Skip to content

Commit 0c9dba3

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #520 from jingxu97/June/kusto
New kustomization for pd driver
2 parents 317f2a6 + def8dae commit 0c9dba3

File tree

28 files changed

+462
-142
lines changed

28 files changed

+462
-142
lines changed

deploy/kubernetes/base/setup-cluster.yaml renamed to deploy/kubernetes/base/controller/cluster_setup.yaml

Lines changed: 39 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -147,33 +147,6 @@ roleRef:
147147
apiGroup: rbac.authorization.k8s.io
148148

149149
---
150-
apiVersion: policy/v1beta1
151-
kind: PodSecurityPolicy
152-
metadata:
153-
name: csi-gce-pd-node-psp
154-
spec:
155-
seLinux:
156-
rule: RunAsAny
157-
supplementalGroups:
158-
rule: RunAsAny
159-
runAsUser:
160-
rule: RunAsAny
161-
fsGroup:
162-
rule: RunAsAny
163-
privileged: true
164-
volumes:
165-
- '*'
166-
hostNetwork: true
167-
allowedHostPaths:
168-
- pathPrefix: "/var/lib/kubelet/plugins_registry/"
169-
- pathPrefix: "/var/lib/kubelet"
170-
- pathPrefix: "/var/lib/kubelet/plugins/pd.csi.storage.gke.io/"
171-
- pathPrefix: "/dev"
172-
- pathPrefix: "/etc/udev"
173-
- pathPrefix: "/lib/udev"
174-
- pathPrefix: "/run/udev"
175-
- pathPrefix: "/sys"
176-
---
177150

178151
kind: ClusterRole
179152
apiVersion: rbac.authorization.k8s.io/v1
@@ -187,6 +160,18 @@ rules:
187160
- csi-gce-pd-node-psp
188161
---
189162

163+
kind: ClusterRole
164+
apiVersion: rbac.authorization.k8s.io/v1
165+
metadata:
166+
name: csi-gce-pd-node-deploy-win
167+
rules:
168+
- apiGroups: ['policy']
169+
resources: ['podsecuritypolicies']
170+
verbs: ['use']
171+
resourceNames:
172+
- csi-gce-pd-node-psp-win
173+
---
174+
190175
apiVersion: rbac.authorization.k8s.io/v1
191176
kind: ClusterRoleBinding
192177
metadata:
@@ -196,9 +181,35 @@ roleRef:
196181
kind: ClusterRole
197182
name: csi-gce-pd-node-deploy
198183
subjects:
184+
- kind: ServiceAccount
185+
name: csi-gce-pd-node-sa
186+
---
187+
188+
apiVersion: rbac.authorization.k8s.io/v1
189+
kind: ClusterRoleBinding
190+
metadata:
191+
name: csi-gce-pd-node-win
192+
roleRef:
193+
apiGroup: rbac.authorization.k8s.io
194+
kind: ClusterRole
195+
name: csi-gce-pd-node-deploy-win
196+
subjects:
199197
- kind: ServiceAccount
200198
name: csi-gce-pd-node-sa
201199

200+
---
201+
apiVersion: rbac.authorization.k8s.io/v1
202+
kind: ClusterRoleBinding
203+
metadata:
204+
name: csi-gce-pd-controller
205+
roleRef:
206+
apiGroup: rbac.authorization.k8s.io
207+
kind: ClusterRole
208+
name: csi-gce-pd-node-deploy
209+
subjects:
210+
- kind: ServiceAccount
211+
name: csi-gce-pd-controller-sa
212+
202213
---
203214
apiVersion: rbac.authorization.k8s.io/v1
204215
kind: ClusterRole
@@ -231,7 +242,6 @@ roleRef:
231242
kind: ClusterRole
232243
name: csi-gce-pd-snapshotter-role
233244
apiGroup: rbac.authorization.k8s.io
234-
235245
---
236246

237247
kind: Role
@@ -262,3 +272,4 @@ roleRef:
262272
kind: Role
263273
name: csi-gce-pd-leaderelection-role
264274
apiGroup: rbac.authorization.k8s.io
275+

deploy/kubernetes/base/controller.yaml renamed to deploy/kubernetes/base/controller/controller.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ spec:
1717
# this requirement when issue is resolved and before any exposure of
1818
# metrics ports
1919
hostNetwork: true
20+
nodeSelector:
21+
kubernetes.io/os: linux
2022
serviceAccountName: csi-gce-pd-controller-sa
2123
priorityClassName: csi-gce-pd-controller
2224
containers:

‎deploy/kubernetes/base/controller/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
namespace:
4+
gce-pd-csi-driver
5+
resources:
6+
- cluster_setup.yaml
7+
- controller.yaml

‎deploy/kubernetes/base/kustomization.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
commonLabels:
2-
k8s-app: gcp-compute-persistent-disk-csi-driver
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
33
namespace:
44
gce-pd-csi-driver
55
resources:
6-
- node.yaml
7-
- controller.yaml
8-
- setup-cluster.yaml
6+
- controller
7+
- node_linux
8+
- node_windows

‎deploy/kubernetes/base/node_linux/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
namespace:
4+
gce-pd-csi-driver
5+
resources:
6+
- node.yaml
7+
- psp.yaml

deploy/kubernetes/base/node.yaml renamed to deploy/kubernetes/base/node_linux/node.yaml

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,17 +19,15 @@ spec:
1919
hostNetwork: true
2020
priorityClassName: csi-gce-pd-node
2121
serviceAccountName: csi-gce-pd-node-sa
22+
nodeSelector:
23+
kubernetes.io/os: linux
2224
containers:
2325
- name: csi-driver-registrar
2426
image: gke.gcr.io/csi-node-driver-registrar
2527
args:
2628
- "--v=5"
2729
- "--csi-address=/csi/csi.sock"
2830
- "--kubelet-registration-path=/var/lib/kubelet/plugins/pd.csi.storage.gke.io/csi.sock"
29-
lifecycle:
30-
preStop:
31-
exec:
32-
command: ["/bin/sh", "-c", "rm -rf /registration/pd.csi.storage.gke.io /registration/pd.csi.storage.gke.io-reg.sock"]
3331
env:
3432
- name: KUBE_NODE_NAME
3533
valueFrom:
@@ -41,14 +39,14 @@ spec:
4139
- name: registration-dir
4240
mountPath: /registration
4341
- name: gce-pd-driver
44-
securityContext:
45-
privileged: true
4642
# Don't change base image without changing pdImagePlaceholder in
4743
# test/k8s-integration/main.go
4844
image: gke.gcr.io/gcp-compute-persistent-disk-csi-driver
4945
args:
5046
- "--v=5"
5147
- "--endpoint=unix:/csi/csi.sock"
48+
securityContext:
49+
privileged: true
5250
volumeMounts:
5351
- name: kubelet-dir
5452
mountPath: /var/lib/kubelet
@@ -67,8 +65,6 @@ spec:
6765
mountPath: /run/udev
6866
- name: sys
6967
mountPath: /sys
70-
nodeSelector:
71-
kubernetes.io/os: linux
7268
volumes:
7369
- name: registration-dir
7470
hostPath:

‎deploy/kubernetes/base/node_linux/psp.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
apiVersion: policy/v1beta1
2+
kind: PodSecurityPolicy
3+
metadata:
4+
name: csi-gce-pd-node-psp
5+
spec:
6+
seLinux:
7+
rule: RunAsAny
8+
supplementalGroups:
9+
rule: RunAsAny
10+
runAsUser:
11+
rule: RunAsAny
12+
fsGroup:
13+
rule: RunAsAny
14+
privileged: true
15+
volumes:
16+
- '*'
17+
hostNetwork: true
18+
allowedHostPaths:
19+
- pathPrefix: "/var/lib/kubelet/plugins_registry/"
20+
- pathPrefix: "/var/lib/kubelet"
21+
- pathPrefix: "/var/lib/kubelet/plugins/pd.csi.storage.gke.io/"
22+
- pathPrefix: "/dev"
23+
- pathPrefix: "/etc/udev"
24+
- pathPrefix: "/lib/udev"
25+
- pathPrefix: "/run/udev"
26+
- pathPrefix: "/sys"
27+

‎deploy/kubernetes/base/node_windows/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
namespace:
4+
gce-pd-csi-driver
5+
resources:
6+
- node.yaml
7+
- psp.yaml

