Change:
err: nil, }, { <ins> name:    "existing labels from dynamic provisioning are not changed", handler: newPersistentVolumeLabel(), pvlabeler: mockVolumeLabels(map[string]string{ v1.LabelZoneFailureDomain: "domain1", v1.LabelZoneRegion:        "region1", }), preAdmissionPV: &api.PersistentVolume{ ObjectMeta: metav1.ObjectMeta{ Name: "awsebs", Namespace: "myns", Labels: map[string]string{ v1.LabelZoneFailureDomain: "existingDomain", v1.LabelZoneRegion:        "existingRegion", }, Annotations: map[string]string{ persistentvolume.AnnDynamicallyProvisioned: "kubernetes.io/aws-ebs", }, }, Spec: api.PersistentVolumeSpec{ PersistentVolumeSource: api.PersistentVolumeSource{ AWSElasticBlockStore: &api.AWSElasticBlockStoreVolumeSource{ VolumeID: "123", }, }, }, }, postAdmissionPV: &api.PersistentVolume{ ObjectMeta: metav1.ObjectMeta{ Name:      "awsebs", Namespace: "myns", Labels: map[string]string{ v1.LabelZoneFailureDomain: "existingDomain", v1.LabelZoneRegion:        "existingRegion", }, Annotations: map[string]string{ persistentvolume.AnnDynamicallyProvisioned: "kubernetes.io/aws-ebs", }, }, Spec: api.PersistentVolumeSpec{ PersistentVolumeSource: api.PersistentVolumeSource{ AWSElasticBlockStore: &api.AWSElasticBlockStoreVolumeSource{ VolumeID: "123", }, }, NodeAffinity: &api.VolumeNodeAffinity{ Required: &api.NodeSelector{ NodeSelectorTerms: []api.NodeSelectorTerm{ { MatchExpressions: []api.NodeSelectorRequirement{ { Key:      v1.LabelZoneRegion, Operator: api.NodeSelectorOpIn, Values:   []string{"existingRegion"}, }, { Key:      v1.LabelZoneFailureDomain, Operator: api.NodeSelectorOpIn, Values:   []string{"existingDomain"}, }, }, }, }, }, }, }, }, err: nil, }, { name:    "existing labels from user are changed", handler: newPersistentVolumeLabel(), pvlabeler: mockVolumeLabels(map[string]string{ v1.LabelZoneFailureDomain: "domain1", v1.LabelZoneRegion:        "region1", }), preAdmissionPV: &api.PersistentVolume{ ObjectMeta: metav1.ObjectMeta{ Name: "awsebs", Namespace: "myns", Labels: map[string]string{ v1.LabelZoneFailureDomain: "existingDomain", v1.LabelZoneRegion:        "existingRegion", }, }, Spec: api.PersistentVolumeSpec{ PersistentVolumeSource: api.PersistentVolumeSource{ AWSElasticBlockStore: &api.AWSElasticBlockStoreVolumeSource{ VolumeID: "123", }, }, }, }, postAdmissionPV: &api.PersistentVolume{ ObjectMeta: metav1.ObjectMeta{ Name:      "awsebs", Namespace: "myns", Labels: map[string]string{ v1.LabelZoneFailureDomain: "domain1", v1.LabelZoneRegion:        "region1", }, }, Spec: api.PersistentVolumeSpec{ PersistentVolumeSource: api.PersistentVolumeSource{ AWSElasticBlockStore: &api.AWSElasticBlockStoreVolumeSource{ VolumeID: "123", }, }, NodeAffinity: &api.VolumeNodeAffinity{ Required: &api.NodeSelector{ NodeSelectorTerms: []api.NodeSelectorTerm{ { MatchExpressions: []api.NodeSelectorRequirement{ { Key:      v1.LabelZoneRegion, Operator: api.NodeSelectorOpIn, Values:   []string{"region1"}, }, { Key:      v1.LabelZoneFailureDomain, Operator: api.NodeSelectorOpIn, Values:   []string{"domain1"}, }, }, }, }, }, }, }, }, err: nil, }, { </ins> name:    "GCE PD PV labeled correctly", handler: newPersistentVolumeLabel(), pvlabeler: mockVolumeLabels(map[string]string{

Discussion:
API server latency for PV creation depends on underlying cloud API latency. We have admission plugin that examines incoming PV and adds topology labels and node selector: When the cluster (and cloud) are under pressure, e.g. lot of PVCs are created and dynamically provisioned at one time and attached to nodes, API server latency increases. We've seen cases when we ran out of cloud API request quota and the admission plugin needed to sleep for couple of seconds (on AWS). There should be an easy fix: check, if the created PV already has all necessary labels and topology information and ask the cloud for them only when they're missing. Dynamically provisioned volumes already have these labels. The admission plugin will then ask the cloud only for manually provisioned PVs, which we believe is just a fraction of all PVs in the cluster. There is one glitch: previously, when user created a PV with wrong topology labels, the admission plugin corrected them. With the fix suggested above, this PV won't be corrected. /sig storage cc
Implementation of the above: