frame-all grid-all" style="width:100%; ">
+<colgroup>
+<col style="width:20%;">
+<col style="width:20%;">
+<col style="width:20%;">
+<col style="width:20%;">
+<col style="width:20%;"> 
+</colgroup>
+<thead>
+<tr>
+<th class="tableblock halign-left valign-top">Name</th>
+<th class="tableblock halign-left valign-top">Description</th>
+<th class="tableblock halign-left valign-top">Required</th>
+<th class="tableblock halign-left valign-top">Schema</th>
+<th class="tableblock halign-left valign-top">Default</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">gateway</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The host address of the ScaleIO API Gateway.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
+<td class="tableblock halign-left valign-top"></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">system</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the storage system as configured in ScaleIO.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
+<td class="tableblock halign-left valign-top"></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">secretRef</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">SecretRef references to the secret for ScaleIO user and other sensitive information. If this is not provided, Login operation will fail.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_secretreference">v1.SecretReference</a></p></td>
+<td class="tableblock halign-left valign-top"></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">sslEnabled</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Flag to enable/disable SSL communication with Gateway, default false</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">boolean</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">protectionDomain</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the ScaleIO Protection Domain for the configured storage.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
+<td class="tableblock halign-left valign-top"></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">storagePool</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The ScaleIO Storage Pool associated with the protection domain.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
+<td class="tableblock halign-left valign-top"></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">storageMode</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
+<td class="tableblock halign-left valign-top"></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">volumeName</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of a volume already created in the ScaleIO system that is associated with this volume source.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
+<td class="tableblock halign-left valign-top"></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">fsType</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
+<td class="tableblock halign-left valign-top"></td>
+</tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">readOnly</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">boolean</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
+</tr>
+</tbody>
+</table>
+
 </div>
 <div class="sect2">
 <h3 id="_v1_servicespec">v1.ServiceSpec</h3>

federation/apis/openapi-spec/swagger.json

@@ -12525,7 +12525,7 @@
       "type": "string"
      },
      "protectionDomain": {
-      "description": "The name of the Protection Domain for the configured storage (defaults to \"default\").",
+      "description": "The name of the ScaleIO Protection Domain for the configured storage.",
       "type": "string"
      },
      "readOnly": {
@@ -12541,11 +12541,11 @@
       "type": "boolean"
      },
      "storageMode": {
-      "description": "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\").",
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.",
       "type": "string"
      },
      "storagePool": {
-      "description": "The Storage Pool associated with the protection domain (defaults to \"default\").",
+      "description": "The ScaleIO Storage Pool associated with the protection domain.",
       "type": "string"
      },
      "system": {

federation/apis/swagger-spec/extensions_v1beta1.json

@@ -6516,15 +6516,15 @@
      },
      "protectionDomain": {
       "type": "string",
-      "description": "The name of the Protection Domain for the configured storage (defaults to \"default\")."
+      "description": "The name of the ScaleIO Protection Domain for the configured storage."
      },
      "storagePool": {
       "type": "string",
-      "description": "The Storage Pool associated with the protection domain (defaults to \"default\")."
+      "description": "The ScaleIO Storage Pool associated with the protection domain."
      },
      "storageMode": {
       "type": "string",
-      "description": "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\")."
+      "description": "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned."
      },
      "volumeName": {
       "type": "string",

federation/docs/api-reference/extensions/v1beta1/definitions.html

@@ -4850,21 +4850,21 @@ Examples:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">protectionDomain</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the Protection Domain for the configured storage (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the ScaleIO Protection Domain for the configured storage.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storagePool</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">The Storage Pool associated with the protection domain (defaults to "default").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">The ScaleIO Storage Pool associated with the protection domain.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">storageMode</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be thick or thin (defaults to "thin").</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>

pkg/api/fuzzer/fuzzer.go

@@ -410,14 +410,16 @@ var Funcs = func(codecs runtimeserializer.CodecFactory) []interface{} {
 			}
 		},
 		func(sio *api.ScaleIOVolumeSource, c fuzz.Continue) {
-			sio.ProtectionDomain = c.RandString()
+			sio.StorageMode = c.RandString()
-			if sio.ProtectionDomain == "" {
+			if sio.StorageMode == "" {
-				sio.ProtectionDomain = "default"
+				sio.StorageMode = "ThinProvisioned"
 			}
-			sio.StoragePool = c.RandString()
+			sio.FSType = c.RandString()
-			if sio.StoragePool == "" {
+			if sio.FSType == "" {
-				sio.StoragePool = "default"
+				sio.FSType = "xfs"
 			}
+		},
+		func(sio *api.ScaleIOPersistentVolumeSource, c fuzz.Continue) {
 			sio.StorageMode = c.RandString()
 			if sio.StorageMode == "" {
 				sio.StorageMode = "ThinProvisioned"

pkg/api/persistentvolume/util.go

@@ -76,9 +76,15 @@ func VisitPVSecretNames(pv *api.PersistentVolume, visitor Visitor) bool {
 			}
 		}
 	case source.ScaleIO != nil:
-		if source.ScaleIO.SecretRef != nil && !visitor(getClaimRefNamespace(pv), source.ScaleIO.SecretRef.Name) {
+		if source.ScaleIO.SecretRef != nil {
+			ns := getClaimRefNamespace(pv)
+			if source.ScaleIO.SecretRef != nil && len(source.ScaleIO.SecretRef.Namespace) > 0 {
+				ns = source.ScaleIO.SecretRef.Namespace
+			}
+			if !visitor(ns, source.ScaleIO.SecretRef.Name) {
 				return false
 			}
+		}
 	case source.ISCSI != nil:
 		if source.ISCSI.SecretRef != nil && !visitor(getClaimRefNamespace(pv), source.ISCSI.SecretRef.Name) {
 			return false

pkg/api/persistentvolume/util_test.go

@@ -78,9 +78,16 @@ func TestPVSecrets(t *testing.T) {
 		{Spec: api.PersistentVolumeSpec{
 			ClaimRef: &api.ObjectReference{Namespace: "claimrefns", Name: "claimrefname"},
 			PersistentVolumeSource: api.PersistentVolumeSource{
-				ScaleIO: &api.ScaleIOVolumeSource{
+				ScaleIO: &api.ScaleIOPersistentVolumeSource{
-					SecretRef: &api.LocalObjectReference{
+					SecretRef: &api.SecretReference{
 						Name: "Spec.PersistentVolumeSource.ScaleIO.SecretRef"}}}}},
+		{Spec: api.PersistentVolumeSpec{
+			ClaimRef: &api.ObjectReference{Namespace: "claimrefns", Name: "claimrefname"},
+			PersistentVolumeSource: api.PersistentVolumeSource{
+				ScaleIO: &api.ScaleIOPersistentVolumeSource{
+					SecretRef: &api.SecretReference{
+						Name:      "Spec.PersistentVolumeSource.ScaleIO.SecretRef",
+						Namespace: "scaleions"}}}}},
 		{Spec: api.PersistentVolumeSpec{
 			ClaimRef: &api.ObjectReference{Namespace: "claimrefns", Name: "claimrefname"},
 			PersistentVolumeSource: api.PersistentVolumeSource{
@@ -150,6 +157,7 @@ func TestPVSecrets(t *testing.T) {
 		"claimrefns/Spec.PersistentVolumeSource.RBD.SecretRef",
 		"rbdns/Spec.PersistentVolumeSource.RBD.SecretRef",
 		"claimrefns/Spec.PersistentVolumeSource.ScaleIO.SecretRef",
+		"scaleions/Spec.PersistentVolumeSource.ScaleIO.SecretRef",
 		"claimrefns/Spec.PersistentVolumeSource.ISCSI.SecretRef",
 		"storageosns/Spec.PersistentVolumeSource.StorageOS.SecretRef",
 	)

pkg/api/types.go

@@ -383,7 +383,7 @@ type PersistentVolumeSource struct {
 	PortworxVolume *PortworxVolumeSource
 	// ScaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
 	// +optional
-	ScaleIO *ScaleIOVolumeSource
+	ScaleIO *ScaleIOPersistentVolumeSource
 	// Local represents directly-attached storage with node affinity
 	// +optional
 	Local *LocalVolumeSource
@@ -1285,13 +1285,13 @@ type ScaleIOVolumeSource struct {
 	// Flag to enable/disable SSL communication with Gateway, default false
 	// +optional
 	SSLEnabled bool
-	// The name of the Protection Domain for the configured storage (defaults to "default").
+	// The name of the ScaleIO Protection Domain for the configured storage.
 	// +optional
 	ProtectionDomain string
-	// The Storage Pool associated with the protection domain (defaults to "default").
+	// The ScaleIO Storage Pool associated with the protection domain.
 	// +optional
 	StoragePool string
-	// Indicates whether the storage for a volume should be thick or thin (defaults to "thin").
+	// Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.
 	// +optional
 	StorageMode string
 	// The name of a volume already created in the ScaleIO system
@@ -1308,6 +1308,42 @@ type ScaleIOVolumeSource struct {
 	ReadOnly bool
 }
 
