Release of 2.20 #46
12
README.md
12
README.md
|
|
@ -13,12 +13,14 @@ KubeZero is a Kubernetes distribution providing an integrated container platform
|
|||
|
||||
# Version / Support Matrix
|
||||
|
||||
| KubeZero \ Kubernetes Version | v1.18 | v1.19 | v1.20 | EOL |
|
||||
| KubeZero \ Kubernetes Version | v1.19 | v1.20 | v1.21 | EOL |
|
||||
|----------------------------------------|-------|-------|-------|-------------|
|
||||
| master branch | yes | yes | beta | |
|
||||
| stable branch | yes | yes | no | |
|
||||
| v2.19.0 | yes | yes | no | 30 Jun 2021 |
|
||||
| v2.18.0 | yes | no | no | 30 Apr 2021 |
|
||||
| master branch | no | yes | alpha | |
|
||||
| stable branch | yes | no | no | |
|
||||
| v2.20.0 | no | yes | no | 30 Aug 2021 |
|
||||
| v2.19.0 | yes | no | no | 30 Aug 2021 |
|
||||
|
||||
[Upstream release policy](https://kubernetes.io/releases/)
|
||||
|
||||
# Architecure
|
||||
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
*.sh
|
||||
*.md
|
||||
*.md.gotmpl
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@ apiVersion: v2
|
|||
name: kubeadm
|
||||
description: KubeZero Kubeadm golden config
|
||||
type: application
|
||||
version: 1.20.0
|
||||
version: 1.20.8
|
||||
home: https://kubezero.com
|
||||
icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
|
||||
keywords:
|
||||
|
|
|
|||
|
|
@ -35,3 +35,7 @@ Installs the Istio control plane
|
|||
- https://godoc.org/k8s.io/kube-proxy/config/v1alpha1#KubeProxyConfiguration
|
||||
|
||||
- https://github.com/awslabs/amazon-eks-ami
|
||||
|
||||
### Etcd
|
||||
- https://itnext.io/breaking-down-and-fixing-etcd-cluster-d81e35b9260d
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/bash
|
||||
|
||||
echo "Minor uppgrade from 1.19!"
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/bash
|
||||
|
||||
echo "Patch upgrade within 1.20"
|
||||
|
|
@ -2,40 +2,54 @@ apiVersion: kubeadm.k8s.io/v1beta2
|
|||
kind: ClusterConfiguration
|
||||
metadata:
|
||||
name: kubezero-clusterconfiguration
|
||||
kubernetesVersion: {{ .Values.clusterVersion }}
|
||||
kubernetesVersion: {{ .Chart.Version }}
|
||||
clusterName: {{ .Values.clusterName }}
|
||||
controlPlaneEndpoint: {{ .Values.apiEndpoint }}
|
||||
controlPlaneEndpoint: {{ .Values.api.endpoint }}
|
||||
networking:
|
||||
podSubnet: 10.244.0.0/16
|
||||
etcd:
|
||||
local:
|
||||
extraArgs:
|
||||
### DNS discovery
|
||||
#discovery-srv: {{ .Values.domain }}
|
||||
#discovery-srv-name: {{ .Values.clusterName }}
|
||||
#initial-cluster:
|
||||
initial-cluster-token: etcd-{{ .Values.clusterName }}
|
||||
listen-metrics-urls: "http://{{ .Values.listenAddress }}:2381"
|
||||
logger: "zap"
|
||||
# log-level: "warn"
|
||||
{{- with .Values.etcdExtraArgs }}
|
||||
{{- with .Values.etcd.extraArgs }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
# These will only be used to create the etcd certs but removed for Init/Join kudeadm calls allowing us to sneak in aliases for etcd nodes
|
||||
serverCertSANs:
|
||||
- "{{ .Values.etcd.nodeName }}"
|
||||
- "{{ .Values.etcd.nodeName }}.{{ .Values.domain }}"
|
||||
- "{{ .Values.domain }}"
|
||||
peerCertSANs:
|
||||
- "{{ .Values.etcd.nodeName }}"
|
||||
- "{{ .Values.etcd.nodeName }}.{{ .Values.domain }}"
|
||||
- "{{ .Values.domain }}"
|
||||
controllerManager:
|
||||
extraArgs:
|
||||
profiling: "false"
|
||||
bind-address: {{ .Values.listenAddress }}
|
||||
terminated-pod-gc-threshold: "300"
|
||||
leader-elect: {{ .Values.clusterHighAvailable | quote }}
|
||||
# leader-elect: {{ .Values.highAvailable | quote }}
|
||||
logging-format: json
|
||||
feature-gates: {{ include "kubeadm.featuregates" ( dict "return" "csv" "platform" .Values.platform ) | trimSuffix "," | quote }}
|
||||
scheduler:
|
||||
extraArgs:
|
||||
profiling: "false"
|
||||
bind-address: {{ .Values.listenAddress }}
|
||||
leader-elect: {{ .Values.clusterHighAvailable | quote }}
|
||||
# leader-elect: {{ .Values.highAvailable | quote }}
|
||||
logging-format: json
|
||||
feature-gates: {{ include "kubeadm.featuregates" ( dict "return" "csv" "platform" .Values.platform ) | trimSuffix "," | quote }}
|
||||
apiServer:
|
||||
certSANs:
|
||||
- {{ regexSplit ":" .Values.apiEndpoint -1 | first }}
|
||||
- {{ regexSplit ":" .Values.api.endpoint -1 | first }}
|
||||
extraArgs:
|
||||
etcd-servers: {{ .Values.allEtcdEndpoints }}
|
||||
etcd-servers: {{ .Values.api.allEtcdEndpoints }}
|
||||
profiling: "false"
|
||||
audit-log-path: "/var/log/kubernetes/audit.log"
|
||||
audit-policy-file: /etc/kubernetes/apiserver/audit-policy.yaml
|
||||
|
|
@ -46,15 +60,22 @@ apiServer:
|
|||
tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
|
||||
admission-control-config-file: /etc/kubernetes/apiserver/admission-configuration.yaml
|
||||
{{- if eq .Values.platform "aws" }}
|
||||
service-account-issuer: "{{ .Values.serviceAccountIssuer }}"
|
||||
service-account-jwks-uri: "{{ .Values.serviceAccountIssuer }}/openid/v1/jwks"
|
||||
api-audiences: "istio-ca,sts.amazonaws.com"
|
||||
authentication-token-webhook-config-file: /etc/kubernetes/apiserver/aws-iam-authenticator.yaml
|
||||
{{- else }}
|
||||
api-audiences: "istio-ca"
|
||||
{{- end }}
|
||||
feature-gates: {{ include "kubeadm.featuregates" ( dict "return" "csv" "platform" .Values.platform ) | trimSuffix "," | quote }}
|
||||
# for 1.21
|
||||
# enable-admission-plugins: DenyServiceExternalIPs,NodeRestriction,EventRateLimit
|
||||
enable-admission-plugins: NodeRestriction,EventRateLimit
|
||||
{{- if .Values.clusterHighAvailable }}
|
||||
goaway-chance: ".001"
|
||||
{{- end }}
|
||||
# {{- if .Values.highAvailable }}
|
||||
# goaway-chance: ".001"
|
||||
# {{- end }}
|
||||
logging-format: json
|
||||
{{- with .Values.apiExtraArgs }}
|
||||
{{- with .Values.api.extraArgs }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
extraVolumes:
|
||||
|
|
|
|||
|
|
@ -3,10 +3,14 @@ kind: InitConfiguration
|
|||
metadata:
|
||||
name: kubezero-initconfiguration
|
||||
localAPIEndpoint:
|
||||
bindPort: {{ regexSplit ":" .Values.apiEndpoint -1 | last }}
|
||||
bindPort: {{ .Values.api.listenPort }}
|
||||
nodeRegistration:
|
||||
ignorePreflightErrors:
|
||||
- Swap
|
||||
- DirAvailable--var-lib-etcd
|
||||
- KubeletVersion
|
||||
kubeletExtraArgs:
|
||||
node-labels: {{ .Values.nodeLabels | quote }}
|
||||
{{- with .Values.providerID }}
|
||||
provider-id: {{ . }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -5,12 +5,16 @@ discovery:
|
|||
kubeConfigPath: /root/.kube/config
|
||||
controlPlane:
|
||||
localAPIEndpoint:
|
||||
advertiseAddress: IP_ADDRESS
|
||||
bindPort: {{ regexSplit ":" .Values.apiEndpoint -1 | last }}
|
||||
advertiseAddress: {{ .Values.serviceIp }}
|
||||
bindPort: {{ .Values.api.listenPort }}
|
||||
nodeRegistration:
|
||||
ignorePreflightErrors:
|
||||
- DirAvailable--var-lib-etcd
|
||||
- FileAvailable--etc-kubernetes-pki-ca.crt
|
||||
- Swap
|
||||
- KubeletVersion
|
||||
kubeletExtraArgs:
|
||||
node-labels: {{ .Values.nodeLabels | quote }}
|
||||
{{- with .Values.providerID }}
|
||||
provider-id: {{ . }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ apiVersion: v1
|
|||
kind: Config
|
||||
clusters:
|
||||
- cluster:
|
||||
server: https://{{ .Values.apiEndpoint }}
|
||||
server: https://{{ .Values.api.endpoint }}
|
||||
name: {{ .Values.clusterName }}
|
||||
contexts:
|
||||
- context:
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
spec:
|
||||
replicas: {{ ternary 3 1 .Values.clusterHighAvailable }}
|
||||
replicas: {{ ternary 3 1 .Values.highAvailable }}
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
|
|
|
|||
|
|
@ -5,3 +5,4 @@ spec:
|
|||
requests:
|
||||
cpu: 200m
|
||||
memory: 192Mi
|
||||
ephemeral-storage: 1Gi
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ kind: IAMIdentityMapping
|
|||
metadata:
|
||||
name: kubezero-worker-nodes
|
||||
spec:
|
||||
arn: {{ .Values.WorkerNodeRole }}
|
||||
arn: {{ .Values.workerNodeRole }}
|
||||
username: system:node:{{ "{{" }}EC2PrivateDNSName{{ "}}" }}
|
||||
groups:
|
||||
# For now use masters, define properly with 1.20
|
||||
|
|
|
|||
|
|
@ -0,0 +1,13 @@
|
|||
{{- if eq .Values.platform "aws" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: oidc-public
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:service-account-issuer-discovery
|
||||
subjects:
|
||||
- kind: Group
|
||||
name: system:unauthenticated
|
||||
{{- end }}
|
||||
|
|
@ -1,16 +1,26 @@
|
|||
clusterVersion: 1.19.0
|
||||
listenAddress: 0.0.0.0
|
||||
clusterName: pleasechangeme
|
||||
apiEndpoint: kube-api.changeme.org:6443
|
||||
etcdExtraArgs: {}
|
||||
apiExtraArgs: {}
|
||||
clusterHighAvailable: false
|
||||
allEtcdEndpoints: ""
|
||||
domain: changeme.org
|
||||
|
||||
serviceIp: set_via_cmdline
|
||||
|
||||
api:
|
||||
endpoint: kube-api.changeme.org:6443
|
||||
listenPort: 6443
|
||||
allEtcdEndpoints: ""
|
||||
extraArgs: {}
|
||||
|
||||
etcd:
|
||||
nodeName: set_via_cmdline
|
||||
extraArgs: {}
|
||||
|
||||
highAvailable: false
|
||||
listenAddress: 0.0.0.0
|
||||
|
||||
# supported values aws,bare-metal
|
||||
platform: "aws"
|
||||
# Set to false for openrc, eg. on Gentoo or Alpine
|
||||
systemd: true
|
||||
protectKernelDefaults: true
|
||||
|
||||
WorkerNodeRole: "arn:aws:iam::000000000000:role/KubernetesNode"
|
||||
KubeAdminRole: "arn:aws:iam::000000000000:role/KubernetesNode"
|
||||
workerNodeRole: "arn:aws:iam::000000000000:role/KubernetesNode"
|
||||
kubeAdminRole: "arn:aws:iam::000000000000:role/KubernetesNode"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
apiVersion: v2
|
||||
description: KubeZero ArgoCD Helm chart to install ArgoCD itself and the KubeZero ArgoCD Application
|
||||
name: kubezero-argocd
|
||||
version: 0.7.1
|
||||
version: 0.8.0
|
||||
home: https://kubezero.com
|
||||
icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
|
||||
keywords:
|
||||
|
|
@ -15,6 +15,6 @@ dependencies:
|
|||
version: ">= 0.1.3"
|
||||
repository: https://zero-down-time.github.io/kubezero/
|
||||
- name: argo-cd
|
||||
version: 2.17.4
|
||||
version: 3.6.10
|
||||
repository: https://argoproj.github.io/argo-helm
|
||||
kubeVersion: ">= 1.18.0"
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# kubezero-argocd
|
||||
|
||||
|
||||
|
||||
|
||||
KubeZero ArgoCD Helm chart to install ArgoCD itself and the KubeZero ArgoCD Application
|
||||
|
||||
|
|
@ -18,7 +18,7 @@ Kubernetes: `>= 1.18.0`
|
|||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| https://argoproj.github.io/argo-helm | argo-cd | 2.17.4 |
|
||||
| https://argoproj.github.io/argo-helm | argo-cd | 3.6.10 |
|
||||
| https://zero-down-time.github.io/kubezero/ | kubezero-lib | >= 0.1.3 |
|
||||
|
||||
## Values
|
||||
|
|
@ -30,23 +30,22 @@ Kubernetes: `>= 1.18.0`
|
|||
| argo-cd.controller.args.statusProcessors | string | `"8"` | |
|
||||
| argo-cd.controller.logFormat | string | `"json"` | |
|
||||
| argo-cd.controller.metrics.enabled | bool | `false` | |
|
||||
| argo-cd.controller.metrics.serviceMonitor.additionalLabels.release | string | `"metrics"` | |
|
||||
| argo-cd.controller.metrics.serviceMonitor.enabled | bool | `true` | |
|
||||
| argo-cd.controller.resources.requests.cpu | string | `"100m"` | |
|
||||
| argo-cd.controller.resources.requests.memory | string | `"256Mi"` | |
|
||||
| argo-cd.dex.enabled | bool | `false` | |
|
||||
| argo-cd.global.image.tag | string | `"v1.8.7"` | |
|
||||
| argo-cd.global.image.tag | string | `"v2.0.4"` | |
|
||||
| argo-cd.installCRDs | bool | `false` | |
|
||||
| argo-cd.repoServer.logFormat | string | `"json"` | |
|
||||
| argo-cd.repoServer.metrics.enabled | bool | `false` | |
|
||||
| argo-cd.repoServer.metrics.serviceMonitor.additionalLabels.release | string | `"metrics"` | |
|
||||
| argo-cd.repoServer.metrics.serviceMonitor.enabled | bool | `true` | |
|
||||
| argo-cd.server.config."resource.customizations" | string | `"cert-manager.io/Certificate:\n # Lua script for customizing the health status assessment\n health.lua: |\n hs = {}\n if obj.status ~= nil then\n if obj.status.conditions ~= nil then\n for i, condition in ipairs(obj.status.conditions) do\n if condition.type == \"Ready\" and condition.status == \"False\" then\n hs.status = \"Degraded\"\n hs.message = condition.message\n return hs\n end\n if condition.type == \"Ready\" and condition.status == \"True\" then\n hs.status = \"Healthy\"\n hs.message = condition.message\n return hs\n end\n end\n end\n end\n hs.status = \"Progressing\"\n hs.message = \"Waiting for certificate\"\n return hs\n"` | |
|
||||
| argo-cd.server.config."ui.bannercontent" | string | `"KubeZero Release 2.20 incl. ArgoCD 2.0 -> Release notes"` | |
|
||||
| argo-cd.server.config."ui.bannerurl" | string | `"https://blog.argoproj.io/argo-cd-v2-0-rc1-is-here-f7d21ff1aa64"` | |
|
||||
| argo-cd.server.config.url | string | `"argocd.example.com"` | ArgoCD hostname to be exposed via Istio |
|
||||
| argo-cd.server.extraArgs[0] | string | `"--insecure"` | |
|
||||
| argo-cd.server.logFormat | string | `"json"` | |
|
||||
| argo-cd.server.metrics.enabled | bool | `false` | |
|
||||
| argo-cd.server.metrics.serviceMonitor.additionalLabels.release | string | `"metrics"` | |
|
||||
| argo-cd.server.metrics.serviceMonitor.enabled | bool | `true` | |
|
||||
| argo-cd.server.service.servicePortHttpsName | string | `"grpc"` | |
