remove csi tests from e2e suite

test/e2e/utils/accessors.go

@@ -1,13 +1,10 @@
 package utils
 
 import (
-	"strings"
-
 	appsv1 "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
-	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
 	rolloutsv1alpha1 "github.com/argoproj/argo-rollouts/pkg/apis/rollouts/v1alpha1"
 	openshiftappsv1 "github.com/openshift/api/apps/v1"
@@ -150,27 +147,3 @@ var (
 		return d.Status.ReadyReplicas == d.Spec.Replicas
 	}
 )
-
-// SecretProviderClassPodStatus accessors
-var (
-	SPCPSIsMounted StatusAccessor[*csiv1.SecretProviderClassPodStatus] = func(s *csiv1.SecretProviderClassPodStatus) bool {
-		return s.Status.Mounted
-	}
-	SPCPSClassName ValueAccessor[*csiv1.SecretProviderClassPodStatus, string] = func(s *csiv1.SecretProviderClassPodStatus) string {
-		return s.Status.SecretProviderClassName
-	}
-	SPCPSPodName ValueAccessor[*csiv1.SecretProviderClassPodStatus, string] = func(s *csiv1.SecretProviderClassPodStatus) string {
-		return s.Status.PodName
-	}
-	// SPCPSVersions returns concatenated versions of all objects for change detection.
-	SPCPSVersions ValueAccessor[*csiv1.SecretProviderClassPodStatus, string] = func(s *csiv1.SecretProviderClassPodStatus) string {
-		if len(s.Status.Objects) == 0 {
-			return ""
-		}
-		var versions []string
-		for _, obj := range s.Status.Objects {
-			versions = append(versions, obj.Version)
-		}
-		return strings.Join(versions, ",")
-	}
-)

test/e2e/utils/annotations.go

@@ -20,11 +20,6 @@ const (
 	// Value: comma-separated list of Secret names, e.g., "secret1,secret2"
 	AnnotationSecretReload = "secret.reloader.stakater.com/reload"
 
-	// AnnotationSecretProviderClassReload triggers reload when specified SecretProviderClass(es) change.
-	// Value: comma-separated list of SecretProviderClass names, e.g., "spc1,spc2"
-	// Note: Reloader actually watches SecretProviderClassPodStatus resources, not SecretProviderClass.
-	AnnotationSecretProviderClassReload = "secretproviderclass.reloader.stakater.com/reload"
-
 	// ============================================================
 	// Auto-reload annotations
 	// ============================================================
@@ -41,10 +36,6 @@ const (
 	// Value: "true" or "false"
 	AnnotationSecretAuto = "secret.reloader.stakater.com/auto"
 
-	// AnnotationSecretProviderClassAuto enables auto-reload for all referenced SecretProviderClasses only.
-	// Value: "true" or "false"
-	AnnotationSecretProviderClassAuto = "secretproviderclass.reloader.stakater.com/auto"
-
 	// ============================================================
 	// Exclude annotations (used with auto=true to exclude specific resources)
 	// ============================================================
@@ -57,10 +48,6 @@ const (
 	// Value: comma-separated list of Secret names
 	AnnotationSecretExclude = "secrets.exclude.reloader.stakater.com/reload"
 
-	// AnnotationSecretProviderClassExclude excludes specified SecretProviderClasses from auto-reload.
-	// Value: comma-separated list of SecretProviderClass names
-	AnnotationSecretProviderClassExclude = "secretproviderclasses.exclude.reloader.stakater.com/reload"
-
 	// ============================================================
 	// Search annotations (for regex matching)
 	// ============================================================
@@ -130,13 +117,6 @@ func BuildSecretReloadAnnotation(secretNames ...string) map[string]string {
 	}
 }
 
-// BuildSecretProviderClassReloadAnnotation creates an annotation map for SecretProviderClass reload.
-func BuildSecretProviderClassReloadAnnotation(spcNames ...string) map[string]string {
-	return map[string]string{
-		AnnotationSecretProviderClassReload: joinNames(spcNames),
-	}
-}
-
 // BuildAutoTrueAnnotation creates an annotation map with auto=true.
 func BuildAutoTrueAnnotation() map[string]string {
 	return map[string]string{
@@ -165,13 +145,6 @@ func BuildSecretAutoAnnotation() map[string]string {
 	}
 }
 