+// ScaleIOPersistentVolumeSource represents a persistent ScaleIO volume that can be defined
+// by a an admin via a storage class, for instance.
+type ScaleIOPersistentVolumeSource struct {
+	// The host address of the ScaleIO API Gateway.
+	Gateway string
+	// The name of the storage system as configured in ScaleIO.
+	System string
+	// SecretRef references to the secret for ScaleIO user and other
+	// sensitive information. If this is not provided, Login operation will fail.
+	SecretRef *SecretReference
+	// Flag to enable/disable SSL communication with Gateway, default false
+	// +optional
+	SSLEnabled bool
+	// The name of the ScaleIO Protection Domain for the configured storage.
+	// +optional
+	ProtectionDomain string
+	// The ScaleIO Storage Pool associated with the protection domain.
+	// +optional
+	StoragePool string
+	// Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.
+	// +optional
+	StorageMode string
+	// The name of a volume created in the ScaleIO system
+	// that is associated with this volume source.
+	VolumeName string
+	// Filesystem type to mount.
+	// Must be a filesystem type supported by the host operating system.
+	// Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+	// +optional
+	FSType string
+	// Defaults to false (read/write). ReadOnly here will force
+	// the ReadOnly setting in VolumeMounts.
+	// +optional
+	ReadOnly bool
+}
+
 // Represents a StorageOS persistent volume resource.
 type StorageOSVolumeSource struct {
 	// VolumeName is the human-readable name of the StorageOS volume.  Volume

pkg/api/v1/defaults.go

@@ -381,12 +381,15 @@ func SetDefaults_RBDPersistentVolumeSource(obj *v1.RBDPersistentVolumeSource) {
 }
 
 func SetDefaults_ScaleIOVolumeSource(obj *v1.ScaleIOVolumeSource) {
-	if obj.ProtectionDomain == "" {
+	if obj.StorageMode == "" {
-		obj.ProtectionDomain = "default"
+		obj.StorageMode = "ThinProvisioned"
 	}
-	if obj.StoragePool == "" {
+	if obj.FSType == "" {
-		obj.StoragePool = "default"
+		obj.FSType = "xfs"
 	}
+}
+
+func SetDefaults_ScaleIOPersistentVolumeSource(obj *v1.ScaleIOPersistentVolumeSource) {
 	if obj.StorageMode == "" {
 		obj.StorageMode = "ThinProvisioned"
 	}

pkg/api/v1/zz_generated.conversion.go

@@ -335,6 +335,8 @@ func RegisterConversions(scheme *runtime.Scheme) error {
 		Convert_api_ResourceRequirements_To_v1_ResourceRequirements,
 		Convert_v1_SELinuxOptions_To_api_SELinuxOptions,
 		Convert_api_SELinuxOptions_To_v1_SELinuxOptions,
+		Convert_v1_ScaleIOPersistentVolumeSource_To_api_ScaleIOPersistentVolumeSource,
+		Convert_api_ScaleIOPersistentVolumeSource_To_v1_ScaleIOPersistentVolumeSource,
 		Convert_v1_ScaleIOVolumeSource_To_api_ScaleIOVolumeSource,
 		Convert_api_ScaleIOVolumeSource_To_v1_ScaleIOVolumeSource,
 		Convert_v1_Secret_To_api_Secret,
@@ -3139,7 +3141,7 @@ func autoConvert_v1_PersistentVolumeSource_To_api_PersistentVolumeSource(in *v1.
 	out.AzureDisk = (*api.AzureDiskVolumeSource)(unsafe.Pointer(in.AzureDisk))
 	out.PhotonPersistentDisk = (*api.PhotonPersistentDiskVolumeSource)(unsafe.Pointer(in.PhotonPersistentDisk))
 	out.PortworxVolume = (*api.PortworxVolumeSource)(unsafe.Pointer(in.PortworxVolume))
-	out.ScaleIO = (*api.ScaleIOVolumeSource)(unsafe.Pointer(in.ScaleIO))
+	out.ScaleIO = (*api.ScaleIOPersistentVolumeSource)(unsafe.Pointer(in.ScaleIO))
 	out.Local = (*api.LocalVolumeSource)(unsafe.Pointer(in.Local))
 	out.StorageOS = (*api.StorageOSPersistentVolumeSource)(unsafe.Pointer(in.StorageOS))
 	return nil
@@ -3169,7 +3171,7 @@ func autoConvert_api_PersistentVolumeSource_To_v1_PersistentVolumeSource(in *api
 	out.AzureDisk = (*v1.AzureDiskVolumeSource)(unsafe.Pointer(in.AzureDisk))
 	out.PhotonPersistentDisk = (*v1.PhotonPersistentDiskVolumeSource)(unsafe.Pointer(in.PhotonPersistentDisk))
 	out.PortworxVolume = (*v1.PortworxVolumeSource)(unsafe.Pointer(in.PortworxVolume))
-	out.ScaleIO = (*v1.ScaleIOVolumeSource)(unsafe.Pointer(in.ScaleIO))
+	out.ScaleIO = (*v1.ScaleIOPersistentVolumeSource)(unsafe.Pointer(in.ScaleIO))
 	out.Local = (*v1.LocalVolumeSource)(unsafe.Pointer(in.Local))
 	out.StorageOS = (*v1.StorageOSPersistentVolumeSource)(unsafe.Pointer(in.StorageOS))
 	return nil
@@ -4494,6 +4496,44 @@ func Convert_api_SELinuxOptions_To_v1_SELinuxOptions(in *api.SELinuxOptions, out
 	return autoConvert_api_SELinuxOptions_To_v1_SELinuxOptions(in, out, s)
 }
 
+func autoConvert_v1_ScaleIOPersistentVolumeSource_To_api_ScaleIOPersistentVolumeSource(in *v1.ScaleIOPersistentVolumeSource, out *api.ScaleIOPersistentVolumeSource, s conversion.Scope) error {
+	out.Gateway = in.Gateway
+	out.System = in.System
+	out.SecretRef = (*api.SecretReference)(unsafe.Pointer(in.SecretRef))
+	out.SSLEnabled = in.SSLEnabled
+	out.ProtectionDomain = in.ProtectionDomain
+	out.StoragePool = in.StoragePool
+	out.StorageMode = in.StorageMode
+	out.VolumeName = in.VolumeName
+	out.FSType = in.FSType
+	out.ReadOnly = in.ReadOnly
+	return nil
+}
+
+// Convert_v1_ScaleIOPersistentVolumeSource_To_api_ScaleIOPersistentVolumeSource is an autogenerated conversion function.
+func Convert_v1_ScaleIOPersistentVolumeSource_To_api_ScaleIOPersistentVolumeSource(in *v1.ScaleIOPersistentVolumeSource, out *api.ScaleIOPersistentVolumeSource, s conversion.Scope) error {
+	return autoConvert_v1_ScaleIOPersistentVolumeSource_To_api_ScaleIOPersistentVolumeSource(in, out, s)
+}
+
+func autoConvert_api_ScaleIOPersistentVolumeSource_To_v1_ScaleIOPersistentVolumeSource(in *api.ScaleIOPersistentVolumeSource, out *v1.ScaleIOPersistentVolumeSource, s conversion.Scope) error {
+	out.Gateway = in.Gateway
+	out.System = in.System
+	out.SecretRef = (*v1.SecretReference)(unsafe.Pointer(in.SecretRef))
+	out.SSLEnabled = in.SSLEnabled
+	out.ProtectionDomain = in.ProtectionDomain
+	out.StoragePool = in.StoragePool
+	out.StorageMode = in.StorageMode
+	out.VolumeName = in.VolumeName
+	out.FSType = in.FSType
+	out.ReadOnly = in.ReadOnly
+	return nil
+}
+
+// Convert_api_ScaleIOPersistentVolumeSource_To_v1_ScaleIOPersistentVolumeSource is an autogenerated conversion function.
+func Convert_api_ScaleIOPersistentVolumeSource_To_v1_ScaleIOPersistentVolumeSource(in *api.ScaleIOPersistentVolumeSource, out *v1.ScaleIOPersistentVolumeSource, s conversion.Scope) error {
+	return autoConvert_api_ScaleIOPersistentVolumeSource_To_v1_ScaleIOPersistentVolumeSource(in, out, s)
+}
+
 func autoConvert_v1_ScaleIOVolumeSource_To_api_ScaleIOVolumeSource(in *v1.ScaleIOVolumeSource, out *api.ScaleIOVolumeSource, s conversion.Scope) error {
 	out.Gateway = in.Gateway
 	out.System = in.System

pkg/api/v1/zz_generated.defaults.go

@@ -146,7 +146,7 @@ func SetObjectDefaults_PersistentVolume(in *v1.PersistentVolume) {
 		SetDefaults_AzureDiskVolumeSource(in.Spec.PersistentVolumeSource.AzureDisk)
 	}
 	if in.Spec.PersistentVolumeSource.ScaleIO != nil {
-		SetDefaults_ScaleIOVolumeSource(in.Spec.PersistentVolumeSource.ScaleIO)
+		SetDefaults_ScaleIOPersistentVolumeSource(in.Spec.PersistentVolumeSource.ScaleIO)
 	}
 }
 

pkg/api/validation/validation.go

@@ -1245,6 +1245,20 @@ func validateScaleIOVolumeSource(sio *api.ScaleIOVolumeSource, fldPath *field.Pa
 	return allErrs
 }
 
