diff --git a/assets/overlays/gcp-pd/base/controller_hostnetwork_binding.yaml b/assets/overlays/gcp-pd/base/controller_hostnetwork_binding.yaml new file mode 100644 index 000000000..b70c766e1 --- /dev/null +++ b/assets/overlays/gcp-pd/base/controller_hostnetwork_binding.yaml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: gcp-pd-controller-hostnetwork-binding +subjects: + - kind: ServiceAccount + name: gcp-pd-csi-driver-controller-sa + namespace: ${NAMESPACE} +roleRef: + kind: ClusterRole + name: gcp-pd-hostnetwork-role + apiGroup: rbac.authorization.k8s.io diff --git a/assets/overlays/gcp-pd/base/csidriver.yaml b/assets/overlays/gcp-pd/base/csidriver.yaml new file mode 100644 index 000000000..19d994f5f --- /dev/null +++ b/assets/overlays/gcp-pd/base/csidriver.yaml @@ -0,0 +1,13 @@ +apiVersion: storage.k8s.io/v1 +kind: CSIDriver +metadata: + name: pd.csi.storage.gke.io +spec: + attachRequired: true + podInfoOnMount: false + fsGroupPolicy: File + requiresRepublish: false + storageCapacity: false + seLinuxMount: true + volumeLifecycleModes: + - Persistent diff --git a/assets/overlays/gcp-pd/base/hostnetwork_role.yaml b/assets/overlays/gcp-pd/base/hostnetwork_role.yaml new file mode 100644 index 000000000..133d40416 --- /dev/null +++ b/assets/overlays/gcp-pd/base/hostnetwork_role.yaml @@ -0,0 +1,12 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: gcp-pd-hostnetwork-role +rules: + - apiGroups: ["security.openshift.io"] + resourceNames: ["hostnetwork-v2"] + resources: ["securitycontextconstraints"] + verbs: ["use"] + - apiGroups: [""] + resources: ["nodes"] + verbs: ["get"] diff --git a/assets/overlays/gcp-pd/base/storageclass.yaml b/assets/overlays/gcp-pd/base/storageclass.yaml new file mode 100644 index 000000000..d7a2c5fe5 --- /dev/null +++ b/assets/overlays/gcp-pd/base/storageclass.yaml @@ -0,0 +1,13 @@ +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: standard-csi + annotations: + storageclass.kubernetes.io/is-default-class: "true" +provisioner: pd.csi.storage.gke.io +parameters: + type: pd-standard + replication-type: none +volumeBindingMode: WaitForFirstConsumer +allowVolumeExpansion: true +reclaimPolicy: Delete diff --git a/assets/overlays/gcp-pd/base/storageclass_hyperdisk_balanced.yaml b/assets/overlays/gcp-pd/base/storageclass_hyperdisk_balanced.yaml new file mode 100644 index 000000000..071c17d2e --- /dev/null +++ b/assets/overlays/gcp-pd/base/storageclass_hyperdisk_balanced.yaml @@ -0,0 +1,13 @@ +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: hyperdisk-balanced + annotations: + storageclass.kubernetes.io/is-default-class: "true" +provisioner: pd.csi.storage.gke.io +parameters: + type: hyperdisk-balanced + replication-type: none +volumeBindingMode: WaitForFirstConsumer +allowVolumeExpansion: true +reclaimPolicy: Delete diff --git a/assets/overlays/gcp-pd/base/storageclass_ssd.yaml b/assets/overlays/gcp-pd/base/storageclass_ssd.yaml new file mode 100644 index 000000000..f38805708 --- /dev/null +++ b/assets/overlays/gcp-pd/base/storageclass_ssd.yaml @@ -0,0 +1,11 @@ +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: ssd-csi +provisioner: pd.csi.storage.gke.io +parameters: + type: pd-ssd + replication-type: none +volumeBindingMode: WaitForFirstConsumer +allowVolumeExpansion: true +reclaimPolicy: Delete diff --git a/assets/overlays/gcp-pd/base/volumesnapshotclass.yaml b/assets/overlays/gcp-pd/base/volumesnapshotclass.yaml new file mode 100644 index 000000000..acc224035 --- /dev/null +++ b/assets/overlays/gcp-pd/base/volumesnapshotclass.yaml @@ -0,0 +1,8 @@ +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotClass +metadata: + name: csi-gce-pd-vsc + annotations: + snapshot.storage.kubernetes.io/is-default-class: "true" +driver: pd.csi.storage.gke.io +deletionPolicy: Delete \ No newline at end of file diff --git a/assets/overlays/gcp-pd/base/volumesnapshotclass_images.yaml b/assets/overlays/gcp-pd/base/volumesnapshotclass_images.yaml new file mode 100644 index 000000000..e261f2f4f --- /dev/null +++ b/assets/overlays/gcp-pd/base/volumesnapshotclass_images.yaml @@ -0,0 +1,8 @@ +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotClass +metadata: + name: csi-gce-pd-vsc-images +driver: pd.csi.storage.gke.io +deletionPolicy: Delete +parameters: + snapshot-type: images \ No newline at end of file diff --git a/assets/overlays/gcp-pd/generated/standalone/cabundle_cm.yaml b/assets/overlays/gcp-pd/generated/standalone/cabundle_cm.yaml index bd392d2b3..ea19ef85c 100644 --- a/assets/overlays/gcp-pd/generated/standalone/cabundle_cm.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/cabundle_cm.yaml @@ -1,7 +1,13 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/cabundle_cm.yaml +# +# + apiVersion: v1 kind: ConfigMap metadata: labels: config.openshift.io/inject-trusted-cabundle: "true" name: gcp-pd-csi-driver-trusted-ca-bundle - namespace: openshift-cluster-csi-drivers + namespace: ${NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/controller.yaml b/assets/overlays/gcp-pd/generated/standalone/controller.yaml index 90c5bc096..ad595ba0c 100644 --- a/assets/overlays/gcp-pd/generated/standalone/controller.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/controller.yaml @@ -1,331 +1,346 @@ -kind: Deployment +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/controller.yaml +# Applied strategic merge patch overlays/gcp-pd/patches/controller_add_driver.yaml +# provisioner.yaml: Loaded from common/sidecars/provisioner.yaml +# provisioner.yaml: Added arguments [--default-fstype=ext4 --feature-gates=Topology=true --extra-create-metadata=true --timeout=250s --controller-publish-readonly] +# Applied strategic merge patch provisioner.yaml +# attacher.yaml: Loaded from common/sidecars/attacher.yaml +# attacher.yaml: Added arguments [--timeout=250s] +# Applied strategic merge patch attacher.yaml +# resizer.yaml: Loaded from common/sidecars/resizer.yaml +# Applied strategic merge patch resizer.yaml +# snapshotter.yaml: Loaded from common/sidecars/snapshotter.yaml +# snapshotter.yaml: Added arguments [--timeout=300s] +# Applied strategic merge patch snapshotter.yaml +# pod_network_livenessprobe.yaml: Loaded from common/sidecars/pod_network_livenessprobe.yaml +# pod_network_livenessprobe.yaml: Added arguments [--probe-timeout=3s] +# Applied strategic merge patch pod_network_livenessprobe.yaml +# Applied strategic merge patch common/standalone/controller_add_affinity.yaml +# +# + apiVersion: apps/v1 +kind: Deployment metadata: - name: gcp-pd-csi-driver-controller - namespace: openshift-cluster-csi-drivers annotations: config.openshift.io/inject-proxy: csi-driver config.openshift.io/inject-proxy-cabundle: csi-driver + name: gcp-pd-csi-driver-controller + namespace: ${NAMESPACE} spec: - strategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 1 - maxSurge: 0 selector: matchLabels: app: gcp-pd-csi-driver-controller + strategy: + rollingUpdate: + maxSurge: 0 + maxUnavailable: 1 + type: RollingUpdate template: metadata: - labels: - app: gcp-pd-csi-driver-controller annotations: + cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes: socket-dir openshift.io/required-scc: hostnetwork-v2 target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' + labels: + app: gcp-pd-csi-driver-controller spec: - hostNetwork: true - serviceAccountName: gcp-pd-csi-driver-controller-sa - priorityClassName: system-cluster-critical - nodeSelector: - node-role.kubernetes.io/master: "" - tolerations: - - key: CriticalAddonsOnly - operator: Exists - - key: node-role.kubernetes.io/master - operator: Exists - effect: "NoSchedule" affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - labelSelector: - matchLabels: - app: gcp-pd-csi-driver-controller - topologyKey: kubernetes.io/hostname + - podAffinityTerm: + labelSelector: + matchLabels: + app: gcp-pd-csi-driver-controller + topologyKey: kubernetes.io/hostname + weight: 100 containers: - - name: csi-driver - securityContext: - readOnlyRootFilesystem: true - image: ${DRIVER_IMAGE} - imagePullPolicy: IfNotPresent - args: - - --endpoint=$(CSI_ENDPOINT) - - --logtostderr - - --v=${LOG_LEVEL} - - --enable-storage-pools=true - - --allow-hdha-provisioning=true - - --supports-dynamic-throughput-provisioning=hyperdisk-balanced,hyperdisk-throughput,hyperdisk-ml - - --supports-dynamic-iops-provisioning=hyperdisk-balanced,hyperdisk-extreme - env: - - name: GOOGLE_APPLICATION_CREDENTIALS - value: "/etc/cloud-sa/service_account.json" - - name: CSI_ENDPOINT - value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock - ports: - - name: healthz - # Due to hostNetwork, this port is open on a node! - containerPort: 10301 - protocol: TCP - livenessProbe: - httpGet: - path: /healthz - port: healthz - initialDelaySeconds: 10 - timeoutSeconds: 3 - periodSeconds: 10 - failureThreshold: 5 - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: socket-dir - mountPath: /var/lib/csi/sockets/pluginproxy/ - - name: cloud-sa-volume - readOnly: true - mountPath: "/etc/cloud-sa" - - name: bound-sa-token - mountPath: /var/run/secrets/openshift/serviceaccount - readOnly: true - resources: - requests: - memory: 50Mi - cpu: 10m - - name: csi-provisioner - securityContext: - readOnlyRootFilesystem: true - image: ${PROVISIONER_IMAGE} - imagePullPolicy: IfNotPresent - args: - - --csi-address=$(ADDRESS) - - --default-fstype=ext4 - - --feature-gates=Topology=true - - --extra-create-metadata=true - - --http-endpoint=localhost:8202 - - --timeout=250s - - --leader-election - - --leader-election-lease-duration=${LEADER_ELECTION_LEASE_DURATION} - - --leader-election-renew-deadline=${LEADER_ELECTION_RENEW_DEADLINE} - - --leader-election-retry-period=${LEADER_ELECTION_RETRY_PERIOD} - - --controller-publish-readonly - - --v=${LOG_LEVEL} - env: - - name: ADDRESS - value: /var/lib/csi/sockets/pluginproxy/csi.sock - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: socket-dir - mountPath: /var/lib/csi/sockets/pluginproxy/ - resources: - requests: - memory: 50Mi - cpu: 10m - # kube-rbac-proxy for