3.5. All controller operations to reach one controller

When a CSI-driver provides the CONTROLLER_SERVICE capability, the sidecar tries to become the leader by obtaining a lease based on the name of the CSI-driver.

The Kubernetes CSI-Addons Operator tries to connect to the random CSI-Addons sidecar that is registered and try to make the RPC calls to the random sidecar. This can create a problem if the CSI-driver has implemented some internal locking mechanism or has some local cache for the lifetime of that instance.

The NetworkFence (and other CSI-Addons) operations are only sent to a CSI-Addons sidecar that has the CONTROLLER_SERVICE capability. There is a single leader for the CSI-Addons sidecars that support that, and the leader can be identified by the Lease object for the CSI-drivername.