-// BuildSecretProviderClassAutoAnnotation creates an annotation map with secretproviderclass auto=true.
-func BuildSecretProviderClassAutoAnnotation() map[string]string {
-	return map[string]string{
-		AnnotationSecretProviderClassAuto: AnnotationValueTrue,
-	}
-}
-
 // BuildSearchAnnotation creates an annotation map to enable search mode.
 func BuildSearchAnnotation() map[string]string {
 	return map[string]string{
@@ -214,13 +187,6 @@ func BuildSecretExcludeAnnotation(secretNames ...string) map[string]string {
 	}
 }
 
-// BuildSecretProviderClassExcludeAnnotation creates an annotation to exclude SecretProviderClasses from auto-reload.
-func BuildSecretProviderClassExcludeAnnotation(spcNames ...string) map[string]string {
-	return map[string]string{
-		AnnotationSecretProviderClassExclude: joinNames(spcNames),
-	}
-}
-
 // BuildPausePeriodAnnotation creates an annotation for deployment pause period.
 func BuildPausePeriodAnnotation(duration string) map[string]string {
 	return map[string]string{

test/e2e/utils/conditions.go

@@ -6,7 +6,6 @@ import (
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
-	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 )
 
 // PodTemplateAccessor extracts PodTemplateSpec from a workload.
@@ -216,43 +215,3 @@ func IsTriggeredJobForCronJob(cronJobName string) Condition[*batchv1.Job] {
 		return false
 	}
 }
-
-// SPCPSVersionChanged returns a condition that checks if the SPCPS version has changed
-// from the initial version and the SPCPS is mounted.
-func SPCPSVersionChanged(initialVersion string) Condition[*csiv1.SecretProviderClassPodStatus] {
-	return func(spcps *csiv1.SecretProviderClassPodStatus) bool {
-		if !spcps.Status.Mounted || len(spcps.Status.Objects) == 0 {
-			return false
-		}
-		for _, obj := range spcps.Status.Objects {
-			if obj.Version != initialVersion {
-				return true
-			}
-		}
-		return false
-	}
-}
-
-// SPCPSForSPC returns a condition that checks if the SPCPS references a specific
-// SecretProviderClass and is mounted.
-func SPCPSForSPC(spcName string) Condition[*csiv1.SecretProviderClassPodStatus] {
-	return func(spcps *csiv1.SecretProviderClassPodStatus) bool {
-		return spcps.Status.SecretProviderClassName == spcName && spcps.Status.Mounted
-	}
-}
-
-// SPCPSForPod returns a condition that checks if the SPCPS references a specific
-// pod and is mounted.
-func SPCPSForPod(podName string) Condition[*csiv1.SecretProviderClassPodStatus] {
-	return func(spcps *csiv1.SecretProviderClassPodStatus) bool {
-		return spcps.Status.PodName == podName && spcps.Status.Mounted
-	}
-}
-
-// SPCPSForPods returns a condition that checks if the SPCPS references any of the
-// specified pods and is mounted.
-func SPCPSForPods(podNames map[string]bool) Condition[*csiv1.SecretProviderClassPodStatus] {
-	return func(spcps *csiv1.SecretProviderClassPodStatus) bool {
-		return podNames[spcps.Status.PodName] && spcps.Status.Mounted
-	}
-}

test/e2e/utils/csi.go

@@ -1,338 +0,0 @@
-package utils
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	"k8s.io/client-go/kubernetes"
-	"k8s.io/client-go/kubernetes/scheme"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
-	"k8s.io/client-go/tools/remotecommand"
-	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
-	csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned"
-)
-
-// CSI Driver constants
-const (
-	// CSIDriverName is the name of the secrets-store CSI driver
-	CSIDriverName = "secrets-store.csi.k8s.io"
-
-	// DefaultCSIProvider is the default provider name for testing (Vault)
-	DefaultCSIProvider = "vault"
-
-	// VaultAddress is the default Vault address in the cluster
-	VaultAddress = "http://vault.vault:8200"
-
-	// VaultRole is the Kubernetes auth role configured in Vault for testing
-	VaultRole = "test-role"
-
-	// VaultNamespace is the namespace where Vault is deployed
-	VaultNamespace = "vault"
-
-	// VaultPodName is the name of the Vault pod (dev mode)
-	VaultPodName = "vault-0"
-
-	// CSIVolumeName is the default volume name for CSI volumes in tests
-	CSIVolumeName = "csi-secrets-store"
-
-	// CSIMountPath is the default mount path for CSI volumes in tests
-	CSIMountPath = "/mnt/secrets-store"
-
-	// CSIRotationPollInterval is how often CSI driver checks for secret changes
-	CSIRotationPollInterval = 2 * time.Second
-)
-
-// NewCSIClient creates a new CSI client using the default kubeconfig.
-func NewCSIClient() (csiclient.Interface, error) {
-	kubeconfig := GetKubeconfig()
-	config, err := clientcmd.BuildConfigFromFlags("", kubeconfig)
-	if err != nil {
-		return nil, fmt.Errorf("building config from kubeconfig: %w", err)
-	}
-	return NewCSIClientFromConfig(config)
-}
-
-// NewCSIClientFromConfig creates a new CSI client from a rest.Config.
-func NewCSIClientFromConfig(config *rest.Config) (csiclient.Interface, error) {
-	client, err := csiclient.NewForConfig(config)
-	if err != nil {
-		return nil, fmt.Errorf("creating CSI client: %w", err)
-	}
-	return client, nil
-}
-
-// IsCSIDriverInstalled checks if the CSI secrets store driver CRDs are available in the cluster.
-// This checks for the SecretProviderClass CRD which is required for CSI tests.
-func IsCSIDriverInstalled(ctx context.Context, client csiclient.Interface) bool {
-	if client == nil {
-		return false
-	}
-
-	// Try to list SecretProviderClasses - if CRD doesn't exist, this will fail
-	_, err := client.SecretsstoreV1().SecretProviderClasses("default").List(ctx, metav1.ListOptions{Limit: 1})
-	return err == nil
-}
-
-// IsVaultProviderInstalled checks if Vault CSI provider is installed by checking for the vault-csi-provider DaemonSet.
-// This is used to determine if CSI tests with actual volume mounting can run.
-func IsVaultProviderInstalled(ctx context.Context, kubeClient kubernetes.Interface) bool {
-	if kubeClient == nil {
-		return false
-	}
-
-	// Check if vault-csi-provider DaemonSet exists in vault namespace
-	_, err := kubeClient.AppsV1().DaemonSets("vault").Get(ctx, "vault-csi-provider", metav1.GetOptions{})
-	return err == nil
-}
-
-// CreateSecretProviderClass creates a SecretProviderClass in the given namespace.
-// If params is nil, it creates a Vault-compatible SecretProviderClass with default test settings.
-func CreateSecretProviderClass(ctx context.Context, client csiclient.Interface, namespace, name string, params map[string]string) (
-	*csiv1.SecretProviderClass, error,
-) {
-	if params == nil {
-		params = map[string]string{
-			"vaultAddress": VaultAddress,
-			"roleName":     VaultRole,
-			"objects": `- objectName: "test-secret"
-  secretPath: "secret/data/test"
-  secretKey: "username"`,
-		}
-	}
-
-	spc := &csiv1.SecretProviderClass{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
-			Namespace: namespace,
-		},
-		Spec: csiv1.SecretProviderClassSpec{
-			Provider:   DefaultCSIProvider,
-			Parameters: params,
-		},
-	}
-
-	created, err := client.SecretsstoreV1().SecretProviderClasses(namespace).Create(ctx, spc, metav1.CreateOptions{})
-	if err != nil {
-		return nil, fmt.Errorf("creating SecretProviderClass %s/%s: %w", namespace, name, err)
-	}
-	return created, nil
-}
-
-// CreateSecretProviderClassWithSecret creates a SecretProviderClass that fetches a specific secret from Vault.
-// secretPath should be like "secret/mysecret" (the function converts it to KV v2 format "secret/data/mysecret").
