From e0cea3b90ef746c611fe1d0e86880d0910818be9 Mon Sep 17 00:00:00 2001 From: Stefan Reimer Date: Mon, 21 Aug 2023 17:24:01 +0000 Subject: [PATCH] storage module version bumps for 1.26 --- charts/kubezero-storage/Chart.yaml | 2 +- .../kubezero-storage/aws-efs-csi-driver.patch | 22 - .../charts/aws-ebs-csi-driver/CHANGELOG.md | 28 ++ .../charts/aws-ebs-csi-driver/Chart.yaml | 4 +- .../templates/clusterrole-csi-node.yaml | 2 +- .../templates/clusterrole-provisioner.yaml | 3 - .../templates/controller.yaml | 113 ++++- .../templates/node-windows.yaml | 4 + .../aws-ebs-csi-driver/templates/node.yaml | 31 +- .../poddisruptionbudget-controller.yaml | 6 +- .../templates/role-leases.yaml | 9 + .../templates/rolebinding-leases.yaml | 15 + .../serviceaccount-csi-controller.yaml | 3 + .../templates/serviceaccount-csi-node.yaml | 3 + .../templates/tests/helm-tester.yaml | 223 ---------- .../charts/aws-ebs-csi-driver/values.yaml | 82 +++- .../charts/aws-efs-csi-driver/CHANGELOG.md | 16 + .../charts/aws-efs-csi-driver/Chart.yaml | 4 +- .../templates/controller-deployment.yaml | 13 +- .../templates/node-daemonset.yaml | 23 +- .../templates/node-serviceaccount.yaml | 27 ++ .../charts/aws-efs-csi-driver/values.yaml | 47 +- .../kubezero-storage/charts/gemini/Chart.yaml | 3 +- .../kubezero-storage/charts/gemini/README.md | 5 + .../charts/gemini/templates/deployment.yaml | 21 + .../charts/gemini/values.yaml | 30 ++ .../charts/lvm-localpv/Chart.yaml | 6 +- .../charts/lvm-localpv/README.md | 108 ++--- .../lvm-localpv/templates/lvm-controller.yaml | 4 +- .../lvm-localpv/templates/lvm-node.yaml | 4 +- .../charts/lvm-localpv/templates/rbac.yaml | 4 +- .../templates/volumesnapshotclasses-crd.yaml | 136 ++++++ .../templates/volumesnapshotcontents-crd.yaml | 403 ++++++++++++++++++ .../templates/volumesnapshots-crd.yaml | 314 ++++++++++++++ .../charts/lvm-localpv/values.yaml | 56 ++- .../jsonnet/jsonnetfile.lock.json | 12 +- .../snapshot-controller/controller.yaml | 2 +- charts/kubezero-storage/update.sh | 2 - charts/kubezero-storage/values.yaml | 4 +- charts/kubezero/templates/storage.yaml | 28 +- charts/kubezero/values.yaml | 2 +- scripts/lib-update.sh | 2 +- 42 files changed, 1422 insertions(+), 404 deletions(-) create mode 100644 charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/role-leases.yaml create mode 100644 charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/rolebinding-leases.yaml delete mode 100644 charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/tests/helm-tester.yaml create mode 100644 charts/kubezero-storage/charts/lvm-localpv/templates/volumesnapshotclasses-crd.yaml create mode 100644 charts/kubezero-storage/charts/lvm-localpv/templates/volumesnapshotcontents-crd.yaml create mode 100644 charts/kubezero-storage/charts/lvm-localpv/templates/volumesnapshots-crd.yaml diff --git a/charts/kubezero-storage/Chart.yaml b/charts/kubezero-storage/Chart.yaml index 94d587c..cd6fa16 100644 --- a/charts/kubezero-storage/Chart.yaml +++ b/charts/kubezero-storage/Chart.yaml @@ -39,4 +39,4 @@ dependencies: version: 4.4.1 condition: k8up.enabled repository: https://k8up-io.github.io/k8up -kubeVersion: ">= 1.25.0" +kubeVersion: ">= 1.26.0" diff --git a/charts/kubezero-storage/aws-efs-csi-driver.patch b/charts/kubezero-storage/aws-efs-csi-driver.patch index e8186b4..7651590 100644 --- a/charts/kubezero-storage/aws-efs-csi-driver.patch +++ b/charts/kubezero-storage/aws-efs-csi-driver.patch @@ -30,25 +30,3 @@ diff -tuNr charts/aws-efs-csi-driver.orig/templates/controller-deployment.yaml c {{- with .Values.controller.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} -diff -tuNr charts/aws-efs-csi-driver.orig/templates/node-daemonset.yaml charts/aws-efs-csi-driver/templates/node-daemonset.yaml ---- charts/aws-efs-csi-driver.orig/templates/node-daemonset.yaml 2022-10-11 20:57:20.000000000 +0200 -+++ charts/aws-efs-csi-driver/templates/node-daemonset.yaml 2022-10-12 22:39:19.796397838 +0200 -@@ -40,15 +40,10 @@ - {{- with .Values.node.nodeSelector }} - {{- toYaml . | nindent 8 }} - {{- end }} -+ {{- with .Values.node.affinity }} - affinity: -- nodeAffinity: -- requiredDuringSchedulingIgnoredDuringExecution: -- nodeSelectorTerms: -- - matchExpressions: -- - key: eks.amazonaws.com/compute-type -- operator: NotIn -- values: -- - fargate -+ {{- . | toYaml | nindent 8 }} -+ {{- end }} - hostNetwork: true - dnsPolicy: {{ .Values.node.dnsPolicy }} - {{- with .Values.node.dnsConfig }} diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/CHANGELOG.md b/charts/kubezero-storage/charts/aws-ebs-csi-driver/CHANGELOG.md index bc6aa00..59b1433 100644 --- a/charts/kubezero-storage/charts/aws-ebs-csi-driver/CHANGELOG.md +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/CHANGELOG.md @@ -1,5 +1,33 @@ # Helm chart +## v2.22.0 +* Default PodDisruptionBudget to policy/v1 ([#1707](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/1707), [@iNoahNothing](https://github.com/iNoahNothing)) + +## v2.21.0 +* Bump driver version to `v1.21.0` +* Enable additional volume mounts on node pods ([#1670](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/1670), [@AndrewSirenko](https://github.com/AndrewSirenko)) +* Enable customization of aws-secret name and keys in Helm Chart ([#1668](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/1668), [@AndrewSirenko](https://github.com/AndrewSirenko)) +* The sidecars have been updated. The new versions are: + - csi-snapshotter: `v6.2.2` + +## v2.20.0 +* Bump driver version to `v1.20.0` +* Enable leader election in csi-resizer sidecar ([#1606](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/1606), [@rdpsin](https://github.com/rdpsin)) +* Namespace-scoped leases permissions ([#1614](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/1614), [@torredil](https://github.com/torredil)) +* Add additionalArgs parameter for sidecars ([#1627](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/1627), [@ConnorJC3](https://github.com/ConnorJC3)) +* Avoid generating manifests with empty envFrom fields ([#1630](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/1630), [@mvgmb](https://github.com/mvgmb)) +* Allow to set automountServiceAccountToken in ServiceAccount ([#1619](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/1619), [@kahirokunn](https://github.com/kahirokunn)) + +## v2.19.0 +* Bump driver version to `v1.19.0` +* The sidecars have been updated. The new versions are: + - csi-provisioner: `v3.5.0` + - csi-attacher: `v4.3.0` + - livenessprobe: `v2.10.0` + - csi-resizer: `v1.8.0` + - node-driver-registrar: `v2.8.0` +* Remove CPU limits ([#1596](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/pull/1596), [@torredil](https://github.com/torredil)) + ## v2.18.0 ### Urgent Upgrade Notes *(No, really, you MUST read this before you upgrade)* diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/Chart.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/Chart.yaml index 0f93e99..ef68789 100644 --- a/charts/kubezero-storage/charts/aws-ebs-csi-driver/Chart.yaml +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 1.18.0 +appVersion: 1.22.0 description: A Helm chart for AWS EBS CSI Driver home: https://github.com/kubernetes-sigs/aws-ebs-csi-driver keywords: @@ -13,4 +13,4 @@ maintainers: name: aws-ebs-csi-driver sources: - https://github.com/kubernetes-sigs/aws-ebs-csi-driver -version: 2.18.0 +version: 2.22.0 diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/clusterrole-csi-node.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/clusterrole-csi-node.yaml index 3ca368e..3e53822 100644 --- a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/clusterrole-csi-node.yaml +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/clusterrole-csi-node.yaml @@ -8,4 +8,4 @@ metadata: rules: - apiGroups: [""] resources: ["nodes"] - verbs: ["get"] + verbs: ["get", "patch"] diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/clusterrole-provisioner.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/clusterrole-provisioner.yaml index 0fb7ded..c8f737d 100644 --- a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/clusterrole-provisioner.yaml +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/clusterrole-provisioner.yaml @@ -30,9 +30,6 @@ rules: - apiGroups: [ "" ] resources: [ "nodes" ] verbs: [ "get", "list", "watch" ] - - apiGroups: [ "coordination.k8s.io" ] - resources: [ "leases" ] - verbs: [ "get", "watch", "list", "delete", "update", "create" ] - apiGroups: [ "storage.k8s.io" ] resources: [ "volumeattachments" ] verbs: [ "get", "list", "watch" ] diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/controller.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/controller.yaml index 0d79331..dda851b 100644 --- a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/controller.yaml +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/controller.yaml @@ -90,6 +90,9 @@ spec: {{- with .Values.controller.loggingFormat }} - --logging-format={{ . }} {{- end }} + {{- with .Values.controller.userAgentExtra }} + - --user-agent-extra={{ . }} + {{- end }} - --v={{ .Values.controller.logLevel }} {{- range .Values.controller.additionalArgs }} - {{ . }} @@ -101,18 +104,20 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName + {{- with .Values.awsAccessSecret }} - name: AWS_ACCESS_KEY_ID valueFrom: secretKeyRef: - name: aws-secret - key: key_id + name: {{ .name }} + key: {{ .keyId }} optional: true - name: AWS_SECRET_ACCESS_KEY valueFrom: secretKeyRef: - name: aws-secret - key: access_key + name: {{ .name }} + key: {{ .accessKey }} optional: true + {{- end }} - name: AWS_EC2_ENDPOINT valueFrom: configMapKeyRef: @@ -129,10 +134,10 @@ spec: {{- with .Values.controller.env }} {{- . | toYaml | nindent 12 }} {{- end }} + {{- with .Values.controller.envFrom }} envFrom: - {{- with .Values.controller.envFrom }} {{- . | toYaml | nindent 12 }} - {{- end }} + {{- end }} volumeMounts: - name: socket-dir mountPath: /var/lib/csi/sockets/pluginproxy/ @@ -195,6 +200,9 @@ spec: {{- end }} {{- end }} - --default-fstype={{ .Values.controller.defaultFsType }} + {{- range .Values.sidecars.provisioner.additionalArgs }} + - {{ . }} + {{- end }} env: - name: ADDRESS value: /var/lib/csi/sockets/pluginproxy/csi.sock @@ -204,10 +212,10 @@ spec: {{- with .Values.sidecars.provisioner.env }} {{- . | toYaml | nindent 12 }} {{- end }} + {{- with .Values.controller.envFrom }} envFrom: - {{- with .Values.controller.envFrom }} {{- . | toYaml | nindent 12 }} - {{- end }} + {{- end }} volumeMounts: - name: socket-dir mountPath: /var/lib/csi/sockets/pluginproxy/ @@ -237,6 +245,9 @@ spec: - --leader-election-retry-period={{ .Values.sidecars.attacher.leaderElection.retryPeriod }} {{- end }} {{- end }} + {{- range .Values.sidecars.attacher.additionalArgs }} + - {{ . }} + {{- end }} env: - name: ADDRESS value: /var/lib/csi/sockets/pluginproxy/csi.sock @@ -246,10 +257,10 @@ spec: {{- with .Values.sidecars.attacher.env }} {{- . | toYaml | nindent 12 }} {{- end }} + {{- with .Values.controller.envFrom }} envFrom: - {{- with .Values.controller.envFrom }} {{- . | toYaml | nindent 12 }} - {{- end }} + {{- end }} volumeMounts: - name: socket-dir mountPath: /var/lib/csi/sockets/pluginproxy/ @@ -271,6 +282,9 @@ spec: {{- if .Values.controller.extraCreateMetadata }} - --extra-create-metadata {{- end}} + {{- range .Values.sidecars.snapshotter.additionalArgs }} + - {{ . }} + {{- end }} env: - name: ADDRESS value: /var/lib/csi/sockets/pluginproxy/csi.sock @@ -280,10 +294,10 @@ spec: {{- with .Values.sidecars.snapshotter.env }} {{- . | toYaml | nindent 12 }} {{- end }} + {{- with .Values.controller.envFrom }} envFrom: - {{- with .Values.controller.envFrom }} {{- . | toYaml | nindent 12 }} - {{- end }} + {{- end }} volumeMounts: - name: socket-dir mountPath: /var/lib/csi/sockets/pluginproxy/ @@ -296,6 +310,53 @@ spec: {{- toYaml . | nindent 12 }} {{- end }} {{- end }} + {{- if (.Values.controller.volumeModificationFeature).enabled }} + - name: volumemodifier + image: {{ printf "%s%s:%s" (default "" .Values.image.containerRegistry) .Values.sidecars.volumemodifier.image.repository .Values.sidecars.volumemodifier.image.tag }} + imagePullPolicy: {{ default .Values.image.pullPolicy .Values.sidecars.volumemodifier.image.pullPolicy }} + args: + - --csi-address=$(ADDRESS) + - --v={{ .Values.sidecars.volumemodifier.logLevel }} + - --leader-election={{ .Values.sidecars.volumemodifier.leaderElection.enabled | required "leader election state for csi-volumemodifier is required, must be set to true || false." }} + {{- if .Values.sidecars.volumemodifier.leaderElection.enabled }} + {{- if .Values.sidecars.volumemodifier.leaderElection.leaseDuration }} + - --leader-election-lease-duration={{ .Values.sidecars.volumemodifier.leaderElection.leaseDuration }} + {{- end }} + {{- if .Values.sidecars.volumemodifier.leaderElection.renewDeadline}} + - --leader-election-renew-deadline={{ .Values.sidecars.volumemodifier.leaderElection.renewDeadline }} + {{- end }} + {{- if .Values.sidecars.volumemodifier.leaderElection.retryPeriod }} + - --leader-election-retry-period={{ .Values.sidecars.volumemodifier.leaderElection.retryPeriod }} + {{- end }} + {{- end }} + {{- range .Values.sidecars.volumemodifier.additionalArgs }} + - {{ . }} + {{- end }} + env: + - name: ADDRESS + value: /var/lib/csi/sockets/pluginproxy/csi.sock + {{- if .Values.proxy.http_proxy }} + {{- include "aws-ebs-csi-driver.http-proxy" . | nindent 12 }} + {{- end }} + {{- with .Values.sidecars.volumemodifier.env }} + {{- . | toYaml | nindent 12 }} + {{- end }} + {{- with .Values.controller.envFrom }} + envFrom: + {{- . | toYaml | nindent 12 }} + {{- end }} + volumeMounts: + - name: socket-dir + mountPath: /var/lib/csi/sockets/pluginproxy/ + {{- with default .Values.controller.resources .Values.sidecars.volumemodifier.