‎deploy/kubernetes/base/node_windows/node.yaml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#TODO(#40): Force DaemonSet to not run on master.
2+
kind: DaemonSet
3+
apiVersion: apps/v1
4+
metadata:
5+
name: csi-gce-pd-node-win
6+
spec:
7+
selector:
8+
matchLabels:
9+
app: gcp-compute-persistent-disk-csi-driver-win
10+
template:
11+
metadata:
12+
labels:
13+
app: gcp-compute-persistent-disk-csi-driver-win
14+
spec:
15+
# Host network must be used for interaction with Workload Identity in GKE
16+
# since it replaces GCE Metadata Server with GKE Metadata Server. Remove
17+
# this requirement when issue is resolved and before any exposure of
18+
# metrics ports. But hostNetwork is not working for Windows, might be an issue
19+
# when deploying on GKE Windows node.
20+
# hostNetwork: true
21+
priorityClassName: csi-gce-pd-node
22+
serviceAccountName: csi-gce-pd-node-sa
23+
nodeSelector:
24+
kubernetes.io/os: windows
25+
containers:
26+
- name: csi-driver-registrar
27+
image: gke.gcr.io/k8s-staging-csi/csi-node-driver-registrar-win
28+
args:
29+
- --v=5
30+
- --csi-address=unix://C:\\csi\\csi.sock
31+
- --kubelet-registration-path=C:\\var\\lib\\kubelet\\plugins\\pd.csi.storage.gke.io\\csi.sock
32+
env:
33+
- name: KUBE_NODE_NAME
34+
valueFrom:
35+
fieldRef:
36+
fieldPath: spec.nodeName
37+
volumeMounts:
38+
- name: plugin-dir
39+
mountPath: /csi
40+
- name: registration-dir
41+
mountPath: /registration
42+
- name: gce-pd-driver
43+
# Don't change base image without changing pdImagePlaceholder in
44+
# test/k8s-integration/main.go
45+
image: gke.gcr.io/gcp-compute-persistent-disk-csi-driver-win
46+
args:
47+
- "--v=5"
48+
- "--endpoint=unix:/csi/csi.sock"
49+
volumeMounts:
50+
- name: kubelet-dir
51+
mountPath: C:\var\lib\kubelet
52+
mountPropagation: "None"
53+
- name: plugin-dir
54+
mountPath: C:\csi
55+
- name: csi-proxy-disk-pipe
56+
mountPath: \\.\pipe\csi-proxy-disk-v1alpha1
57+
- name: csi-proxy-volume-pipe
58+
mountPath: \\.\pipe\csi-proxy-volume-v1alpha1
59+
- name: csi-proxy-filesystem-pipe
60+
mountPath: \\.\pipe\csi-proxy-filesystem-v1alpha1
61+
volumes:
62+
- name: csi-proxy-disk-pipe
63+
hostPath:
64+
path: \\.\pipe\csi-proxy-disk-v1alpha1
65+
type: ""
66+
- name: csi-proxy-volume-pipe
67+
hostPath:
68+
path: \\.\pipe\csi-proxy-volume-v1alpha1
69+
type: ""
70+
- name: csi-proxy-filesystem-pipe
71+
hostPath:
72+
path: \\.\pipe\csi-proxy-filesystem-v1alpha1
73+
type: ""
74+
- name: registration-dir
75+
hostPath:
76+
path: \var\lib\kubelet\plugins_registry
77+
type: Directory
78+
- name: kubelet-dir
79+
hostPath:
80+
path: \var\lib\kubelet
81+
type: Directory
82+
- name: plugin-dir
83+
hostPath:
84+
path: \var\lib\kubelet\plugins\pd.csi.storage.gke.io
85+
type: DirectoryOrCreate

‎deploy/kubernetes/base/node_windows/psp.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: policy/v1beta1
2+
kind: PodSecurityPolicy
3+
metadata:
4+
name: csi-gce-pd-node-psp-win
5+
spec:
6+
supplementalGroups:
7+
rule: RunAsAny
8+
runAsUser:
9+
rule: RunAsAny
10+
fsGroup:
11+
rule: RunAsAny
12+
seLinux:
13+
rule: RunAsAny
14+
volumes:
15+
- '*'
16+
hostNetwork: true
17+
allowedHostPaths:
18+
- pathPrefix: \var\lib\kubelet
19+
- pathPrefix: \var\lib\kubelet\plugins_registry
20+
- pathPrefix: \var\lib\kubelet\plugins\pd.csi.storage.gke.io
21+
- pathPrefix: \\.\pipe\csi-proxy-disk-v1alpha1
22+
- pathPrefix: \\.\pipe\csi-proxy-volume-v1alpha1
23+
- pathPrefix: \\.\pipe\csi-proxy-filesystem-v1alpha1
24+

0 commit comments

Comments
 (0)