-// secretKey is the key within that secret to fetch.
-func CreateSecretProviderClassWithSecret(ctx context.Context, client csiclient.Interface, namespace, name, secretPath, secretKey string) (
-	*csiv1.SecretProviderClass, error,
-) {
-	kvV2Path := secretPath
-	if strings.HasPrefix(secretPath, "secret/") && !strings.HasPrefix(secretPath, "secret/data/") {
-		kvV2Path = strings.Replace(secretPath, "secret/", "secret/data/", 1)
-	}
-
-	params := map[string]string{
-		"vaultAddress": VaultAddress,
-		"roleName":     VaultRole,
-		"objects": fmt.Sprintf(
-			`- objectName: "%s"
-  secretPath: "%s"
-  secretKey: "%s"`, secretKey, kvV2Path, secretKey,
-		),
-	}
-	return CreateSecretProviderClass(ctx, client, namespace, name, params)
-}
-
-// DeleteSecretProviderClass deletes a SecretProviderClass by name.
-func DeleteSecretProviderClass(ctx context.Context, client csiclient.Interface, namespace, name string) error {
-	err := client.SecretsstoreV1().SecretProviderClasses(namespace).Delete(ctx, name, metav1.DeleteOptions{})
-	if err != nil {
-		return fmt.Errorf("deleting SecretProviderClass %s/%s: %w", namespace, name, err)
-	}
-	return nil
-}
-
-// UpdateSecretProviderClassPodStatusLabels updates only the labels on a SecretProviderClassPodStatus.
-// This should NOT trigger a reload (used for negative testing to verify Reloader ignores label-only changes).
-func UpdateSecretProviderClassPodStatusLabels(ctx context.Context, client csiclient.Interface, namespace, name string, labels map[string]string) error {
-	spcps, err := client.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Get(ctx, name, metav1.GetOptions{})
-	if err != nil {
-		return fmt.Errorf("getting SecretProviderClassPodStatus %s/%s: %w", namespace, name, err)
-	}
-
-	if spcps.Labels == nil {
-		spcps.Labels = make(map[string]string)
-	}
-	for k, v := range labels {
-		spcps.Labels[k] = v
-	}
-
-	_, err = client.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Update(ctx, spcps, metav1.UpdateOptions{})
-	if err != nil {
-		return fmt.Errorf("updating SecretProviderClassPodStatus labels %s/%s: %w", namespace, name, err)
-	}
-	return nil
-}
-
-// =============================================================================
-// Vault Integration Helpers
-// =============================================================================
-
-// CreateVaultSecret creates a new secret in Vault.
-// secretPath should be like "secret/test" (without "data" prefix - it's added automatically).
-// data is a map of key-value pairs to store in the secret.
-func CreateVaultSecret(ctx context.Context, kubeClient kubernetes.Interface, restConfig *rest.Config, secretPath string, data map[string]string) error {
-	return UpdateVaultSecret(ctx, kubeClient, restConfig, secretPath, data)
-}
-
-// UpdateVaultSecret updates a secret in Vault. This triggers the CSI driver to
-// sync the new secret version, which creates/updates the SecretProviderClassPodStatus.
-// secretPath should be like "secret/test" (without "data" prefix - it's added automatically).
-// data is a map of key-value pairs to store in the secret.
-func UpdateVaultSecret(ctx context.Context, kubeClient kubernetes.Interface, restConfig *rest.Config, secretPath string, data map[string]string) error {
-	args := []string{"kv", "put", secretPath}
-	for k, v := range data {
-		args = append(args, fmt.Sprintf("%s=%s", k, v))
-	}
-
-	if err := execInVaultPod(ctx, kubeClient, restConfig, args); err != nil {
-		return fmt.Errorf("updating Vault secret %s: %w", secretPath, err)
-	}
-	return nil
-}
-
-// DeleteVaultSecret deletes a secret from Vault.
-// secretPath should be like "secret/test".
-func DeleteVaultSecret(ctx context.Context, kubeClient kubernetes.Interface, restConfig *rest.Config, secretPath string) error {
-	args := []string{"kv", "metadata", "delete", secretPath}
-	if err := execInVaultPod(ctx, kubeClient, restConfig, args); err != nil {
-		if strings.Contains(err.Error(), "No value found") {
-			return nil
-		}
-		return fmt.Errorf("deleting Vault secret %s: %w", secretPath, err)
-	}
-	return nil
-}
-
-// execInVaultPod executes a vault command in the Vault pod.
-func execInVaultPod(ctx context.Context, kubeClient kubernetes.Interface, restConfig *rest.Config, args []string) error {
-	req := kubeClient.CoreV1().RESTClient().Post().