|
||||
| istio.enabled | bool | `false` | Deploy Istio VirtualService to expose ArgoCD |
|
||||
|
|
|
|||
|
|
@ -0,0 +1,8 @@
|
|||
configmap: grafana-dashboards
|
||||
gzip: true
|
||||
condition: 'index .Values "argo-cd" "controller" "metrics" "enabled"'
|
||||
dashboards:
|
||||
- name: ArgoCD
|
||||
url: https://grafana.com/api/dashboards/14584/revisions/1/download
|
||||
tags:
|
||||
- ArgoCD
|
||||
File diff suppressed because one or more lines are too long
|
|
@ -0,0 +1,4 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Create ZDT dashboard configmap
|
||||
../kubezero-metrics/sync_grafana_dashboards.py dashboards.yaml templates/grafana-dashboards.yaml
|
||||
|
|
@ -42,7 +42,7 @@ argo-cd:
|
|||
|
||||
global:
|
||||
image:
|
||||
tag: v1.8.7
|
||||
tag: v2.0.4
|
||||
|
||||
controller:
|
||||
args:
|
||||
|
|
@ -55,8 +55,6 @@ argo-cd:
|
|||
enabled: false
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
additionalLabels:
|
||||
release: metrics
|
||||
|
||||
resources:
|
||||
# limits:
|
||||
|
|
@ -72,12 +70,13 @@ argo-cd:
|
|||
enabled: false
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
additionalLabels:
|
||||
release: metrics
|
||||
|
||||
server:
|
||||
logFormat: json
|
||||
config:
|
||||
ui.bannercontent: "KubeZero Release 2.20 incl. ArgoCD 2.0 -> Release notes"
|
||||
ui.bannerurl: "https://blog.argoproj.io/argo-cd-v2-0-rc1-is-here-f7d21ff1aa64"
|
||||
|
||||
# argo-cd.server.config.url -- ArgoCD hostname to be exposed via Istio
|
||||
url: argocd.example.com
|
||||
|
||||
|
|
@ -117,8 +116,6 @@ argo-cd:
|
|||
enabled: false
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
additionalLabels:
|
||||
release: metrics
|
||||
|
||||
extraArgs:
|
||||
- --insecure
|
||||
|
|
|
|||
|
|
@ -2,8 +2,8 @@ apiVersion: v2
|
|||
name: kubezero-aws-ebs-csi-driver
|
||||
description: KubeZero Umbrella Chart for aws-ebs-csi-driver
|
||||
type: application
|
||||
version: 0.5.1
|
||||
appVersion: 0.10.0
|
||||
version: 0.6.3
|
||||
appVersion: 1.2.4
|
||||
home: https://kubezero.com
|
||||
icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
|
||||
sources:
|
||||
|
|
@ -18,8 +18,8 @@ maintainers:
|
|||
- name: Quarky9
|
||||
dependencies:
|
||||
- name: aws-ebs-csi-driver
|
||||
version: 0.10.0
|
||||
repository: https://kubernetes-sigs.github.io/aws-ebs-csi-driver
|
||||
version: 1.2.4
|
||||
# repository: https://kubernetes-sigs.github.io/aws-ebs-csi-driver
|
||||
- name: kubezero-lib
|
||||
version: ">= 0.1.3"
|
||||
repository: https://zero-down-time.github.io/kubezero/
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# kubezero-aws-ebs-csi-driver
|
||||
|
||||
  
|
||||
  
|
||||
|
||||
KubeZero Umbrella Chart for aws-ebs-csi-driver
|
||||
|
||||
|
|
@ -23,7 +23,7 @@ Kubernetes: `>= 1.18.0`
|
|||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| https://kubernetes-sigs.github.io/aws-ebs-csi-driver | aws-ebs-csi-driver | 0.9.14 |
|
||||
| | aws-ebs-csi-driver | 1.2.3 |
|
||||
| https://zero-down-time.github.io/kubezero/ | kubezero-lib | >= 0.1.3 |
|
||||
|
||||
## IAM Role
|
||||
|
|
@ -41,17 +41,16 @@ This class is by default also set as default storage class.
|
|||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| aws-ebs-csi-driver.enableVolumeResizing | bool | `true` | |
|
||||
| aws-ebs-csi-driver.enableVolumeScheduling | bool | `true` | |
|
||||
| aws-ebs-csi-driver.controller.logLevel | int | `1` | |
|
||||
| aws-ebs-csi-driver.controller.nodeSelector."node-role.kubernetes.io/master" | string | `""` | |
|
||||
| aws-ebs-csi-driver.controller.replicaCount | int | `1` | |
|
||||
| aws-ebs-csi-driver.controller.resources.limits.memory | string | `"40Mi"` | |
|
||||
| aws-ebs-csi-driver.controller.resources.requests.cpu | string | `"10m"` | |
|
||||
| aws-ebs-csi-driver.controller.resources.requests.memory | string | `"24Mi"` | |
|
||||
| aws-ebs-csi-driver.controller.tolerations[0].effect | string | `"NoSchedule"` | |
|
||||
| aws-ebs-csi-driver.controller.tolerations[0].key | string | `"node-role.kubernetes.io/master"` | |
|
||||
| aws-ebs-csi-driver.enableVolumeSnapshot | bool | `true` | |
|
||||
| aws-ebs-csi-driver.extraVolumeTags | object | `{}` | Optional tags to be added to each EBS volume |
|
||||
| aws-ebs-csi-driver.logLevel | int | `1` | |
|
||||
| aws-ebs-csi-driver.nodeSelector."node-role.kubernetes.io/master" | string | `""` | |
|
||||
| aws-ebs-csi-driver.podAnnotations | object | `{}` | iam.amazonaws.com/role: <IAM role ARN> to assume |
|
||||
| aws-ebs-csi-driver.replicaCount | int | `1` | |
|
||||
| aws-ebs-csi-driver.resources.limits.memory | string | `"40Mi"` | |
|
||||
| aws-ebs-csi-driver.resources.requests.cpu | string | `"10m"` | |
|
||||
| aws-ebs-csi-driver.resources.requests.memory | string | `"24Mi"` | |
|
||||
| aws-ebs-csi-driver.storageClasses[0].allowVolumeExpansion | bool | `true` | |
|
||||
| aws-ebs-csi-driver.storageClasses[0].name | string | `"ebs-sc-gp2-xfs"` | |
|
||||
| aws-ebs-csi-driver.storageClasses[0].parameters."csi.storage.k8s.io/fstype" | string | `"xfs"` | |
|
||||
|
|
|
|||
|
|
@ -0,0 +1,6 @@
|
|||
# Helm chart
|
||||
|
||||
# v1.2.4
|
||||
* Bump app/driver version to `v1.1.1`
|
||||
* Install VolumeSnapshotClass, VolumeSnapshotContent, VolumeSnapshot CRDs if enableVolumeSnapshot is true
|
||||
* Only run csi-snapshotter sidecar if enableVolumeSnapshot is true or if CRDs are already installed
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
apiVersion: v1
|
||||
appVersion: 0.10.0
|
||||
appVersion: 1.1.1
|
||||
description: A Helm chart for AWS EBS CSI Driver
|
||||
home: https://github.com/kubernetes-sigs/aws-ebs-csi-driver
|
||||
keywords:
|
||||
|
|
@ -15,4 +15,4 @@ maintainers:
|
|||
name: aws-ebs-csi-driver
|
||||
sources:
|
||||
- https://github.com/kubernetes-sigs/aws-ebs-csi-driver
|
||||
version: 0.10.0
|
||||
version: 1.2.4
|
||||
|
|
|
|||
|
|
@ -0,0 +1,628 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.4.0
|
||||
api-approved.kubernetes.io: "https://github.com/kubernetes-csi/external-snapshotter/pull/419"
|
||||
creationTimestamp: null
|
||||
name: volumesnapshotclasses.snapshot.storage.k8s.io
|
||||
spec:
|
||||
group: snapshot.storage.k8s.io
|
||||
names:
|
||||
kind: VolumeSnapshotClass
|
||||
listKind: VolumeSnapshotClassList
|
||||
plural: volumesnapshotclasses
|
||||
singular: volumesnapshotclass
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .driver
|
||||
name: Driver
|
||||
type: string
|
||||
- description: Determines whether a VolumeSnapshotContent created through the VolumeSnapshotClass should be deleted when its bound VolumeSnapshot is deleted.
|
||||
jsonPath: .deletionPolicy
|
||||
name: DeletionPolicy
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: VolumeSnapshotClass specifies parameters that a underlying storage system uses when creating a volume snapshot. A specific VolumeSnapshotClass is used by specifying its name in a VolumeSnapshot object. VolumeSnapshotClasses are non-namespaced
|
||||
properties:
|
||||
apiVersion:
|
||||
description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
|
||||
type: string
|
||||
deletionPolicy:
|
||||
description: deletionPolicy determines whether a VolumeSnapshotContent created through the VolumeSnapshotClass should be deleted when its bound VolumeSnapshot is deleted. Supported values are "Retain" and "Delete". "Retain" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are kept. "Delete" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are deleted. Required.
|
||||
enum:
|
||||
- Delete
|
||||
- Retain
|
||||
type: string
|
||||
driver:
|
||||
description: driver is the name of the storage driver that handles this VolumeSnapshotClass. Required.
|
||||
type: string
|
||||
kind:
|
||||
description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
|
||||
type: string
|
||||
parameters:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: parameters is a key-value map with storage driver specific parameters for creating snapshots. These values are opaque to Kubernetes.
|
||||
type: object
|
||||
required:
|
||||
- deletionPolicy
|
||||
- driver
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .driver
|
||||
name: Driver
|
||||
type: string
|
||||
- description: Determines whether a VolumeSnapshotContent created through the VolumeSnapshotClass should be deleted when its bound VolumeSnapshot is deleted.
|
||||
jsonPath: .deletionPolicy
|
||||
name: DeletionPolicy
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: VolumeSnapshotClass specifies parameters that a underlying storage system uses when creating a volume snapshot. A specific VolumeSnapshotClass is used by specifying its name in a VolumeSnapshot object. VolumeSnapshotClasses are non-namespaced
|
||||
properties:
|
||||
apiVersion:
|
||||
description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
|
||||
type: string
|
||||
deletionPolicy:
|
||||
description: deletionPolicy determines whether a VolumeSnapshotContent created through the VolumeSnapshotClass should be deleted when its bound VolumeSnapshot is deleted. Supported values are "Retain" and "Delete". "Retain" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are kept. "Delete" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are deleted. Required.
|
||||
enum:
|
||||
- Delete
|
||||
- Retain
|
||||
type: string
|
||||
driver:
|
||||
description: driver is the name of the storage driver that handles this VolumeSnapshotClass. Required.
|
||||
type: string
|
||||
kind:
|
||||
description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
|
||||
type: string
|
||||
parameters:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: parameters is a key-value map with storage driver specific parameters for creating snapshots. These values are opaque to Kubernetes.
|
||||
type: object
|
||||
required:
|
||||
- deletionPolicy
|
||||
- driver
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.4.0
|
||||
api-approved.kubernetes.io: "https://github.com/kubernetes-csi/external-snapshotter/pull/419"
|
||||
creationTimestamp: null
|
||||
name: volumesnapshotcontents.snapshot.storage.k8s.io
|
||||
spec:
|
||||
group: snapshot.storage.k8s.io
|
||||
names:
|
||||
kind: VolumeSnapshotContent
|
||||
listKind: VolumeSnapshotContentList
|
||||
plural: volumesnapshotcontents
|
||||
singular: volumesnapshotcontent
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Indicates if the snapshot is ready to be used to restore a volume.
|
||||
jsonPath: .status.readyToUse
|
||||
name: ReadyToUse
|
||||
type: boolean
|
||||
- description: Represents the complete size of the snapshot in bytes
|
||||
jsonPath: .status.restoreSize
|
||||
name: RestoreSize
|
||||
type: integer
|
||||
- description: Determines whether this VolumeSnapshotContent and its physical snapshot on the underlying storage system should be deleted when its bound VolumeSnapshot is deleted.
|
||||
jsonPath: .spec.deletionPolicy
|
||||
name: DeletionPolicy
|
||||
type: string
|
||||
- description: Name of the CSI driver used to create the physical snapshot on the underlying storage system.
|
||||
jsonPath: .spec.driver
|
||||
name: Driver
|
||||
type: string
|
||||
- description: Name of the VolumeSnapshotClass to which this snapshot belongs.
|
||||
jsonPath: .spec.volumeSnapshotClassName
|
||||
name: VolumeSnapshotClass
|
||||
type: string
|
||||
- description: Name of the VolumeSnapshot object to which this VolumeSnapshotContent object is bound.
|
||||
jsonPath: .spec.volumeSnapshotRef.name
|
||||
name: VolumeSnapshot
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: VolumeSnapshotContent represents the actual "on-disk" snapshot object in the underlying storage system
|
||||
properties:
|
||||
apiVersion:
|
||||
description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
|
||||
type: string
|
||||
kind:
|
||||
description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
|
||||
type: string
|
||||
spec:
|
||||
description: spec defines properties of a VolumeSnapshotContent created by the underlying storage system. Required.
|
||||
properties:
|
||||
deletionPolicy:
|
||||
description: deletionPolicy determines whether this VolumeSnapshotContent and its physical snapshot on the underlying storage system should be deleted when its bound VolumeSnapshot is deleted. Supported values are "Retain" and "Delete". "Retain" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are kept. "Delete" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are deleted. For dynamically provisioned snapshots, this field will automatically be filled in by the CSI snapshotter sidecar with the "DeletionPolicy" field defined in the corresponding VolumeSnapshotClass. For pre-existing snapshots, users MUST specify this field when creating the VolumeSnapshotContent object. Required.
|
||||
enum:
|
||||
- Delete
|
||||
- Retain
|
||||
type: string
|
||||
driver:
|
||||
description: driver is the name of the CSI driver used to create the physical snapshot on the underlying storage system. This MUST be the same as the name returned by the CSI GetPluginName() call for that driver. Required.
|
||||
type: string
|
||||
source:
|
||||
description: source specifies whether the snapshot is (or should be) dynamically provisioned or already exists, and just requires a Kubernetes object representation. This field is immutable after creation. Required.
|
||||
properties:
|
||||
snapshotHandle:
|
||||
description: snapshotHandle specifies the CSI "snapshot_id" of a pre-existing snapshot on the underlying storage system for which a Kubernetes object representation was (or should be) created. This field is immutable.
|
||||
type: string
|
||||
volumeHandle:
|
||||
description: volumeHandle specifies the CSI "volume_id" of the volume from which a snapshot should be dynamically taken from. This field is immutable.
|
||||
type: string
|
||||
type: object
|
||||
oneOf:
|
||||
- required: ["snapshotHandle"]
|
||||
- required: ["volumeHandle"]
|
||||
volumeSnapshotClassName:
|
||||
description: name of the VolumeSnapshotClass from which this snapshot was (or will be) created. Note that after provisioning, the VolumeSnapshotClass may be deleted or recreated with different set of values, and as such, should not be referenced post-snapshot creation.
|
||||
type: string
|
||||
volumeSnapshotRef:
|
||||
description: volumeSnapshotRef specifies the VolumeSnapshot object to which this VolumeSnapshotContent object is bound. VolumeSnapshot.Spec.VolumeSnapshotContentName field must reference to this VolumeSnapshotContent's name for the bidirectional binding to be valid. For a pre-existing VolumeSnapshotContent object, name and namespace of the VolumeSnapshot object MUST be provided for binding to happen. This field is immutable after creation. Required.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: 'If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. TODO: this design is not final and this field is subject to change in the future.'
