fix: check if Azure file share exists before calling Create to allow read-only permissions for existing shares

[Copilot]

CreateFileShare unconditionally calls the Create API even for pre-existing shares, requiring write permissions in all cases. This prevents scenarios where an existing share should only need read access.

Changes

• pkg/azurefile/azurefile.go: Before calling fileClient.CreateFileShare, call GetFileShareQuota (a read-only operation) to check existence. If the share already exists, skip Create entirely.

// Before: always called Create
if err = fileClient.CreateFileShare(ctx, shareOptions); err != nil { ... }

// After: skip Create if share already exists
if _, err := fileClient.GetFileShareQuota(ctx, shareOptions.Name); err == nil {
    klog.V(2).Infof("file share(%s) already exists, skip creating", shareOptions.Name)
    return true, nil
}
if err = fileClient.CreateFileShare(ctx, shareOptions); err != nil { ... }

• pkg/azurefile/azurefile_test.go: Added TestDriverCreateFileShare covering three cases: share exists (Create skipped), share absent (Create called), GetFileShareQuota error (Create called as fallback).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• test.file.ut
  • Triggering command: /tmp/go-build2833821331/b001/azurefile.test /tmp/go-build2833821331/b001/azurefile.test -test.testlogfile=/tmp/go-build2833821331/b001/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.run=TestDriverCreateFileShare|TestGetFileShareQuota -test.v=true driver/azurefile-ifaceassert ux-amd64/pkg/tool/linux_amd64/vet ibrary-for-go/ap/home/REDACTED/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.0.linux-amd64/pkg/too-buildtags .io/otel/attribu-atomic mpile ux-amd64/pkg/too-buildtags -o driver/azurefile-errorsas .cfg ux-amd64/pkg/tool/linux_amd64/vet /virtualnetworkl/home/REDACTED/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.0.linux-amd64/pkg/too-buildtags /virtualnetworkl-atomic mpile ux-amd64/pkg/too-buildtags (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Check if Azure file share exists before calling Create to allow read-only permission for existing shares</issue_title>
<issue_description>## Problem

The current implementation in pkg/azurefile/azurefile.go always calls the Create interface for Azure File share operations, regardless of whether the file share already exists. This can cause problems with permissions: even if the share already exists, the code requires write permissions to call Create, when in theory, only read permissions should be needed for existing file shares.

Suggestion

Before calling the Create interface for a file share, the code should first check if the share exists. If it does, then skip calling Create. This would allow scenarios where for existing file shares, only read permission is needed instead of write permissions.

Benefit

• Reduces the required permissions for applications that only consume existing file shares
• Improves security by following the principle of least privilege

Additional Context

Reference problematic code section (current implementation requires write permissions in all cases):
azurefile.go#L1085-L1089

---

Request: Please consider updating the logic so that it checks if the share exists before attempting to create it, allowing read-only permissions to suffice when no creation is needed.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Check if Azure file share exists before calling Create to allow read-only permission for existing shares #3040

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[k8s-ci-robot]

Hi @copilot. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Copilot
Once this PR has been reviewed and has the lgtm label, please ask for approval from andyzhangx. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[andyzhangx]

/ok-to-test

[andyzhangx]

/hold

[Copilot]

Pull request overview

This PR updates the Azure File share creation flow to avoid calling the write-requiring Create operation when a share already exists, enabling read-only permissions for pre-provisioned shares.

Changes:

• Added a pre-check in Driver.CreateFileShare to detect existing shares (via a quota read) and skip creation when present.
• Updated controller-server unit tests to account for the new pre-check behavior.
• Added a dedicated unit test for Driver.CreateFileShare covering “exists / absent / quota-check-error” paths.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pkg/azurefile/azurefile.go	Adds an existence check before attempting share creation to reduce required permissions for existing shares.
pkg/azurefile/controllerserver_test.go	Adjusts mocked share GET behavior to align with the new pre-check in CreateFileShare.
pkg/azurefile/azurefile_test.go	Adds tests validating CreateFileShare behavior when the share exists, does not exist, or the existence check errors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: andyzhangx / name: Andy Zhang (11ce44a, 4ba9c8a, c492e0b, e06a7ae)
• ✅ login: andyzhangx / name: andyzhangx (19ffa92, b161c6a, feadfaa)
• ✅ login: Copilot / name: copilot-swe-agent[bot] (11ce44a, 2f93eed)

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.