external-provisioner container. - # Provides https proxy for http-based external-provisioner metrics. - - name: provisioner-kube-rbac-proxy - securityContext: - readOnlyRootFilesystem: true - args: - - --secure-listen-address=0.0.0.0:9202 - - --upstream=http://127.0.0.1:8202/ - - --tls-cert-file=/etc/tls/private/tls.crt - - --tls-private-key-file=/etc/tls/private/tls.key - - --tls-cipher-suites=${TLS_CIPHER_SUITES} - - --tls-min-version=${TLS_MIN_VERSION} - - --logtostderr=true - image: ${KUBE_RBAC_PROXY_IMAGE} - imagePullPolicy: IfNotPresent - ports: - - containerPort: 9202 - name: provisioner-m - protocol: TCP - resources: - requests: - memory: 20Mi - cpu: 10m - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - mountPath: /etc/tls/private - name: metrics-serving-cert - - name: csi-attacher - securityContext: - readOnlyRootFilesystem: true - image: ${ATTACHER_IMAGE} - imagePullPolicy: IfNotPresent - args: - - --csi-address=$(ADDRESS) - - --http-endpoint=localhost:8203 - - --leader-election - - --timeout=250s - - --leader-election-lease-duration=${LEADER_ELECTION_LEASE_DURATION} - - --leader-election-renew-deadline=${LEADER_ELECTION_RENEW_DEADLINE} - - --leader-election-retry-period=${LEADER_ELECTION_RETRY_PERIOD} - - --v=${LOG_LEVEL} - env: - - name: ADDRESS - value: /var/lib/csi/sockets/pluginproxy/csi.sock - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: socket-dir - mountPath: /var/lib/csi/sockets/pluginproxy/ - resources: - requests: - memory: 50Mi - cpu: 10m - - name: attacher-kube-rbac-proxy - securityContext: - readOnlyRootFilesystem: true - args: - - --secure-listen-address=0.0.0.0:9203 - - --upstream=http://127.0.0.1:8203/ - - --tls-cert-file=/etc/tls/private/tls.crt - - --tls-private-key-file=/etc/tls/private/tls.key - - --tls-cipher-suites=${TLS_CIPHER_SUITES} - - --tls-min-version=${TLS_MIN_VERSION} - - --logtostderr=true - image: ${KUBE_RBAC_PROXY_IMAGE} - imagePullPolicy: IfNotPresent - ports: - - containerPort: 9203 - name: attacher-m - protocol: TCP - resources: - requests: - memory: 20Mi - cpu: 10m - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - mountPath: /etc/tls/private - name: metrics-serving-cert - - name: csi-resizer - securityContext: - readOnlyRootFilesystem: true - image: ${RESIZER_IMAGE} - imagePullPolicy: IfNotPresent - args: - - --csi-address=$(ADDRESS) - - --http-endpoint=localhost:8204 - - --leader-election - - --leader-election-lease-duration=${LEADER_ELECTION_LEASE_DURATION} - - --leader-election-renew-deadline=${LEADER_ELECTION_RENEW_DEADLINE} - - --leader-election-retry-period=${LEADER_ELECTION_RETRY_PERIOD} - - --v=${LOG_LEVEL} - env: - - name: ADDRESS - value: /var/lib/csi/sockets/pluginproxy/csi.sock - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: socket-dir - mountPath: /var/lib/csi/sockets/pluginproxy/ - resources: - requests: - memory: 50Mi - cpu: 10m - - name: resizer-kube-rbac-proxy - securityContext: - readOnlyRootFilesystem: true - args: - - --secure-listen-address=0.0.0.0:9204 - - --upstream=http://127.0.0.1:8204/ - - --tls-cert-file=/etc/tls/private/tls.crt - - --tls-private-key-file=/etc/tls/private/tls.key - - --tls-cipher-suites=${TLS_CIPHER_SUITES} - - --tls-min-version=${TLS_MIN_VERSION} - - --logtostderr=true - image: ${KUBE_RBAC_PROXY_IMAGE} - imagePullPolicy: IfNotPresent - ports: - - containerPort: 9204 - name: resizer-m - protocol: TCP - resources: - requests: - memory: 20Mi - cpu: 10m - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - mountPath: /etc/tls/private - name: metrics-serving-cert - - name: csi-snapshotter - securityContext: - readOnlyRootFilesystem: true - image: ${SNAPSHOTTER_IMAGE} - imagePullPolicy: IfNotPresent - args: - - --csi-address=$(ADDRESS) - - --metrics-address=localhost:8205 - - --leader-election - - --timeout=300s - - --leader-election-lease-duration=${LEADER_ELECTION_LEASE_DURATION} - - --leader-election-renew-deadline=${LEADER_ELECTION_RENEW_DEADLINE} - - --leader-election-retry-period=${LEADER_ELECTION_RETRY_PERIOD} - - --v=${LOG_LEVEL} - env: - - name: ADDRESS - value: /var/lib/csi/sockets/pluginproxy/csi.sock - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - mountPath: /var/lib/csi/sockets/pluginproxy/ - name: socket-dir - resources: - requests: - memory: 50Mi - cpu: 10m - - name: snapshotter-kube-rbac-proxy - securityContext: - readOnlyRootFilesystem: true - args: - - --secure-listen-address=0.0.0.0:9205 - - --upstream=http://127.0.0.1:8205/ - - --tls-cert-file=/etc/tls/private/tls.crt - - --tls-private-key-file=/etc/tls/private/tls.key - - --tls-cipher-suites=${TLS_CIPHER_SUITES} - - --tls-min-version=${TLS_MIN_VERSION} - - --logtostderr=true - image: ${KUBE_RBAC_PROXY_IMAGE} - imagePullPolicy: IfNotPresent - ports: - - containerPort: 9205 - name: snapshotter-m - protocol: TCP - resources: - requests: - memory: 20Mi - cpu: 10m - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - mountPath: /etc/tls/private - name: metrics-serving-cert - - name: csi-liveness-probe - securityContext: - readOnlyRootFilesystem: true - image: ${LIVENESS_PROBE_IMAGE} - imagePullPolicy: IfNotPresent - args: - - --csi-address=/csi/csi.sock - - --probe-timeout=3s - - --health-port=10301 - - --v=${LOG_LEVEL} - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: socket-dir - mountPath: /csi - resources: - requests: - memory: 50Mi - cpu: 10m + - args: + - --endpoint=$(CSI_ENDPOINT) + - --logtostderr + - --v=${LOG_LEVEL} + - --enable-storage-pools=true + - --allow-hdha-provisioning=true + - --supports-dynamic-throughput-provisioning=hyperdisk-balanced,hyperdisk-throughput,hyperdisk-ml + - --supports-dynamic-iops-provisioning=hyperdisk-balanced,hyperdisk-extreme + env: + - name: GOOGLE_APPLICATION_CREDENTIALS + value: /etc/cloud-sa/service_account.json + - name: CSI_ENDPOINT + value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock + image: ${DRIVER_IMAGE} + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 5 + httpGet: + path: /healthz + port: healthz + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 3 + name: csi-driver + ports: + - containerPort: 10301 + name: healthz + protocol: TCP + resources: + requests: + cpu: 10m + memory: 50Mi + securityContext: + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /var/lib/csi/sockets/pluginproxy/ + name: socket-dir + - mountPath: /etc/cloud-sa + name: cloud-sa-volume + readOnly: true + - mountPath: /var/run/secrets/openshift/serviceaccount + name: bound-sa-token + readOnly: true + - args: + - --csi-address=/var/lib/csi/sockets/pluginproxy/csi.sock + - --http-endpoint=localhost:8202 + - --leader-election + - --leader-election-lease-duration=${LEADER_ELECTION_LEASE_DURATION} + - --leader-election-renew-deadline=${LEADER_ELECTION_RENEW_DEADLINE} + - --leader-election-retry-period=${LEADER_ELECTION_RETRY_PERIOD} + - --leader-election-namespace=${NODE_NAMESPACE} + - --v=${LOG_LEVEL} + - --default-fstype=ext4 + - --feature-gates=Topology=true + - --extra-create-metadata=true + - --timeout=250s + - --controller-publish-readonly + env: [] + image: ${PROVISIONER_IMAGE} + imagePullPolicy: IfNotPresent + name: csi-provisioner + resources: + requests: + cpu: 10m + memory: 50Mi + securityContext: + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /var/lib/csi/sockets/pluginproxy/ + name: socket-dir + - args: + - --secure-listen-address=0.0.0.0:9202 + - --upstream=http://127.0.0.1:8202/ + - --tls-cert-file=/etc/tls/private/tls.crt + - --tls-private-key-file=/etc/tls/private/tls.key + - --tls-cipher-suites=${TLS_CIPHER_SUITES} + - --tls-min-version=${TLS_MIN_VERSION} + - --logtostderr=true + image: ${KUBE_RBAC_PROXY_IMAGE} + imagePullPolicy: IfNotPresent + name: provisioner-kube-rbac-proxy + ports: + - containerPort: 9202 + name: provisioner-m + protocol: TCP + resources: + requests: + cpu: 10m + memory: 20Mi + securityContext: + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /etc/tls/private + name: metrics-serving-cert + - args: + - --csi-address=/var/lib/csi/sockets/pluginproxy/csi.sock + - --http-endpoint=localhost:8203 + - --leader-election + - --leader-election-lease-duration=${LEADER_ELECTION_LEASE_DURATION} + - --leader-election-renew-deadline=${LEADER_ELECTION_RENEW_DEADLINE} + - --leader-election-retry-period=${LEADER_ELECTION_RETRY_PERIOD} + - --leader-election-namespace=${NODE_NAMESPACE} + - --v=${LOG_LEVEL} + - --timeout=250s + env: [] + image: ${ATTACHER_IMAGE} + imagePullPolicy: IfNotPresent + name: csi-attacher + resources: + requests: + cpu: 10m + memory: 50Mi + securityContext: + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /var/lib/csi/sockets/pluginproxy/ + name: socket-dir + - args: + - --secure-listen-address=0.0.0.0:9203 + - --upstream=http://127.0.0.1:8203/ + - --tls-cert-file=/etc/tls/private/tls.crt + - --tls-private-key-file=/etc/tls/private/tls.key + - --tls-cipher-suites=${TLS_CIPHER_SUITES} + - --tls-min-version=${TLS_MIN_VERSION} + - --logtostderr=true + image: ${KUBE_RBAC_PROXY_IMAGE} + imagePullPolicy: IfNotPresent + name: attacher-kube-rbac-proxy + ports: + - containerPort: 9203 + name: attacher-m + protocol: TCP + resources: + requests: + cpu: 10m + memory: 20Mi + securityContext: + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /etc/tls/private + name: metrics-serving-cert + - args: + - --csi-address=/var/lib/csi/sockets/pluginproxy/csi.sock + - --http-endpoint=localhost:8204 + - --leader-election + - --leader-election-lease-duration=${LEADER_ELECTION_LEASE_DURATION} + - --leader-election-renew-deadline=${LEADER_ELECTION_RENEW_DEADLINE} + - --leader-election-retry-period=${LEADER_ELECTION_RETRY_PERIOD} + - --leader-election-namespace=${NODE_NAMESPACE} + - --v=${LOG_LEVEL} + env: [] + image: ${RESIZER_IMAGE} + imagePullPolicy: IfNotPresent + name: csi-resizer + resources: + requests: + cpu: 10m + memory: 50Mi + securityContext: + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /var/lib/csi/sockets/pluginproxy/ + name: socket-dir + - args: + - --secure-listen-address=0.0.0.0:9204 + - --upstream=http://127.0.0.1:8204/ + - --tls-cert-file=/etc/tls/private/tls.crt + - --tls-private-key-file=/etc/tls/private/tls.key + - --tls-cipher-suites=${TLS_CIPHER_SUITES} + - --tls-min-version=${TLS_MIN_VERSION} + - --logtostderr=true + image: ${KUBE_RBAC_PROXY_IMAGE} + imagePullPolicy: IfNotPresent + name: resizer-kube-rbac-proxy + ports: + - containerPort: 9204 + name: resizer-m + protocol: TCP + resources: + requests: + cpu: 10m + memory: 20Mi + securityContext: + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /etc/tls/private + name: metrics-serving-cert + - args: + - --csi-address=/var/lib/csi/sockets/pluginproxy/csi.sock + - --metrics-address=localhost:8205 + - --leader-election + - --leader-election-lease-duration=${LEADER_ELECTION_LEASE_DURATION} + - --leader-election-renew-deadline=${LEADER_ELECTION_RENEW_DEADLINE} + - --leader-election-retry-period=${LEADER_ELECTION_RETRY_PERIOD} + - --leader-election-namespace=${NODE_NAMESPACE} + - --v=${LOG_LEVEL} + - --timeout=300s + env: [] + image: ${SNAPSHOTTER_IMAGE} + imagePullPolicy: IfNotPresent + name: csi-snapshotter + resources: + requests: + cpu: 10m + memory: 50Mi + securityContext: + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /var/lib/csi/sockets/pluginproxy/ + name: socket-dir + - args: + - --secure-listen-address=0.0.0.0:9205 + - --upstream=http://127.0.0.1:8205/ + - --tls-cert-file=/etc/tls/private/tls.crt + - --tls-private-key-file=/etc/tls/private/tls.key + - --tls-cipher-suites=${TLS_CIPHER_SUITES} + - --tls-min-version=${TLS_MIN_VERSION} + - --logtostderr=true + image: ${KUBE_RBAC_PROXY_IMAGE} + imagePullPolicy: IfNotPresent + name: snapshotter-kube-rbac-proxy + ports: + - containerPort: 9205 + name: snapshotter-m + protocol: TCP + resources: + requests: + cpu: 10m + memory: 20Mi + securityContext: + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /etc/tls/private + name: metrics-serving-cert + - args: + - --csi-address=/csi/csi.sock + - --health-port=10301 + - --v=${LOG_LEVEL} + - --probe-timeout=3s + env: [] + image: ${LIVENESS_PROBE_IMAGE} + imagePullPolicy: IfNotPresent + name: csi-liveness-probe + resources: + requests: + cpu: 10m + memory: 50Mi + securityContext: + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /csi + name: socket-dir + hostNetwork: true + nodeSelector: + node-role.kubernetes.io/master: "" + priorityClassName: system-cluster-critical + serviceAccount: gcp-pd-csi-driver-controller-sa + tolerations: + - key: CriticalAddonsOnly + operator: Exists + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists volumes: - - name: socket-dir - emptyDir: {} - - name: cloud-sa-volume - secret: - secretName: gcp-pd-cloud-credentials - - name: metrics-serving-cert - secret: - secretName: gcp-pd-csi-driver-controller-metrics-serving-cert - # This service account token can be used to provide identity outside the cluster. - # For example, this token can be used to authenticate with GCP using workload identity. - - name: bound-sa-token - projected: - sources: - - serviceAccountToken: - path: token - audience: openshift + - emptyDir: {} + name: socket-dir + - name: metrics-serving-cert + secret: + secretName: gcp-pd-csi-driver-controller-metrics-serving-cert + - name: cloud-sa-volume + secret: + secretName: gcp-pd-cloud-credentials + - name: bound-sa-token + projected: + sources: + - serviceAccountToken: + audience: openshift + path: token diff --git a/assets/overlays/gcp-pd/generated/standalone/controller_hostnetwork_binding.yaml b/assets/overlays/gcp-pd/generated/standalone/controller_hostnetwork_binding.yaml index 6e59c19bd..a9250bc96 100644 --- a/assets/overlays/gcp-pd/generated/standalone/controller_hostnetwork_binding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/controller_hostnetwork_binding.yaml @@ -1,12 +1,18 @@ -kind: ClusterRoleBinding +# Generated file. Do not edit. Update using "make update". +# +# Loaded from overlays/gcp-pd/base/controller_hostnetwork_binding.yaml +# +# + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding metadata: name: gcp-pd-controller-hostnetwork-binding -subjects: - - kind: ServiceAccount - name: gcp-pd-csi-driver-controller-sa - namespace: openshift-cluster-csi-drivers roleRef: + apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: gcp-pd-hostnetwork-role - apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: gcp-pd-csi-driver-controller-sa + namespace: ${NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/controller_pdb.yaml b/assets/overlays/gcp-pd/generated/standalone/controller_pdb.yaml index 5a76d1db8..634bd7cbe 100644 --- a/assets/overlays/gcp-pd/generated/standalone/controller_pdb.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/controller_pdb.yaml @@ -1,8 +1,14 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/controller_pdb.yaml +# +# + apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: gcp-pd-csi-driver-controller-pdb - namespace: openshift-cluster-csi-drivers + namespace: ${NAMESPACE} spec: maxUnavailable: 1 selector: diff --git a/assets/overlays/gcp-pd/generated/standalone/controller_sa.yaml b/assets/overlays/gcp-pd/generated/standalone/controller_sa.yaml index 50f259b81..698c02187 100644 --- a/assets/overlays/gcp-pd/generated/standalone/controller_sa.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/controller_sa.yaml @@ -1,5 +1,11 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/controller_sa.yaml +# +# + apiVersion: v1 kind: ServiceAccount metadata: name: gcp-pd-csi-driver-controller-sa - namespace: openshift-cluster-csi-drivers + namespace: ${NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/csidriver.yaml b/assets/overlays/gcp-pd/generated/standalone/csidriver.yaml index 19d994f5f..a4c1ec2c7 100644 --- a/assets/overlays/gcp-pd/generated/standalone/csidriver.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/csidriver.yaml @@ -1,13 +1,19 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from overlays/gcp-pd/base/csidriver.yaml +# +# + apiVersion: storage.k8s.io/v1 kind: CSIDriver metadata: name: pd.csi.storage.gke.io spec: attachRequired: true - podInfoOnMount: false fsGroupPolicy: File + podInfoOnMount: false requiresRepublish: false - storageCapacity: false seLinuxMount: true + storageCapacity: false volumeLifecycleModes: - - Persistent + - Persistent diff --git a/assets/overlays/gcp-pd/generated/standalone/hostnetwork_role.yaml b/assets/overlays/gcp-pd/generated/standalone/hostnetwork_role.yaml index 133d40416..b7519c171 100644 --- a/assets/overlays/gcp-pd/generated/standalone/hostnetwork_role.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/hostnetwork_role.yaml @@ -1,12 +1,25 @@ -kind: ClusterRole +# Generated file. Do not edit. Update using "make update". +# +# Loaded from overlays/gcp-pd/base/hostnetwork_role.yaml +# +# + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole metadata: name: gcp-pd-hostnetwork-role rules: - - apiGroups: ["security.openshift.io"] - resourceNames: ["hostnetwork-v2"] - resources: ["securitycontextconstraints"] - verbs: ["use"] - - apiGroups: [""] - resources: ["nodes"] - verbs: ["get"] +- apiGroups: + - security.openshift.io + resourceNames: + - hostnetwork-v2 + resources: + - securitycontextconstraints + verbs: + - use +- apiGroups: + - "" + resources: + - nodes + verbs: + - get diff --git a/assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_binding.yaml b/assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_binding.yaml index 426ff4541..ff1679b5a 100644 --- a/assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_binding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_binding.yaml @@ -1,13 +1,19 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/kube_rbac_proxy_binding.yaml +# +# # Allow kube-rbac-proxies to create tokenreviews to check Prometheus identity when scraping metrics. -kind: ClusterRoleBinding + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding metadata: name: gcp-pd-kube-rbac-proxy-binding -subjects: - - kind: ServiceAccount - name: gcp-pd-csi-driver-controller-sa - namespace: openshift-cluster-csi-drivers roleRef: + apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: gcp-pd-kube-rbac-proxy-role - apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: gcp-pd-csi-driver-controller-sa + namespace: ${NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_role.yaml b/assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_role.yaml index 1985a1506..10ee3bb24 100644 --- a/assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_role.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/kube_rbac_proxy_role.yaml @@ -1,12 +1,18 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/kube_rbac_proxy_role.yaml +# +# # Allow kube-rbac-proxies to create tokenreviews to check Prometheus identity when scraping metrics. -kind: ClusterRole + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole metadata: name: gcp-pd-kube-rbac-proxy-role rules: - - apiGroups: - - "authentication.k8s.io" - resources: - - "tokenreviews" - verbs: - - "create" +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create diff --git a/assets/overlays/gcp-pd/generated/standalone/lease_leader_election_rolebinding.yaml b/assets/overlays/gcp-pd/generated/standalone/lease_leader_election_binding.yaml similarity index 64% rename from assets/overlays/gcp-pd/generated/standalone/lease_leader_election_rolebinding.yaml rename to assets/overlays/gcp-pd/generated/standalone/lease_leader_election_binding.yaml index b5ea6606b..3c60ef682 100644 --- a/assets/overlays/gcp-pd/generated/standalone/lease_leader_election_rolebinding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/lease_leader_election_binding.yaml @@ -1,9 +1,15 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/lease_leader_election_binding.yaml +# +# # Grant controller access to leases + apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: gcp-pd-csi-driver-lease-leader-election - namespace: openshift-cluster-csi-drivers + namespace: ${NODE_NAMESPACE} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -11,4 +17,4 @@ roleRef: subjects: - kind: ServiceAccount name: gcp-pd-csi-driver-controller-sa - namespace: openshift-cluster-csi-drivers + namespace: ${NODE_NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/lease_leader_election_role.yaml b/assets/overlays/gcp-pd/generated/standalone/lease_leader_election_role.yaml index 152746437..d71694513 100644 --- a/assets/overlays/gcp-pd/generated/standalone/lease_leader_election_role.