|
||||
type: string
|
||||
kind:
|
||||
description: "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
|
||||
type: string
|
||||
name:
|
||||
description: "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names"
|
||||
type: string
|
||||
namespace:
|
||||
description: "Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/"
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: "Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency"
|
||||
type: string
|
||||
uid:
|
||||
description: "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids"
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- deletionPolicy
|
||||
- driver
|
||||
- source
|
||||
- volumeSnapshotRef
|
||||
type: object
|
||||
status:
|
||||
description: status represents the current information of a snapshot.
|
||||
properties:
|
||||
creationTime:
|
||||
description: creationTime is the timestamp when the point-in-time snapshot is taken by the underlying storage system. In dynamic snapshot creation case, this field will be filled in by the CSI snapshotter sidecar with the "creation_time" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "creation_time" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it. If not specified, it indicates the creation time is unknown. The format of this field is a Unix nanoseconds time encoded as an int64. On Unix, the command `date +%s%N` returns the current time in nanoseconds since 1970-01-01 00:00:00 UTC.
|
||||
format: int64
|
||||
type: integer
|
||||
error:
|
||||
description: error is the last observed error during snapshot creation, if any. Upon success after retry, this error field will be cleared.
|
||||
properties:
|
||||
message:
|
||||
description: "message is a string detailing the encountered error during snapshot creation if specified. NOTE: message may be logged, and it should not contain sensitive information."
|
||||
type: string
|
||||
time:
|
||||
description: time is the timestamp when the error was encountered.
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
readyToUse:
|
||||
description: readyToUse indicates if a snapshot is ready to be used to restore a volume. In dynamic snapshot creation case, this field will be filled in by the CSI snapshotter sidecar with the "ready_to_use" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "ready_to_use" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it, otherwise, this field will be set to "True". If not specified, it means the readiness of a snapshot is unknown.
|
||||
type: boolean
|
||||
restoreSize:
|
||||
description: restoreSize represents the complete size of the snapshot in bytes. In dynamic snapshot creation case, this field will be filled in by the CSI snapshotter sidecar with the "size_bytes" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "size_bytes" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it. When restoring a volume from this snapshot, the size of the volume MUST NOT be smaller than the restoreSize if it is specified, otherwise the restoration will fail. If not specified, it indicates that the size is unknown.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
snapshotHandle:
|
||||
description: snapshotHandle is the CSI "snapshot_id" of a snapshot on the underlying storage system. If not specified, it indicates that dynamic snapshot creation has either failed or it is still in progress.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources:
|
||||
status: {}
|
||||
- additionalPrinterColumns:
|
||||
- description: Indicates if the snapshot is ready to be used to restore a volume.
|
||||
jsonPath: .status.readyToUse
|
||||
name: ReadyToUse
|
||||
type: boolean
|
||||
- description: Represents the complete size of the snapshot in bytes
|
||||
jsonPath: .status.restoreSize
|
||||
name: RestoreSize
|
||||
type: integer
|
||||
- description: Determines whether this VolumeSnapshotContent and its physical snapshot on the underlying storage system should be deleted when its bound VolumeSnapshot is deleted.
|
||||
jsonPath: .spec.deletionPolicy
|
||||
name: DeletionPolicy
|
||||
type: string
|
||||
- description: Name of the CSI driver used to create the physical snapshot on the underlying storage system.
|
||||
jsonPath: .spec.driver
|
||||
name: Driver
|
||||
type: string
|
||||
- description: Name of the VolumeSnapshotClass to which this snapshot belongs.
|
||||
jsonPath: .spec.volumeSnapshotClassName
|
||||
name: VolumeSnapshotClass
|
||||
type: string
|
||||
- description: Name of the VolumeSnapshot object to which this VolumeSnapshotContent object is bound.
|
||||
jsonPath: .spec.volumeSnapshotRef.name
|
||||
name: VolumeSnapshot
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: VolumeSnapshotContent represents the actual "on-disk" snapshot object in the underlying storage system
|
||||
properties:
|
||||
apiVersion:
|
||||
description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
|
||||
type: string
|
||||
kind:
|
||||
description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
|
||||
type: string
|
||||
spec:
|
||||
description: spec defines properties of a VolumeSnapshotContent created by the underlying storage system. Required.
|
||||
properties:
|
||||
deletionPolicy:
|
||||
description: deletionPolicy determines whether this VolumeSnapshotContent and its physical snapshot on the underlying storage system should be deleted when its bound VolumeSnapshot is deleted. Supported values are "Retain" and "Delete". "Retain" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are kept. "Delete" means that the VolumeSnapshotContent and its physical snapshot on underlying storage system are deleted. For dynamically provisioned snapshots, this field will automatically be filled in by the CSI snapshotter sidecar with the "DeletionPolicy" field defined in the corresponding VolumeSnapshotClass. For pre-existing snapshots, users MUST specify this field when creating the VolumeSnapshotContent object. Required.
|
||||
enum:
|
||||
- Delete
|
||||
- Retain
|
||||
type: string
|
||||
driver:
|
||||
description: driver is the name of the CSI driver used to create the physical snapshot on the underlying storage system. This MUST be the same as the name returned by the CSI GetPluginName() call for that driver. Required.
|
||||
type: string
|
||||
source:
|
||||
description: source specifies whether the snapshot is (or should be) dynamically provisioned or already exists, and just requires a Kubernetes object representation. This field is immutable after creation. Required.
|
||||
properties:
|
||||
snapshotHandle:
|
||||
description: snapshotHandle specifies the CSI "snapshot_id" of a pre-existing snapshot on the underlying storage system for which a Kubernetes object representation was (or should be) created. This field is immutable.
|
||||
type: string
|
||||
volumeHandle:
|
||||
description: volumeHandle specifies the CSI "volume_id" of the volume from which a snapshot should be dynamically taken from. This field is immutable.
|
||||
type: string
|
||||
type: object
|
||||
volumeSnapshotClassName:
|
||||
description: name of the VolumeSnapshotClass from which this snapshot was (or will be) created. Note that after provisioning, the VolumeSnapshotClass may be deleted or recreated with different set of values, and as such, should not be referenced post-snapshot creation.
|
||||
type: string
|
||||
volumeSnapshotRef:
|
||||
description: volumeSnapshotRef specifies the VolumeSnapshot object to which this VolumeSnapshotContent object is bound. VolumeSnapshot.Spec.VolumeSnapshotContentName field must reference to this VolumeSnapshotContent's name for the bidirectional binding to be valid. For a pre-existing VolumeSnapshotContent object, name and namespace of the VolumeSnapshot object MUST be provided for binding to happen. This field is immutable after creation. Required.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: 'If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. TODO: this design is not final and this field is subject to change in the future.'
|
||||
type: string
|
||||
kind:
|
||||
description: "Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
|
||||
type: string
|
||||
name:
|
||||
description: "Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names"
|
||||
type: string
|
||||
namespace:
|
||||
description: "Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/"
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: "Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency"
|
||||
type: string
|
||||
uid:
|
||||
description: "UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids"
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- deletionPolicy
|
||||
- driver
|
||||
- source
|
||||
- volumeSnapshotRef
|
||||
type: object
|
||||
status:
|
||||
description: status represents the current information of a snapshot.
|
||||
properties:
|
||||
creationTime:
|
||||
description: creationTime is the timestamp when the point-in-time snapshot is taken by the underlying storage system. In dynamic snapshot creation case, this field will be filled in by the CSI snapshotter sidecar with the "creation_time" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "creation_time" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it. If not specified, it indicates the creation time is unknown. The format of this field is a Unix nanoseconds time encoded as an int64. On Unix, the command `date +%s%N` returns the current time in nanoseconds since 1970-01-01 00:00:00 UTC.
|
||||
format: int64
|
||||
type: integer
|
||||
error:
|
||||
description: error is the last observed error during snapshot creation, if any. Upon success after retry, this error field will be cleared.
|
||||
properties:
|
||||
message:
|
||||
description: "message is a string detailing the encountered error during snapshot creation if specified. NOTE: message may be logged, and it should not contain sensitive information."
|
||||
type: string
|
||||
time:
|
||||
description: time is the timestamp when the error was encountered.