+func validateScaleIOPersistentVolumeSource(sio *api.ScaleIOPersistentVolumeSource, fldPath *field.Path) field.ErrorList {
+	allErrs := field.ErrorList{}
+	if sio.Gateway == "" {
+		allErrs = append(allErrs, field.Required(fldPath.Child("gateway"), ""))
+	}
+	if sio.System == "" {
+		allErrs = append(allErrs, field.Required(fldPath.Child("system"), ""))
+	}
+	if sio.VolumeName == "" {
+		allErrs = append(allErrs, field.Required(fldPath.Child("volumeName"), ""))
+	}
+	return allErrs
+}
+
 func validateLocalVolumeSource(ls *api.LocalVolumeSource, fldPath *field.Path) field.ErrorList {
 	allErrs := field.ErrorList{}
 	if ls.Path == "" {
@@ -1489,7 +1503,7 @@ func ValidatePersistentVolume(pv *api.PersistentVolume) field.ErrorList {
 			allErrs = append(allErrs, field.Forbidden(specPath.Child("scaleIO"), "may not specify more than 1 volume type"))
 		} else {
 			numVolumes++
-			allErrs = append(allErrs, validateScaleIOVolumeSource(pv.Spec.ScaleIO, specPath.Child("scaleIO"))...)
+			allErrs = append(allErrs, validateScaleIOPersistentVolumeSource(pv.Spec.ScaleIO, specPath.Child("scaleIO"))...)
 		}
 	}
 	if pv.Spec.Local != nil {

pkg/api/zz_generated.deepcopy.go

@@ -631,6 +631,10 @@ func RegisterDeepCopies(scheme *runtime.Scheme) error {
 			in.(*SELinuxOptions).DeepCopyInto(out.(*SELinuxOptions))
 			return nil
 		}, InType: reflect.TypeOf(&SELinuxOptions{})},
+		conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error {
+			in.(*ScaleIOPersistentVolumeSource).DeepCopyInto(out.(*ScaleIOPersistentVolumeSource))
+			return nil
+		}, InType: reflect.TypeOf(&ScaleIOPersistentVolumeSource{})},
 		conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error {
 			in.(*ScaleIOVolumeSource).DeepCopyInto(out.(*ScaleIOVolumeSource))
 			return nil
@@ -3868,7 +3872,7 @@ func (in *PersistentVolumeSource) DeepCopyInto(out *PersistentVolumeSource) {
 		if *in == nil {
 			*out = nil
 		} else {
-			*out = new(ScaleIOVolumeSource)
+			*out = new(ScaleIOPersistentVolumeSource)
 			(*in).DeepCopyInto(*out)
 		}
 	}
@@ -5230,6 +5234,31 @@ func (in *SELinuxOptions) DeepCopy() *SELinuxOptions {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ScaleIOPersistentVolumeSource) DeepCopyInto(out *ScaleIOPersistentVolumeSource) {
+	*out = *in
+	if in.SecretRef != nil {
+		in, out := &in.SecretRef, &out.SecretRef
+		if *in == nil {
+			*out = nil
+		} else {
+			*out = new(SecretReference)
+			**out = **in
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ScaleIOPersistentVolumeSource.
+func (in *ScaleIOPersistentVolumeSource) DeepCopy() *ScaleIOPersistentVolumeSource {
+	if in == nil {
+		return nil
+	}
+	out := new(ScaleIOPersistentVolumeSource)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ScaleIOVolumeSource) DeepCopyInto(out *ScaleIOVolumeSource) {
 	*out = *in

pkg/printers/internalversion/describe.go

@@ -970,6 +970,26 @@ func printScaleIOVolumeSource(sio *api.ScaleIOVolumeSource, w PrefixWriter) {
 		sio.Gateway, sio.System, sio.ProtectionDomain, sio.StoragePool, sio.StorageMode, sio.VolumeName, sio.FSType, sio.ReadOnly)
 }
 
+func printScaleIOPersistentVolumeSource(sio *api.ScaleIOPersistentVolumeSource, w PrefixWriter) {
+	var secretNS, secretName string
+	if sio.SecretRef != nil {
+		secretName = sio.SecretRef.Name
+		secretNS = sio.SecretRef.Namespace
+	}
+	w.Write(LEVEL_2, "Type:\tScaleIO (a persistent volume backed by a block device in ScaleIO)\n"+
+		"    Gateway:\t%v\n"+
+		"    System:\t%v\n"+
+		"    Protection Domain:\t%v\n"+
+		"    Storage Pool:\t%v\n"+
+		"    Storage Mode:\t%v\n"+
+		"    VolumeName:\t%v\n"+
+		"    SecretName:\t%v\n"+
+		"    SecretNamespace:\t%v\n"+
+		"    FSType:\t%v\n"+
+		"    ReadOnly:\t%v\n",
+		sio.Gateway, sio.System, sio.ProtectionDomain, sio.StoragePool, sio.StorageMode, sio.VolumeName, secretName, secretNS, sio.FSType, sio.ReadOnly)
+}
+
 func printLocalVolumeSource(ls *api.LocalVolumeSource, w PrefixWriter) {
 	w.Write(LEVEL_2, "Type:\tLocalVolume (a persistent volume backed by local storage on a node)\n"+
 		"    Path:\t%v\n",
@@ -1135,7 +1155,7 @@ func describePersistentVolume(pv *api.PersistentVolume, events *api.EventList) (
 		case pv.Spec.PortworxVolume != nil:
 			printPortworxVolumeSource(pv.Spec.PortworxVolume, w)
 		case pv.Spec.ScaleIO != nil:
-			printScaleIOVolumeSource(pv.Spec.ScaleIO, w)
+			printScaleIOPersistentVolumeSource(pv.Spec.ScaleIO, w)
 		case pv.Spec.Local != nil:
 			printLocalVolumeSource(pv.Spec.Local, w)
 		case pv.Spec.CephFS != nil:

pkg/volume/scaleio/BUILD

@@ -23,6 +23,7 @@ go_test(
         "//vendor/github.com/golang/glog:go_default_library",
         "//vendor/k8s.io/api/core/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/types:go_default_library",
         "//vendor/k8s.io/client-go/kubernetes/fake:go_default_library",
         "//vendor/k8s.io/client-go/util/testing:go_default_library",

pkg/volume/scaleio/sio_mgr_test.go

@@ -37,7 +37,7 @@ var (
 		confKey.sslEnabled: "false",
 		confKey.system:     "scaleio",
 		confKey.volumeName: "sio-0001",
-		confKey.secretRef:  "sio-secret",
+		confKey.secretName: "sio-secret",
 		confKey.username:   "c2lvdXNlcgo=",     // siouser
 		confKey.password:   "c2lvcGFzc3dvcmQK", // siopassword
 	}

pkg/volume/scaleio/sio_plugin.go

@@ -60,12 +60,11 @@ func (p *sioPlugin) GetPluginName() string {
 }
 
 func (p *sioPlugin) GetVolumeName(spec *volume.Spec) (string, error) {
-	source, err := getVolumeSourceFromSpec(spec)
+	attribs, err := getVolumeSourceAttribs(spec)
 	if err != nil {
 		return "", err
 	}
-
+	return attribs.volName, nil
-	return source.VolumeName, nil
 }
 
 func (p *sioPlugin) CanSupport(spec *volume.Spec) bool {
@@ -81,29 +80,33 @@ func (p *sioPlugin) NewMounter(
 	spec *volume.Spec,
 	pod *api.Pod,
 	_ volume.VolumeOptions) (volume.Mounter, error) {
-	sioSource, err := getVolumeSourceFromSpec(spec)
+
+	// extract source info from either ScaleIOVolumeSource or ScaleIOPersistentVolumeSource type
+	attribs, err := getVolumeSourceAttribs(spec)
 	if err != nil {
-		glog.Error(log("failed to extract ScaleIOVolumeSource from spec: %v", err))
+		return nil, errors.New(log("mounter failed to extract volume attributes from spec: %v", err))
-		return nil, err
+	}
+
+	secretName, secretNS, err := getSecretAndNamespaceFromSpec(spec, pod)
+	if err != nil {
+		return nil, errors.New(log("failed to get secret name or secretNamespace: %v", err))
 	}
 
 	return &sioVolume{
 		pod:             pod,
 		spec:            spec,
-		source:      sioSource,
+		secretName:      secretName,
-		namespace:   pod.Namespace,
+		secretNamespace: secretNS,
 		volSpecName:     spec.Name(),
-		volName:     sioSource.VolumeName,
+		volName:         attribs.volName,
 		podUID:          pod.UID,
-		readOnly:    sioSource.ReadOnly,
+		readOnly:        attribs.readOnly,
-		fsType:      sioSource.FSType,
+		fsType:          attribs.fsType,
 		plugin:          p,
 	}, nil
 }
 