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.sidecars.volumemodifier.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- end }} - name: csi-resizer image: {{ printf "%s%s:%s" (default "" .Values.image.containerRegistry) .Values.sidecars.resizer.image.repository .Values.sidecars.resizer.image.tag }} imagePullPolicy: {{ default .Values.image.pullPolicy .Values.sidecars.resizer.image.pullPolicy }} @@ -303,6 +364,21 @@ spec: - --csi-address=$(ADDRESS) - --v={{ .Values.sidecars.resizer.logLevel }} - --handle-volume-inuse-error=false + {{- with .Values.sidecars.resizer.leaderElection }} + - --leader-election={{ .enabled | default true }} + {{- if .leaseDuration }} + - --leader-election-lease-duration={{ .leaseDuration }} + {{- end }} + {{- if .renewDeadline }} + - --leader-election-renew-deadline={{ .renewDeadline }} + {{- end }} + {{- if .retryPeriod }} + - --leader-election-retry-period={{ .retryPeriod }} + {{- end }} + {{- end }} + {{- range .Values.sidecars.resizer.additionalArgs }} + - {{ . }} + {{- end }} env: - name: ADDRESS value: /var/lib/csi/sockets/pluginproxy/csi.sock @@ -312,10 +388,10 @@ spec: {{- with .Values.sidecars.resizer.env }} {{- . | toYaml | nindent 12 }} {{- end }} + {{- with .Values.controller.envFrom }} envFrom: - {{- with .Values.controller.envFrom }} {{- . | toYaml | nindent 12 }} - {{- end }} + {{- end }} volumeMounts: - name: socket-dir mountPath: /var/lib/csi/sockets/pluginproxy/ @@ -332,10 +408,13 @@ spec: imagePullPolicy: {{ default .Values.image.pullPolicy .Values.sidecars.livenessProbe.image.pullPolicy }} args: - --csi-address=/csi/csi.sock - envFrom: - {{- with .Values.controller.envFrom }} - {{- . | toYaml | nindent 12 }} + {{- range .Values.sidecars.livenessProbe.additionalArgs }} + - {{ . }} {{- end }} + {{- with .Values.controller.envFrom }} + envFrom: + {{- . | toYaml | nindent 12 }} + {{- end }} volumeMounts: - name: socket-dir mountPath: /csi diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/node-windows.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/node-windows.yaml index 42cc091..3f46056 100644 --- a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/node-windows.yaml +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/node-windows.yaml @@ -99,6 +99,9 @@ spec: resources: {{- toYaml . | nindent 12 }} {{- end }} + securityContext: + windowsOptions: + runAsUserName: "ContainerAdministrator" - name: node-driver-registrar image: {{ printf "%s%s:%s" (default "" .Values.image.containerRegistry) .Values.sidecars.nodeDriverRegistrar.image.repository .Values.sidecars.nodeDriverRegistrar.image.tag }} imagePullPolicy: {{ default .Values.image.pullPolicy .Values.sidecars.nodeDriverRegistrar.image.pullPolicy }} @@ -125,6 +128,7 @@ spec: - --mode=kubelet-registration-probe initialDelaySeconds: 30 timeoutSeconds: 15 + periodSeconds: 90 volumeMounts: - name: plugin-dir mountPath: C:\csi diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/node.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/node.yaml index 520c09e..9e24c10 100644 --- a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/node.yaml +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/node.yaml @@ -43,6 +43,8 @@ spec: {{- with .Values.node.tolerations }} {{- toYaml . | nindent 8 }} {{- end }} + - key: "ebs.csi.aws.com/agent-not-ready" + operator: "Exists" {{- end }} {{- with .Values.node.securityContext }} securityContext: @@ -75,10 +77,10 @@ spec: {{- with .Values.node.env }} {{- . | toYaml | nindent 12 }} {{- end }} + {{- with .Values.controller.envFrom }} envFrom: - {{- with .Values.controller.envFrom }} {{- . | toYaml | nindent 12 }} - {{- end }} + {{- end }} volumeMounts: - name: kubelet-dir mountPath: {{ .Values.node.kubeletPath }} @@ -87,6 +89,9 @@ spec: mountPath: /csi - name: device-dir mountPath: /dev + {{- with .Values.node.volumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} ports: - name: healthz containerPort: 9808 @@ -125,10 +130,13 @@ spec: {{- with .Values.sidecars.nodeDriverRegistrar.env }} {{- . | toYaml | nindent 12 }} {{- end }} - envFrom: - {{- with .Values.controller.envFrom }} - {{- . | toYaml | nindent 12 }} + {{- range .Values.sidecars.nodeDriverRegistrar.additionalArgs }} + - {{ . }} {{- end }} + {{- with .Values.controller.envFrom }} + envFrom: + {{- . | toYaml | nindent 12 }} + {{- end }} livenessProbe: exec: command: @@ -137,6 +145,7 @@ spec: - --mode=kubelet-registration-probe initialDelaySeconds: 30 timeoutSeconds: 15 + periodSeconds: 90 volumeMounts: - name: plugin-dir mountPath: /csi @@ -157,10 +166,13 @@ spec: imagePullPolicy: {{ default .Values.image.pullPolicy .Values.sidecars.livenessProbe.image.pullPolicy }} args: - --csi-address=/csi/csi.sock - envFrom: - {{- with .Values.controller.envFrom }} - {{- . | toYaml | nindent 12 }} + {{- range .Values.sidecars.livenessProbe.additionalArgs }} + - {{ . }} {{- end }} + {{- with .Values.controller.envFrom }} + envFrom: + {{- . | toYaml | nindent 12 }} + {{- end }} volumeMounts: - name: plugin-dir mountPath: /csi @@ -197,3 +209,6 @@ spec: type: Directory - name: probe-dir emptyDir: {} + {{- with .Values.node.volumes }} + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/poddisruptionbudget-controller.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/poddisruptionbudget-controller.yaml index 6f73fa2..e818b57 100644 --- a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/poddisruptionbudget-controller.yaml +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/poddisruptionbudget-controller.yaml @@ -1,7 +1,7 @@ -{{- if .Capabilities.APIVersions.Has "policy/v1/PodDisruptionBudget" }} -apiVersion: policy/v1 -{{- else }} +{{- if not (.Capabilities.APIVersions.Has "policy/v1") }} apiVersion: policy/v1beta1 +{{- else }} +apiVersion: policy/v1 {{- end }} kind: PodDisruptionBudget metadata: diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/role-leases.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/role-leases.yaml new file mode 100644 index 0000000..39e1546 --- /dev/null +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/role-leases.yaml @@ -0,0 +1,9 @@ +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + namespace: {{ .Release.Namespace }} + name: ebs-csi-leases-role +rules: +- apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "watch", "list", "delete", "update", "create"] diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/rolebinding-leases.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/rolebinding-leases.yaml new file mode 100644 index 0000000..88fded8 --- /dev/null +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/rolebinding-leases.yaml @@ -0,0 +1,15 @@ +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: ebs-csi-leases-rolebinding + namespace: {{ .Release.Namespace }} + labels: + {{- include "aws-ebs-csi-driver.labels" . | nindent 4 }} +subjects: +- kind: ServiceAccount + name: {{ .Values.controller.serviceAccount.name }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: ebs-csi-leases-role + apiGroup: rbac.authorization.k8s.io diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/serviceaccount-csi-controller.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/serviceaccount-csi-controller.yaml index a5b1102..d819f54 100644 --- a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/serviceaccount-csi-controller.yaml +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/serviceaccount-csi-controller.yaml @@ -15,4 +15,7 @@ metadata: #annotations: # eks.amazonaws.com/role-arn: arn::iam:::role/ebs-csi-role {{- end }} +{{- if .Values.controller.serviceAccount.automountServiceAccountToken }} +automountServiceAccountToken: {{ .Values.controller.serviceAccount.automountServiceAccountToken }} +{{- end }} {{- end -}} diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/serviceaccount-csi-node.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/serviceaccount-csi-node.yaml index fb85abe..9f3c7c7 100644 --- a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/serviceaccount-csi-node.yaml +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/serviceaccount-csi-node.yaml @@ -10,4 +10,7 @@ metadata: annotations: {{- toYaml . | nindent 4 }} {{- end }} +{{- if .Values.node.serviceAccount.automountServiceAccountToken }} +automountServiceAccountToken: {{ .Values.node.serviceAccount.automountServiceAccountToken }} +{{- end }} {{- end -}} diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/tests/helm-tester.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/tests/helm-tester.yaml deleted file mode 100644 index 217db10..0000000 --- a/charts/kubezero-storage/charts/aws-ebs-csi-driver/templates/tests/helm-tester.yaml +++ /dev/null @@ -1,223 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: ebs-csi-driver-test - annotations: - "helm.sh/hook": test - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: ebs-csi-driver-test - annotations: - "helm.sh/hook": test - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed -rules: - - apiGroups: [ "" ] - resources: - - events - - nodes - - pods - - replicationcontrollers - - serviceaccounts - - configmaps - - persistentvolumes - - persistentvolumeclaims - verbs: [ "list" ] - - apiGroups: [ "" ] - resources: - - services - - nodes - - nodes/proxy - - persistentvolumes - - persistentvolumeclaims - - pods - - pods/log - verbs: [ "get" ] - - apiGroups: [ "" ] - resources: - - namespaces - - persistentvolumes - - persistentvolumeclaims - - pods - - pods/exec - verbs: [ "create" ] - - apiGroups: [ "" ] - resources: - - namespaces - - persistentvolumes - - persistentvolumeclaims - - pods - verbs: [ "delete" ] - - apiGroups: [ "" ] - resources: - - persistentvolumeclaims - verbs: [ "update" ] - - apiGroups: [ "" ] - resources: - - pods/ephemeralcontainers - verbs: [ "patch" ] - - apiGroups: [ "" ] - resources: - - serviceaccounts - - configmaps - verbs: [ "watch" ] - - apiGroups: [ "apps" ] - resources: - - replicasets - - daemonsets - verbs: [ "list" ] - - apiGroups: [ "storage.k8s.io" ] - resources: - - storageclasses - verbs: [ "create" ] - - apiGroups: [ "storage.k8s.io" ] - resources: - - storageclasses - - csinodes - verbs: [ "get" ] - - apiGroups: [ "storage.k8s.io" ] - resources: - - storageclasses - verbs: [ "delete" ] - - apiGroups: [ "snapshot.storage.k8s.io" ] - resources: - - volumesnapshots - - volumesnapshotclasses - - volumesnapshotcontents - verbs: [ "create" ] - - apiGroups: [ "snapshot.storage.k8s.io" ] - resources: - - volumesnapshots - - volumesnapshotclasses - - volumesnapshotcontents - verbs: [ "get" ] - - apiGroups: [ "snapshot.storage.k8s.io" ] - resources: - - volumesnapshotcontents - verbs: [ "update" ] - - apiGroups: [ "snapshot.storage.k8s.io" ] - resources: - - volumesnapshots - - volumesnapshotclasses - - volumesnapshotcontents - verbs: [ "delete" ] - - apiGroups: [ "authorization.k8s.io" ] - resources: - - clusterroles - verbs: [ "list" ] - - apiGroups: [ "authorization.k8s.io" ] - resources: - - subjectaccessreviews - verbs: [ "create" ] - - apiGroups: [ "rbac.authorization.k8s.io" ] - resources: - - clusterroles - verbs: [ "list" ] - - apiGroups: [ "rbac.authorization.k8s.io" ] - resources: - - clusterrolebindings - verbs: [ "create" ] - - apiGroups: [ "apiextensions.k8s.io" ] - resources: - - customresourcedefinitions - verbs: [ "get" ] ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: ebs-csi-driver-test - annotations: - "helm.sh/hook": test - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed -subjects: - - kind: ServiceAccount - name: ebs-csi-driver-test - namespace: kube-system -roleRef: - kind: ClusterRole - name: ebs-csi-driver-test - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: v1 -kind: ConfigMap -data: - manifests.yaml: | - ShortName: ebs - StorageClass: - FromFile: storageclass.yaml - SnapshotClass: - FromName: true - DriverInfo: - Name: ebs.csi.aws.com - SupportedSizeRange: - Min: 1Gi - Max: 16Ti - SupportedFsType: - xfs: {} - ext4: {} - SupportedMountOption: - dirsync: {} - TopologyKeys: ["topology.ebs.csi.aws.com/zone"] - Capabilities: - persistence: true - fsGroup: true - block: true - exec: true - snapshotDataSource: true - pvcDataSource: false - multipods: true - controllerExpansion: true - nodeExpansion: true - volumeLimits: true - topology: true - storageclass.yaml: | - kind: StorageClass - apiVersion: storage.k8s.io/v1 - metadata: - name: ebs.csi.aws.com - provisioner: ebs.csi.aws.com - volumeBindingMode: WaitForFirstConsumer -metadata: - name: ebs-csi-driver-test - annotations: - "helm.sh/hook": test - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed ---- -apiVersion: v1 -kind: Pod -metadata: - name: ebs-csi-driver-test - annotations: - "helm.sh/hook": test - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed -spec: - containers: - - name: kubetest2 - image: gcr.io/k8s-staging-test-infra/kubekins-e2e:v20220624-1a63fdd9f2-master - command: [ "/bin/sh", "-c" ] - args: - - | - cp /etc/config/storageclass.yaml /workspace/storageclass.yaml - go install sigs.k8s.io/kubetest2/...@latest - kubectl config set-cluster cluster --server=https://kubernetes.default --certificate-authority=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt - kubectl config set-context kubetest2 --cluster=cluster - kubectl config set-credentials sa --token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token) - kubectl config set-context kubetest2 --user=sa && kubectl config use-context kubetest2 - kubectl get crd volumesnapshots.snapshot.storage.k8s.io - if [ $? -eq 0 ]; then - SNAPSHOTS="|snapshot fields" - fi - export FOCUS_REGEX="\bebs.csi.aws.com\b.