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
readyToUse:
|
||||
description: readyToUse indicates if a snapshot is ready to be used to restore a volume. In dynamic snapshot creation case, this field will be filled in by the CSI snapshotter sidecar with the "ready_to_use" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "ready_to_use" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it, otherwise, this field will be set to "True". If not specified, it means the readiness of a snapshot is unknown.
|
||||
type: boolean
|
||||
restoreSize:
|
||||
description: restoreSize represents the complete size of the snapshot in bytes. In dynamic snapshot creation case, this field will be filled in by the CSI snapshotter sidecar with the "size_bytes" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "size_bytes" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it. When restoring a volume from this snapshot, the size of the volume MUST NOT be smaller than the restoreSize if it is specified, otherwise the restoration will fail. If not specified, it indicates that the size is unknown.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
snapshotHandle:
|
||||
description: snapshotHandle is the CSI "snapshot_id" of a snapshot on the underlying storage system. If not specified, it indicates that dynamic snapshot creation has either failed or it is still in progress.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.4.0
|
||||
api-approved.kubernetes.io: "https://github.com/kubernetes-csi/external-snapshotter/pull/419"
|
||||
creationTimestamp: null
|
||||
name: volumesnapshots.snapshot.storage.k8s.io
|
||||
spec:
|
||||
group: snapshot.storage.k8s.io
|
||||
names:
|
||||
kind: VolumeSnapshot
|
||||
listKind: VolumeSnapshotList
|
||||
plural: volumesnapshots
|
||||
singular: volumesnapshot
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Indicates if the snapshot is ready to be used to restore a volume.
|
||||
jsonPath: .status.readyToUse
|
||||
name: ReadyToUse
|
||||
type: boolean
|
||||
- description: If a new snapshot needs to be created, this contains the name of the source PVC from which this snapshot was (or will be) created.
|
||||
jsonPath: .spec.source.persistentVolumeClaimName
|
||||
name: SourcePVC
|
||||
type: string
|
||||
- description: If a snapshot already exists, this contains the name of the existing VolumeSnapshotContent object representing the existing snapshot.
|
||||
jsonPath: .spec.source.volumeSnapshotContentName
|
||||
name: SourceSnapshotContent
|
||||
type: string
|
||||
- description: Represents the minimum size of volume required to rehydrate from this snapshot.
|
||||
jsonPath: .status.restoreSize
|
||||
name: RestoreSize
|
||||
type: string
|
||||
- description: The name of the VolumeSnapshotClass requested by the VolumeSnapshot.
|
||||
jsonPath: .spec.volumeSnapshotClassName
|
||||
name: SnapshotClass
|
||||
type: string
|
||||
- description: Name of the VolumeSnapshotContent object to which the VolumeSnapshot object intends to bind to. Please note that verification of binding actually requires checking both VolumeSnapshot and VolumeSnapshotContent to ensure both are pointing at each other. Binding MUST be verified prior to usage of this object.
|
||||
jsonPath: .status.boundVolumeSnapshotContentName
|
||||
name: SnapshotContent
|
||||
type: string
|
||||
- description: Timestamp when the point-in-time snapshot was taken by the underlying storage system.
|
||||
jsonPath: .status.creationTime
|
||||
name: CreationTime
|
||||
type: date
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: VolumeSnapshot is a user's request for either creating a point-in-time snapshot of a persistent volume, or binding to a pre-existing snapshot.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
|
||||
type: string
|
||||
kind:
|
||||
description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
|
||||
type: string
|
||||
spec:
|
||||
description: "spec defines the desired characteristics of a snapshot requested by a user. More info: https://kubernetes.io/docs/concepts/storage/volume-snapshots#volumesnapshots Required."
|
||||
properties:
|
||||
source:
|
||||
description: source specifies where a snapshot will be created from. This field is immutable after creation. Required.
|
||||
properties:
|
||||
persistentVolumeClaimName:
|
||||
description: persistentVolumeClaimName specifies the name of the PersistentVolumeClaim object representing the volume from which a snapshot should be created. This PVC is assumed to be in the same namespace as the VolumeSnapshot object. This field should be set if the snapshot does not exists, and needs to be created. This field is immutable.
|
||||
type: string
|
||||
volumeSnapshotContentName:
|
||||
description: volumeSnapshotContentName specifies the name of a pre-existing VolumeSnapshotContent object representing an existing volume snapshot. This field should be set if the snapshot already exists and only needs a representation in Kubernetes. This field is immutable.
|
||||
type: string
|
||||
type: object
|
||||
oneOf:
|
||||
- required: ["persistentVolumeClaimName"]
|
||||
- required: ["volumeSnapshotContentName"]
|
||||
volumeSnapshotClassName:
|
||||
description: "VolumeSnapshotClassName is the name of the VolumeSnapshotClass requested by the VolumeSnapshot. VolumeSnapshotClassName may be left nil to indicate that the default SnapshotClass should be used. A given cluster may have multiple default Volume SnapshotClasses: one default per CSI Driver. If a VolumeSnapshot does not specify a SnapshotClass, VolumeSnapshotSource will be checked to figure out what the associated CSI Driver is, and the default VolumeSnapshotClass associated with that CSI Driver will be used. If more than one VolumeSnapshotClass exist for a given CSI Driver and more than one have been marked as default, CreateSnapshot will fail and generate an event. Empty string is not allowed for this field."
|
||||
type: string
|
||||
required:
|
||||
- source
|
||||
type: object
|
||||
status:
|
||||
description: status represents the current information of a snapshot. Consumers must verify binding between VolumeSnapshot and VolumeSnapshotContent objects is successful (by validating that both VolumeSnapshot and VolumeSnapshotContent point at each other) before using this object.
|
||||
properties:
|
||||
boundVolumeSnapshotContentName:
|
||||
description: "boundVolumeSnapshotContentName is the name of the VolumeSnapshotContent object to which this VolumeSnapshot object intends to bind to. If not specified, it indicates that the VolumeSnapshot object has not been successfully bound to a VolumeSnapshotContent object yet. NOTE: To avoid possible security issues, consumers must verify binding between VolumeSnapshot and VolumeSnapshotContent objects is successful (by validating that both VolumeSnapshot and VolumeSnapshotContent point at each other) before using this object."
|
||||
type: string
|
||||
creationTime:
|
||||
description: creationTime is the timestamp when the point-in-time snapshot is taken by the underlying storage system. In dynamic snapshot creation case, this field will be filled in by the snapshot controller with the "creation_time" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "creation_time" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it. If not specified, it may indicate that the creation time of the snapshot is unknown.
|
||||
format: date-time
|
||||
type: string
|
||||
error:
|
||||
description: error is the last observed error during snapshot creation, if any. This field could be helpful to upper level controllers(i.e., application controller) to decide whether they should continue on waiting for the snapshot to be created based on the type of error reported. The snapshot controller will keep retrying when an error occurrs during the snapshot creation. Upon success, this error field will be cleared.
|
||||
properties:
|
||||
message:
|
||||
description: "message is a string detailing the encountered error during snapshot creation if specified. NOTE: message may be logged, and it should not contain sensitive information."
|
||||
type: string
|
||||
time:
|
||||
description: time is the timestamp when the error was encountered.
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
readyToUse:
|
||||
description: readyToUse indicates if the snapshot is ready to be used to restore a volume. In dynamic snapshot creation case, this field will be filled in by the snapshot controller with the "ready_to_use" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "ready_to_use" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it, otherwise, this field will be set to "True". If not specified, it means the readiness of a snapshot is unknown.
|
||||
type: boolean
|
||||
restoreSize:
|
||||
type: string
|
||||
description: restoreSize represents the minimum size of volume required to create a volume from this snapshot. In dynamic snapshot creation case, this field will be filled in by the snapshot controller with the "size_bytes" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "size_bytes" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it. When restoring a volume from this snapshot, the size of the volume MUST NOT be smaller than the restoreSize if it is specified, otherwise the restoration will fail. If not specified, it indicates that the size is unknown.