 // NewUnmounter creates a representation of the volume to unmount
-// The specName param can be used to carry the namespace value (if needed) using format:
-// specName = [<namespace>nsSep]<somevalue> where the specname is pre-pended with the namespace
 func (p *sioPlugin) NewUnmounter(specName string, podUID types.UID) (volume.Unmounter, error) {
 	glog.V(4).Info(log("Unmounter for %s", specName))
 
@@ -156,22 +159,25 @@ func (p *sioPlugin) GetAccessModes() []api.PersistentVolumeAccessMode {
 var _ volume.DeletableVolumePlugin = &sioPlugin{}
 
 func (p *sioPlugin) NewDeleter(spec *volume.Spec) (volume.Deleter, error) {
-	sioSource, err := getVolumeSourceFromSpec(spec)
+	attribs, err := getVolumeSourceAttribs(spec)
 	if err != nil {
-		glog.Error(log("deleter failed to extract source from spec: %v", err))
+		glog.Error(log("deleter failed to extract volume attributes from spec: %v", err))
 		return nil, err
 	}
 
-	namespace := spec.PersistentVolume.Spec.ClaimRef.Namespace
+	secretName, secretNS, err := getSecretAndNamespaceFromSpec(spec, nil)
+	if err != nil {
+		return nil, errors.New(log("failed to get secret name or secretNamespace: %v", err))
+	}
 
 	return &sioVolume{
 		spec:            spec,
-		source:      sioSource,
+		secretName:      secretName,
-		namespace:   namespace,
+		secretNamespace: secretNS,
 		volSpecName:     spec.Name(),
-		volName:     sioSource.VolumeName,
+		volName:         attribs.volName,
 		plugin:          p,
-		readOnly:    sioSource.ReadOnly,
+		readOnly:        attribs.readOnly,
 	}, nil
 }
 
@@ -189,13 +195,26 @@ func (p *sioPlugin) NewProvisioner(options volume.VolumeOptions) (volume.Provisi
 		return nil, errors.New("option parameters missing")
 	}
 
-	namespace := options.PVC.Namespace
+	// Supports ref of name of secret a couple of ways:
+	// options.Parameters["secretRef"] for backward compat, or
+	// options.Parameters["secretName"]
+	secretName := configData[confKey.secretName]
+	if secretName == "" {
+		secretName = configData["secretName"]
+		configData[confKey.secretName] = secretName
+	}
+
+	secretNS := configData[confKey.secretNamespace]
+	if secretNS == "" {
+		secretNS = options.PVC.Namespace
+	}
 
 	return &sioVolume{
 		configData:      configData,
 		plugin:          p,
 		options:         options,
-		namespace:   namespace,
+		secretName:      secretName,
+		secretNamespace: secretNS,
 		volSpecName:     options.PVName,
 	}, nil
 }

pkg/volume/scaleio/sio_util.go

@@ -31,11 +31,17 @@ import (
 	volutil "k8s.io/kubernetes/pkg/volume/util"
 )
 
+type volSourceAttribs struct {
+	volName,
+	fsType string
+	readOnly bool
+}
+
 var (
 	confKey = struct {
 		gateway,
 		sslEnabled,
-		secretRef,
+		secretName,
 		system,
 		protectionDomain,
 		storagePool,
@@ -47,12 +53,13 @@ var (
 		readOnly,
 		username,
 		password,
-		namespace,
+		secretNamespace,
 		sdcGuid string
 	}{
 		gateway:          "gateway",
 		sslEnabled:       "sslEnabled",
-		secretRef:        "secretRef",
+		secretName:       "secretRef",
+		secretNamespace:  "secretNamespace",
 		system:           "system",
 		protectionDomain: "protectionDomain",
 		storagePool:      "storagePool",
@@ -64,7 +71,6 @@ var (
 		readOnly:         "readOnly",
 		username:         "username",
 		password:         "password",
-		namespace:        "namespace",
 		sdcGuid:          "sdcGuid",
 	}
 	sdcGuidLabelName = "scaleio.sdcGuid"
@@ -79,15 +85,11 @@ var (
 	protectionDomainNotProvidedErr = errors.New("ScaleIO protection domain not provided")
 )
 
-// mapScaleIOVolumeSource maps attributes from a ScaleIOVolumeSource to config
+// mapVolumeSpec maps attributes from either ScaleIOVolumeSource  or ScaleIOPersistentVolumeSource to config
-func mapVolumeSource(config map[string]string, source *api.ScaleIOVolumeSource) {
+func mapVolumeSpec(config map[string]string, spec *volume.Spec) {
+
+	if source, err := getScaleIOPersistentVolumeSourceFromSpec(spec); err == nil {
 		config[confKey.gateway] = source.Gateway
-	config[confKey.secretRef] = func() string {
-		if source.SecretRef != nil {
-			return string(source.SecretRef.Name)
-		}
-		return ""
-	}()
 		config[confKey.system] = source.System
 		config[confKey.volumeName] = source.VolumeName
 		config[confKey.sslEnabled] = strconv.FormatBool(source.SSLEnabled)
@@ -96,6 +98,19 @@ func mapVolumeSource(config map[string]string, source *api.ScaleIOVolumeSource)
 		config[confKey.storageMode] = source.StorageMode
 		config[confKey.fsType] = source.FSType
 		config[confKey.readOnly] = strconv.FormatBool(source.ReadOnly)
+	}
+
+	if source, err := getScaleIOVolumeSourceFromSpec(spec); err == nil {
+		config[confKey.gateway] = source.Gateway
+		config[confKey.system] = source.System
+		config[confKey.volumeName] = source.VolumeName
+		config[confKey.sslEnabled] = strconv.FormatBool(source.SSLEnabled)
+		config[confKey.protectionDomain] = source.ProtectionDomain
+		config[confKey.storagePool] = source.StoragePool
+		config[confKey.storageMode] = source.StorageMode
+		config[confKey.fsType] = source.FSType
+		config[confKey.readOnly] = strconv.FormatBool(source.ReadOnly)
+	}
 
 	//optionals
 	applyConfigDefaults(config)
@@ -105,7 +120,7 @@ func validateConfigs(config map[string]string) error {
 	if config[confKey.gateway] == "" {
 		return gatewayNotProvidedErr
 	}
-	if config[confKey.secretRef] == "" {
+	if config[confKey.secretName] == "" {
 		return secretRefNotProvidedErr
 	}
 	if config[confKey.system] == "" {
@@ -202,7 +217,7 @@ func saveConfig(configName string, data map[string]string) error {
 // attachSecret loads secret object and attaches to configData
 func attachSecret(plug *sioPlugin, namespace string, configData map[string]string) error {
 	// load secret
-	secretRefName := configData[confKey.secretRef]
+	secretRefName := configData[confKey.secretName]
 	kubeClient := plug.host.GetKubeClient()
 	secretMap, err := volutil.GetSecretForPV(namespace, secretRefName, sioPluginName, kubeClient)
 	if err != nil {
@@ -244,8 +259,8 @@ func getSdcGuidLabel(plug *sioPlugin) (string, error) {
 	return label, nil
 }
 