+(validate content|resize volume|offline PVC|AllowedTopologies|store data$SNAPSHOTS)" - kubetest2 noop --run-id='e2e-kubernetes' --test=ginkgo -- --test-package-version=$(curl https://storage.googleapis.com/kubernetes-release/release/stable-1.25.txt) --skip-regex='\[Disruptive\]|\[Serial\]' --focus-regex="$FOCUS_REGEX" --parallel=25 --test-args='-storage.testdriver=/etc/config/manifests.yaml' - volumeMounts: - - name: config-vol - mountPath: /etc/config - serviceAccountName: ebs-csi-driver-test - volumes: - - name: config-vol - configMap: - name: ebs-csi-driver-test - restartPolicy: Never diff --git a/charts/kubezero-storage/charts/aws-ebs-csi-driver/values.yaml b/charts/kubezero-storage/charts/aws-ebs-csi-driver/values.yaml index 4877fe4..7197097 100644 --- a/charts/kubezero-storage/charts/aws-ebs-csi-driver/values.yaml +++ b/charts/kubezero-storage/charts/aws-ebs-csi-driver/values.yaml @@ -19,8 +19,9 @@ sidecars: image: pullPolicy: IfNotPresent repository: public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner - tag: "v3.4.1-eks-1-26-7" + tag: "v3.5.0-eks-1-27-9" logLevel: 2 + additionalArgs: [] resources: {} # Tune leader lease election for csi-provisioner. # Leader election is on by default. @@ -40,7 +41,7 @@ sidecars: image: pullPolicy: IfNotPresent repository: public.ecr.aws/eks-distro/kubernetes-csi/external-attacher - tag: "v4.2.0-eks-1-26-7" + tag: "v4.3.0-eks-1-27-9" # Tune leader lease election for csi-attacher. # Leader election is on by default. leaderElection: @@ -52,6 +53,7 @@ sidecars: # renewDeadline: "10s" # retryPeriod: "5s" logLevel: 2 + additionalArgs: [] resources: {} securityContext: readOnlyRootFilesystem: true @@ -63,8 +65,9 @@ sidecars: image: pullPolicy: IfNotPresent repository: public.ecr.aws/eks-distro/kubernetes-csi/external-snapshotter/csi-snapshotter - tag: "v6.2.1-eks-1-26-7" + tag: "v6.2.2-eks-1-27-9" logLevel: 2 + additionalArgs: [] resources: {} securityContext: readOnlyRootFilesystem: true @@ -73,7 +76,8 @@ sidecars: image: pullPolicy: IfNotPresent repository: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe - tag: "v2.9.0-eks-1-26-7" + tag: "v2.10.0-eks-1-27-9" + additionalArgs: [] resources: {} securityContext: readOnlyRootFilesystem: true @@ -83,8 +87,19 @@ sidecars: image: pullPolicy: IfNotPresent repository: public.ecr.aws/eks-distro/kubernetes-csi/external-resizer - tag: "v1.7.0-eks-1-26-7" + tag: "v1.8.0-eks-1-27-9" + # Tune leader lease election for csi-resizer. + # Leader election is on by default. + leaderElection: + enabled: true + # Optional values to tune lease behavior. + # The arguments provided must be in an acceptable time.ParseDuration format. + # Ref: https://pkg.go.dev/flag#Duration + # leaseDuration: "15s" + # renewDeadline: "10s" + # retryPeriod: "5s" logLevel: 2 + additionalArgs: [] resources: {} securityContext: readOnlyRootFilesystem: true @@ -94,8 +109,29 @@ sidecars: image: pullPolicy: IfNotPresent repository: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar - tag: "v2.7.0-eks-1-26-7" + tag: "v2.8.0-eks-1-27-9" logLevel: 2 + additionalArgs: [] + resources: {} + securityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + volumemodifier: + env: [] + image: + pullPolicy: IfNotPresent + repository: public.ecr.aws/ebs-csi-driver/volume-modifier-for-k8s + tag: "v0.1.2" + leaderElection: + enabled: true + # Optional values to tune lease behavior. + # The arguments provided must be in an acceptable time.ParseDuration format. + # Ref: https://pkg.go.dev/flag#Duration + # leaseDuration: "15s" + # renewDeadline: "10s" + # retryPeriod: "5s" + logLevel: 2 + additionalArgs: [] resources: {} securityContext: readOnlyRootFilesystem: true @@ -109,7 +145,14 @@ imagePullSecrets: [] nameOverride: fullnameOverride: +awsAccessSecret: + name: aws-secret + keyId: key_id + accessKey: access_key + controller: + volumeModificationFeature: + enabled: false additionalArgs: [] sdkDebugLog: false loggingFormat: text @@ -166,6 +209,7 @@ controller: # ID of the Kubernetes cluster used for tagging provisioned EBS volumes (optional). k8sTagClusterId: logLevel: 2 + userAgentExtra: "helm" nodeSelector: {} podAnnotations: {} podLabels: {} @@ -189,13 +233,13 @@ controller: cpu: 10m memory: 40Mi limits: - cpu: 100m memory: 256Mi serviceAccount: # A service account will be created for you if set to true. Set to false if you want to use your own. create: true name: ebs-csi-controller-sa annotations: {} + automountServiceAccountToken: true tolerations: - key: CriticalAddonsOnly operator: Exists @@ -220,8 +264,18 @@ controller: runAsUser: 1000 runAsGroup: 1000 fsGroup: 1000 + # Add additional volume mounts on the controller with controller.volumes and controller.volumeMounts volumes: [] + # Add additional volumes to be mounted onto the controller: + # - name: custom-dir + # hostPath: + # path: /path/to/dir + # type: Directory volumeMounts: [] + # And add mount paths for those additional volumes: + # - name: custom-dir + # mountPath: /mount/path + # --- # securityContext on the controller container (see sidecars for securityContext on sidecar containers) containerSecurityContext: readOnlyRootFilesystem: true @@ -264,12 +318,12 @@ node: cpu: 10m memory: 40Mi limits: - cpu: 100m memory: 256Mi serviceAccount: create: true name: ebs-csi-node-sa annotations: {} + automountServiceAccountToken: true enableWindows: false # The "maximum number of attachable volumes" per node volumeAttachLimit: @@ -284,6 +338,18 @@ node: runAsUser: 0 runAsGroup: 0 fsGroup: 0 + # Add additional volume mounts on the node pods with node.volumes and node.volumeMounts + volumes: [] + # Add additional volumes to be mounted onto the node pods: + # - name: custom-dir + # hostPath: + # path: /path/to/dir + # type: Directory + volumeMounts: [] + # And add mount paths for those additional volumes: + # - name: custom-dir + # mountPath: /mount/path + # --- # securityContext on the node container (see sidecars for securityContext on sidecar containers) containerSecurityContext: readOnlyRootFilesystem: true diff --git a/charts/kubezero-storage/charts/aws-efs-csi-driver/CHANGELOG.md b/charts/kubezero-storage/charts/aws-efs-csi-driver/CHANGELOG.md index afcece4..ce38be9 100644 --- a/charts/kubezero-storage/charts/aws-efs-csi-driver/CHANGELOG.md +++ b/charts/kubezero-storage/charts/aws-efs-csi-driver/CHANGELOG.md @@ -1,4 +1,20 @@ # Helm chart +# v2.4.9 +* Bump app/driver version to `v1.6.0` +# v2.4.8 +* Bump app/driver version to `v1.5.9` +# v2.4.7 +* Bump app/driver version to `v1.5.8` +# v2.4.6 +* Bump app/driver version to `v1.5.7` +# v2.4.5 +* Bump helm version for change of state-dir path to avoid losing track of state files which exists already to `v2.4.5` +# v2.4.4 +* Bump helm version to pick the latest side-car images `v2.4.4` +# v2.4.3 +* Bump app/driver version to `v1.5.6` +# v2.4.2 +* Bump app/driver version to `v1.5.5` # v2.4.1 * Bump app/driver version to `v1.5.4` # v2.4.0 diff --git a/charts/kubezero-storage/charts/aws-efs-csi-driver/Chart.yaml b/charts/kubezero-storage/charts/aws-efs-csi-driver/Chart.yaml index 8620cb5..68e22c5 100644 --- a/charts/kubezero-storage/charts/aws-efs-csi-driver/Chart.yaml +++ b/charts/kubezero-storage/charts/aws-efs-csi-driver/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 1.5.4 +appVersion: 1.6.0 description: A Helm chart for AWS EFS CSI Driver home: https://github.com/kubernetes-sigs/aws-efs-csi-driver keywords: @@ -15,4 +15,4 @@ maintainers: name: aws-efs-csi-driver sources: - https://github.com/kubernetes-sigs/aws-efs-csi-driver -version: 2.4.1 +version: 2.4.9 diff --git a/charts/kubezero-storage/charts/aws-efs-csi-driver/templates/controller-deployment.yaml b/charts/kubezero-storage/charts/aws-efs-csi-driver/templates/controller-deployment.yaml index cf2d4c1..dee398b 100644 --- a/charts/kubezero-storage/charts/aws-efs-csi-driver/templates/controller-deployment.yaml +++ b/charts/kubezero-storage/charts/aws-efs-csi-driver/templates/controller-deployment.yaml @@ -43,6 +43,10 @@ spec: {{- with .Values.controller.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }} + {{- with .Values.controller.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} containers: - name: efs-plugin securityContext: @@ -57,7 +61,6 @@ spec: {{- end }} - --v={{ .Values.controller.logLevel }} - --delete-access-point-root-dir={{ hasKey .Values.controller "deleteAccessPointRootDir" | ternary .Values.controller.deleteAccessPointRootDir false }} - - --vol-metrics-opt-in={{ hasKey .Values.controller "volMetricsOptIn" | ternary .Values.controller.volMetricsOptIn false }} env: - name: CSI_ENDPOINT value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock @@ -116,6 +119,10 @@ spec: {{- with .Values.sidecars.csiProvisioner.resources }} resources: {{ toYaml . | nindent 12 }} {{- end }} + {{- with .Values.sidecars.csiProvisioner.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} - name: liveness-probe image: {{ printf "%s:%s" .Values.sidecars.livenessProbe.image.repository .Values.sidecars.livenessProbe.image.tag }} imagePullPolicy: {{ .Values.sidecars.livenessProbe.image.pullPolicy }} @@ -128,6 +135,10 @@ spec: {{- with .Values.sidecars.livenessProbe.resources }} resources: {{ toYaml . | nindent 12 }} {{- end }} + {{- with .Values.sidecars.livenessProbe.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} volumes: - name: socket-dir emptyDir: {} diff --git a/charts/kubezero-storage/charts/aws-efs-csi-driver/templates/node-daemonset.yaml b/charts/kubezero-storage/charts/aws-efs-csi-driver/templates/node-daemonset.yaml index 209f567..acaebe2 100644 --- a/charts/kubezero-storage/charts/aws-efs-csi-driver/templates/node-daemonset.yaml +++ b/charts/kubezero-storage/charts/aws-efs-csi-driver/templates/node-daemonset.yaml @@ -45,10 +45,8 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} {{- with .Values.node.affinity }} - affinity: - {{- . | toYaml | nindent 8 }} + affinity: {{- toYaml . | nindent 8 }} {{- end }} - hostNetwork: true dnsPolicy: {{ .Values.node.dnsPolicy }} {{- with .Values.node.dnsConfig }} dnsConfig: {{- toYaml . | nindent 8 }} @@ -58,6 +56,10 @@ spec: {{- with .Values.node.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }} + {{- with .Values.node.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} containers: - name: efs-plugin securityContext: @@ -68,9 +70,16 @@ spec: - --endpoint=$(CSI_ENDPOINT) - --logtostderr - --v={{ .Values.node.logLevel }} + - --vol-metrics-opt-in={{ hasKey .Values.node "volMetricsOptIn" | ternary .Values.node.volMetricsOptIn false }} + - --vol-metrics-refresh-period={{ hasKey .Values.node "volMetricsRefreshPeriod" | ternary .Values.node.volMetricsRefreshPeriod 240 }} + - --vol-metrics-fs-rate-limit={{ hasKey .Values.node "volMetricsFsRateLimit" | ternary .Values.node.volMetricsFsRateLimit 5 }} env: - name: CSI_ENDPOINT value: unix:/csi/csi.sock + - name: CSI_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName {{- if .Values.useFIPS }} - name: AWS_USE_FIPS_ENDPOINT value: "true" @@ -126,6 +135,10 @@ spec: {{- with .Values.sidecars.nodeDriverRegistrar.resources }} resources: {{ toYaml . | nindent 12 }} {{- end }} + {{- with .Values.sidecars.nodeDriverRegistrar.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} - name: liveness-probe image: {{ printf "%s:%s" .Values.sidecars.livenessProbe.image.repository .Values.sidecars.livenessProbe.image.tag }} imagePullPolicy: {{ .Values.sidecars.livenessProbe.image.pullPolicy }} @@ -139,6 +152,10 @@ spec: {{- with .Values.sidecars.livenessProbe.resources }} resources: {{ toYaml . | nindent 12 }} {{- end }} + {{- with .Values.sidecars.livenessProbe.