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources:
|
||||
status: {}
|
||||
- additionalPrinterColumns:
|
||||
- description: Indicates if the snapshot is ready to be used to restore a volume.
|
||||
jsonPath: .status.readyToUse
|
||||
name: ReadyToUse
|
||||
type: boolean
|
||||
- description: If a new snapshot needs to be created, this contains the name of the source PVC from which this snapshot was (or will be) created.
|
||||
jsonPath: .spec.source.persistentVolumeClaimName
|
||||
name: SourcePVC
|
||||
type: string
|
||||
- description: If a snapshot already exists, this contains the name of the existing VolumeSnapshotContent object representing the existing snapshot.
|
||||
jsonPath: .spec.source.volumeSnapshotContentName
|
||||
name: SourceSnapshotContent
|
||||
type: string
|
||||
- description: Represents the minimum size of volume required to rehydrate from this snapshot.
|
||||
jsonPath: .status.restoreSize
|
||||
name: RestoreSize
|
||||
type: string
|
||||
- description: The name of the VolumeSnapshotClass requested by the VolumeSnapshot.
|
||||
jsonPath: .spec.volumeSnapshotClassName
|
||||
name: SnapshotClass
|
||||
type: string
|
||||
- description: Name of the VolumeSnapshotContent object to which the VolumeSnapshot object intends to bind to. Please note that verification of binding actually requires checking both VolumeSnapshot and VolumeSnapshotContent to ensure both are pointing at each other. Binding MUST be verified prior to usage of this object.
|
||||
jsonPath: .status.boundVolumeSnapshotContentName
|
||||
name: SnapshotContent
|
||||
type: string
|
||||
- description: Timestamp when the point-in-time snapshot was taken by the underlying storage system.
|
||||
jsonPath: .status.creationTime
|
||||
name: CreationTime
|
||||
type: date
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: VolumeSnapshot is a user's request for either creating a point-in-time snapshot of a persistent volume, or binding to a pre-existing snapshot.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
|
||||
type: string
|
||||
kind:
|
||||
description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
|
||||
type: string
|
||||
spec:
|
||||
description: "spec defines the desired characteristics of a snapshot requested by a user. More info: https://kubernetes.io/docs/concepts/storage/volume-snapshots#volumesnapshots Required."
|
||||
properties:
|
||||
source:
|
||||
description: source specifies where a snapshot will be created from. This field is immutable after creation. Required.
|
||||
properties:
|
||||
persistentVolumeClaimName:
|
||||
description: persistentVolumeClaimName specifies the name of the PersistentVolumeClaim object representing the volume from which a snapshot should be created. This PVC is assumed to be in the same namespace as the VolumeSnapshot object. This field should be set if the snapshot does not exists, and needs to be created. This field is immutable.
|
||||
type: string
|
||||
volumeSnapshotContentName:
|
||||
description: volumeSnapshotContentName specifies the name of a pre-existing VolumeSnapshotContent object representing an existing volume snapshot. This field should be set if the snapshot already exists and only needs a representation in Kubernetes. This field is immutable.
|
||||
type: string
|
||||
type: object
|
||||
volumeSnapshotClassName:
|
||||
description: "VolumeSnapshotClassName is the name of the VolumeSnapshotClass requested by the VolumeSnapshot. VolumeSnapshotClassName may be left nil to indicate that the default SnapshotClass should be used. A given cluster may have multiple default Volume SnapshotClasses: one default per CSI Driver. If a VolumeSnapshot does not specify a SnapshotClass, VolumeSnapshotSource will be checked to figure out what the associated CSI Driver is, and the default VolumeSnapshotClass associated with that CSI Driver will be used. If more than one VolumeSnapshotClass exist for a given CSI Driver and more than one have been marked as default, CreateSnapshot will fail and generate an event. Empty string is not allowed for this field."
|
||||
type: string
|
||||
required:
|
||||
- source
|
||||
type: object
|
||||
status:
|
||||
description: status represents the current information of a snapshot. Consumers must verify binding between VolumeSnapshot and VolumeSnapshotContent objects is successful (by validating that both VolumeSnapshot and VolumeSnapshotContent point at each other) before using this object.
|
||||
properties:
|
||||
boundVolumeSnapshotContentName:
|
||||
description: "boundVolumeSnapshotContentName is the name of the VolumeSnapshotContent object to which this VolumeSnapshot object intends to bind to. If not specified, it indicates that the VolumeSnapshot object has not been successfully bound to a VolumeSnapshotContent object yet. NOTE: To avoid possible security issues, consumers must verify binding between VolumeSnapshot and VolumeSnapshotContent objects is successful (by validating that both VolumeSnapshot and VolumeSnapshotContent point at each other) before using this object."
|
||||
type: string
|
||||
creationTime:
|
||||
description: creationTime is the timestamp when the point-in-time snapshot is taken by the underlying storage system. In dynamic snapshot creation case, this field will be filled in by the snapshot controller with the "creation_time" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "creation_time" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it. If not specified, it may indicate that the creation time of the snapshot is unknown.
|
||||
format: date-time
|
||||
type: string
|
||||
error:
|
||||
description: error is the last observed error during snapshot creation, if any. This field could be helpful to upper level controllers(i.e., application controller) to decide whether they should continue on waiting for the snapshot to be created based on the type of error reported. The snapshot controller will keep retrying when an error occurrs during the snapshot creation. Upon success, this error field will be cleared.
|
||||
properties:
|
||||
message:
|
||||
description: "message is a string detailing the encountered error during snapshot creation if specified. NOTE: message may be logged, and it should not contain sensitive information."
|
||||
type: string
|
||||
time:
|
||||
description: time is the timestamp when the error was encountered.
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
readyToUse:
|
||||
description: readyToUse indicates if the snapshot is ready to be used to restore a volume. In dynamic snapshot creation case, this field will be filled in by the snapshot controller with the "ready_to_use" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "ready_to_use" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it, otherwise, this field will be set to "True". If not specified, it means the readiness of a snapshot is unknown.
|
||||
type: boolean
|
||||
restoreSize:
|
||||
type: string
|
||||
description: restoreSize represents the minimum size of volume required to create a volume from this snapshot. In dynamic snapshot creation case, this field will be filled in by the snapshot controller with the "size_bytes" value returned from CSI "CreateSnapshot" gRPC call. For a pre-existing snapshot, this field will be filled with the "size_bytes" value returned from the CSI "ListSnapshots" gRPC call if the driver supports it. When restoring a volume from this snapshot, the size of the volume MUST NOT be smaller than the restoreSize if it is specified, otherwise the restoration will fail. If not specified, it indicates that the size is unknown.
|
||||
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
||||
x-kubernetes-int-or-string: true
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
|
@ -1,3 +1,39 @@
|
|||
To verify that aws-ebs-csi-driver has started, run:
|
||||
|
||||
kubectl get pod -n {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "aws-ebs-csi-driver.name" . }},app.kubernetes.io/instance={{ .Release.Name }}"
|
||||
|
||||
|
||||
WARNING: The following values have been deprecated in favor of moving them into the controller or node groups. They will be removed in a subsequent release.
|
||||
|
||||
affinity:
|
||||
extraCreateMetadata:
|
||||
extraVolumeTags:
|
||||
k8sTagClusterId:
|
||||
nodeSelector:
|
||||
podAnnotations:
|
||||
priorityClassName:
|
||||
region:
|
||||
replicaCount:
|
||||
resources:
|
||||
tolerations:
|
||||
topologySpreadConstraints:
|
||||
volumeAttachLimit:
|
||||
|
||||
are moving to
|
||||
|
||||
controller:
|
||||
affinity:
|
||||
extraCreateMetadata:
|
||||
extraVolumeTags:
|
||||
k8sTagClusterId:
|
||||
nodeSelector:
|
||||
podAnnotations:
|
||||
priorityClassName:
|
||||
region:
|
||||
replicaCount:
|
||||
resources:
|
||||
tolerations:
|
||||
topologySpreadConstraints:
|
||||
|
||||
node:
|
||||
volumeAttachLimit:
|
||||
|
|
|
|||
|
|
@ -59,11 +59,24 @@ app.kubernetes.io/instance: {{ .Release.Name }}
|
|||
Convert the `--extra-volume-tags` command line arg from a map.