-// getVolumeSourceFromSpec safely extracts ScaleIOVolumeSource from spec
+// getVolumeSourceFromSpec safely extracts ScaleIOVolumeSource or ScaleIOPersistentVolumeSource from spec
-func getVolumeSourceFromSpec(spec *volume.Spec) (*api.ScaleIOVolumeSource, error) {
+func getVolumeSourceFromSpec(spec *volume.Spec) (interface{}, error) {
 	if spec.Volume != nil && spec.Volume.ScaleIO != nil {
 		return spec.Volume.ScaleIO, nil
 	}
@@ -257,6 +272,66 @@ func getVolumeSourceFromSpec(spec *volume.Spec) (*api.ScaleIOVolumeSource, error
 	return nil, fmt.Errorf("ScaleIO not defined in spec")
 }
 
+func getVolumeSourceAttribs(spec *volume.Spec) (*volSourceAttribs, error) {
+	attribs := new(volSourceAttribs)
+	if pvSource, err := getScaleIOPersistentVolumeSourceFromSpec(spec); err == nil {
+		attribs.volName = pvSource.VolumeName
+		attribs.fsType = pvSource.FSType
+		attribs.readOnly = pvSource.ReadOnly
+	} else if pSource, err := getScaleIOVolumeSourceFromSpec(spec); err == nil {
+		attribs.volName = pSource.VolumeName
+		attribs.fsType = pSource.FSType
+		attribs.readOnly = pSource.ReadOnly
+	} else {
+		msg := log("failed to get ScaleIOVolumeSource or ScaleIOPersistentVolumeSource from spec")
+		glog.Error(msg)
+		return nil, errors.New(msg)
+	}
+	return attribs, nil
+}
+
+func getScaleIOPersistentVolumeSourceFromSpec(spec *volume.Spec) (*api.ScaleIOPersistentVolumeSource, error) {
+	source, err := getVolumeSourceFromSpec(spec)
+	if err != nil {
+		return nil, err
+	}
+	if val, ok := source.(*api.ScaleIOPersistentVolumeSource); ok {
+		return val, nil
+	}
+	return nil, fmt.Errorf("spec is not a valid ScaleIOPersistentVolume type")
+}
+
+func getScaleIOVolumeSourceFromSpec(spec *volume.Spec) (*api.ScaleIOVolumeSource, error) {
+	source, err := getVolumeSourceFromSpec(spec)
+	if err != nil {
+		return nil, err
+	}
+	if val, ok := source.(*api.ScaleIOVolumeSource); ok {
+		return val, nil
+	}
+	return nil, fmt.Errorf("spec is not a valid ScaleIOVolume type")
+}
+
+func getSecretAndNamespaceFromSpec(spec *volume.Spec, pod *api.Pod) (secretName string, secretNS string, err error) {
+	if source, err := getScaleIOVolumeSourceFromSpec(spec); err == nil {
+		secretName = source.SecretRef.Name
+		if pod != nil {
+			secretNS = pod.Namespace
+		}
+	} else if source, err := getScaleIOPersistentVolumeSourceFromSpec(spec); err == nil {
+		if source.SecretRef != nil {
+			secretName = source.SecretRef.Name
+			secretNS = source.SecretRef.Namespace
+			if secretNS == "" && pod != nil {
+				secretNS = pod.Namespace
+			}
+		}
+	} else {
+		return "", "", errors.New("failed to get ScaleIOVolumeSource or ScaleIOPersistentVolumeSource")
+	}
+	return secretName, secretNS, nil
+}
+
 func log(msg string, parts ...interface{}) string {
 	return fmt.Sprintf(fmt.Sprintf("scaleio: %s", msg), parts...)
 }

pkg/volume/scaleio/sio_util_test.go

@@ -25,6 +25,7 @@ import (
 
 	api "k8s.io/api/core/v1"
 	utiltesting "k8s.io/client-go/util/testing"
+	"k8s.io/kubernetes/pkg/volume"
 )
 
 var (
@@ -48,7 +49,7 @@ var (
 		confKey.gateway:          "http://sio/",
 		confKey.volSpecName:      testSioVolName,
 		confKey.volumeName:       "sio-vol",
-		confKey.secretRef:        "sio-secret",
+		confKey.secretName:       "sio-secret",
 		confKey.protectionDomain: "defaultPD",
 		confKey.storagePool:      "deraultSP",
 		confKey.fsType:           "xfs",
@@ -60,7 +61,7 @@ var (
 
 func TestUtilMapVolumeSource(t *testing.T) {
 	data := make(map[string]string)
-	mapVolumeSource(data, vol.VolumeSource.ScaleIO)
+	mapVolumeSpec(data, volume.NewSpecFromVolume(vol))
 	if data[confKey.gateway] != "http://test.scaleio:1111" {
 		t.Error("Unexpected gateway value")
 	}
@@ -79,9 +80,6 @@ func TestUtilMapVolumeSource(t *testing.T) {
 	if data[confKey.fsType] != "ext4" {
 		t.Error("Unexpected fstype value")
 	}
-	if data[confKey.secretRef] != "test-secret" {
-		t.Error("Unexpected secret ref value")
-	}
 	if data[confKey.sslEnabled] != "false" {
 		t.Error("Unexpected sslEnabled value")
 	}
@@ -92,7 +90,7 @@ func TestUtilMapVolumeSource(t *testing.T) {
 
 func TestUtilValidateConfigs(t *testing.T) {
 	data := map[string]string{
-		confKey.secretRef: "sio-secret",
+		confKey.secretName: "sio-secret",
 		confKey.system:     "sio",
 	}
 	if err := validateConfigs(data); err != gatewayNotProvidedErr {
@@ -105,7 +103,7 @@ func TestUtilApplyConfigDefaults(t *testing.T) {
 		confKey.system:     "sio",
 		confKey.gateway:    "http://sio/",
 		confKey.volumeName: "sio-vol",
-		confKey.secretRef:  "test-secret",
+		confKey.secretName: "test-secret",
 	}
 	applyConfigDefaults(data)
 
@@ -130,7 +128,7 @@ func TestUtilApplyConfigDefaults(t *testing.T) {
 	if data[confKey.storageMode] != "ThinProvisioned" {
 		t.Error("Unexpected storage mode value")
 	}
-	if data[confKey.secretRef] != "test-secret" {
+	if data[confKey.secretName] != "test-secret" {
 		t.Error("Unexpected secret ref value")
 	}
 	if data[confKey.sslEnabled] != "false" {
@@ -157,7 +155,7 @@ func TestUtilSaveConfig(t *testing.T) {
 	config := path.Join(tmpDir, testConfigFile)
 	data := map[string]string{
 		confKey.gateway:    "https://test-gateway/",
-		confKey.secretRef:  "sio-secret",
+		confKey.secretName: "sio-secret",
 		confKey.sslEnabled: "false",
 	}
 	if err := saveConfig(config, data); err != nil {
@@ -178,7 +176,7 @@ func TestUtilSaveConfig(t *testing.T) {
 }
 
 func TestUtilAttachSecret(t *testing.T) {
-	plugMgr, tmpDir := newPluginMgr(t)
+	plugMgr, tmpDir := newPluginMgr(t, makeScaleIOSecret(testSecret, testns))
 	defer os.RemoveAll(tmpDir)
 
 	plug, err := plugMgr.FindPluginByName(sioPluginName)

pkg/volume/scaleio/sio_volume.go

@@ -42,8 +42,8 @@ type sioVolume struct {
 	pod             *api.Pod
 	podUID          types.UID
 	spec            *volume.Spec
-	source      *api.ScaleIOVolumeSource
+	secretName      string
-	namespace   string
+	secretNamespace string
 	volSpecName     string
 	volName         string
 	readOnly        bool
@@ -59,7 +59,6 @@ type sioVolume struct {
 var _ volume.Volume = &sioVolume{}
 
 // GetPath returns the path where the volume will be mounted.
-// The volumeName is prefixed with the pod's namespace a <pod.Namespace>-<volumeName>
 func (v *sioVolume) GetPath() string {
 	return v.plugin.host.GetPodVolumeDir(
 		v.podUID,
@@ -128,11 +127,11 @@ func (v *sioVolume) SetUpAt(dir string, fsGroup *int64) error {
 	switch {
 	default:
 		options = append(options, "rw")
-	case isROM && !v.source.ReadOnly:
+	case isROM && !v.readOnly:
 		options = append(options, "rw")
 	case isROM:
 		options = append(options, "ro")
-	case v.source.ReadOnly:
+	case v.readOnly:
 		options = append(options, "ro")
 	}
 