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/lease_leader_election_role.yaml @@ -1,10 +1,24 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/lease_leader_election_role.yaml +# +# # Role for electing leader by the operator + apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: gcp-pd-csi-driver-lease-leader-election - namespace: openshift-cluster-csi-drivers + namespace: ${NODE_NAMESPACE} rules: -- apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "watch", "list", "delete", "update", "create"] +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - watch + - list + - delete + - update + - create diff --git a/assets/overlays/gcp-pd/generated/standalone/main_attacher_binding.yaml b/assets/overlays/gcp-pd/generated/standalone/main_attacher_binding.yaml index 7bca8b4c2..db1a22bc3 100644 --- a/assets/overlays/gcp-pd/generated/standalone/main_attacher_binding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/main_attacher_binding.yaml @@ -1,12 +1,19 @@ -kind: ClusterRoleBinding +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/main_attacher_binding.yaml +# because it's needed by controller sidecar common/sidecars/attacher.yaml +# +# + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding metadata: name: gcp-pd-csi-main-attacher-binding -subjects: - - kind: ServiceAccount - name: gcp-pd-csi-driver-controller-sa - namespace: openshift-cluster-csi-drivers roleRef: + apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: openshift-csi-main-attacher-role - apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: gcp-pd-csi-driver-controller-sa + namespace: ${NODE_NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/main_provisioner_binding.yaml b/assets/overlays/gcp-pd/generated/standalone/main_provisioner_binding.yaml index e8b921e41..e7a8813cc 100644 --- a/assets/overlays/gcp-pd/generated/standalone/main_provisioner_binding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/main_provisioner_binding.yaml @@ -1,12 +1,19 @@ -kind: ClusterRoleBinding +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/main_provisioner_binding.yaml +# because it's needed by controller sidecar common/sidecars/provisioner.yaml +# +# + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding metadata: name: gcp-pd-csi-main-provisioner-binding -subjects: - - kind: ServiceAccount - name: gcp-pd-csi-driver-controller-sa - namespace: openshift-cluster-csi-drivers roleRef: + apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: openshift-csi-main-provisioner-role - apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: gcp-pd-csi-driver-controller-sa + namespace: ${NODE_NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/main_resizer_binding.yaml b/assets/overlays/gcp-pd/generated/standalone/main_resizer_binding.yaml index 7f188eb77..4cb68d049 100644 --- a/assets/overlays/gcp-pd/generated/standalone/main_resizer_binding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/main_resizer_binding.yaml @@ -1,12 +1,19 @@ -kind: ClusterRoleBinding +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/main_resizer_binding.yaml +# because it's needed by controller sidecar common/sidecars/resizer.yaml +# +# + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding metadata: name: gcp-pd-csi-main-resizer-binding -subjects: - - kind: ServiceAccount - name: gcp-pd-csi-driver-controller-sa - namespace: openshift-cluster-csi-drivers roleRef: + apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: openshift-csi-main-resizer-role - apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: gcp-pd-csi-driver-controller-sa + namespace: ${NODE_NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/main_snapshotter_binding.yaml b/assets/overlays/gcp-pd/generated/standalone/main_snapshotter_binding.yaml index ba293d271..cd2960a52 100644 --- a/assets/overlays/gcp-pd/generated/standalone/main_snapshotter_binding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/main_snapshotter_binding.yaml @@ -1,12 +1,19 @@ -kind: ClusterRoleBinding +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/main_snapshotter_binding.yaml +# because it's needed by controller sidecar common/sidecars/snapshotter.yaml +# +# + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding metadata: name: gcp-pd-csi-main-snapshotter-binding -subjects: - - kind: ServiceAccount - name: gcp-pd-csi-driver-controller-sa - namespace: openshift-cluster-csi-drivers roleRef: + apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: openshift-csi-main-snapshotter-role - apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: gcp-pd-csi-driver-controller-sa + namespace: ${NODE_NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/manifests.yaml b/assets/overlays/gcp-pd/generated/standalone/manifests.yaml index 19a6b42fc..84403e3dc 100644 --- a/assets/overlays/gcp-pd/generated/standalone/manifests.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/manifests.yaml @@ -3,13 +3,19 @@ controllerStaticAssetNames: - controller.yaml - controller_pdb.yaml - controller_sa.yaml +- kube_rbac_proxy_binding.yaml +- kube_rbac_proxy_role.yaml +- prometheus_binding.yaml +- prometheus_role.yaml - service.yaml - servicemonitor.yaml guestStaticAssetNames: +- controller_hostnetwork_binding.yaml - csidriver.yaml +- hostnetwork_role.yaml - kube_rbac_proxy_binding.yaml - kube_rbac_proxy_role.yaml -- lease_leader_election_rolebinding.yaml +- lease_leader_election_binding.yaml - lease_leader_election_role.yaml - main_attacher_binding.yaml - main_provisioner_binding.yaml @@ -17,16 +23,14 @@ guestStaticAssetNames: - main_snapshotter_binding.yaml - node.yaml - node_privileged_binding.yaml -- controller_hostnetwork_binding.yaml - node_sa.yaml - privileged_role.yaml -- hostnetwork_role.yaml -- prometheus_rolebinding.yaml +- prometheus_binding.yaml - prometheus_role.yaml - storageclass.yaml -- storageclass_ssd.yaml - storageclass_hyperdisk_balanced.yaml - storageclass_reader_resizer_binding.yaml +- storageclass_ssd.yaml - volumeattributesclass_reader_provisioner_binding.yaml - volumeattributesclass_reader_resizer_binding.yaml - volumesnapshot_reader_provisioner_binding.yaml diff --git a/assets/overlays/gcp-pd/generated/standalone/node.yaml b/assets/overlays/gcp-pd/generated/standalone/node.yaml index bd6b45445..a61f0134a 100644 --- a/assets/overlays/gcp-pd/generated/standalone/node.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/node.yaml @@ -1,193 +1,197 @@ -kind: DaemonSet +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/node.yaml +# Applied strategic merge patch overlays/gcp-pd/patches/node_add_driver.yaml +# node_driver_registrar.yaml: Loaded from common/sidecars/node_driver_registrar.yaml +# Applied strategic merge patch node_driver_registrar.yaml +# host_network_livenessprobe.yaml: Loaded from common/sidecars/host_network_livenessprobe.yaml +# host_network_livenessprobe.yaml: Added arguments [--probe-timeout=3s] +# Applied strategic merge patch host_network_livenessprobe.yaml +# Applied strategic merge patch common/readOnlyRootFilesystem.yaml +# Applied strategic merge patch overlays/gcp-pd/patches/node_remove_metrics_serving_cert.yaml +# Applied strategic merge patch overlays/gcp-pd/patches/node_remove_sys_fs.yaml +# +# + apiVersion: apps/v1 +kind: DaemonSet metadata: name: gcp-pd-csi-driver-node - namespace: openshift-cluster-csi-drivers - annotations: - config.openshift.io/inject-proxy: csi-driver - config.openshift.io/inject-proxy-cabundle: csi-driver + namespace: ${NODE_NAMESPACE} spec: selector: matchLabels: app: gcp-pd-csi-driver-node - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 10% template: metadata: - labels: - app: gcp-pd-csi-driver-node annotations: + cluster-autoscaler.kubernetes.io/enable-ds-eviction: "false" openshift.io/required-scc: privileged target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' - # This annotation prevents eviction from the cluster-autoscaler - cluster-autoscaler.kubernetes.io/enable-ds-eviction: "false" + labels: + app: gcp-pd-csi-driver-node spec: + containers: + - args: + - --endpoint=$(CSI_ENDPOINT) + - --logtostderr + - --v=${LOG_LEVEL} + - --enable-storage-pools=true + - --node-name=$(KUBE_NODE_NAME) + env: + - name: CSI_ENDPOINT + value: unix:/csi/csi.sock + - name: KUBE_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + image: ${DRIVER_IMAGE} + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 5 + httpGet: + path: /healthz + port: healthz + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 3 + name: csi-driver + ports: + - containerPort: 10300 + name: healthz + protocol: TCP + resources: + requests: + cpu: 10m + memory: 50Mi + securityContext: + privileged: true + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /var/lib/kubelet + mountPropagation: Bidirectional + name: kubelet-dir + - mountPath: /csi + name: socket-dir + - mountPath: /dev + name: device-dir + - mountPath: /etc/udev + name: udev-rules-etc + - mountPath: /lib/udev + name: udev-rules-lib + - mountPath: /run/udev + name: udev-socket + - mountPath: /sys + name: sys + - mountPath: /etc/selinux + name: etc-selinux + - args: + - --csi-address=/csi/csi.sock + - --kubelet-registration-path=/var/lib/kubelet/plugins/pd.csi.storage.gke.io/csi.sock + - --http-endpoint=127.0.0.1:10303 + - --v=${LOG_LEVEL} + env: [] + image: ${NODE_DRIVER_REGISTRAR_IMAGE} + imagePullPolicy: IfNotPresent + lifecycle: + preStop: + exec: + command: + - /bin/sh + - -c + - rm -rf /registration/pd.csi.storage.gke.io-reg.sock /csi/csi.sock + livenessProbe: + failureThreshold: 5 + httpGet: + host: 127.0.0.1 + path: /healthz + port: rhealthz + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 