-		Resource("pods").
-		Name(VaultPodName).
-		Namespace(VaultNamespace).
-		SubResource("exec").
-		VersionedParams(
-			&corev1.PodExecOptions{
-				Container: "vault",
-				Command:   append([]string{"vault"}, args...),
-				Stdout:    true,
-				Stderr:    true,
-			}, scheme.ParameterCodec,
-		)
-
-	exec, err := remotecommand.NewSPDYExecutor(restConfig, "POST", req.URL())
-	if err != nil {
-		return fmt.Errorf("creating executor: %w", err)
-	}
-
-	var stdout, stderr bytes.Buffer
-	err = exec.StreamWithContext(
-		ctx, remotecommand.StreamOptions{
-			Stdout: &stdout,
-			Stderr: &stderr,
-		},
-	)
-	if err != nil {
-		return fmt.Errorf("executing command: %w (stderr: %s)", err, stderr.String())
-	}
-
-	return nil
-}
-
-// WaitForSPCPSVersionChange waits for the SecretProviderClassPodStatus version to change
-// from the initial version using watches. This is used after updating a Vault secret to
-// wait for CSI driver to sync the new version.
-func WaitForSPCPSVersionChange(ctx context.Context, client csiclient.Interface, namespace, spcpsName, initialVersion string, timeout time.Duration) error {
-	watchFunc := func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-		return client.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Watch(ctx, opts)
-	}
-
-	_, err := WatchUntil(ctx, watchFunc, spcpsName, SPCPSVersionChanged(initialVersion), timeout)
-	if errors.Is(err, ErrWatchTimeout) {
-		return fmt.Errorf("timeout waiting for SecretProviderClassPodStatus %s/%s version to change from %s", namespace, spcpsName, initialVersion)
-	}
-	return err
-}
-
-// FindSPCPSForDeployment finds the SecretProviderClassPodStatus created by CSI driver
-// for pods of a given deployment using watches. Returns the first matching SPCPS name.
-func FindSPCPSForDeployment(ctx context.Context, csiClient csiclient.Interface, kubeClient kubernetes.Interface, namespace, deploymentName string, timeout time.Duration) (
-	string, error,
-) {
-	pods, err := kubeClient.CoreV1().Pods(namespace).List(
-		ctx, metav1.ListOptions{
-			LabelSelector: fmt.Sprintf("app=%s", deploymentName),
-		},
-	)
-	if err != nil {
-		return "", fmt.Errorf("listing pods for deployment %s: %w", deploymentName, err)
-	}
-
-	podNames := make(map[string]bool)
-	for _, pod := range pods.Items {
-		podNames[pod.Name] = true
-	}
-
-	watchFunc := func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-		return csiClient.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Watch(ctx, opts)
-	}
-
-	spcps, err := WatchUntil(ctx, watchFunc, "", SPCPSForPods(podNames), timeout)
-	if errors.Is(err, ErrWatchTimeout) {
-		return "", fmt.Errorf("timeout finding SecretProviderClassPodStatus for deployment %s/%s", namespace, deploymentName)
-	}
-	if err != nil {
-		return "", err
-	}
-	return spcps.Name, nil
-}
-
-// FindSPCPSForSPC finds the SecretProviderClassPodStatus created by CSI driver
-// that references a specific SecretProviderClass using watches. Returns the first matching SPCPS name.
-func FindSPCPSForSPC(ctx context.Context, csiClient csiclient.Interface, namespace, spcName string, timeout time.Duration) (string, error) {
-	watchFunc := func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-		return csiClient.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Watch(ctx, opts)
-	}
-
-	spcps, err := WatchUntil(ctx, watchFunc, "", SPCPSForSPC(spcName), timeout)
-	if errors.Is(err, ErrWatchTimeout) {
-		return "", fmt.Errorf("timeout finding SecretProviderClassPodStatus for SPC %s/%s", namespace, spcName)
-	}
-	if err != nil {
-		return "", err
-	}
-	return spcps.Name, nil
-}
-
-// GetSPCPSVersion gets the current version string from a SecretProviderClassPodStatus.
-// Returns the version of the first object, or empty string if not found.
-func GetSPCPSVersion(ctx context.Context, client csiclient.Interface, namespace, name string) (string, error) {
-	spcps, err := client.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Get(ctx, name, metav1.GetOptions{})
-	if err != nil {
-		return "", fmt.Errorf("getting SecretProviderClassPodStatus %s/%s: %w", namespace, name, err)
-	}
-	if len(spcps.Status.Objects) == 0 {
-		return "", nil
-	}
-	var versions []string
-	for _, obj := range spcps.Status.Objects {
-		versions = append(versions, obj.Version)
-	}
-	return strings.Join(versions, ","), nil
-}