@@ -327,10 +326,10 @@ func (v *sioVolume) Provision() (*api.PersistentVolume, error) {
 				),
 			},
 			PersistentVolumeSource: api.PersistentVolumeSource{
-				ScaleIO: &api.ScaleIOVolumeSource{
+				ScaleIO: &api.ScaleIOPersistentVolumeSource{
 					Gateway:          v.configData[confKey.gateway],
 					SSLEnabled:       sslEnabled,
-					SecretRef:        &api.LocalObjectReference{Name: v.configData[confKey.secretRef]},
+					SecretRef:        &api.SecretReference{Name: v.secretName, Namespace: v.secretNamespace},
 					System:           v.configData[confKey.system],
 					ProtectionDomain: v.configData[confKey.protectionDomain],
 					StoragePool:      v.configData[confKey.storagePool],
@@ -366,13 +365,17 @@ func (v *sioVolume) setSioMgr() error {
 			glog.V(4).Info(log("previous config file not found, creating new one"))
 			// prepare config data
 			configData = make(map[string]string)
-			mapVolumeSource(configData, v.source)
+			mapVolumeSpec(configData, v.spec)
+
+			// additional config data
+			configData[confKey.secretNamespace] = v.secretNamespace
+			configData[confKey.secretName] = v.secretName
+			configData[confKey.volSpecName] = v.volSpecName
+
 			if err := validateConfigs(configData); err != nil {
 				glog.Error(log("config setup failed: %s", err))
 				return err
 			}
-			configData[confKey.namespace] = v.namespace
-			configData[confKey.volSpecName] = v.volSpecName
 
 			// persist config
 			if err := saveConfig(configName, configData); err != nil {
@@ -381,7 +384,7 @@ func (v *sioVolume) setSioMgr() error {
 			}
 		}
 		// merge in secret
-		if err := attachSecret(v.plugin, v.namespace, configData); err != nil {
+		if err := attachSecret(v.plugin, v.secretNamespace, configData); err != nil {
 			glog.Error(log("failed to load secret: %v", err))
 			return err
 		}
@@ -414,12 +417,13 @@ func (v *sioVolume) resetSioMgr() error {
 			glog.Error(log("failed to load config data: %v", err))
 			return err
 		}
-		v.namespace = configData[confKey.namespace]
+		v.secretName = configData[confKey.secretName]
+		v.secretNamespace = configData[confKey.secretNamespace]
 		v.volName = configData[confKey.volumeName]
 		v.volSpecName = configData[confKey.volSpecName]
 
 		// attach secret
-		if err := attachSecret(v.plugin, v.namespace, configData); err != nil {
+		if err := attachSecret(v.plugin, v.secretNamespace, configData); err != nil {
 			glog.Error(log("failed to load secret: %v", err))
 			return err
 		}
@@ -446,21 +450,22 @@ func (v *sioVolume) resetSioMgr() error {
 func (v *sioVolume) setSioMgrFromConfig() error {
 	glog.V(4).Info(log("setting scaleio mgr from available config"))
 	if v.sioMgr == nil {
-		configData := v.configData
+		applyConfigDefaults(v.configData)
-		applyConfigDefaults(configData)
+
-		if err := validateConfigs(configData); err != nil {
+		v.configData[confKey.volSpecName] = v.volSpecName
+
+		if err := validateConfigs(v.configData); err != nil {
 			glog.Error(log("config data setup failed: %s", err))
 			return err
 		}
-		configData[confKey.namespace] = v.namespace
-		configData[confKey.volSpecName] = v.volSpecName
 
 		// copy config and attach secret
 		data := map[string]string{}
-		for k, v := range configData {
+		for k, v := range v.configData {
 			data[k] = v
 		}
-		if err := attachSecret(v.plugin, v.namespace, data); err != nil {
+
+		if err := attachSecret(v.plugin, v.secretNamespace, data); err != nil {
 			glog.Error(log("failed to load secret: %v", err))
 			return err
 		}
@@ -483,16 +488,20 @@ func (v *sioVolume) setSioMgrFromSpec() error {
 	if v.sioMgr == nil {
 		// get config data form spec volume source
 		configData := map[string]string{}
-		mapVolumeSource(configData, v.source)
+		mapVolumeSpec(configData, v.spec)
+
+		// additional config
+		configData[confKey.secretNamespace] = v.secretNamespace
+		configData[confKey.secretName] = v.secretName
+		configData[confKey.volSpecName] = v.volSpecName
+
 		if err := validateConfigs(configData); err != nil {
 			glog.Error(log("config setup failed: %s", err))
 			return err
 		}
-		configData[confKey.namespace] = v.namespace
-		configData[confKey.volSpecName] = v.volSpecName
 
 		// attach secret object to config data
-		if err := attachSecret(v.plugin, v.namespace, configData); err != nil {
+		if err := attachSecret(v.plugin, v.secretNamespace, configData); err != nil {
 			glog.Error(log("failed to load secret: %v", err))
 			return err
 		}

pkg/volume/scaleio/sio_volume_test.go

@@ -27,6 +27,7 @@ import (
 
 	api "k8s.io/api/core/v1"
 	meta "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	fakeclient "k8s.io/client-go/kubernetes/fake"
 	utiltesting "k8s.io/client-go/util/testing"
@@ -39,29 +40,18 @@ var (
 	testSioPD      = "default"
 	testSioVol     = "vol-0001"
 	testns         = "default"
+	testSecret     = "sio-secret"
 	testSioVolName = fmt.Sprintf("%s%s%s", testns, "-", testSioVol)
 	podUID         = types.UID("sio-pod")
 )
 
-func newPluginMgr(t *testing.T) (*volume.VolumePluginMgr, string) {
+func newPluginMgr(t *testing.T, apiObject runtime.Object) (*volume.VolumePluginMgr, string) {
 	tmpDir, err := utiltesting.MkTmpdir("scaleio-test")
 	if err != nil {
 		t.Fatalf("can't make a temp dir: %v", err)
 	}
-	config := &api.Secret{
-		ObjectMeta: meta.ObjectMeta{
-			Name:      "sio-secret",
-			Namespace: testns,
-			UID:       "1234567890",
-		},
-		Type: api.SecretType("kubernetes.io/scaleio"),
-		Data: map[string][]byte{
-			"username": []byte("username"),
-			"password": []byte("password"),
-		},
-	}
 
-	fakeClient := fakeclient.NewSimpleClientset(config)
+	fakeClient := fakeclient.NewSimpleClientset(apiObject)
 	host := volumetest.NewFakeVolumeHostWithNodeLabels(
 		tmpDir,
 		fakeClient,
@@ -74,8 +64,23 @@ func newPluginMgr(t *testing.T) (*volume.VolumePluginMgr, string) {
 	return plugMgr, tmpDir
 }
 
+func makeScaleIOSecret(name, namespace string) *api.Secret {
+	return &api.Secret{
+		ObjectMeta: meta.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+			UID:       "1234567890",
+		},
+		Type: api.SecretType("kubernetes.io/scaleio"),
+		Data: map[string][]byte{
+			"username": []byte("username"),
+			"password": []byte("password"),
+		},
+	}
+}
+
 func TestVolumeCanSupport(t *testing.T) {
-	plugMgr, tmpDir := newPluginMgr(t)
+	plugMgr, tmpDir := newPluginMgr(t, makeScaleIOSecret(testSecret, testns))
 	defer os.RemoveAll(tmpDir)
 	plug, err := plugMgr.FindPluginByName(sioPluginName)
 	if err != nil {
@@ -100,7 +105,7 @@ func TestVolumeCanSupport(t *testing.T) {
 			PersistentVolume: &api.PersistentVolume{
 				Spec: api.PersistentVolumeSpec{
 					PersistentVolumeSource: api.PersistentVolumeSource{
-						ScaleIO: &api.ScaleIOVolumeSource{},
+						ScaleIO: &api.ScaleIOPersistentVolumeSource{},
 					},
 				},
 			},
@@ -111,7 +116,7 @@ func TestVolumeCanSupport(t *testing.T) {
 }
 
 func TestVolumeGetAccessModes(t *testing.T) {
-	plugMgr, tmpDir := newPluginMgr(t)
+	plugMgr, tmpDir := newPluginMgr(t, makeScaleIOSecret(testSecret, testns))
 	defer os.RemoveAll(tmpDir)
 	plug, err := plugMgr.FindPersistentPluginByName(sioPluginName)
 	if err != nil {
@@ -131,7 +136,7 @@ func containsMode(modes []api.PersistentVolumeAccessMode, mode api.PersistentVol
 }
 
 func TestVolumeMounterUnmounter(t *testing.T) {
-	plugMgr, tmpDir := newPluginMgr(t)
+	plugMgr, tmpDir := newPluginMgr(t, makeScaleIOSecret(testSecret, testns))
 	defer os.RemoveAll(tmpDir)
 
 	plug, err := plugMgr.FindPluginByName(sioPluginName)
@@ -153,7 +158,7 @@ func TestVolumeMounterUnmounter(t *testing.T) {
 				StoragePool:      "default",
 				VolumeName:       testSioVol,
 				FSType:           "ext4",
-				SecretRef:        &api.LocalObjectReference{Name: "sio-secret"},
+				SecretRef:        &api.LocalObjectReference{Name: testSecret},
 				ReadOnly:         false,
 			},
 		},
@@ -245,7 +250,7 @@ func TestVolumeMounterUnmounter(t *testing.T) {
 }
 
 func TestVolumeProvisioner(t *testing.T) {
-	plugMgr, tmpDir := newPluginMgr(t)
+	plugMgr, tmpDir := newPluginMgr(t, makeScaleIOSecret(testSecret, testns))
 	defer os.RemoveAll(tmpDir)
 
 	plug, err := plugMgr.FindPluginByName(sioPluginName)
@@ -274,7 +279,7 @@ func TestVolumeProvisioner(t *testing.T) {
 		confKey.system:           "sio",
 		confKey.protectionDomain: testSioPD,
 		confKey.storagePool:      "default",
-		confKey.secretRef:        "sio-secret",
+		confKey.secretName:       testSecret,
 	}
 
 	provisioner, err := sioPlug.NewProvisioner(options)
@@ -296,6 +301,17 @@ func TestVolumeProvisioner(t *testing.T) {
 		t.Fatalf("call to Provision() failed: %v", err)
 	}
 