3 + name: csi-node-driver-registrar + ports: + - containerPort: 10303 + name: rhealthz + protocol: TCP + resources: + requests: + cpu: 10m + memory: 50Mi + securityContext: + privileged: true + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /csi + name: socket-dir + - mountPath: /registration + name: registration-dir + - args: + - --csi-address=/csi/csi.sock + - --http-endpoint=127.0.0.1:10300 + - --v=${LOG_LEVEL} + - --probe-timeout=3s + env: [] + image: ${LIVENESS_PROBE_IMAGE} + imagePullPolicy: IfNotPresent + name: csi-liveness-probe + resources: + requests: + cpu: 10m + memory: 50Mi + securityContext: + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - mountPath: /csi + name: socket-dir hostNetwork: true - serviceAccountName: gcp-pd-csi-driver-node-sa - priorityClassName: system-node-critical - tolerations: - - operator: Exists nodeSelector: kubernetes.io/os: linux - containers: - - name: csi-driver - securityContext: - privileged: true - readOnlyRootFilesystem: true - image: ${DRIVER_IMAGE} - imagePullPolicy: IfNotPresent - args: - - --endpoint=$(CSI_ENDPOINT) - - --logtostderr - - --v=${LOG_LEVEL} - - --enable-storage-pools=true - - --node-name=$(KUBE_NODE_NAME) - env: - - name: CSI_ENDPOINT - value: unix:/csi/csi.sock - - name: KUBE_NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - volumeMounts: - - name: kubelet-dir - mountPath: /var/lib/kubelet - mountPropagation: "Bidirectional" - - name: plugin-dir - mountPath: /csi - - name: device-dir - mountPath: /dev - # The following mounts are required to trigger host udevadm from - # container - - name: udev-rules-etc - mountPath: /etc/udev - - name: udev-rules-lib - mountPath: /lib/udev - - name: udev-socket - mountPath: /run/udev - - name: sys - mountPath: /sys - - name: etc-selinux - mountPath: /etc/selinux - ports: - - name: healthz - # Due to hostNetwork, this port is open on all nodes! - containerPort: 10300 - protocol: TCP - livenessProbe: - httpGet: - path: /healthz - port: healthz - initialDelaySeconds: 10 - timeoutSeconds: 3 - periodSeconds: 10 - failureThreshold: 5 - resources: - requests: - memory: 50Mi - cpu: 10m - terminationMessagePolicy: FallbackToLogsOnError - - name: csi-node-driver-registrar - securityContext: - privileged: true - readOnlyRootFilesystem: true - image: ${NODE_DRIVER_REGISTRAR_IMAGE} - imagePullPolicy: IfNotPresent - args: - - --csi-address=$(ADDRESS) - - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH) - - --http-endpoint=:10303 - - --v=${LOG_LEVEL} - lifecycle: - preStop: - exec: - command: ["/bin/sh", "-c", "rm -rf /registration/pd.csi.storage.gke.io-reg.sock /csi/csi.sock"] - env: - - name: KUBE_NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: ADDRESS - value: /csi/csi.sock - - name: DRIVER_REG_SOCK_PATH - value: /var/lib/kubelet/plugins/pd.csi.storage.gke.io/csi.sock - volumeMounts: - - name: plugin-dir - mountPath: /csi - - name: registration-dir - mountPath: /registration - ports: - - containerPort: 10303 - name: rhealthz - resources: - requests: - memory: 50Mi - cpu: 10m - livenessProbe: - httpGet: - path: /healthz - port: rhealthz - initialDelaySeconds: 10 - timeoutSeconds: 3 - periodSeconds: 10 - failureThreshold: 5 - terminationMessagePolicy: FallbackToLogsOnError - - name: csi-liveness-probe - securityContext: - readOnlyRootFilesystem: true - image: ${LIVENESS_PROBE_IMAGE} - imagePullPolicy: IfNotPresent - args: - - --csi-address=/csi/csi.sock - - --probe-timeout=3s - - --health-port=10300 - - --v=${LOG_LEVEL} - volumeMounts: - - name: plugin-dir - mountPath: /csi - resources: - requests: - memory: 50Mi - cpu: 10m - terminationMessagePolicy: FallbackToLogsOnError + priorityClassName: system-node-critical + serviceAccount: gcp-pd-csi-driver-node-sa + tolerations: + - operator: Exists volumes: - - name: kubelet-dir - hostPath: - path: /var/lib/kubelet - type: Directory - - name: plugin-dir - hostPath: - path: /var/lib/kubelet/plugins/pd.csi.storage.gke.io/ - type: DirectoryOrCreate - - name: registration-dir - hostPath: - path: /var/lib/kubelet/plugins_registry/ - type: Directory - - name: device-dir - hostPath: - path: /dev - type: Directory - # The following mounts are required to trigger host udevadm from - # container - - name: udev-rules-etc - hostPath: - path: /etc/udev - type: Directory - - name: udev-rules-lib - hostPath: - path: /lib/udev - type: Directory - - name: udev-socket - hostPath: - path: /run/udev - type: Directory - - name: sys - hostPath: - path: /sys - type: Directory - - name: etc-selinux - hostPath: - path: /etc/selinux - type: DirectoryOrCreate + - hostPath: + path: /var/lib/kubelet + type: Directory + name: kubelet-dir + - hostPath: + path: /var/lib/kubelet/plugins/pd.csi.storage.gke.io/ + type: DirectoryOrCreate + name: socket-dir + - hostPath: + path: /var/lib/kubelet/plugins_registry/ + type: Directory + name: registration-dir + - hostPath: + path: /dev + type: Directory + name: device-dir + - hostPath: + path: /etc/selinux + type: DirectoryOrCreate + name: etc-selinux + - hostPath: + path: /etc/udev + type: Directory + name: udev-rules-etc + - hostPath: + path: /lib/udev + type: Directory + name: udev-rules-lib + - hostPath: + path: /run/udev + type: Directory + name: udev-socket + - hostPath: + path: /sys + type: Directory + name: sys + updateStrategy: + rollingUpdate: + maxUnavailable: 10% + type: RollingUpdate diff --git a/assets/overlays/gcp-pd/generated/standalone/node_privileged_binding.yaml b/assets/overlays/gcp-pd/generated/standalone/node_privileged_binding.yaml index 908a8c806..1f74ae355 100644 --- a/assets/overlays/gcp-pd/generated/standalone/node_privileged_binding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/node_privileged_binding.yaml @@ -1,12 +1,18 @@ -kind: ClusterRoleBinding +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/node_privileged_binding.yaml +# +# + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding metadata: name: gcp-pd-node-privileged-binding -subjects: - - kind: ServiceAccount - name: gcp-pd-csi-driver-node-sa - namespace: openshift-cluster-csi-drivers roleRef: + apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: gcp-pd-privileged-role - apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: gcp-pd-csi-driver-node-sa + namespace: ${NODE_NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/node_sa.yaml b/assets/overlays/gcp-pd/generated/standalone/node_sa.yaml index 9f500e68e..5992ae351 100644 --- a/assets/overlays/gcp-pd/generated/standalone/node_sa.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/node_sa.yaml @@ -1,5 +1,11 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/node_sa.yaml +# +# + apiVersion: v1 kind: ServiceAccount metadata: name: gcp-pd-csi-driver-node-sa - namespace: openshift-cluster-csi-drivers + namespace: ${NODE_NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/privileged_role.yaml b/assets/overlays/gcp-pd/generated/standalone/privileged_role.yaml index 3d830ecae..2ff283978 100644 --- a/assets/overlays/gcp-pd/generated/standalone/privileged_role.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/privileged_role.yaml @@ -1,13 +1,26 @@ -# TODO: create custom SCC with things that the CSI driver needs -kind: ClusterRole +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/privileged_role.yaml +# Applied JSON patch overlays/gcp-pd/patches/privileged_role_get_nodes.yaml.patch +# +# + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole metadata: name: gcp-pd-privileged-role rules: - - apiGroups: ["security.openshift.io"] - resourceNames: ["privileged"] - resources: ["securitycontextconstraints"] - verbs: ["use"] - - apiGroups: [""] - resources: ["nodes"] - verbs: ["get"] +- apiGroups: + - security.openshift.io + resourceNames: + - privileged + resources: + - securitycontextconstraints + verbs: + - use +- apiGroups: + - "" + resources: + - nodes + verbs: + - get diff --git a/assets/overlays/gcp-pd/generated/standalone/prometheus_rolebinding.yaml b/assets/overlays/gcp-pd/generated/standalone/prometheus_binding.yaml similarity index 71% rename from assets/overlays/gcp-pd/generated/standalone/prometheus_rolebinding.yaml rename to assets/overlays/gcp-pd/generated/standalone/prometheus_binding.yaml index 832553d6a..ba67080c8 100644 --- a/assets/overlays/gcp-pd/generated/standalone/prometheus_rolebinding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/prometheus_binding.yaml @@ -1,9 +1,15 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/prometheus_binding.yaml +# +# # Grant cluster-monitoring access to the operator metrics service + apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: gcp-pd-csi-driver-prometheus - namespace: openshift-cluster-csi-drivers + namespace: ${NODE_NAMESPACE} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/assets/overlays/gcp-pd/generated/standalone/prometheus_role.yaml b/assets/overlays/gcp-pd/generated/standalone/prometheus_role.yaml index a86e2a697..dbb55778b 100644 --- a/assets/overlays/gcp-pd/generated/standalone/prometheus_role.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/prometheus_role.yaml @@ -1,9 +1,15 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/prometheus_role.yaml +# +# # Role for accessing metrics exposed by the operator + apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: gcp-pd-csi-driver-prometheus - namespace: openshift-cluster-csi-drivers + namespace: ${NODE_NAMESPACE} rules: - apiGroups: - "" diff --git a/assets/overlays/gcp-pd/generated/standalone/service.yaml b/assets/overlays/gcp-pd/generated/standalone/service.yaml index b94352fd0..245d99bc2 100644 --- a/assets/overlays/gcp-pd/generated/standalone/service.