test/e2e/utils/podspec.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/utils/ptr"
 )
 
 // AddEnvFromSource adds ConfigMap or Secret envFrom to a container.
@@ -107,69 +106,6 @@ func AddKeyRef(spec *corev1.PodSpec, containerIdx int, resourceName, key, envVar
 	spec.Containers[containerIdx].Env = append(spec.Containers[containerIdx].Env, envVar)
 }
 
-// AddCSIVolume adds CSI volume referencing SecretProviderClass.
-func AddCSIVolume(spec *corev1.PodSpec, containerIdx int, spcName string) {
-	volumeName := "csi-" + spcName
-	mountPath := "/mnt/secrets-store/" + spcName
-	spec.Volumes = append(spec.Volumes, corev1.Volume{
-		Name: volumeName,
-		VolumeSource: corev1.VolumeSource{
-			CSI: &corev1.CSIVolumeSource{
-				Driver:   CSIDriverName,
-				ReadOnly: ptr.To(true),
-				VolumeAttributes: map[string]string{
-					"secretProviderClass": spcName,
-				},
-			},
-		},
-	})
-	if containerIdx < len(spec.Containers) {
-		spec.Containers[containerIdx].VolumeMounts = append(
-			spec.Containers[containerIdx].VolumeMounts,
-			corev1.VolumeMount{Name: volumeName, MountPath: mountPath, ReadOnly: true},
-		)
-	}
-}
-
-// AddCSIInitContainer adds an init container that mounts a CSI SecretProviderClass volume.
-// The init container is named "init-csi-{spcName}" to avoid collisions when multiple CSI
-// volumes are mounted. The volume is only added if not already present (idempotent).
-// This is distinct from AddCSIVolume which mounts into a regular container.
-func AddCSIInitContainer(spec *corev1.PodSpec, spcName string) {
-	volumeName := "csi-" + spcName
-	mountPath := "/mnt/secrets-store/" + spcName
-
-	hasVolume := false
-	for _, v := range spec.Volumes {
-		if v.Name == volumeName {
-			hasVolume = true
-			break
-		}
-	}
-	if !hasVolume {
-		spec.Volumes = append(spec.Volumes, corev1.Volume{
-			Name: volumeName,
-			VolumeSource: corev1.VolumeSource{
-				CSI: &corev1.CSIVolumeSource{
-					Driver:   CSIDriverName,
-					ReadOnly: ptr.To(true),
-					VolumeAttributes: map[string]string{
-						"secretProviderClass": spcName,
-					},
-				},
-			},
-		})
-	}
-	spec.InitContainers = append(spec.InitContainers, corev1.Container{
-		Name:    "init-csi-" + spcName,
-		Image:   DefaultImage,
-		Command: []string{"sh", "-c", "echo init done"},
-		VolumeMounts: []corev1.VolumeMount{
-			{Name: volumeName, MountPath: mountPath, ReadOnly: true},
-		},
-	})
-}
-
 // AddInitContainer adds init container with optional envFrom references.
 func AddInitContainer(spec *corev1.PodSpec, cmName, secretName string) {
 	init := corev1.Container{
@@ -282,18 +218,12 @@ func ApplyWorkloadConfig(template *corev1.PodTemplateSpec, cfg WorkloadConfig) {
 		}
 		AddKeyRef(spec, 0, cfg.SecretName, key, envVar, true)
 	}
-	if cfg.UseCSIVolume && cfg.SPCName != "" {
-		AddCSIVolume(spec, 0, cfg.SPCName)
-	}
 	if cfg.UseInitContainer {
 		AddInitContainer(spec, cfg.ConfigMapName, cfg.SecretName)
 	}
 	if cfg.UseInitContainerVolume {
 		AddInitContainerWithVolumes(spec, cfg.ConfigMapName, cfg.SecretName)
 	}
-	if cfg.UseInitContainerCSI && cfg.SPCName != "" {
-		AddCSIInitContainer(spec, cfg.SPCName)
-	}
 	if cfg.MultipleContainers > 1 {
 		for i := 1; i < cfg.MultipleContainers; i++ {
 			spec.Containers = append(spec.Containers, corev1.Container{