+	if spec.Namespace != testns {
+		t.Fatalf("unexpected namespace %v", spec.Namespace)
+	}
+	if spec.Spec.ScaleIO.SecretRef == nil {
+		t.Fatalf("unexpected nil value for spec.SecretRef")
+	}
+	if spec.Spec.ScaleIO.SecretRef.Name != testSecret ||
+		spec.Spec.ScaleIO.SecretRef.Namespace != testns {
+		t.Fatalf("spec.SecretRef is not being set properly")
+	}
+
 	spec.Spec.ClaimRef = &api.ObjectReference{Namespace: testns}
 
 	// validate provision
@@ -379,7 +395,7 @@ func TestVolumeProvisioner(t *testing.T) {
 }
 
 func TestVolumeProvisionerWithIncompleteConfig(t *testing.T) {
-	plugMgr, tmpDir := newPluginMgr(t)
+	plugMgr, tmpDir := newPluginMgr(t, makeScaleIOSecret(testSecret, testns))
 	defer os.RemoveAll(tmpDir)
 
 	plug, err := plugMgr.FindPluginByName(sioPluginName)
@@ -411,7 +427,7 @@ func TestVolumeProvisionerWithIncompleteConfig(t *testing.T) {
 }
 
 func TestVolumeProvisionerWithZeroCapacity(t *testing.T) {
-	plugMgr, tmpDir := newPluginMgr(t)
+	plugMgr, tmpDir := newPluginMgr(t, makeScaleIOSecret(testSecret, testns))
 	defer os.RemoveAll(tmpDir)
 
 	plug, err := plugMgr.FindPluginByName(sioPluginName)
@@ -440,7 +456,7 @@ func TestVolumeProvisionerWithZeroCapacity(t *testing.T) {
 		confKey.system:           "sio",
 		confKey.protectionDomain: testSioPD,
 		confKey.storagePool:      "default",
-		confKey.secretRef:        "sio-secret",
+		confKey.secretName:       "sio-secret",
 	}
 
 	provisioner, _ := sioPlug.NewProvisioner(options)
@@ -457,3 +473,63 @@ func TestVolumeProvisionerWithZeroCapacity(t *testing.T) {
 	}
 
 }
+
+func TestVolumeProvisionerWithSecretNamespace(t *testing.T) {
+	plugMgr, tmpDir := newPluginMgr(t, makeScaleIOSecret("sio-sec", "sio-ns"))
+	defer os.RemoveAll(tmpDir)
+
+	plug, err := plugMgr.FindPluginByName(sioPluginName)
+	if err != nil {
+		t.Fatalf("Can't find the plugin %v", sioPluginName)
+	}
+	sioPlug, ok := plug.(*sioPlugin)
+	if !ok {
+		t.Fatal("Cannot assert plugin to be type sioPlugin")
+	}
+
+	options := volume.VolumeOptions{
+		ClusterName: "testcluster",
+		PVName:      "pvc-sio-dynamic-vol",
+		PVC:         volumetest.CreateTestPVC("100Mi", []api.PersistentVolumeAccessMode{api.ReadWriteOnce}),
+		PersistentVolumeReclaimPolicy: api.PersistentVolumeReclaimDelete,
+	}
+
+	options.PVC.Spec.AccessModes = []api.PersistentVolumeAccessMode{
+		api.ReadWriteOnce,
+	}
+
+	options.PVC.Namespace = "pvc-ns"
+	options.Parameters = map[string]string{
+		confKey.gateway:          "http://test.scaleio:11111",
+		confKey.system:           "sio",
+		confKey.protectionDomain: testSioPD,
+		confKey.storagePool:      "default",
+		confKey.secretName:       "sio-sec",
+		confKey.secretNamespace:  "sio-ns",
+	}
+
+	provisioner, _ := sioPlug.NewProvisioner(options)
+	sio := newFakeSio()
+	sioVol := provisioner.(*sioVolume)
+	if err := sioVol.setSioMgrFromConfig(); err != nil {
+		t.Fatalf("failed to create scaleio mgr from config: %v", err)
+	}
+	sioVol.sioMgr.client = sio
+
+	spec, err := sioVol.Provision()
+	if err != nil {
+		t.Fatalf("call to Provision() failed: %v", err)
+	}
+
+	if spec.GetObjectMeta().GetNamespace() != "pvc-ns" {
+		t.Fatalf("unexpected spec.namespace %s", spec.GetObjectMeta().GetNamespace())
+	}
+
+	if spec.Spec.ScaleIO.SecretRef.Name != "sio-sec" {
+		t.Fatalf("unexpected spec.ScaleIOPersistentVolume.SecretRef.Name %v", spec.Spec.ScaleIO.SecretRef.Name)
+	}
+
+	if spec.Spec.ScaleIO.SecretRef.Namespace != "sio-ns" {
+		t.Fatalf("unexpected spec.ScaleIOPersistentVolume.SecretRef.Namespace %v", spec.Spec.ScaleIO.SecretRef.Namespace)
+	}
+}

staging/src/k8s.io/api/core/v1/generated.proto

@@ -2342,7 +2342,7 @@ message PersistentVolumeSource {
 
   // ScaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
   // +optional
-  optional ScaleIOVolumeSource scaleIO = 19;
+  optional ScaleIOPersistentVolumeSource scaleIO = 19;
 
   // Local represents directly-attached storage with node affinity
   // +optional
@@ -3491,6 +3491,50 @@ message SELinuxOptions {
   optional string level = 4;
 }
 
+// ScaleIOPersistentVolumeSource represents a persistent ScaleIO volume
+message ScaleIOPersistentVolumeSource {
+  // The host address of the ScaleIO API Gateway.
+  optional string gateway = 1;
+
+  // The name of the storage system as configured in ScaleIO.
+  optional string system = 2;
+
+  // SecretRef references to the secret for ScaleIO user and other
+  // sensitive information. If this is not provided, Login operation will fail.
+  optional SecretReference secretRef = 3;
+
+  // Flag to enable/disable SSL communication with Gateway, default false
+  // +optional
+  optional bool sslEnabled = 4;
+
+  // The name of the ScaleIO Protection Domain for the configured storage.
+  // +optional
+  optional string protectionDomain = 5;
+
+  // The ScaleIO Storage Pool associated with the protection domain.
+  // +optional
+  optional string storagePool = 6;
+
+  // Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.
+  // +optional
+  optional string storageMode = 7;
+
+  // The name of a volume already created in the ScaleIO system
+  // that is associated with this volume source.
+  optional string volumeName = 8;
+
+  // Filesystem type to mount.
+  // Must be a filesystem type supported by the host operating system.
+  // Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+  // +optional
+  optional string fsType = 9;
+
+  // Defaults to false (read/write). ReadOnly here will force
+  // the ReadOnly setting in VolumeMounts.
+  // +optional
+  optional bool readOnly = 10;
+}
+
 // ScaleIOVolumeSource represents a persistent ScaleIO volume
 message ScaleIOVolumeSource {
   // The host address of the ScaleIO API Gateway.
@@ -3507,15 +3551,15 @@ message ScaleIOVolumeSource {
   // +optional
   optional bool sslEnabled = 4;
 
-  // The name of the Protection Domain for the configured storage (defaults to "default").
+  // The name of the ScaleIO Protection Domain for the configured storage.
   // +optional
   optional string protectionDomain = 5;
 
-  // The Storage Pool associated with the protection domain (defaults to "default").
+  // The ScaleIO Storage Pool associated with the protection domain.
   // +optional
   optional string storagePool = 6;
 