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/service.yaml @@ -1,3 +1,13 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/controller_metrics_service.yaml +# Applied strategic merge patch common/metrics/service_add_port.yaml +# Applied strategic merge patch common/metrics/service_add_port.yaml +# Applied strategic merge patch common/metrics/service_add_port.yaml +# Applied strategic merge patch common/metrics/service_add_port.yaml +# +# + apiVersion: v1 kind: Service metadata: @@ -6,23 +16,23 @@ metadata: labels: app: gcp-pd-csi-driver-controller-metrics name: gcp-pd-csi-driver-controller-metrics - namespace: openshift-cluster-csi-drivers + namespace: ${NAMESPACE} spec: ports: - name: provisioner-m - port: 443 + port: 9202 protocol: TCP targetPort: provisioner-m - name: attacher-m - port: 444 + port: 9203 protocol: TCP targetPort: attacher-m - name: resizer-m - port: 445 + port: 9204 protocol: TCP targetPort: resizer-m - name: snapshotter-m - port: 446 + port: 9205 protocol: TCP targetPort: snapshotter-m selector: diff --git a/assets/overlays/gcp-pd/generated/standalone/servicemonitor.yaml b/assets/overlays/gcp-pd/generated/standalone/servicemonitor.yaml index f845b429f..0ffa7f1a5 100644 --- a/assets/overlays/gcp-pd/generated/standalone/servicemonitor.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/servicemonitor.yaml @@ -1,8 +1,18 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/controller_metrics_servicemonitor.yaml +# Applied JSON patch common/metrics/service_monitor_add_port.yaml.patch +# Applied JSON patch common/metrics/service_monitor_add_port.yaml.patch +# Applied JSON patch common/metrics/service_monitor_add_port.yaml.patch +# Applied JSON patch common/metrics/service_monitor_add_port.yaml.patch +# +# + apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: gcp-pd-csi-driver-controller-monitor - namespace: openshift-cluster-csi-drivers + namespace: ${NAMESPACE} spec: endpoints: - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token @@ -12,7 +22,7 @@ spec: scheme: https tlsConfig: caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt - serverName: gcp-pd-csi-driver-controller-metrics.openshift-cluster-csi-drivers.svc + serverName: gcp-pd-csi-driver-controller-metrics.${NAMESPACE}.svc - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token interval: 30s path: /metrics @@ -20,7 +30,7 @@ spec: scheme: https tlsConfig: caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt - serverName: gcp-pd-csi-driver-controller-metrics.openshift-cluster-csi-drivers.svc + serverName: gcp-pd-csi-driver-controller-metrics.${NAMESPACE}.svc - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token interval: 30s path: /metrics @@ -28,7 +38,7 @@ spec: scheme: https tlsConfig: caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt - serverName: gcp-pd-csi-driver-controller-metrics.openshift-cluster-csi-drivers.svc + serverName: gcp-pd-csi-driver-controller-metrics.${NAMESPACE}.svc - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token interval: 30s path: /metrics @@ -36,7 +46,7 @@ spec: scheme: https tlsConfig: caFile: /etc/prometheus/configmaps/serving-certs-ca-bundle/service-ca.crt - serverName: gcp-pd-csi-driver-controller-metrics.openshift-cluster-csi-drivers.svc + serverName: gcp-pd-csi-driver-controller-metrics.${NAMESPACE}.svc jobLabel: component selector: matchLabels: diff --git a/assets/overlays/gcp-pd/generated/standalone/storageclass.yaml b/assets/overlays/gcp-pd/generated/standalone/storageclass.yaml index d7a2c5fe5..c9f68a04e 100644 --- a/assets/overlays/gcp-pd/generated/standalone/storageclass.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/storageclass.yaml @@ -1,13 +1,19 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from overlays/gcp-pd/base/storageclass.yaml +# +# + +allowVolumeExpansion: true apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: - name: standard-csi annotations: storageclass.kubernetes.io/is-default-class: "true" -provisioner: pd.csi.storage.gke.io + name: standard-csi parameters: - type: pd-standard replication-type: none -volumeBindingMode: WaitForFirstConsumer -allowVolumeExpansion: true + type: pd-standard +provisioner: pd.csi.storage.gke.io reclaimPolicy: Delete +volumeBindingMode: WaitForFirstConsumer diff --git a/assets/overlays/gcp-pd/generated/standalone/storageclass_hyperdisk_balanced.yaml b/assets/overlays/gcp-pd/generated/standalone/storageclass_hyperdisk_balanced.yaml index 071c17d2e..55d39b5bc 100644 --- a/assets/overlays/gcp-pd/generated/standalone/storageclass_hyperdisk_balanced.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/storageclass_hyperdisk_balanced.yaml @@ -1,13 +1,19 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from overlays/gcp-pd/base/storageclass_hyperdisk_balanced.yaml +# +# + +allowVolumeExpansion: true apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: - name: hyperdisk-balanced annotations: storageclass.kubernetes.io/is-default-class: "true" -provisioner: pd.csi.storage.gke.io + name: hyperdisk-balanced parameters: - type: hyperdisk-balanced replication-type: none -volumeBindingMode: WaitForFirstConsumer -allowVolumeExpansion: true + type: hyperdisk-balanced +provisioner: pd.csi.storage.gke.io reclaimPolicy: Delete +volumeBindingMode: WaitForFirstConsumer diff --git a/assets/overlays/gcp-pd/generated/standalone/storageclass_reader_resizer_binding.yaml b/assets/overlays/gcp-pd/generated/standalone/storageclass_reader_resizer_binding.yaml index e04d44c03..24a0a46e1 100644 --- a/assets/overlays/gcp-pd/generated/standalone/storageclass_reader_resizer_binding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/storageclass_reader_resizer_binding.yaml @@ -1,12 +1,19 @@ -kind: ClusterRoleBinding +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/storageclass_reader_resizer_binding.yaml +# because it's needed by controller sidecar common/sidecars/resizer.yaml +# +# + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding metadata: - name: gcp-pd-storageclass-reader-resizer-binding -subjects: - - kind: ServiceAccount - name: gcp-pd-csi-driver-controller-sa - namespace: openshift-cluster-csi-drivers + name: gcp-pd-csi-storageclass-reader-resizer-binding roleRef: + apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: openshift-csi-resizer-storageclass-reader-role - apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: gcp-pd-csi-driver-controller-sa + namespace: ${NODE_NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/storageclass_ssd.yaml b/assets/overlays/gcp-pd/generated/standalone/storageclass_ssd.yaml index f38805708..72d9b3880 100644 --- a/assets/overlays/gcp-pd/generated/standalone/storageclass_ssd.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/storageclass_ssd.yaml @@ -1,11 +1,17 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from overlays/gcp-pd/base/storageclass_ssd.yaml +# +# + +allowVolumeExpansion: true apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: ssd-csi -provisioner: pd.csi.storage.gke.io parameters: - type: pd-ssd replication-type: none -volumeBindingMode: WaitForFirstConsumer -allowVolumeExpansion: true + type: pd-ssd +provisioner: pd.csi.storage.gke.io reclaimPolicy: Delete +volumeBindingMode: WaitForFirstConsumer diff --git a/assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_provisioner_binding.yaml b/assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_provisioner_binding.yaml index 75904aff2..fad362178 100644 --- a/assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_provisioner_binding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_provisioner_binding.yaml @@ -1,12 +1,19 @@ -kind: ClusterRoleBinding +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/volumeattributesclass_reader_provisioner_binding.yaml +# because it's needed by controller sidecar common/sidecars/provisioner.yaml +# +# + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding metadata: name: gcp-pd-csi-volumeattributesclass-reader-provisioner-binding -subjects: - - kind: ServiceAccount - name: gcp-pd-csi-driver-controller-sa - namespace: openshift-cluster-csi-drivers roleRef: + apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: openshift-csi-provisioner-volumeattributesclass-reader-role - apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: gcp-pd-csi-driver-controller-sa + namespace: ${NODE_NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_resizer_binding.yaml b/assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_resizer_binding.yaml index 10ab9c259..666a81782 100644 --- a/assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_resizer_binding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/volumeattributesclass_reader_resizer_binding.yaml @@ -1,12 +1,19 @@ -kind: ClusterRoleBinding +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/volumeattributesclass_reader_resizer_binding.yaml +# because it's needed by controller sidecar common/sidecars/resizer.yaml +# +# + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding metadata: name: gcp-pd-csi-volumeattributesclass-reader-resizer-binding -subjects: - - kind: ServiceAccount - name: gcp-pd-csi-driver-controller-sa - namespace: openshift-cluster-csi-drivers roleRef: + apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: openshift-csi-resizer-volumeattributesclass-reader-role - apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: gcp-pd-csi-driver-controller-sa + namespace: ${NODE_NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/volumesnapshot_reader_provisioner_binding.yaml b/assets/overlays/gcp-pd/generated/standalone/volumesnapshot_reader_provisioner_binding.yaml index 7e15fac4e..04980849d 100644 --- a/assets/overlays/gcp-pd/generated/standalone/volumesnapshot_reader_provisioner_binding.