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} volumes: - name: kubelet-dir hostPath: diff --git a/charts/kubezero-storage/charts/aws-efs-csi-driver/templates/node-serviceaccount.yaml b/charts/kubezero-storage/charts/aws-efs-csi-driver/templates/node-serviceaccount.yaml index 9fd3c7a..a63383b 100644 --- a/charts/kubezero-storage/charts/aws-efs-csi-driver/templates/node-serviceaccount.yaml +++ b/charts/kubezero-storage/charts/aws-efs-csi-driver/templates/node-serviceaccount.yaml @@ -10,3 +10,30 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} {{- end }} +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: efs-csi-node-role + labels: + app.kubernetes.io/name: {{ include "aws-efs-csi-driver.name" . }} +rules: + - apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "list", "watch"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: efs-csi-node-binding + labels: + app.kubernetes.io/name: {{ include "aws-efs-csi-driver.name" . }} +subjects: + - kind: ServiceAccount + name: {{ .Values.node.serviceAccount.name }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: efs-csi-node-role + apiGroup: rbac.authorization.k8s.io + \ No newline at end of file diff --git a/charts/kubezero-storage/charts/aws-efs-csi-driver/values.yaml b/charts/kubezero-storage/charts/aws-efs-csi-driver/values.yaml index 79c6943..68bebb5 100644 --- a/charts/kubezero-storage/charts/aws-efs-csi-driver/values.yaml +++ b/charts/kubezero-storage/charts/aws-efs-csi-driver/values.yaml @@ -11,28 +11,37 @@ useFIPS: false image: repository: amazon/aws-efs-csi-driver - tag: "v1.5.4" + tag: "v1.6.0" pullPolicy: IfNotPresent sidecars: livenessProbe: image: repository: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe - tag: v2.8.0-eks-1-25-latest + tag: v2.10.0-eks-1-27-3 pullPolicy: IfNotPresent resources: {} + securityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false nodeDriverRegistrar: image: repository: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar - tag: v2.6.2-eks-1-25-latest + tag: v2.8.0-eks-1-27-3 pullPolicy: IfNotPresent resources: {} + securityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false csiProvisioner: image: repository: public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner - tag: v3.3.0-eks-1-25-latest + tag: v3.5.0-eks-1-27-3 pullPolicy: IfNotPresent resources: {} + securityContext: + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false imagePullSecrets: [] @@ -53,7 +62,6 @@ controller: # Enable if you want the controller to also delete the # path on efs when deleteing an access point deleteAccessPointRootDir: false - volMetricsOptIn: false podAnnotations: {} resources: {} @@ -80,11 +88,22 @@ controller: # eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/efs-csi-role healthPort: 9909 regionalStsEndpoints: false + # securityContext on the controller pod + securityContext: + runAsNonRoot: false + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + + ## Node daemonset variables node: # Number for the log level verbosity logLevel: 2 + volMetricsOptIn: false + volMetricsRefreshPeriod: 240 + volMetricsFsRateLimit: 5 hostAliases: {} # For cross VPC EFS, you need to poison or overwrite the DNS for the efs volume as per @@ -119,6 +138,15 @@ node: # type: OnDelete tolerations: - operator: Exists + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: eks.amazonaws.com/compute-type + operator: NotIn + values: + - fargate # Specifies whether a service account should be created serviceAccount: create: true @@ -127,6 +155,13 @@ node: ## Enable if EKS IAM for SA is used # eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/efs-csi-role healthPort: 9809 + # securityContext on the node pod + securityContext: + # The node pod must be run as root to bind to the registration/driver sockets + runAsNonRoot: false + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 storageClasses: [] # Add StorageClass resources like: @@ -143,5 +178,7 @@ storageClasses: [] # gidRangeStart: "1000" # gidRangeEnd: "2000" # basePath: "/dynamic_provisioning" +# subPathPattern: "/subPath" +# ensureUniqueDirectory: true # reclaimPolicy: Delete # volumeBindingMode: Immediate diff --git a/charts/kubezero-storage/charts/gemini/Chart.yaml b/charts/kubezero-storage/charts/gemini/Chart.yaml index 797feb0..a9838d4 100644 --- a/charts/kubezero-storage/charts/gemini/Chart.yaml +++ b/charts/kubezero-storage/charts/gemini/Chart.yaml @@ -2,8 +2,9 @@ apiVersion: v1 appVersion: "2.0" description: Automated backup and restore of PersistentVolumes using the VolumeSnapshot API +kubeVersion: '>= 1.22.0-0' maintainers: - email: robertb@fairwinds.com name: rbren name: gemini -version: 2.0.0 +version: 2.1.3 diff --git a/charts/kubezero-storage/charts/gemini/README.md b/charts/kubezero-storage/charts/gemini/README.md index 87b543f..505debd 100644 --- a/charts/kubezero-storage/charts/gemini/README.md +++ b/charts/kubezero-storage/charts/gemini/README.md @@ -43,3 +43,8 @@ before upgrading, and add `--skip-crds` when running `helm install`. | rbac.serviceAccountName | string | `nil` | | | verbosity | int | `5` | How verbose the controller logs should be | | resources | object | `{"limits":{"cpu":"200m","memory":"512Mi"},"requests":{"cpu":"25m","memory":"64Mi"}}` | The resources block for the controller pods | +| tolerations | list | `[]` | Taint tolerations for nodes | +| nodeSelector | object | `{}` | Select nodes to deploy which matches the following labels | +| affinity | object | `{}` | Pod affinity and pod anti-affinity allow you to specify rules about how pods should be placed relative to other pods. | +| additionalPodLabels | object | `{}` | Additional labels added on pod | +| additionalPodAnnotations | object | `{}` | Additional annotations added on pod | diff --git a/charts/kubezero-storage/charts/gemini/templates/deployment.yaml b/charts/kubezero-storage/charts/gemini/templates/deployment.yaml index 2486654..b636114 100644 --- a/charts/kubezero-storage/charts/gemini/templates/deployment.yaml +++ b/charts/kubezero-storage/charts/gemini/templates/deployment.yaml @@ -13,6 +13,15 @@ spec: metadata: labels: app: gemini +{{- if .Values.additionalPodLabels }} +{{ toYaml .Values.additionalPodLabels | indent 8 }} +{{- end }} +{{- if .Values.additionalPodAnnotations }} + annotations: +{{- end }} +{{- with .Values.additionalPodAnnotations }} +{{ toYaml . | indent 8 }} +{{- end }} spec: {{- if .Values.rbac.create }} serviceAccountName: {{ include "gemini.fullname" . }}-controller @@ -46,3 +55,15 @@ spec: capabilities: drop: - ALL + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | indent 8 -}} + {{- end }} + {{- if .Values.affinity }} + affinity: +{{ toYaml .Values.affinity | indent 8 -}} + {{- end }} diff --git a/charts/kubezero-storage/charts/gemini/values.yaml b/charts/kubezero-storage/charts/gemini/values.yaml index 32098ad..7af0d0b 100644 --- a/charts/kubezero-storage/charts/gemini/values.yaml +++ b/charts/kubezero-storage/charts/gemini/values.yaml @@ -23,3 +23,33 @@ resources: limits: memory: 512Mi cpu: 200m + +# tolerations -- Taint tolerations for nodes +tolerations: [] + # - key: "dedicated" + # operator: "Equal" + # value: "app" + # effect: "NoSchedule" + +# nodeSelector -- Select nodes to deploy which matches the following labels +nodeSelector: {} + # cloud.google.com/gke-nodepool: default-pool + +# affinity -- Pod affinity and pod anti-affinity allow you to specify rules about how pods should be placed relative to other pods. +affinity: {} +# nodeAffinity: +# requiredDuringSchedulingIgnoredDuringExecution: +# nodeSelectorTerms: +# - matchExpressions: +# - key: disktype +# operator: In +# values: +# - ssd + +# additionalPodLabels -- Additional labels added on pod +additionalPodLabels: {} + # env: prod + +# additionalPodAnnotations -- Additional annotations added on pod +additionalPodAnnotations: {} + # key: value diff --git a/charts/kubezero-storage/charts/lvm-localpv/Chart.yaml b/charts/kubezero-storage/charts/lvm-localpv/Chart.yaml index 557705b..eb94e7e 100644 --- a/charts/kubezero-storage/charts/lvm-localpv/Chart.yaml +++ b/charts/kubezero-storage/charts/lvm-localpv/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 -appVersion: 1.0.0 +appVersion: 1.2.0 description: CSI Driver for dynamic provisioning of LVM Persistent Local Volumes. -home: http://www.openebs.io/ +home: https://openebs.io/ icon: https://raw.githubusercontent.com/cncf/artwork/master/projects/openebs/icon/color/openebs-icon-color.png keywords: - cloud-native-storage @@ -20,4 +20,4 @@ maintainers: name: lvm-localpv sources: - https://github.com/openebs/lvm-localpv -version: 1.0.1 +version: 1.2.0 diff --git a/charts/kubezero-storage/charts/lvm-localpv/README.md b/charts/kubezero-storage/charts/lvm-localpv/README.md index c5f7c69..acb26d3 100644 --- a/charts/kubezero-storage/charts/lvm-localpv/README.md +++ b/charts/kubezero-storage/charts/lvm-localpv/README.md @@ -94,60 +94,60 @@ helm install openebs-lvmlocalpv openebs-lvmlocalpv/lvm-localpv --namespace opene ``` -| Parameter| Description| Default| -| -| -| -| -| `imagePullSecrets`| Provides image pull secrect| `""`| -| `lvmPlugin.image.registry`| Registry for openebs-lvm-plugin image| `""`| -| `lvmPlugin.image.repository`| Image repository for openebs-lvm-plugin| `openebs/lvm-driver`| -| `lvmPlugin.image.pullPolicy`| Image pull policy for openebs-lvm-plugin| `IfNotPresent`| -| `lvmPlugin.image.tag`| Image tag for openebs-lvm-plugin| `1.0.0`| -| `lvmPlugin.metricsPort`| The TCP port number used for exposing lvm-metrics | `9500`| -| `lvmPlugin.allowedTopologies`| The comma seperated list of allowed node topologies | `kubernetes.io/hostname,`| -| `lvmNode.driverRegistrar.image.registry`| Registry for csi-node-driver-registrar image| `k8s.gcr.io/`| -| `lvmNode.driverRegistrar.image.repository`| Image repository for csi-node-driver-registrar| `sig-storage/csi-node-driver-registrar`| -| `lvmNode.driverRegistrar.image.pullPolicy`| Image pull policy for csi-node-driver-registrar| `IfNotPresent`| -| `lvmNode.driverRegistrar.image.tag`| Image tag for csi-node-driver-registrar| `v2.3.0`| -| `lvmNode.updateStrategy.type`| Update strategy for lvmnode daemonset | `RollingUpdate` | -| `lvmNode.kubeletDir`| Kubelet mount point for lvmnode daemonset| `"/var/lib/kubelet/"` | -| `lvmNode.annotations` | Annotations for lvmnode daemonset metadata| `""`| -| `lvmNode.podAnnotations`| Annotations for lvmnode daemonset's pods metadata | `""`| -| `lvmNode.resources`| Resource and request and limit for lvmnode daemonset containers | `""`| -| `lvmNode.labels`| Labels for lvmnode daemonset metadata | `""`| -| `lvmNode.podLabels`| Appends labels to the lvmnode daemonset pods| `""`| -| `lvmNode.nodeSelector`| Nodeselector for lvmnode daemonset pods| `""`| -| `lvmNode.tolerations` | lvmnode daemonset's pod toleration values | `""`| -| `lvmNode.securityContext` | Security context for lvmnode daemonset container | `""`| -| `lvmController.resizer.image.registry`| Registry for csi-resizer image| `k8s.gcr.io/`| -| `lvmController.resizer.image.repository`| Image repository for csi-resizer| `sig-storage/csi-resizer`| -| `lvmController.resizer.image.pullPolicy`| Image pull policy for csi-resizer| `IfNotPresent`| -| `lvmController.resizer.image.tag`| Image tag for csi-resizer| `v1.2.0`| -| `lvmController.snapshotter.image.registry`| Registry for csi-snapshotter image| `k8s.gcr.io/`| -| `lvmController.snapshotter.image.repository`| Image repository for csi-snapshotter| `sig-storage/csi-snapshotter`| -| `lvmController.snapshotter.image.pullPolicy`| Image pull policy for csi-snapshotter| `IfNotPresent`| -| `lvmController.snapshotter.image.tag`| Image tag for csi-snapshotter| `v4.0.0`| -| `lvmController.snapshotController.image.registry`| Registry for snapshot-controller image| `k8s.gcr.io/`| -| `lvmController.snapshotController.image.repository`| Image repository for snapshot-controller| `sig-storage/snapshot-controller`| -| `lvmController.snapshotController.image.pullPolicy`| Image pull policy for snapshot-controller| `IfNotPresent`| -| `lvmController.snapshotController.image.tag`| Image tag for snapshot-controller| `v4.0.0`| -| `lvmController.provisioner.image.registry`| Registry for csi-provisioner image| `k8s.gcr.io/`| -| `lvmController.provisioner.image.repository`| Image repository for csi-provisioner| `sig-storage/csi-provisioner`| -| `lvmController.provisioner.image.pullPolicy`| Image pull policy for csi-provisioner| `IfNotPresent`| -| `lvmController.provisioner.image.tag`| Image tag for csi-provisioner| `v2.3.0`| -| `lvmController.updateStrategy.type`| Update strategy for lvm localpv controller statefulset | `RollingUpdate` | -| `lvmController.annotations` | Annotations for lvm localpv controller statefulset metadata| `""`| -| `lvmController.podAnnotations`| Annotations for lvm localpv controller statefulset's pods metadata | `""`| -| `lvmController.resources`| Resource and request and limit for lvm localpv controller statefulset containers | `""`| -| `lvmController.labels`| Labels for lvm localpv controller statefulset metadata | `""`| -| `lvmController.podLabels`| Appends labels to the lvm localpv controller statefulset pods| `""`| -| `lvmController.nodeSelector`| Nodeselector for lvm localpv controller statefulset pods| `""`| -| `lvmController.tolerations` | lvm localpv controller statefulset's pod toleration values | `""`| -| `lvmController.securityContext` | Seurity context for lvm localpv controller statefulset container | `""`| -| `rbac.pspEnabled` | Enable PodSecurityPolicy | `false` | -| `serviceAccount.lvmNode.create` | Create a service account for lvmnode or not| `true`| -| `serviceAccount.lvmNode.name` | Name for the lvmnode service account| `openebs-lvm-node-sa`| -| `serviceAccount.lvmController.create` | Create a service account for lvm localpv controller or not| `true`| -| `serviceAccount.lvmController.name` | Name for the lvm localpv controller service account| `openebs-lvm-controller-sa`| -| `analytics.enabled` | Enable or Disable google analytics for the controller| `true`| +| Parameter | Description | Default | +|-----------------------------------------------------|----------------------------------------------------------------------------------|-----------------------------------------| +| `imagePullSecrets` | Provides image pull secrect | `""` | +| `lvmPlugin.image.registry` | Registry for openebs-lvm-plugin image | `""` | +| `lvmPlugin.image.repository` | Image repository for openebs-lvm-plugin | `openebs/lvm-driver` | +| `lvmPlugin.image.pullPolicy` | Image pull policy for openebs-lvm-plugin | `IfNotPresent` | +| `lvmPlugin.image.tag` | Image tag for openebs-lvm-plugin | `1.2.0` | +| `lvmPlugin.metricsPort` | The TCP port number used for exposing lvm-metrics | `9500` | +| `lvmPlugin.allowedTopologies` | The comma seperated list of allowed node topologies | `kubernetes.io/hostname,` | +| `lvmNode.driverRegistrar.image.registry` | Registry for csi-node-driver-registrar image | `registry.k8s.io/` | +| `lvmNode.driverRegistrar.image.repository` | Image repository for csi-node-driver-registrar | `sig-storage/csi-node-driver-registrar` | +| `lvmNode.driverRegistrar.image.pullPolicy` | Image pull policy for csi-node-driver-registrar | `IfNotPresent` | +| `lvmNode.driverRegistrar.image.tag` | Image tag for csi-node-driver-registrar | `v2.8.0` | +| `lvmNode.updateStrategy.type` | Update strategy for lvmnode daemonset | `RollingUpdate` | +| `lvmNode.kubeletDir` | Kubelet mount point for lvmnode daemonset | `"/var/lib/kubelet/"` | +| `lvmNode.annotations` | Annotations for lvmnode daemonset metadata | `""` | +| `lvmNode.podAnnotations` | Annotations