test/e2e/utils/resources.go

@@ -516,42 +516,6 @@ func WithInitContainerProjectedVolume(cmName, secretName string) DeploymentOptio
 	}
 }
 
-// WithCSIVolume adds a CSI volume referencing a SecretProviderClass to a Deployment.
-func WithCSIVolume(spcName string) DeploymentOption {
-	return func(d *appsv1.Deployment) {
-		volumeName := csiVolumeName(spcName)
-		mountPath := csiMountPath(spcName)
-
-		d.Spec.Template.Spec.Volumes = append(d.Spec.Template.Spec.Volumes, corev1.Volume{
-			Name: volumeName,
-			VolumeSource: corev1.VolumeSource{
-				CSI: &corev1.CSIVolumeSource{
-					Driver:   CSIDriverName,
-					ReadOnly: ptr.To(true),
-					VolumeAttributes: map[string]string{
-						"secretProviderClass": spcName,
-					},
-				},
-			},
-		})
-		d.Spec.Template.Spec.Containers[0].VolumeMounts = append(
-			d.Spec.Template.Spec.Containers[0].VolumeMounts,
-			corev1.VolumeMount{
-				Name:      volumeName,
-				MountPath: mountPath,
-				ReadOnly:  true,
-			},
-		)
-	}
-}
-
-// WithInitContainerCSIVolume adds an init container with a CSI volume mount.
-func WithInitContainerCSIVolume(spcName string) DeploymentOption {
-	return func(d *appsv1.Deployment) {
-		AddCSIInitContainer(&d.Spec.Template.Spec, spcName)
-	}
-}
-
 func baseDeploymentResource(namespace, name string) *appsv1.Deployment {
 	labels := map[string]string{"app": name}
 	return &appsv1.Deployment{
@@ -868,35 +832,6 @@ func WithJobCommand(command string) JobOption {
 	}
 }
 