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/volumesnapshot_reader_provisioner_binding.yaml @@ -1,12 +1,19 @@ -kind: ClusterRoleBinding +# Generated file. Do not edit. Update using "make update". +# +# Loaded from base/rbac/volumesnapshot_reader_provisioner_binding.yaml +# because it's needed by controller sidecar common/sidecars/provisioner.yaml +# +# + apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding metadata: - name: gcp-pd-volumesnapshot-reader-provisioner-binding -subjects: - - kind: ServiceAccount - name: gcp-pd-csi-driver-controller-sa - namespace: openshift-cluster-csi-drivers + name: gcp-pd-csi-volumesnapshot-reader-provisioner-binding roleRef: + apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: openshift-csi-provisioner-volumesnapshot-reader-role - apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: gcp-pd-csi-driver-controller-sa + namespace: ${NODE_NAMESPACE} diff --git a/assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass.yaml b/assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass.yaml index acc224035..ac6f40c48 100644 --- a/assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass.yaml @@ -1,8 +1,14 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from overlays/gcp-pd/base/volumesnapshotclass.yaml +# +# + apiVersion: snapshot.storage.k8s.io/v1 +deletionPolicy: Delete +driver: pd.csi.storage.gke.io kind: VolumeSnapshotClass metadata: - name: csi-gce-pd-vsc annotations: snapshot.storage.kubernetes.io/is-default-class: "true" -driver: pd.csi.storage.gke.io -deletionPolicy: Delete \ No newline at end of file + name: csi-gce-pd-vsc diff --git a/assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass_images.yaml b/assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass_images.yaml index e261f2f4f..ed9018819 100644 --- a/assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass_images.yaml +++ b/assets/overlays/gcp-pd/generated/standalone/volumesnapshotclass_images.yaml @@ -1,8 +1,14 @@ +# Generated file. Do not edit. Update using "make update". +# +# Loaded from overlays/gcp-pd/base/volumesnapshotclass_images.yaml +# +# + apiVersion: snapshot.storage.k8s.io/v1 +deletionPolicy: Delete +driver: pd.csi.storage.gke.io kind: VolumeSnapshotClass metadata: name: csi-gce-pd-vsc-images -driver: pd.csi.storage.gke.io -deletionPolicy: Delete parameters: - snapshot-type: images \ No newline at end of file + snapshot-type: images diff --git a/assets/overlays/gcp-pd/patches/controller_add_driver.yaml b/assets/overlays/gcp-pd/patches/controller_add_driver.yaml new file mode 100644 index 000000000..43ecadb77 --- /dev/null +++ b/assets/overlays/gcp-pd/patches/controller_add_driver.yaml @@ -0,0 +1,71 @@ +kind: Deployment +apiVersion: apps/v1 +metadata: + annotations: + config.openshift.io/inject-proxy: csi-driver + config.openshift.io/inject-proxy-cabundle: csi-driver +spec: + template: + metadata: + annotations: + openshift.io/required-scc: hostnetwork-v2 + spec: + hostNetwork: true + containers: + - name: csi-driver + image: ${DRIVER_IMAGE} + imagePullPolicy: IfNotPresent + args: + - --endpoint=$(CSI_ENDPOINT) + - --logtostderr + - --v=${LOG_LEVEL} + - --enable-storage-pools=true + - --allow-hdha-provisioning=true + - --supports-dynamic-throughput-provisioning=hyperdisk-balanced,hyperdisk-throughput,hyperdisk-ml + - --supports-dynamic-iops-provisioning=hyperdisk-balanced,hyperdisk-extreme + env: + - name: GOOGLE_APPLICATION_CREDENTIALS + value: "/etc/cloud-sa/service_account.json" + - name: CSI_ENDPOINT + value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock + ports: + - name: healthz + # Due to hostNetwork, this port is open on a node! + containerPort: 10301 + protocol: TCP + livenessProbe: + httpGet: + path: /healthz + port: healthz + initialDelaySeconds: 10 + timeoutSeconds: 3 + periodSeconds: 10 + failureThreshold: 5 + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - name: socket-dir + mountPath: /var/lib/csi/sockets/pluginproxy/ + - name: cloud-sa-volume + readOnly: true + mountPath: "/etc/cloud-sa" + - name: bound-sa-token + mountPath: /var/run/secrets/openshift/serviceaccount + readOnly: true + securityContext: + readOnlyRootFilesystem: true + resources: + requests: + memory: 50Mi + cpu: 10m + volumes: + - name: cloud-sa-volume + secret: + secretName: gcp-pd-cloud-credentials + # This service account token can be used to provide identity outside the cluster. + # For example, this token can be used to authenticate with GCP using workload identity. + - name: bound-sa-token + projected: + sources: + - serviceAccountToken: + path: token + audience: openshift diff --git a/assets/overlays/gcp-pd/patches/node_add_driver.yaml b/assets/overlays/gcp-pd/patches/node_add_driver.yaml new file mode 100644 index 000000000..c7a5a696a --- /dev/null +++ b/assets/overlays/gcp-pd/patches/node_add_driver.yaml @@ -0,0 +1,103 @@ +kind: DaemonSet +apiVersion: apps/v1 +spec: + template: + spec: + hostNetwork: true + containers: + - name: csi-driver + securityContext: + privileged: true + readOnlyRootFilesystem: true + image: ${DRIVER_IMAGE} + imagePullPolicy: IfNotPresent + args: + - --endpoint=$(CSI_ENDPOINT) + - --logtostderr + - --v=${LOG_LEVEL} + - --enable-storage-pools=true + - --node-name=$(KUBE_NODE_NAME) + env: + - name: CSI_ENDPOINT + value: unix:/csi/csi.sock + - name: KUBE_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + volumeMounts: + - name: kubelet-dir + mountPath: /var/lib/kubelet + mountPropagation: "Bidirectional" + - name: socket-dir + mountPath: /csi + - name: device-dir + mountPath: /dev + # The following mounts are required to trigger host udevadm from + # container + - name: udev-rules-etc + mountPath: /etc/udev + - name: udev-rules-lib + mountPath: /lib/udev + - name: udev-socket + mountPath: /run/udev + - name: sys + mountPath: /sys + - name: etc-selinux + mountPath: /etc/selinux + ports: + - name: healthz + # Due to hostNetwork, this port is open on all nodes! + containerPort: 10300 + protocol: TCP + livenessProbe: + httpGet: + path: /healthz + port: healthz + initialDelaySeconds: 10 + timeoutSeconds: 3 + periodSeconds: 10 + failureThreshold: 5 + resources: + requests: + memory: 50Mi + cpu: 10m + terminationMessagePolicy: FallbackToLogsOnError + volumes: + - name: kubelet-dir + hostPath: + path: /var/lib/kubelet + type: Directory + - name: socket-dir + hostPath: + path: /var/lib/kubelet/plugins/pd.csi.storage.gke.io/ + type: DirectoryOrCreate + - name: registration-dir + hostPath: + path: /var/lib/kubelet/plugins_registry/ + type: Directory + - name: device-dir + hostPath: + path: /dev + type: Directory + # The following mounts are required to trigger host udevadm from + # container + - name: udev-rules-etc + hostPath: + path: /etc/udev + type: Directory + - name: udev-rules-lib + hostPath: + path: /lib/udev + type: Directory + - name: udev-socket + hostPath: + path: /run/udev + type: Directory + - name: sys + hostPath: + path: /sys + type: Directory + - name: etc-selinux + hostPath: + path: /etc/selinux + type: DirectoryOrCreate diff --git a/assets/overlays/gcp-pd/patches/node_remove_metrics_serving_cert.yaml b/assets/overlays/gcp-pd/patches/node_remove_metrics_serving_cert.yaml new file mode 100644 index 000000000..303e4cd14 --- /dev/null +++ b/assets/overlays/gcp-pd/patches/node_remove_metrics_serving_cert.yaml @@ -0,0 +1,8 @@ +apiVersion: apps/v1 +kind: DaemonSet +spec: + template: + spec: + volumes: + - $patch: delete + name: metrics-serving-cert diff --git a/assets/overlays/gcp-pd/patches/node_remove_sys_fs.yaml b/assets/overlays/gcp-pd/patches/node_remove_sys_fs.yaml new file mode 100644 index 000000000..a07ff21ed --- /dev/null +++ b/assets/overlays/gcp-pd/patches/node_remove_sys_fs.yaml @@ -0,0 +1,8 @@ +apiVersion: apps/v1 +kind: DaemonSet +spec: + template: + spec: + volumes: + - $patch: delete + name: sys-fs diff --git a/assets/overlays/gcp-pd/patches/privileged_role_get_nodes.yaml b/assets/overlays/gcp-pd/patches/privileged_role_get_nodes.yaml new file mode 100644 index 000000000..776596877 --- /dev/null +++ b/assets/overlays/gcp-pd/patches/privileged_role_get_nodes.yaml @@ -0,0 +1,6 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +rules: + - apiGroups: [""] + resources: ["nodes"] + verbs: ["get"] diff --git a/assets/overlays/gcp-pd/patches/privileged_role_get_nodes.yaml.patch b/assets/overlays/gcp-pd/patches/privileged_role_get_nodes.yaml.patch new file mode 100644 index 000000000..abf553b1d --- /dev/null +++ b/assets/overlays/gcp-pd/patches/privileged_role_get_nodes.yaml.patch @@ -0,0 +1,7 @@ +# Add ... +- op: add + path: /rules/- + value: + apiGroups: [""] + resources: ["nodes"] + verbs: ["get"] diff --git a/cmd/generator/main.go b/cmd/generator/main.go index a176a54be..ab965a664 100644 --- a/cmd/generator/main.go +++ b/cmd/generator/main.go @@ -10,6 +10,7 @@ import ( aws_efs "github.com/openshift/csi-operator/pkg/driver/aws-efs" azure_disk "github.com/openshift/csi-operator/pkg/driver/azure-disk" azure_file "github.com/openshift/csi-operator/pkg/driver/azure-file" + gcp_pd "github.com/openshift/csi-operator/pkg/driver/gcp-pd" openstack_cinder "github.com/openshift/csi-operator/pkg/driver/openstack-cinder" openstack_manila "github.com/openshift/csi-operator/pkg/driver/openstack-manila" samba "github.com/openshift/csi-operator/pkg/driver/samba" @@ -66,5 +67,6 @@ func collectConfigs() []*generator.CSIDriverGeneratorConfig { openstack_cinder.GetOpenStackCinderGeneratorConfig(), openstack_manila.GetOpenStackManilaGeneratorConfig(), samba.GetSambaGeneratorConfig(), + gcp_pd.GetGCPPDGeneratorConfig(), } } diff --git a/pkg/driver/common/generator/port_registry.go b/pkg/driver/common/generator/port_registry.go index c8bc51ede..3923e87ea 100644 --- a/pkg/driver/common/generator/port_registry.go +++ b/pkg/driver/common/generator/port_registry.go @@ -25,4 +25,7 @@ const ( OpenStackManilaLoopbackMetricsPortStart = 8202 OpenStackManilaExposedMetricsPortStart = 9202 + + GCPPDLoopbackMetricsPortStart = 8202 + GCPPDExposedMetricsPortStart = 9202 ) diff --git a/pkg/driver/gcp-pd/gcp_pd.go b/pkg/driver/gcp-pd/gcp_pd.go index 32000730b..612e94722 100644 --- a/pkg/driver/gcp-pd/gcp_pd.go +++ b/pkg/driver/gcp-pd/gcp_pd.go @@ -14,6 +14,7 @@ import ( opv1 "github.com/openshift/api/operator/v1" configclient "github.com/openshift/client-go/config/clientset/versioned" + commongenerator "github.com/openshift/csi-operator/pkg/driver/common/generator" "github.com/openshift/library-go/pkg/controller/factory" "github.com/openshift/library-go/pkg/operator/csi/csidrivercontrollerservicecontroller" "github.com/openshift/library-go/pkg/operator/csi/csidrivernodeservicecontroller" @@ -58,6 +59,83 @@ const ( defaultKMSKeyLocation = "global" ) +// GetGCPPDGeneratorConfig returns configuration for generating assets of GCP PD CSI driver operator. +func GetGCPPDGeneratorConfig() *generator.CSIDriverGeneratorConfig { + return &generator.CSIDriverGeneratorConfig{ + AssetPrefix: "gcp-pd-csi-driver", + AssetShortPrefix: "gcp-pd", + DriverName: "pd.csi.storage.gke.io", + StandaloneOnly: true, + OutputDir: generatedAssetBase, + + ControllerConfig: &generator.ControlPlaneConfig{ + DeploymentTemplateAssetName: "overlays/gcp-pd/patches/controller_add_driver.yaml", + LivenessProbePort: 10301, + SidecarLocalMetricsPortStart: commongenerator.GCPPDLoopbackMetricsPortStart, + SidecarExposedMetricsPortStart: commongenerator.GCPPDExposedMetricsPortStart, + Sidecars: []generator.SidecarConfig{ + commongenerator.DefaultProvisionerWithSnapshots.WithExtraArguments( + "--default-fstype=ext4", + "--feature-gates=Topology=true", + "--extra-create-metadata=true", + "--timeout=250s", + "--controller-publish-readonly", + ).WithAdditionalAssets( + "base/rbac/volumeattributesclass_reader_provisioner_binding.yaml", + ), + commongenerator.DefaultAttacher.WithExtraArguments( + "--timeout=250s", + ), + commongenerator.DefaultResizer.WithAdditionalAssets( + "base/rbac/volumeattributesclass_reader_resizer_binding.yaml", + ), + commongenerator.DefaultSnapshotter.WithExtraArguments( + "--timeout=300s", + ), + commongenerator.DefaultPodNetworkLivenessProbe.WithExtraArguments( + "--probe-timeout=3s", + ), + }, + Assets: commongenerator.DefaultControllerAssets.WithAssets(generator.StandaloneOnly, + "base/rbac/kube_rbac_proxy_role.yaml", + "base/rbac/kube_rbac_proxy_binding.yaml", + "base/rbac/prometheus_role.yaml", + "base/rbac/prometheus_binding.yaml", + ), + AssetPatches: generator.NewAssetPatches(generator.StandaloneOnly, + "controller.yaml", "common/standalone/controller_add_affinity.yaml", + ), + }, + + GuestConfig: &generator.GuestConfig{ + DaemonSetTemplateAssetName: "overlays/gcp-pd/patches/node_add_driver.yaml", + LivenessProbePort: 10300, + NodeRegistrarHealthCheckPort: 10303, + Sidecars: []generator.SidecarConfig{ + commongenerator.DefaultNodeDriverRegistrar, + commongenerator.DefaultHostNetworkLivenessProbe.WithExtraArguments( + "--probe-timeout=3s", + ), + }, + Assets: commongenerator.DefaultNodeAssets.WithAssets(generator.AllFlavours, + "overlays/gcp-pd/base/storageclass.yaml", + "overlays/gcp-pd/base/storageclass_ssd.yaml", + "overlays/gcp-pd/base/storageclass_hyperdisk_balanced.yaml", + "overlays/gcp-pd/base/hostnetwork_role.yaml", + "overlays/gcp-pd/base/controller_hostnetwork_binding.yaml", + "overlays/gcp-pd/base/csidriver.yaml", + "overlays/gcp-pd/base/volumesnapshotclass.yaml", + "overlays/gcp-pd/base/volumesnapshotclass_images.yaml", + ), + AssetPatches: commongenerator.DefaultGuestAssetPatches.WithPatches(generator.StandaloneOnly, + "node.yaml", "overlays/gcp-pd/patches/node_remove_metrics_serving_cert.yaml", + "node.yaml", "overlays/gcp-pd/patches/node_remove_sys_fs.yaml", + "privileged_role.yaml", "overlays/gcp-pd/patches/privileged_role_get_nodes.yaml.patch", + ), + }, + } +} + // GetGCPPDOperatorConfig returns runtime configuration of the CSI driver operator. func GetGCPPDOperatorConfig() *config.OperatorConfig { return &config.OperatorConfig{ diff --git a/pkg/operator/prerequisites.go b/pkg/operator/prerequisites.go index 5dbbd5e2f..c26418245 100644 --- a/pkg/operator/prerequisites.go +++ b/pkg/operator/prerequisites.go @@ -3,10 +3,8 @@ package operator import ( "context" "fmt" - "path/filepath" "time" - "github.com/openshift/csi-operator/assets" "github.com/openshift/library-go/pkg/operator/events" "github.com/openshift/library-go/pkg/operator/resource/resourceapply" kubeclient "k8s.io/client-go/kubernetes" @@ -18,16 +16,17 @@ var ( delayIteration = 5 * time.Second ) -func applyPrerequisites(ctx context.Context, kubeClient kubeclient.Interface, recorder events.Recorder, assetDir string, assetNames []string) error { - files := make([]string, len(assetNames)) - for i, name := range assetNames { - files[i] = filepath.Join(assetDir, name) - - } +func applyPrerequisites( + ctx context.Context, + kubeClient kubeclient.Interface, + recorder events.Recorder, + assetNames []string, + assetFunc resourceapply.AssetFunc, +) error { var errs []error for range numIterations { - if len(files) == 0 { + if len(assetNames) == 0 { klog.Infof("All prerequisite assets are applied") return nil } @@ -36,8 +35,8 @@ func applyPrerequisites(ctx context.Context, kubeClient kubeclient.Interface, re resourceapply.NewKubeClientHolder(kubeClient), recorder, resourceapply.NewResourceCache(), - assets.ReadFile, - files..., + assetFunc, + assetNames..., ) errs = errs[:0] @@ -48,9 +47,9 @@ func applyPrerequisites(ctx context.Context, kubeClient kubeclient.Interface, re } klog.V(2).Infof("Applied prerequisite asset %s (changed=%v)", result.File, result.Changed) // Remove successfully applied assets from the list - for i, file := range files { + for i, file := range assetNames { if file == result.File { - files = append(files[:i], files[i+1:]...) + assetNames = append(assetNames[:i], assetNames[i+1:]...) break } } @@ -58,7 +57,7 @@ func applyPrerequisites(ctx context.Context, kubeClient kubeclient.Interface, re if len(errs) != 0 { klog.Warningf("Failed to apply some prerequisites: %v", errs) } - if len(files) != 0 { + if len(assetNames) != 0 { select { case <-ctx.Done(): return ctx.Err() diff --git a/pkg/operator/prerequisites_test.go b/pkg/operator/prerequisites_test.go index 80b62d563..daf4b7f33 100644 --- a/pkg/operator/prerequisites_test.go +++ b/pkg/operator/prerequisites_test.go @@ -3,9 +3,15 @@ package operator import ( "context" "fmt" + "path/filepath" "strings" "testing" + "github.com/openshift/csi-operator/assets" + "github.com/openshift/csi-operator/pkg/driver/common/operator" + gcp_pd "github.com/openshift/csi-operator/pkg/driver/gcp-pd" + generated_assets "github.com/openshift/csi-operator/pkg/generated-assets" + "github.com/openshift/csi-operator/pkg/generator" "github.com/openshift/library-go/pkg/operator/events" corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -16,11 +22,18 @@ import ( ) func TestApplyPrerequisites(t *testing.T) { - assetDir := "overlays/gcp-pd/generated/standalone" + opConfig := gcp_pd.GetGCPPDOperatorConfig() + assetDir := filepath.Join(opConfig.AssetDir, string(generator.FlavourStandalone)) + a, err := generated_assets.NewFromAssets(assets.ReadFile, assetDir) + if err != nil { + t.Fatalf("Failure when reading assets: %v", err) + } + controlPlaneNamespace := "openshift-cluster-csi-drivers" + defaultReplacements := operator.DefaultReplacements(controlPlaneNamespace, controlPlaneNamespace) + a.SetReplacements(defaultReplacements) cases := []struct { name string - assetDir string assetNames []string setupReactor func(client *fakecore.Clientset) expectErr bool @@ -28,19 +41,16 @@ func TestApplyPrerequisites(t *testing.T) { }{ { name: "should apply all prerequisite assets successfully", - assetDir: assetDir, assetNames: []string{"controller_sa.yaml", "node_sa.yaml"}, expectErr: false, }, { name: "should succeed with empty asset list", - assetDir: assetDir, assetNames: []string{}, expectErr: false, }, { - name: "should apply all GCP PD prerequisite assets", - assetDir: assetDir, + name: "should apply all GCP PD prerequisite assets", assetNames: []string{ "controller_sa.yaml", "node_sa.yaml", @@ -53,21 +63,18 @@ func TestApplyPrerequisites(t *testing.T) { }, { name: "should return error for non-existent asset file", - assetDir: assetDir, assetNames: []string{"nonexistent.yaml"}, expectErr: true, errContains: "nonexistent.yaml", }, { name: "should return error when some assets do not exist", - assetDir: assetDir, assetNames: []string{"controller_sa.yaml", "nonexistent.yaml"}, expectErr: true, errContains: "nonexistent.yaml", }, { - name: "should retry failed assets and eventually succeed", - assetDir: assetDir, + name: "should retry failed assets and eventually succeed", assetNames: []string{ "controller_sa.yaml", "node_sa.yaml", @@ -88,12 +95,6 @@ func TestApplyPrerequisites(t *testing.T) { }, expectErr: false, }, - { - name: "should return error for non-existent asset directory", - assetDir: "no/such/dir", - assetNames: []string{"controller_sa.yaml"}, - expectErr: true, - }, } for _, tc := range cases { @@ -114,7 +115,7 @@ func TestApplyPrerequisites(t *testing.T) { recorder := events.NewInMemoryRecorder("test", &clock.RealClock{}) ctx := context.Background() - err := applyPrerequisites(ctx, kubeClient, recorder, tc.assetDir, tc.assetNames) + err := applyPrerequisites(ctx, kubeClient, recorder, tc.assetNames, a.GetAsset) if tc.expectErr && err == nil { t.Fatalf("expected error but got nil") } @@ -126,13 +127,13 @@ func TestApplyPrerequisites(t *testing.T) { } if !tc.expectErr { - verifyAppliedAssets(t, ctx, kubeClient, tc.assetDir, tc.assetNames) + verifyAppliedAssets(t, ctx, kubeClient, tc.assetNames) } }) } } -func verifyAppliedAssets(t *testing.T, ctx context.Context, kubeClient *fakecore.Clientset, assetDir string, assetNames []string) { +func verifyAppliedAssets(t *testing.T, ctx context.Context, kubeClient *fakecore.Clientset, assetNames []string) { t.Helper() for _, name := range assetNames { switch { diff --git a/pkg/operator/starter.go b/pkg/operator/starter.go index 975300444..9ea3f8577 100644 --- a/pkg/operator/starter.go +++ b/pkg/operator/starter.go @@ -255,7 +255,7 @@ func RunOperator(ctx context.Context, controllerConfig *controllercmd.Controller klog.V(2).Infof("Informers synced") // Apply some assets earlier. Some controllers won't be happy until they are applied. See, for example, OCPBUGS-99490. - if err = applyPrerequisites(ctx, c.ControlPlaneKubeClient, controllerConfig.EventRecorder, assetDir, opConfig.PrerequisiteAssets); err != nil { + if err = applyPrerequisites(ctx, c.ControlPlaneKubeClient, controllerConfig.EventRecorder, opConfig.PrerequisiteAssets, a.GetAsset); err != nil { return err }