for lvmnode daemonset's pods metadata | `""` | +| `lvmNode.resources` | Resource and request and limit for lvmnode daemonset containers | `""` | +| `lvmNode.labels` | Labels for lvmnode daemonset metadata | `""` | +| `lvmNode.podLabels` | Appends labels to the lvmnode daemonset pods | `""` | +| `lvmNode.nodeSelector` | Nodeselector for lvmnode daemonset pods | `""` | +| `lvmNode.tolerations` | lvmnode daemonset's pod toleration values | `""` | +| `lvmNode.securityContext` | Security context for lvmnode daemonset container | `""` | +| `lvmController.resizer.image.registry` | Registry for csi-resizer image | `registry.k8s.io/` | +| `lvmController.resizer.image.repository` | Image repository for csi-resizer | `sig-storage/csi-resizer` | +| `lvmController.resizer.image.pullPolicy` | Image pull policy for csi-resizer | `IfNotPresent` | +| `lvmController.resizer.image.tag` | Image tag for csi-resizer | `v1.8.0` | +| `lvmController.snapshotter.image.registry` | Registry for csi-snapshotter image | `registry.k8s.io/` | +| `lvmController.snapshotter.image.repository` | Image repository for csi-snapshotter | `sig-storage/csi-snapshotter` | +| `lvmController.snapshotter.image.pullPolicy` | Image pull policy for csi-snapshotter | `IfNotPresent` | +| `lvmController.snapshotter.image.tag` | Image tag for csi-snapshotter | `v6.2.2` | +| `lvmController.snapshotController.image.registry` | Registry for snapshot-controller image | `registry.k8s.io/` | +| `lvmController.snapshotController.image.repository` | Image repository for snapshot-controller | `sig-storage/snapshot-controller` | +| `lvmController.snapshotController.image.pullPolicy` | Image pull policy for snapshot-controller | `IfNotPresent` | +| `lvmController.snapshotController.image.tag` | Image tag for snapshot-controller | `v6.2.2` | +| `lvmController.provisioner.image.registry` | Registry for csi-provisioner image | `registry.k8s.io/` | +| `lvmController.provisioner.image.repository` | Image repository for csi-provisioner | `sig-storage/csi-provisioner` | +| `lvmController.provisioner.image.pullPolicy` | Image pull policy for csi-provisioner | `IfNotPresent` | +| `lvmController.provisioner.image.tag` | Image tag for csi-provisioner | `v3.5.0` | +| `lvmController.updateStrategy.type` | Update strategy for lvm localpv controller statefulset | `RollingUpdate` | +| `lvmController.annotations` | Annotations for lvm localpv controller statefulset metadata | `""` | +| `lvmController.podAnnotations` | Annotations for lvm localpv controller statefulset's pods metadata | `""` | +| `lvmController.resources` | Resource and request and limit for lvm localpv controller statefulset containers | `""` | +| `lvmController.labels` | Labels for lvm localpv controller statefulset metadata | `""` | +| `lvmController.podLabels` | Appends labels to the lvm localpv controller statefulset pods | `""` | +| `lvmController.nodeSelector` | Nodeselector for lvm localpv controller statefulset pods | `""` | +| `lvmController.tolerations` | lvm localpv controller statefulset's pod toleration values | `""` | +| `lvmController.securityContext` | Seurity context for lvm localpv controller statefulset container | `""` | +| `rbac.pspEnabled` | Enable PodSecurityPolicy | `false` | +| `serviceAccount.lvmNode.create` | Create a service account for lvmnode or not | `true` | +| `serviceAccount.lvmNode.name` | Name for the lvmnode service account | `openebs-lvm-node-sa` | +| `serviceAccount.lvmController.create` | Create a service account for lvm localpv controller or not | `true` | +| `serviceAccount.lvmController.name` | Name for the lvm localpv controller service account | `openebs-lvm-controller-sa` | +| `analytics.enabled` | Enable or Disable google analytics for the controller | `true` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. diff --git a/charts/kubezero-storage/charts/lvm-localpv/templates/lvm-controller.yaml b/charts/kubezero-storage/charts/lvm-localpv/templates/lvm-controller.yaml index 928a368..a48e3d2 100644 --- a/charts/kubezero-storage/charts/lvm-localpv/templates/lvm-controller.yaml +++ b/charts/kubezero-storage/charts/lvm-localpv/templates/lvm-controller.yaml @@ -37,7 +37,7 @@ spec: {{- if .Values.lvmController.priorityClass.create }} priorityClassName: {{ template "lvmlocalpv.lvmController.priorityClassName" . }} {{- end }} - serviceAccount: {{ .Values.serviceAccount.lvmController.name }} + serviceAccountName: {{ .Values.serviceAccount.lvmController.name }} containers: - name: {{ .Values.lvmController.resizer.name }} image: "{{ .Values.lvmController.resizer.image.registry }}{{ .Values.lvmController.resizer.image.repository }}:{{ .Values.lvmController.resizer.image.tag }}" @@ -121,6 +121,8 @@ spec: args : - "--endpoint=$(OPENEBS_CSI_ENDPOINT)" - "--plugin=$(OPENEBS_CONTROLLER_DRIVER)" + - "--kube-api-qps={{ .Values.lvmController.kubeClientRateLimiter.qps }}" + - "--kube-api-burst={{ .Values.lvmController.kubeClientRateLimiter.burst }}" volumeMounts: - name: socket-dir mountPath: /var/lib/csi/sockets/pluginproxy/ diff --git a/charts/kubezero-storage/charts/lvm-localpv/templates/lvm-node.yaml b/charts/kubezero-storage/charts/lvm-localpv/templates/lvm-node.yaml index 3d072b8..13e6b19 100644 --- a/charts/kubezero-storage/charts/lvm-localpv/templates/lvm-node.yaml +++ b/charts/kubezero-storage/charts/lvm-localpv/templates/lvm-node.yaml @@ -29,7 +29,7 @@ spec: {{- if .Values.lvmNode.priorityClass.create }} priorityClassName: {{ template "lvmlocalpv.lvmNode.priorityClassName" . }} {{- end }} - serviceAccount: {{ .Values.serviceAccount.lvmNode.name }} + serviceAccountName: {{ .Values.serviceAccount.lvmNode.name }} hostNetwork: true containers: - name: {{ .Values.lvmNode.driverRegistrar.name }} @@ -71,6 +71,8 @@ spec: - "--nodeid=$(OPENEBS_NODE_ID)" - "--endpoint=$(OPENEBS_CSI_ENDPOINT)" - "--plugin=$(OPENEBS_NODE_DRIVER)" + - "--kube-api-qps={{ .Values.lvmNode.kubeClientRateLimiter.qps }}" + - "--kube-api-burst={{ .Values.lvmNode.kubeClientRateLimiter.burst }}" {{- if .Values.lvmPlugin.ioLimits.enabled }} - "--setiolimits" - "--container-runtime=$(CONTAINER_RUNTIME)" diff --git a/charts/kubezero-storage/charts/lvm-localpv/templates/rbac.yaml b/charts/kubezero-storage/charts/lvm-localpv/templates/rbac.yaml index 5f54948..2d87a9d 100644 --- a/charts/kubezero-storage/charts/lvm-localpv/templates/rbac.yaml +++ b/charts/kubezero-storage/charts/lvm-localpv/templates/rbac.yaml @@ -93,10 +93,10 @@ rules: verbs: ["get", "list", "watch"] - apiGroups: ["snapshot.storage.k8s.io"] resources: ["volumesnapshotcontents"] - verbs: ["create", "get", "list", "watch", "update", "delete"] + verbs: ["create", "get", "list", "watch", "update", "delete", "patch"] - apiGroups: ["snapshot.storage.k8s.io"] resources: ["volumesnapshots"] - verbs: ["get", "list", "watch", "update"] + verbs: ["get", "list", "watch", "update", "patch"] - apiGroups: ["snapshot.storage.k8s.io"] resources: ["volumesnapshotcontents/status"] verbs: ["update"] diff --git a/charts/kubezero-storage/charts/lvm-localpv/templates/volumesnapshotclasses-crd.yaml b/charts/kubezero-storage/charts/lvm-localpv/templates/volumesnapshotclasses-crd.yaml new file mode 100644 index 0000000..5c89653 --- /dev/null +++ b/charts/kubezero-storage/charts/lvm-localpv/templates/volumesnapshotclasses-crd.yaml @@ -0,0 +1,136 @@ +{{- if .Values.crd.volumeSnapshot }} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.11.3 + api-approved.kubernetes.io: "https://github.com/kubernetes-csi/external-snapshotter/pull/814" + creationTimestamp: null + name: volumesnapshotclasses.snapshot.storage.k8s.io +spec: + group: snapshot.storage.k8s.io + names: + kind: VolumeSnapshotClass + listKind: VolumeSnapshotClassList + plural: volumesnapshotclasses + shortNames: + - vsclass + - vsclasses + singular: volumesnapshotclass + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .driver + name: Driver + type: string + - description: Determines whether a VolumeSnapshotContent created through the + VolumeSnapshotClass should be deleted when its bound VolumeSnapshot is deleted. + jsonPath: .deletionPolicy + name: DeletionPolicy + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: VolumeSnapshotClass specifies parameters that a underlying storage + system uses when creating a volume snapshot. A specific VolumeSnapshotClass + is used by specifying its name in a VolumeSnapshot object. VolumeSnapshotClasses + are non-namespaced + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + deletionPolicy: + description: deletionPolicy determines whether a VolumeSnapshotContent + created through the VolumeSnapshotClass should be deleted when its bound + VolumeSnapshot is deleted. Supported values are "Retain" and "Delete". + "Retain" means that the VolumeSnapshotContent and its physical snapshot + on underlying storage system are kept. "Delete" means that the VolumeSnapshotContent + and its physical snapshot on underlying storage system are deleted. + Required. + enum: + - Delete + - Retain + type: string + driver: + description: driver is the name of the storage driver that handles this + VolumeSnapshotClass. Required. + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + parameters: + additionalProperties: + type: string + description: parameters is a key-value map with storage driver specific + parameters for creating snapshots. These values are opaque to Kubernetes. + type: object + required: + - deletionPolicy + - driver + type: object + served: true + storage: true + subresources: {} + - additionalPrinterColumns: + - jsonPath: .driver + name: Driver + type: string + - description: Determines whether a VolumeSnapshotContent created through the VolumeSnapshotClass should be deleted when its bound VolumeSnapshot is deleted. + jsonPath: .deletionPolicy + name: DeletionPolicy + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + # This indicates the v1beta1 version of the custom resource is deprecated. + # API requests to this version receive a warning in the server response. + deprecated: true + # This overrides the default warning returned to clients making v1beta1 API requests. + deprecationWarning: "snapshot.storage.k8s.io/v1beta1 VolumeSnapshotClass is deprecated; use snapshot.storage.k8s.io/v1 VolumeSnapshotClass" + schema: + openAPIV3Schema: + description: VolumeSnapshotClass specifies parameters that a underlying storage system uses when creating a volume snapshot. A specific VolumeSnapshotClass is used by specifying its name in a VolumeSnapshot object. VolumeSnapshotClasses are non-namespaced + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + deletionPolicy: + description: deletionPolicy determines whether a VolumeSnapshotContent created through the VolumeSnapshotClass should be deleted when its bound VolumeSnapshot is deleted. Supported values are "Retain" and "Delete". "Retain" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are kept. "Delete" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are deleted. Required. + enum: + - Delete + - Retain + type: string + driver: + description: driver is the name of the storage driver that handles this VolumeSnapshotClass. Required. + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + parameters: + additionalProperties: + type: string + description: parameters is a key-value map with storage driver specific parameters for creating snapshots. These values are opaque to Kubernetes. + type: object + required: + - deletionPolicy + - driver + type: object + served: false + storage: false + subresources: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +{{- end }} diff --git a/charts/kubezero-storage/charts/lvm-localpv/templates/volumesnapshotcontents-crd.yaml b/charts/kubezero-storage/charts/lvm-localpv/templates/volumesnapshotcontents-crd.yaml new file mode 100644 index 0000000..7c4ec07 --- /dev/null +++ b/charts/kubezero-storage/charts/lvm-localpv/templates/volumesnapshotcontents-crd.yaml @@ -0,0 +1,403 @@ +{{- if .Values.crd.volumeSnapshot }} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.11.3 + api-approved.kubernetes.io: "https://github.com/kubernetes-csi/external-snapshotter/pull/814" + creationTimestamp: null + name: volumesnapshotcontents.snapshot.storage.k8s.io +spec: + group: snapshot.storage.k8s.io + names: + kind: VolumeSnapshotContent + listKind: VolumeSnapshotContentList + plural: volumesnapshotcontents + shortNames: + - vsc + - vscs + singular: volumesnapshotcontent + scope: Cluster + versions: + - additionalPrinterColumns: + - description: Indicates if the snapshot is ready to be used to restore a volume. + jsonPath: .status.readyToUse + name: ReadyToUse + type: boolean + - description: Represents the complete size of the snapshot in bytes + jsonPath: .status.restoreSize + name: RestoreSize + type: integer + - description: Determines whether this VolumeSnapshotContent and its physical + snapshot on the underlying storage system should be deleted when its bound + VolumeSnapshot is deleted. + jsonPath: .spec.deletionPolicy + name: DeletionPolicy + type: string + - description: Name of the CSI driver used to create the physical snapshot on + the underlying storage system. + jsonPath: .spec.driver + name: Driver + type: string + - description: Name of the VolumeSnapshotClass to which this snapshot belongs. + jsonPath: .spec.volumeSnapshotClassName + name: VolumeSnapshotClass + type: string + - description: Name of the VolumeSnapshot object to which this VolumeSnapshotContent + object is bound. + jsonPath: .spec.volumeSnapshotRef.name + name: VolumeSnapshot + type: string + - description: Namespace of the VolumeSnapshot object to which this VolumeSnapshotContent object is