-// WithJobCSIVolume adds a CSI volume referencing a SecretProviderClass to a Job.
-func WithJobCSIVolume(spcName string) JobOption {
-	return func(j *batchv1.Job) {
-		volumeName := csiVolumeName(spcName)
-		mountPath := csiMountPath(spcName)
-
-		j.Spec.Template.Spec.Volumes = append(j.Spec.Template.Spec.Volumes, corev1.Volume{
-			Name: volumeName,
-			VolumeSource: corev1.VolumeSource{
-				CSI: &corev1.CSIVolumeSource{
-					Driver:   CSIDriverName,
-					ReadOnly: ptr.To(true),
-					VolumeAttributes: map[string]string{
-						"secretProviderClass": spcName,
-					},
-				},
-			},
-		})
-		j.Spec.Template.Spec.Containers[0].VolumeMounts = append(
-			j.Spec.Template.Spec.Containers[0].VolumeMounts,
-			corev1.VolumeMount{
-				Name:      volumeName,
-				MountPath: mountPath,
-				ReadOnly:  true,
-			},
-		)
-	}
-}
-
 // baseJobResource creates a base Job template.
 func baseJobResource(namespace, name string) *batchv1.Job {
 	labels := map[string]string{"app": name}
@@ -933,14 +868,6 @@ func DeleteJob(ctx context.Context, client kubernetes.Interface, namespace, name
 	})
 }
 
-func csiVolumeName(spcName string) string {
-	return fmt.Sprintf("csi-%s", spcName)
-}
-
-func csiMountPath(spcName string) string {
-	return fmt.Sprintf("/mnt/secrets-store/%s", spcName)
-}
-
 // GetDeployment retrieves a deployment by name.
 func GetDeployment(ctx context.Context, client kubernetes.Interface, namespace, name string) (*appsv1.Deployment, error) {
 	return client.AppsV1().Deployments(namespace).Get(ctx, name, metav1.GetOptions{})

test/e2e/utils/testenv.go

@@ -13,7 +13,6 @@ import (
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
-	csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned"
 )
 
 // TestEnvironment holds the common test environment state.
@@ -22,7 +21,6 @@ type TestEnvironment struct {
 	Cancel          context.CancelFunc
 	KubeClient      kubernetes.Interface
 	DiscoveryClient discovery.DiscoveryInterface
-	CSIClient       csiclient.Interface
 	RolloutsClient  rolloutsclient.Interface
 	OpenShiftClient openshiftclient.Interface
 	RestConfig      *rest.Config
@@ -84,9 +82,6 @@ func SetupSharedTestEnvironment(ctx context.Context, namespace, releaseName stri
 	}
 
 	// Optional clients — failures are non-fatal.
-	if env.CSIClient, err = csiclient.NewForConfig(config); err != nil {
-		env.CSIClient = nil
-	}
 	if env.RolloutsClient, err = rolloutsclient.NewForConfig(config); err != nil {
 		env.RolloutsClient = nil
 	}
@@ -135,12 +130,6 @@ func SetupTestEnvironment(ctx context.Context, namespacePrefix string) (*TestEnv
 		return nil, fmt.Errorf("creating discovery client: %w", err)
 	}
 
-	env.CSIClient, err = csiclient.NewForConfig(config)
-	if err != nil {
-		ginkgo.GinkgoWriter.Printf("Warning: Could not create CSI client: %v (CSI tests will be skipped)\n", err)
-		env.CSIClient = nil
-	}
-
 	// Try to create Argo Rollouts client (optional - may not be installed)
 	env.RolloutsClient, err = rolloutsclient.NewForConfig(config)
 	if err != nil {

test/e2e/utils/workload_adapter.go

@@ -32,7 +32,6 @@ const (
 type WorkloadConfig struct {
 	ConfigMapName          string
 	SecretName             string
-	SPCName                string
 	Annotations            map[string]string // Annotations for workload metadata (e.g., Deployment.metadata.annotations)
 	PodTemplateAnnotations map[string]string // Annotations for pod template metadata (e.g., Deployment.spec.template.metadata.annotations)
 	UseConfigMapEnvFrom    bool
@@ -44,8 +43,6 @@ type WorkloadConfig struct {
 	UseSecretKeyRef        bool
 	UseInitContainer       bool
 	UseInitContainerVolume bool
-	UseCSIVolume           bool
-	UseInitContainerCSI    bool
 	ConfigMapKey           string
 	SecretKey              string
 	EnvVarName             string