-  // Indicates whether the storage for a volume should be thick or thin (defaults to "thin").
+  // Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.
   // +optional
   optional string storageMode = 7;
 

staging/src/k8s.io/api/core/v1/types.go

@@ -440,7 +440,7 @@ type PersistentVolumeSource struct {
 	PortworxVolume *PortworxVolumeSource `json:"portworxVolume,omitempty" protobuf:"bytes,18,opt,name=portworxVolume"`
 	// ScaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
 	// +optional
-	ScaleIO *ScaleIOVolumeSource `json:"scaleIO,omitempty" protobuf:"bytes,19,opt,name=scaleIO"`
+	ScaleIO *ScaleIOPersistentVolumeSource `json:"scaleIO,omitempty" protobuf:"bytes,19,opt,name=scaleIO"`
 	// Local represents directly-attached storage with node affinity
 	// +optional
 	Local *LocalVolumeSource `json:"local,omitempty" protobuf:"bytes,20,opt,name=local"`
@@ -1396,13 +1396,48 @@ type ScaleIOVolumeSource struct {
 	// Flag to enable/disable SSL communication with Gateway, default false
 	// +optional
 	SSLEnabled bool `json:"sslEnabled,omitempty" protobuf:"varint,4,opt,name=sslEnabled"`
-	// The name of the Protection Domain for the configured storage (defaults to "default").
+	// The name of the ScaleIO Protection Domain for the configured storage.
 	// +optional
 	ProtectionDomain string `json:"protectionDomain,omitempty" protobuf:"bytes,5,opt,name=protectionDomain"`
-	// The Storage Pool associated with the protection domain (defaults to "default").
+	// The ScaleIO Storage Pool associated with the protection domain.
 	// +optional
 	StoragePool string `json:"storagePool,omitempty" protobuf:"bytes,6,opt,name=storagePool"`
-	// Indicates whether the storage for a volume should be thick or thin (defaults to "thin").
+	// Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.
+	// +optional
+	StorageMode string `json:"storageMode,omitempty" protobuf:"bytes,7,opt,name=storageMode"`
+	// The name of a volume already created in the ScaleIO system
+	// that is associated with this volume source.
+	VolumeName string `json:"volumeName,omitempty" protobuf:"bytes,8,opt,name=volumeName"`
+	// Filesystem type to mount.
+	// Must be a filesystem type supported by the host operating system.
+	// Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+	// +optional
+	FSType string `json:"fsType,omitempty" protobuf:"bytes,9,opt,name=fsType"`
+	// Defaults to false (read/write). ReadOnly here will force
+	// the ReadOnly setting in VolumeMounts.
+	// +optional
+	ReadOnly bool `json:"readOnly,omitempty" protobuf:"varint,10,opt,name=readOnly"`
+}
+
+// ScaleIOPersistentVolumeSource represents a persistent ScaleIO volume
+type ScaleIOPersistentVolumeSource struct {
+	// The host address of the ScaleIO API Gateway.
+	Gateway string `json:"gateway" protobuf:"bytes,1,opt,name=gateway"`
+	// The name of the storage system as configured in ScaleIO.
+	System string `json:"system" protobuf:"bytes,2,opt,name=system"`
+	// SecretRef references to the secret for ScaleIO user and other
+	// sensitive information. If this is not provided, Login operation will fail.
+	SecretRef *SecretReference `json:"secretRef" protobuf:"bytes,3,opt,name=secretRef"`
+	// Flag to enable/disable SSL communication with Gateway, default false
+	// +optional
+	SSLEnabled bool `json:"sslEnabled,omitempty" protobuf:"varint,4,opt,name=sslEnabled"`
+	// The name of the ScaleIO Protection Domain for the configured storage.
+	// +optional
+	ProtectionDomain string `json:"protectionDomain,omitempty" protobuf:"bytes,5,opt,name=protectionDomain"`
+	// The ScaleIO Storage Pool associated with the protection domain.
+	// +optional
+	StoragePool string `json:"storagePool,omitempty" protobuf:"bytes,6,opt,name=storagePool"`
+	// Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.
 	// +optional
 	StorageMode string `json:"storageMode,omitempty" protobuf:"bytes,7,opt,name=storageMode"`
 	// The name of a volume already created in the ScaleIO system

staging/src/k8s.io/api/core/v1/types_swagger_doc_generated.go

@@ -1748,15 +1748,33 @@ func (SELinuxOptions) SwaggerDoc() map[string]string {
 	return map_SELinuxOptions
 }
 
+var map_ScaleIOPersistentVolumeSource = map[string]string{
+	"":                 "ScaleIOPersistentVolumeSource represents a persistent ScaleIO volume",
+	"gateway":          "The host address of the ScaleIO API Gateway.",
+	"system":           "The name of the storage system as configured in ScaleIO.",
+	"secretRef":        "SecretRef references to the secret for ScaleIO user and other sensitive information. If this is not provided, Login operation will fail.",
+	"sslEnabled":       "Flag to enable/disable SSL communication with Gateway, default false",
+	"protectionDomain": "The name of the ScaleIO Protection Domain for the configured storage.",
+	"storagePool":      "The ScaleIO Storage Pool associated with the protection domain.",
+	"storageMode":      "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.",
+	"volumeName":       "The name of a volume already created in the ScaleIO system that is associated with this volume source.",
+	"fsType":           "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
+	"readOnly":         "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",
+}
+
+func (ScaleIOPersistentVolumeSource) SwaggerDoc() map[string]string {
+	return map_ScaleIOPersistentVolumeSource
+}
+
 var map_ScaleIOVolumeSource = map[string]string{
 	"":                 "ScaleIOVolumeSource represents a persistent ScaleIO volume",
 	"gateway":          "The host address of the ScaleIO API Gateway.",
 	"system":           "The name of the storage system as configured in ScaleIO.",
 	"secretRef":        "SecretRef references to the secret for ScaleIO user and other sensitive information. If this is not provided, Login operation will fail.",
 	"sslEnabled":       "Flag to enable/disable SSL communication with Gateway, default false",
-	"protectionDomain": "The name of the Protection Domain for the configured storage (defaults to \"default\").",
+	"protectionDomain": "The name of the ScaleIO Protection Domain for the configured storage.",
-	"storagePool":      "The Storage Pool associated with the protection domain (defaults to \"default\").",
+	"storagePool":      "The ScaleIO Storage Pool associated with the protection domain.",
-	"storageMode":      "Indicates whether the storage for a volume should be thick or thin (defaults to \"thin\").",
+	"storageMode":      "Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.",
 	"volumeName":       "The name of a volume already created in the ScaleIO system that is associated with this volume source.",
 	"fsType":           "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified.",
 	"readOnly":         "Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.",

staging/src/k8s.io/api/core/v1/zz_generated.deepcopy.go

@@ -631,6 +631,10 @@ func RegisterDeepCopies(scheme *runtime.Scheme) error {
 			in.(*SELinuxOptions).DeepCopyInto(out.(*SELinuxOptions))
 			return nil
 		}, InType: reflect.TypeOf(&SELinuxOptions{})},
+		conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error {
+			in.(*ScaleIOPersistentVolumeSource).DeepCopyInto(out.(*ScaleIOPersistentVolumeSource))
+			return nil
+		}, InType: reflect.TypeOf(&ScaleIOPersistentVolumeSource{})},
 		conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error {
 			in.(*ScaleIOVolumeSource).DeepCopyInto(out.(*ScaleIOVolumeSource))
 			return nil
@@ -3854,7 +3858,7 @@ func (in *PersistentVolumeSource) DeepCopyInto(out *PersistentVolumeSource) {
 		if *in == nil {
 			*out = nil
 		} else {
-			*out = new(ScaleIOVolumeSource)
+			*out = new(ScaleIOPersistentVolumeSource)
 			(*in).DeepCopyInto(*out)
 		}
 	}
@@ -5225,6 +5229,31 @@ func (in *SELinuxOptions) DeepCopy() *SELinuxOptions {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ScaleIOPersistentVolumeSource) DeepCopyInto(out *ScaleIOPersistentVolumeSource) {
+	*out = *in
+	if in.SecretRef != nil {
+		in, out := &in.SecretRef, &out.SecretRef
+		if *in == nil {
+			*out = nil
+		} else {
+			*out = new(SecretReference)
+			**out = **in
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ScaleIOPersistentVolumeSource.
+func (in *ScaleIOPersistentVolumeSource) DeepCopy() *ScaleIOPersistentVolumeSource {
+	if in == nil {
+		return nil
+	}
+	out := new(ScaleIOPersistentVolumeSource)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ScaleIOVolumeSource) DeepCopyInto(out *ScaleIOVolumeSource) {
 	*out = *in