bound. + jsonPath: .spec.volumeSnapshotRef.namespace + name: VolumeSnapshotNamespace + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: VolumeSnapshotContent represents the actual "on-disk" snapshot + object in the underlying storage system + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + spec: + description: spec defines properties of a VolumeSnapshotContent created + by the underlying storage system. Required. + properties: + deletionPolicy: + description: deletionPolicy determines whether this VolumeSnapshotContent + and its physical snapshot on the underlying storage system should + be deleted when its bound VolumeSnapshot is deleted. Supported values + are "Retain" and "Delete". "Retain" means that the VolumeSnapshotContent + and its physical snapshot on underlying storage system are kept. + "Delete" means that the VolumeSnapshotContent and its physical snapshot + on underlying storage system are deleted. For dynamically provisioned + snapshots, this field will automatically be filled in by the CSI + snapshotter sidecar with the "DeletionPolicy" field defined in the + corresponding VolumeSnapshotClass. For pre-existing snapshots, users + MUST specify this field when creating the VolumeSnapshotContent + object. Required. + enum: + - Delete + - Retain + type: string + driver: + description: driver is the name of the CSI driver used to create the + physical snapshot on the underlying storage system. This MUST be + the same as the name returned by the CSI GetPluginName() call for + that driver. Required. + type: string + source: + description: source specifies whether the snapshot is (or should be) + dynamically provisioned or already exists, and just requires a Kubernetes + object representation. This field is immutable after creation. Required. + properties: + snapshotHandle: + description: snapshotHandle specifies the CSI "snapshot_id" of + a pre-existing snapshot on the underlying storage system for + which a Kubernetes object representation was (or should be) + created. This field is immutable. + type: string + volumeHandle: + description: volumeHandle specifies the CSI "volume_id" of the + volume from which a snapshot should be dynamically taken from. + This field is immutable. + type: string + type: object + oneOf: + - required: [ "snapshotHandle" ] + - required: [ "volumeHandle" ] + sourceVolumeMode: + description: SourceVolumeMode is the mode of the volume whose snapshot + is taken. Can be either “Filesystem” or “Block”. If not specified, + it indicates the source volume's mode is unknown. This field is + immutable. This field is an alpha field. + type: string + volumeSnapshotClassName: + description: name of the VolumeSnapshotClass from which this snapshot + was (or will be) created. Note that after provisioning, the VolumeSnapshotClass + may be deleted or recreated with different set of values, and as + such, should not be referenced post-snapshot creation. + type: string + volumeSnapshotRef: + description: volumeSnapshotRef specifies the VolumeSnapshot object + to which this VolumeSnapshotContent object is bound. VolumeSnapshot.Spec.VolumeSnapshotContentName + field must reference to this VolumeSnapshotContent's name for the + bidirectional binding to be valid. For a pre-existing VolumeSnapshotContent + object, name and namespace of the VolumeSnapshot object MUST be + provided for binding to happen. This field is immutable after creation. + Required. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead of + an entire object, this string should contain a valid JSON/Go + field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within + a pod, this would take on a value like: "spec.containers{name}" + (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" + (container with index 2 in this pod). This syntax is chosen + only to have some well-defined way of referencing a part of + an object. TODO: this design is not final and this field is + subject to change in the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference + is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + x-kubernetes-map-type: atomic + required: + - deletionPolicy + - driver + - source + - volumeSnapshotRef + type: object + status: + description: status represents the current information of a snapshot. + properties: + creationTime: + description: creationTime is the timestamp when the point-in-time + snapshot is taken by the underlying storage system. In dynamic snapshot + creation case, this field will be filled in by the CSI snapshotter + sidecar with the "creation_time" value returned from CSI "CreateSnapshot" + gRPC call. For a pre-existing snapshot, this field will be filled + with the "creation_time" value returned from the CSI "ListSnapshots" + gRPC call if the driver supports it. If not specified, it indicates + the creation time is unknown. The format of this field is a Unix + nanoseconds time encoded as an int64. On Unix, the command `date + +%s%N` returns the current time in nanoseconds since 1970-01-01 + 00:00:00 UTC. + format: int64 + type: integer + error: + description: error is the last observed error during snapshot creation, + if any. Upon success after retry, this error field will be cleared. + properties: + message: + description: 'message is a string detailing the encountered error + during snapshot creation if specified. NOTE: message may be + logged, and it should not contain sensitive information.' + type: string + time: + description: time is the timestamp when the error was encountered. + format: date-time + type: string + type: object + readyToUse: + description: readyToUse indicates if a snapshot is ready to be used + to restore a volume. In dynamic snapshot creation case, this field + will be filled in by the CSI snapshotter sidecar with the "ready_to_use" + value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing + snapshot, this field will be filled with the "ready_to_use" value + returned from the CSI "ListSnapshots" gRPC call if the driver supports + it, otherwise, this field will be set to "True". If not specified, + it means the readiness of a snapshot is unknown. + type: boolean + restoreSize: + description: restoreSize represents the complete size of the snapshot + in bytes. In dynamic snapshot creation case, this field will be + filled in by the CSI snapshotter sidecar with the "size_bytes" value + returned from CSI "CreateSnapshot" gRPC call. For a pre-existing + snapshot, this field will be filled with the "size_bytes" value + returned from the CSI "ListSnapshots" gRPC call if the driver supports + it. When restoring a volume from this snapshot, the size of the + volume MUST NOT be smaller than the restoreSize if it is specified, + otherwise the restoration will fail. If not specified, it indicates + that the size is unknown. + format: int64 + minimum: 0 + type: integer + snapshotHandle: + description: snapshotHandle is the CSI "snapshot_id" of a snapshot + on the underlying storage system. If not specified, it indicates + that dynamic snapshot creation has either failed or it is still + in progress. + type: string + volumeGroupSnapshotContentName: + description: VolumeGroupSnapshotContentName is the name of the VolumeGroupSnapshotContent + of which this VolumeSnapshotContent is a part of. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: { } + - additionalPrinterColumns: + - description: Indicates if the snapshot is ready to be used to restore a volume. + jsonPath: .status.readyToUse + name: ReadyToUse + type: boolean + - description: Represents the complete size of the snapshot in bytes + jsonPath: .status.restoreSize + name: RestoreSize + type: integer + - description: Determines whether this VolumeSnapshotContent and its physical snapshot on the underlying storage system should be deleted when its bound VolumeSnapshot is deleted. + jsonPath: .spec.deletionPolicy + name: DeletionPolicy + type: string + - description: Name of the CSI driver used to create the physical snapshot on the underlying storage system. + jsonPath: .spec.driver + name: Driver + type: string + - description: Name of the VolumeSnapshotClass to which this snapshot belongs. + jsonPath: .spec.volumeSnapshotClassName + name: VolumeSnapshotClass + type: string + - description: Name of the VolumeSnapshot object to which this VolumeSnapshotContent object is bound. + jsonPath: .spec.volumeSnapshotRef.name + name: VolumeSnapshot + type: string + - description: Namespace of the VolumeSnapshot object to which this VolumeSnapshotContent object is bound. + jsonPath: .spec.volumeSnapshotRef.namespace + name: VolumeSnapshotNamespace + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + # This indicates the v1beta1 version of the custom resource is deprecated. + # API requests to this version receive a warning in the server response. + deprecated: true + # This overrides the default warning returned to clients making v1beta1 API requests. + deprecationWarning: "snapshot.storage.k8s.io/v1beta1 VolumeSnapshotContent is deprecated; use snapshot.storage.k8s.io/v1 VolumeSnapshotContent" + schema: + openAPIV3Schema: + description: VolumeSnapshotContent represents the actual "on-disk" snapshot object in the underlying storage system + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + spec: + description: spec defines properties of a VolumeSnapshotContent created by the underlying storage system. Required. + properties: + deletionPolicy: + description: deletionPolicy determines whether this VolumeSnapshotContent and its physical snapshot on the underlying storage system should be deleted when its bound VolumeSnapshot is deleted. Supported values are "Retain" and "Delete". "Retain" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are kept. "Delete" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are deleted. For dynamically provisioned snapshots, this field will automatically be filled in by the CSI snapshotter sidecar with the "DeletionPolicy" field defined in the corresponding VolumeSnapshotClass. For pre-existing snapshots, users MUST specify this field when creating the VolumeSnapshotContent object. Required. + enum: + - Delete + - Retain + type: string + driver: + description: driver is the name of the CSI driver used to create the physical snapshot on the underlying storage system. This MUST be the same as the name returned by the CSI GetPluginName() call for that driver. Required. + type: string + source: + description: source specifies whether the snapshot is (or should be) dynamically provisioned or already exists, and just requires a Kubernetes object representation. This field is immutable after creation. Required. + properties: + snapshotHandle: + description: snapshotHandle specifies the CSI "snapshot_id" of a pre-existing snapshot on the underlying storage system for which a Kubernetes object representation was (or should be) created. This field is immutable. + type: string + volumeHandle: + description: volumeHandle specifies the CSI "volume_id" of the volume from which a snapshot should be dynamically taken from. This field is immutable. + type: string + type: object + volumeSnapshotClassName: + description: name of the VolumeSnapshotClass from which this snapshot was (or will be) created. Note that after provisioning, the VolumeSnapshotClass may be deleted or recreated with different set of values, and as such, should not be referenced post-snapshot creation. + type: string + volumeSnapshotRef: + description: volumeSnapshotRef specifies the VolumeSnapshot object to which this VolumeSnapshotContent object is bound. VolumeSnapshot.Spec.VolumeSnapshotContentName field must reference to this VolumeSnapshotContent's name for the bidirectional binding to be valid. For a pre-existing VolumeSnapshotContent object, name and namespace of the VolumeSnapshot object MUST be provided for binding to happen. This field is immutable after creation. Required. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. TODO: this design is not final and this field is subject to change in the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + required: + - deletionPolicy + - driver + - source + - volumeSnapshotRef + type: object + status: + description: status represents the current information of a snapshot. + properties: + creationTime: + description: creationTime is the timestamp when the point-in-time snapshot is taken by the underlying storage system. In dynamic snapshot creation case, this field will be filled in by the CSI snapshotter sidecar with the "creation_time" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "creation_time" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it. If not specified, it indicates the creation time is unknown. The format of this field is a Unix nanoseconds time encoded as an int64. On Unix, the command `date +%s%N` returns the current time in nanoseconds since 1970-01-01 00:00:00 UTC. + format: int64 + type: integer + error: + description: error is the last observed error during snapshot creation, if any. Upon success after retry, this error field will be cleared. + properties: + message: + description: 'message is a string detailing the encountered error during snapshot creation if specified. NOTE: message may be logged, and it should not contain sensitive information.' + type: string + time: + description: time is the timestamp when the error was encountered. + format: date-time + type: string + type: object + readyToUse: + description: readyToUse indicates if a snapshot is ready to be used to restore a volume. In dynamic snapshot creation case, this field will be filled in by the CSI snapshotter sidecar with the "ready_to_use" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "ready_to_use" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it, otherwise, this field will be set to "True". If not specified, it means the readiness of a snapshot is unknown. + type: boolean + restoreSize: + description: restoreSize represents the complete size of the snapshot in bytes. In dynamic snapshot creation case, this field will be filled in by the CSI snapshotter sidecar with the "size_bytes" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "size_bytes" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it. When restoring a volume from this snapshot, the size of the volume MUST NOT be smaller than the restoreSize if it is specified, otherwise the restoration will fail. If not specified, it indicates that the size is unknown. + format: int64 + minimum: 0 + type: integer + snapshotHandle: + description: snapshotHandle is the CSI "snapshot_id" of a snapshot on the underlying storage system. If not specified, it indicates that dynamic snapshot creation has either failed or it is still in progress. + type: string + type: object + required: + - spec + type: object + served: false + storage: false + subresources: + status: { } +status: + acceptedNames: + kind: "" + plural: "" + conditions: [ ] + storedVersions: [ ] +{{- end }} diff --git a/charts/kubezero-storage/charts/lvm-localpv/templates/volumesnapshots-crd.yaml b/charts/kubezero-storage/charts/lvm-localpv/templates/volumesnapshots-crd.yaml new file mode 100644 index 0000000..b303fa9 --- /dev/null +++ b/charts/kubezero-storage/charts/lvm-localpv/templates/volumesnapshots-crd.yaml @@ -0,0 +1,314 @@ +{{- if .Values.crd.volumeSnapshot }} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.11.3 + api-approved.kubernetes.io: "https://github.com/kubernetes-csi/external-snapshotter/pull/814" + creationTimestamp: null + name: volumesnapshots.snapshot.storage.k8s.io +spec: + group: snapshot.storage.k8s.io + names: + kind: VolumeSnapshot + listKind: VolumeSnapshotList + plural: volumesnapshots + shortNames: + - vs + singular: volumesnapshot + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Indicates if the snapshot is ready to be used to restore a volume. + jsonPath: .status.readyToUse + name: ReadyToUse + type: boolean + - description: If a new snapshot needs to be created, this contains the name of + the source PVC from which this snapshot was (or will be) created. + jsonPath: .spec.source.persistentVolumeClaimName + name: SourcePVC + type: string + - description: If a snapshot already exists, this contains the name of the existing + VolumeSnapshotContent object representing the existing snapshot. + jsonPath: .spec.source.volumeSnapshotContentName + name: SourceSnapshotContent + type: string + - description: Represents the minimum size of volume required to rehydrate from + this snapshot. + jsonPath: .status.restoreSize + name: RestoreSize + type: string + - description: The name of the VolumeSnapshotClass requested by the VolumeSnapshot. + jsonPath: .spec.volumeSnapshotClassName + name: SnapshotClass + type: string + - description: Name of the VolumeSnapshotContent object to which the VolumeSnapshot + object intends to bind to. Please note that verification of binding actually + requires checking both VolumeSnapshot and VolumeSnapshotContent to ensure + both are pointing at each other. Binding MUST be verified prior to usage of + this object. + jsonPath: .status.boundVolumeSnapshotContentName + name: SnapshotContent + type: string + - description: Timestamp when the point-in-time snapshot was taken by the underlying + storage system. + jsonPath: .status.creationTime + name: CreationTime + type: date + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: VolumeSnapshot is a user's request for either creating a point-in-time + snapshot of a persistent volume, or binding to a pre-existing snapshot. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + spec: + description: 'spec defines the desired characteristics of a snapshot requested + by a user. More info: https://kubernetes.io/docs/concepts/storage/volume-snapshots#volumesnapshots + Required.' + properties: + source: + description: source specifies where a snapshot will be created from. + This field is immutable after creation. Required. + properties: + persistentVolumeClaimName: + description: persistentVolumeClaimName specifies the name of the + PersistentVolumeClaim object representing the volume from which + a snapshot should be created. This PVC is assumed to be in the + same namespace as the VolumeSnapshot object. This field should + be set if the snapshot does not exists, and needs to be created. + This field is immutable. + type: string + volumeSnapshotContentName: + description: volumeSnapshotContentName specifies the name of a + pre-existing VolumeSnapshotContent object representing an existing + volume snapshot. This field should be set if the snapshot already + exists and only needs a representation in Kubernetes. This field + is immutable. + type: string + type: object + oneOf: + - required: ["persistentVolumeClaimName"] + - required: ["volumeSnapshotContentName"] + volumeSnapshotClassName: + description: 'VolumeSnapshotClassName is the name of the VolumeSnapshotClass + requested by the VolumeSnapshot. VolumeSnapshotClassName may be + left nil to indicate that the default SnapshotClass should be used. + A given cluster may have multiple default Volume SnapshotClasses: + one default per CSI Driver. If a VolumeSnapshot does not specify + a SnapshotClass, VolumeSnapshotSource will be checked to figure + out what the associated CSI Driver is, and the default VolumeSnapshotClass + associated with that CSI Driver will be used. If more than one VolumeSnapshotClass + exist for a given CSI Driver and more than one have been marked + as default, CreateSnapshot will fail and generate an event. Empty + string is not allowed for this field.' + type: string + required: + - source + type: object + status: + description: status represents the current information of a snapshot. + Consumers must verify binding between VolumeSnapshot and VolumeSnapshotContent + objects is successful (by validating that both VolumeSnapshot and VolumeSnapshotContent + point at each other) before using this object. + properties: + boundVolumeSnapshotContentName: + description: 'boundVolumeSnapshotContentName is the name of the VolumeSnapshotContent + object to which this VolumeSnapshot object intends to bind to. If + not specified, it indicates that the VolumeSnapshot object has not + been successfully bound to a VolumeSnapshotContent object yet. NOTE: + To avoid possible security issues, consumers must verify binding + between VolumeSnapshot and VolumeSnapshotContent objects is successful + (by validating that both VolumeSnapshot and VolumeSnapshotContent + point at each other) before using this object.' + type: string + creationTime: + description: creationTime is the timestamp when the point-in-time + snapshot is taken by the underlying storage system. In dynamic snapshot + creation case, this field will be filled in by the snapshot controller + with the "creation_time" value returned from CSI "CreateSnapshot" + gRPC call. For a pre-existing snapshot, this field will be filled + with the "creation_time" value returned from the CSI "ListSnapshots" + gRPC call if the driver supports it. If not specified, it may indicate + that the creation time of the snapshot is unknown. + format: date-time + type: string + error: + description: error is the last observed error during snapshot creation, + if any. This field could be helpful to upper level controllers(i.e., + application controller) to decide whether they should continue on + waiting for the snapshot to be created based on the type of error + reported. The snapshot controller will keep retrying when an error + occurs during the snapshot creation. Upon success, this error field + will be cleared. + properties: + message: + description: 'message is a string detailing the encountered error + during snapshot creation if specified. NOTE: message may be + logged, and it should not contain sensitive information.' + type: string + time: + description: time is the timestamp when the error was encountered. + format: date-time + type: string + type: object + readyToUse: + description: readyToUse indicates if the snapshot is ready to be used + to restore a volume. In dynamic snapshot creation case, this field + will be filled in by the snapshot controller with the "ready_to_use" + value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing + snapshot, this field will be filled with the "ready_to_use" value + returned from the CSI "ListSnapshots" gRPC call if the driver supports + it, otherwise, this field will be set to "True". If not specified, + it means the readiness of a snapshot is unknown. + type: boolean + restoreSize: + type: string + description: restoreSize represents the minimum size of volume required + to create a volume from this snapshot. In dynamic snapshot creation + case, this field will be filled in by the snapshot controller with + the "size_bytes" value returned from CSI "CreateSnapshot" gRPC call. + For a pre-existing snapshot, this field will be filled with the + "size_bytes" value returned from the CSI "ListSnapshots" gRPC call + if the driver supports it. When restoring a volume from this snapshot, + the size of the volume MUST NOT be smaller than the restoreSize + if it is specified, otherwise the restoration will fail. If not + specified, it indicates that the size is unknown. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + volumeGroupSnapshotName: + description: VolumeGroupSnapshotName is the name of the VolumeGroupSnapshot + of which this VolumeSnapshot is a part of. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: Indicates if the snapshot is ready to be used to restore a volume. + jsonPath: .status.readyToUse + name: ReadyToUse + type: boolean + - description: If a new snapshot needs to be created, this contains the name of the source PVC from which this snapshot was (or will be) created. + jsonPath: .spec.source.persistentVolumeClaimName + name: SourcePVC + type: string + - description: If a snapshot already exists, this contains the name of the existing VolumeSnapshotContent object representing the existing snapshot. + jsonPath: .spec.source.volumeSnapshotContentName + name: SourceSnapshotContent + type: string + - description: Represents the minimum size of volume required to rehydrate from this snapshot. + jsonPath: .status.restoreSize + name: RestoreSize + type: string + - description: The name of the VolumeSnapshotClass requested by the VolumeSnapshot. + jsonPath: .spec.volumeSnapshotClassName + name: SnapshotClass + type: string + - description: Name of the VolumeSnapshotContent object to which the VolumeSnapshot object intends to bind to. Please note that verification of binding actually requires checking both VolumeSnapshot and VolumeSnapshotContent to ensure both are pointing at each other. Binding MUST be verified prior to usage of this object. + jsonPath: .status.boundVolumeSnapshotContentName + name: SnapshotContent + type: string + - description: Timestamp when the point-in-time snapshot was taken by the underlying storage system. + jsonPath: .status.creationTime + name: CreationTime + type: date + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + # This indicates the v1beta1 version of the custom resource is deprecated. + # API requests to this version receive a warning in the server response. + deprecated: true + # This overrides the default warning returned to clients making v1beta1 API requests. + deprecationWarning: "snapshot.storage.k8s.io/v1beta1 VolumeSnapshot is deprecated; use snapshot.storage.k8s.io/v1 VolumeSnapshot" + schema: + openAPIV3Schema: + description: VolumeSnapshot is a user's request for either creating a point-in-time snapshot of a persistent volume, or binding to a pre-existing snapshot. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + spec: + description: 'spec defines the desired characteristics of a snapshot requested by a user. More info: https://kubernetes.io/docs/concepts/storage/volume-snapshots#volumesnapshots Required.' + properties: + source: + description: source specifies where a snapshot will be created from. This field is immutable after creation. Required. + properties: + persistentVolumeClaimName: + description: persistentVolumeClaimName specifies the name of the PersistentVolumeClaim object representing the volume from which a snapshot should be created. This PVC is assumed to be in the same namespace as the VolumeSnapshot object. This field should be set if the snapshot does not exists, and needs to be created. This field is immutable. + type: string + volumeSnapshotContentName: + description: volumeSnapshotContentName specifies the name of a pre-existing VolumeSnapshotContent object representing an existing volume snapshot. This field should be set if the snapshot already exists and only needs a representation in Kubernetes. This field is immutable. + type: string + type: object + volumeSnapshotClassName: + description: 'VolumeSnapshotClassName is the name of the VolumeSnapshotClass requested by the VolumeSnapshot. VolumeSnapshotClassName may be left nil to indicate that the default SnapshotClass should be used. A given cluster may have multiple default Volume SnapshotClasses: one default per CSI Driver. If a VolumeSnapshot does not specify a SnapshotClass, VolumeSnapshotSource will be checked to figure out what the associated CSI Driver is, and the default VolumeSnapshotClass associated with that CSI Driver will be used. If more than one VolumeSnapshotClass exist for a given CSI Driver and more than one have been marked as default, CreateSnapshot will fail and generate an event. Empty string is not allowed for this field.' + type: string + required: + - source + type: object + status: + description: status represents the current information of a snapshot. Consumers must verify binding between VolumeSnapshot and VolumeSnapshotContent objects is successful (by validating that both VolumeSnapshot and VolumeSnapshotContent point at each other) before using this object. + properties: + boundVolumeSnapshotContentName: + description: 'boundVolumeSnapshotContentName is the name of the VolumeSnapshotContent object to which this VolumeSnapshot object intends to bind to. If not specified, it indicates that the VolumeSnapshot object has not been successfully bound to a VolumeSnapshotContent object yet. NOTE: To avoid possible security issues, consumers must verify binding between VolumeSnapshot and VolumeSnapshotContent objects is successful (by validating that both VolumeSnapshot and VolumeSnapshotContent point at each other) before using this object.' + type: string + creationTime: + description: creationTime is the timestamp when the point-in-time snapshot is taken by the underlying storage system. In dynamic snapshot creation case, this field will be filled in by the snapshot controller with the "creation_time" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "creation_time" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it. If not specified, it may indicate that the creation time of the snapshot is unknown. + format: date-time + type: string + error: + description: error is the last observed error during snapshot creation, if any. This field could be helpful to upper level controllers(i.e., application controller) to decide whether they should continue on waiting for the snapshot to be created based on the type of error reported. The snapshot controller will keep retrying when an error occurs during the snapshot creation. Upon success, this error field will be cleared. + properties: + message: + description: 'message is a string detailing the encountered error during snapshot creation if specified. NOTE: message may be logged, and it should not contain sensitive information.' + type: string + time: + description: time is the timestamp when the error was encountered. + format: date-time + type: string + type: object + readyToUse: + description: readyToUse indicates if the snapshot is ready to be used to restore a volume. In dynamic snapshot creation case, this field will be filled in by the snapshot controller with the "ready_to_use" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "ready_to_use" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it, otherwise, this field will be set to "True". If not specified, it means the readiness of a snapshot is unknown. + type: boolean + restoreSize: + type: string + description: restoreSize represents the minimum size of volume required to create a volume from this snapshot. In dynamic snapshot creation case, this field will be filled in by the snapshot controller with the "size_bytes" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "size_bytes" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it. When restoring a volume from this snapshot, the size of the volume MUST NOT be smaller than the restoreSize if it is specified, otherwise the restoration will fail. If not specified, it indicates that the size is unknown. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + required: + - spec + type: object + served: false + storage: false + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +{{- end }} diff --git a/charts/kubezero-storage/charts/lvm-localpv/values.yaml b/charts/kubezero-storage/charts/lvm-localpv/values.yaml index 04461db..93e0874 100644 --- a/charts/kubezero-storage/charts/lvm-localpv/values.yaml +++ b/charts/kubezero-storage/charts/lvm-localpv/values.yaml @@ -2,7 +2,7 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. release: - version: "1.0.0" + version: "1.2.0" imagePullSecrets: # - name: "image-pull-secret" @@ -23,12 +23,12 @@ lvmNode: name: "csi-node-driver-registrar" image: # Make sure that registry name end with a '/'. - # For example : k8s.gcr.io/ is a correct value here and quay.io is incorrect - registry: k8s.gcr.io/ + # For example : registry.k8s.io/ is a correct value here and quay.io is incorrect + registry: registry.k8s.io/ repository: sig-storage/csi-node-driver-registrar pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. - tag: v2.3.0 + tag: v2.8.0 updateStrategy: type: RollingUpdate annotations: {} @@ -54,6 +54,13 @@ lvmNode: create: true name: lvm-localpv-csi-node-critical logLevel: 5 + # Configure kubernetes client API requests rate. + kubeClientRateLimiter: + # Configure the number of queries per second. + qps: 0 + # Configure the maximum number of queries allowed after + # accounting for rolled over qps from previous seconds. + burst: 0 # lvmController contains the configurables for @@ -67,42 +74,42 @@ lvmController: name: "csi-resizer" image: # Make sure that registry name end with a '/'. - # For example : k8s.gcr.io/ is a correct value here and quay.io is incorrect - registry: k8s.gcr.io/ + # For example : registry.k8s.io/ is a correct value here and quay.io is incorrect + registry: registry.k8s.io/ repository: sig-storage/csi-resizer pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. - tag: v1.2.0 + tag: v1.8.0 snapshotter: name: "csi-snapshotter" image: # Make sure that registry name end with a '/'. - # For example : k8s.gcr.io/ is a correct value here and quay.io is incorrect - registry: k8s.gcr.io/ + # For example : registry.k8s.io/ is a correct value here and quay.io is incorrect + registry: registry.k8s.io/ repository: sig-storage/csi-snapshotter pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. - tag: v4.0.0 + tag: v6.2.2 snapshotController: name: "snapshot-controller" image: # Make sure that registry name end with a '/'. - # For example : k8s.gcr.io/ is a correct value here and quay.io is incorrect - registry: k8s.gcr.io/ + # For example : registry.k8s.io/ is a correct value here and quay.io is incorrect + registry: registry.k8s.io/ repository: sig-storage/snapshot-controller pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. - tag: v4.0.0 + tag: v6.2.2 provisioner: name: "csi-provisioner" image: # Make sure that registry name end with a '/'. - # For example : k8s.gcr.io/ is a correct value here and quay.io is incorrect - registry: k8s.gcr.io/ + # For example : registry.k8s.io/ is a correct value here and quay.io is incorrect + registry: registry.k8s.io/ repository: sig-storage/csi-provisioner pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. - tag: v3.0.0 + tag: v3.5.0 updateStrategy: type: RollingUpdate annotations: {} @@ -123,6 +130,13 @@ lvmController: priorityClass: create: true name: lvm-localpv-csi-controller-critical + # Configure kubernetes client API requests rate. + kubeClientRateLimiter: + # Configure the number of queries per second. + qps: 0 + # Configure the maximum number of queries allowed after + # accounting for rolled over qps from previous seconds. + burst: 0 # lvmPlugin is the common csi container used by the # controller statefulset and node daemonset @@ -130,19 +144,20 @@ lvmPlugin: name: "openebs-lvm-plugin" image: # Make sure that registry name end with a '/'. - # For example : k8s.gcr.io/ is a correct value here and quay.io is incorrect + # For example : registry.k8s.io/ is a correct value here and quay.io is incorrect registry: repository: openebs/lvm-driver pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. - tag: 1.0.0 + tag: 1.2.0 ioLimits: enabled: false containerRuntime: containerd readIopsPerGB: "" writeIopsPerGB: "" # The TCP port number used for exposing lvm-metrics. - # If not set, service will not be created to expose metrics endpoint to serviceMonitor and listen-address flag will not be set. + # If not set, service will not be created to expose metrics endpoint + # to serviceMonitor andlisten-address flag will not be set. metricsPort: 9500 # Comma seperated list of k8s worker node topologies allowedTopologies: "kubernetes.io/hostname," @@ -151,6 +166,9 @@ role: openebs-lvm crd: enableInstall: true + # Specify installation of the kubernetes-csi volume snapshot CRDs if your Kubernetes distribution + # or another storage operator already manages them. + volumeSnapshot: true serviceAccount: lvmController: diff --git a/charts/kubezero-storage/jsonnet/jsonnetfile.lock.json b/charts/kubezero-storage/jsonnet/jsonnetfile.lock.json index 56a47a0..038266d 100644 --- a/charts/kubezero-storage/jsonnet/jsonnetfile.lock.json +++ b/charts/kubezero-storage/jsonnet/jsonnetfile.lock.json @@ -18,7 +18,7 @@ "subdir": "contrib/mixin" } }, - "version": "f4f5ac93ca4c0949944753e0d8fda530ed26a404", + "version": "6186538c0cbd2b9c5e3139b78924addd43b066c0", "sum": "W/Azptf1PoqjyMwJON96UY69MFugDA4IAYiKURscryc=" }, { @@ -28,7 +28,7 @@ "subdir": "grafonnet" } }, - "version": "f0b70307b8e5f12236b277883d998af129a8211f", + "version": "a1d61cce1da59c71409b99b5c7568511fec661ea", "sum": "342u++/7rViR/zj2jeJOjshzglkZ1SY+hFNuyCBFMdc=" }, { @@ -38,8 +38,8 @@ "subdir": "grafana-builder" } }, - "version": "d680faafc0727c4c5086f1624333363e57d2ce81", - "sum": "tDR6yT2GVfw0wTU12iZH+m01HrbIr6g/xN+/8nzNkU0=" + "version": "62aec8403a5c38d5dc97ba596703753289b1c33b", + "sum": "xEFMv4+ObwP5L1Wu0XK5agWci4AJzNApys6iKAQxLlQ=" }, { "source": { @@ -58,7 +58,7 @@ "subdir": "lib/promgrafonnet" } }, - "version": "eed459199703c969afc318ea55b9361ae48180a7", + "version": "46fc905d5b2981642043088ac7902ea50db2903e", "sum": "zv7hXGui6BfHzE9wPatHI/AGZa4A2WKo6pq7ZdqBsps=" }, { @@ -98,7 +98,7 @@ "subdir": "jsonnet/kube-prometheus" } }, - "version": "fcd73c717f54a49cce69e78b9bcb709d0b4571ff", + "version": "408f3863905f0f9ba1679592fd65a4d7793e7021", "sum": "pupXEvlRbhLdEO9b8LfFZB66+Z7fEqvRZ9m3MyEvsv4=" }, { diff --git a/charts/kubezero-storage/templates/snapshot-controller/controller.yaml b/charts/kubezero-storage/templates/snapshot-controller/controller.yaml index f56f80f..7cbfd3c 100644 --- a/charts/kubezero-storage/templates/snapshot-controller/controller.yaml +++ b/charts/kubezero-storage/templates/snapshot-controller/controller.yaml @@ -46,7 +46,7 @@ spec: serviceAccountName: snapshot-controller containers: - name: snapshot-controller - image: registry.k8s.io/sig-storage/snapshot-controller:v6.2.1 + image: registry.k8s.io/sig-storage/snapshot-controller:v6.2.2 args: - "--v={{ .Values.snapshotController.logLevel }}" {{- if gt (int .Values.snapshotController.replicas) 1 }} diff --git a/charts/kubezero-storage/update.sh b/charts/kubezero-storage/update.sh index ab4387b..9e3cb44 100755 --- a/charts/kubezero-storage/update.sh +++ b/charts/kubezero-storage/update.sh @@ -14,8 +14,6 @@ rm -rf charts/aws-ebs-csi-driver/templates/tests patch_chart aws-efs-csi-driver patch_chart lvm-localpv -# move crds -mv charts/lvm-localpv/crds/volumesnapshot* crds # k8up - CRDs VERSION=$(yq eval '.dependencies[] | select(.name=="k8up") | .version' Chart.yaml) diff --git a/charts/kubezero-storage/values.yaml b/charts/kubezero-storage/values.yaml index d1028dc..c747685 100644 --- a/charts/kubezero-storage/values.yaml +++ b/charts/kubezero-storage/values.yaml @@ -98,7 +98,8 @@ aws-ebs-csi-driver: controller: replicaCount: 1 - logLevel: 2 + + loggingFormat: json defaultFsType: xfs @@ -144,6 +145,7 @@ aws-ebs-csi-driver: memory: 40Mi node: + loggingFormat: json tolerateAllTaints: false tolerations: - key: kubezero-workergroup diff --git a/charts/kubezero/templates/storage.yaml b/charts/kubezero/templates/storage.yaml index dc56f8a..2415c87 100644 --- a/charts/kubezero/templates/storage.yaml +++ b/charts/kubezero/templates/storage.yaml @@ -25,6 +25,7 @@ aws-ebs-csi-driver: controller: replicaCount: {{ ternary 2 1 .Values.global.highAvailable }} k8sTagClusterId: {{ .Values.global.clusterName }} + enableMetrics: {{ .Values.metrics.enabled }} env: - name: AWS_ROLE_ARN value: {{ index .Values "storage" "aws-ebs-csi-driver" "IamArn" | quote }} @@ -33,18 +34,21 @@ aws-ebs-csi-driver: - name: AWS_STS_REGIONAL_ENDPOINTS value: regional - {{- if .Values.global.highAvailable }} - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - ebs-csi-controller - topologyKey: "kubernetes.io/hostname" - {{- end }} + {{- if not .Values.global.highAvailable }} + sidecars: + provisioner: + leaderElection: + enabled: false + attacher: + leaderElection: + enabled: false + resizer: + leaderElection: + enabled: false + volumemodifier: + leaderElection: + enabled: false + {{- end }} aws-efs-csi-driver: enabled: {{ default false (index .Values "storage" "aws-efs-csi-driver" "enabled")}} diff --git a/charts/kubezero/values.yaml b/charts/kubezero/values.yaml index 256d046..5475646 100644 --- a/charts/kubezero/values.yaml +++ b/charts/kubezero/values.yaml @@ -42,7 +42,7 @@ cert-manager: storage: enabled: false - targetRevision: 0.8.2 + targetRevision: 0.8.3 aws-ebs-csi-driver: enabled: false aws-efs-csi-driver: diff --git a/scripts/lib-update.sh b/scripts/lib-update.sh index fa78b98..bcf66c7 100755 --- a/scripts/lib-update.sh +++ b/scripts/lib-update.sh @@ -38,7 +38,7 @@ patch_chart() { tar xfvz charts/$CHART-$VERSION.tgz -C charts && rm charts/$CHART-$VERSION.tgz # diff -tuNr charts/aws-node-termination-handler.orig charts/aws-node-termination-handler > nth.patch - [ -r $CHART.patch ] && patch -p0 -i $CHART.patch --no-backup-if-mismatch + [ -r $CHART.patch ] && patch -p0 -i $CHART.patch --no-backup-if-mismatch || true } update_docs() {