|
||||
*/}}
|
||||
{{- define "aws-ebs-csi-driver.extra-volume-tags" -}}
|
||||
{{- $evt := default .Values.extraVolumeTags .Values.controller.extraVolumeTags }}
|
||||
{{- $result := dict "pairs" (list) -}}
|
||||
{{- range $key, $value := .Values.extraVolumeTags -}}
|
||||
{{- range $key, $value := $evt -}}
|
||||
{{- $noop := printf "%s=%s" $key $value | append $result.pairs | set $result "pairs" -}}
|
||||
{{- end -}}
|
||||
{{- if gt (len $result.pairs) 0 -}}
|
||||
{{- printf "%s=%s" "- --extra-volume-tags" (join "," $result.pairs) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Handle http proxy env vars
|
||||
*/}}
|
||||
{{- define "aws-ebs-csi-driver.http-proxy" -}}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: NO_PROXY
|
||||
value: {{ .Values.proxy.no_proxy | quote }}
|
||||
{{- end -}}
|
||||
|
|
|
|||
|
|
@ -6,18 +6,18 @@ metadata:
|
|||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumes"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["csi.storage.k8s.io"]
|
||||
resources: ["csinodeinfos"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["storage.k8s.io"]
|
||||
resources: ["volumeattachments"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "persistentvolumes" ]
|
||||
verbs: [ "get", "list", "watch", "update", "patch" ]
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "nodes" ]
|
||||
verbs: [ "get", "list", "watch" ]
|
||||
- apiGroups: [ "csi.storage.k8s.io" ]
|
||||
resources: [ "csinodeinfos" ]
|
||||
verbs: [ "get", "list", "watch" ]
|
||||
- apiGroups: [ "storage.k8s.io" ]
|
||||
resources: [ "volumeattachments" ]
|
||||
verbs: [ "get", "list", "watch", "update", "patch" ]
|
||||
- apiGroups: [ "storage.k8s.io" ]
|
||||
resources: [ "volumeattachments/status" ]
|
||||
verbs: [ "patch" ]
|
||||
|
|
|
|||
|
|
@ -0,0 +1,11 @@
|
|||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: ebs-csi-node-role
|
||||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get"]
|
||||
|
|
@ -1,4 +1,3 @@
|
|||
{{- if .Values.enableVolumeResizing }}
|
||||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -12,22 +11,21 @@ rules:
|
|||
# - apiGroups: [""]
|
||||
# resources: ["secrets"]
|
||||
# verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumes"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims/status"]
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["storage.k8s.io"]
|
||||
resources: ["storageclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["list", "watch", "create", "update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
{{- end}}
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "persistentvolumes" ]
|
||||
verbs: [ "get", "list", "watch", "update", "patch" ]
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "persistentvolumeclaims" ]
|
||||
verbs: [ "get", "list", "watch" ]
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "persistentvolumeclaims/status" ]
|
||||
verbs: [ "update", "patch" ]
|
||||
- apiGroups: [ "storage.k8s.io" ]
|
||||
resources: [ "storageclasses" ]
|
||||
verbs: [ "get", "list", "watch" ]
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "events" ]
|
||||
verbs: [ "list", "watch", "create", "update", "patch" ]
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "pods" ]
|
||||
verbs: [ "get", "list", "watch" ]
|
||||
|
|
|
|||
|
|
@ -1,4 +1,3 @@
|
|||
{{- if .Values.enableVolumeSnapshot }}
|
||||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -7,29 +6,27 @@ metadata:
|
|||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["storage.k8s.io"]
|
||||
resources: ["storageclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["list", "watch", "create", "update", "patch"]
|
||||
- apiGroups: ["snapshot.storage.k8s.io"]
|
||||
resources: ["volumesnapshotclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["snapshot.storage.k8s.io"]
|
||||
resources: ["volumesnapshotcontents"]
|
||||
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
||||
- apiGroups: ["snapshot.storage.k8s.io"]
|
||||
resources: ["volumesnapshots"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["snapshot.storage.k8s.io"]
|
||||
resources: ["volumesnapshots/status"]
|
||||
verbs: ["update"]
|
||||
|
||||
{{- end }}
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "persistentvolumes" ]
|
||||
verbs: [ "get", "list", "watch" ]
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "persistentvolumeclaims" ]
|
||||
verbs: [ "get", "list", "watch", "update" ]
|
||||
- apiGroups: [ "storage.k8s.io" ]
|
||||
resources: [ "storageclasses" ]
|
||||
verbs: [ "get", "list", "watch" ]
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "events" ]
|
||||
verbs: [ "list", "watch", "create", "update", "patch" ]
|
||||
- apiGroups: [ "snapshot.storage.k8s.io" ]
|
||||
resources: [ "volumesnapshotclasses" ]
|
||||
verbs: [ "get", "list", "watch" ]
|
||||
- apiGroups: [ "snapshot.storage.k8s.io" ]
|
||||
resources: [ "volumesnapshotcontents" ]
|
||||
verbs: [ "create", "get", "list", "watch", "update", "delete" ]
|
||||
- apiGroups: [ "snapshot.storage.k8s.io" ]
|
||||
resources: [ "volumesnapshots" ]
|
||||
verbs: [ "get", "list", "watch", "update" ]
|
||||
- apiGroups: [ "snapshot.storage.k8s.io" ]
|
||||
resources: [ "volumesnapshots/status" ]
|
||||
verbs: [ "update" ]
|
||||
|
|
|
|||
|
|
@ -1,4 +1,3 @@
|
|||
{{- if .Values.enableVolumeSnapshot }}
|
||||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -7,19 +6,18 @@ metadata:
|
|||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["list", "watch", "create", "update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list"]
|
||||
- apiGroups: ["snapshot.storage.k8s.io"]
|
||||
resources: ["volumesnapshotclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["snapshot.storage.k8s.io"]
|
||||
resources: ["volumesnapshotcontents"]
|
||||
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
||||
- apiGroups: ["snapshot.storage.k8s.io"]
|
||||
resources: ["volumesnapshotcontents/status"]
|
||||
verbs: ["update"]
|
||||
{{- end }}
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "events" ]
|
||||
verbs: [ "list", "watch", "create", "update", "patch" ]
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "secrets" ]
|
||||
verbs: [ "get", "list" ]
|
||||
- apiGroups: [ "snapshot.storage.k8s.io" ]
|
||||
resources: [ "volumesnapshotclasses" ]
|
||||
verbs: [ "get", "list", "watch" ]
|
||||
- apiGroups: [ "snapshot.storage.k8s.io" ]
|
||||
resources: [ "volumesnapshotcontents" ]
|
||||
verbs: [ "create", "get", "list", "watch", "update", "delete" ]
|
||||
- apiGroups: [ "snapshot.storage.k8s.io" ]
|
||||
resources: [ "volumesnapshotcontents/status" ]
|
||||
verbs: [ "update" ]
|
||||
|
|
|
|||
|
|
@ -0,0 +1,15 @@
|
|||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: ebs-csi-node-getter-binding
|
||||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ .Values.serviceAccount.node.name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: ebs-csi-node-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -1,4 +1,3 @@
|
|||
{{- if .Values.enableVolumeResizing }}
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -14,5 +13,3 @@ roleRef:
|
|||
kind: ClusterRole
|
||||
name: ebs-external-resizer-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
{{- end}}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,3 @@
|
|||
{{- if .Values.enableVolumeSnapshot }}
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -14,5 +13,3 @@ roleRef:
|
|||
kind: ClusterRole
|
||||
name: ebs-snapshot-controller-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,3 @@
|
|||
{{- if .Values.enableVolumeSnapshot }}
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -14,5 +13,3 @@ roleRef:
|
|||
kind: ClusterRole
|
||||
name: ebs-external-snapshotter-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ metadata:
|
|||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
replicas: {{ default .Values.replicaCount .Values.controller.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ebs-csi-controller
|
||||
|
|
@ -16,40 +16,46 @@ spec:
|
|||
labels:
|
||||
app: ebs-csi-controller
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 8 }}
|
||||
{{- if .Values.podAnnotations }}
|
||||
annotations: {{ toYaml .Values.podAnnotations | nindent 8 }}
|
||||
{{- if .Values.controller.podLabels }}
|
||||
{{- toYaml .Values.controller.podLabels | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml .Values.controller.podAnnotations | nindent 8 }}
|
||||
{{- else if .Values.podAnnotations}}
|
||||
annotations:
|
||||
{{- toYaml .Values.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
{{- with .Values.nodeSelector }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- with default .Values.nodeSelector .Values.controller.nodeSelector }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ .Values.serviceAccount.controller.name }}
|
||||
priorityClassName: {{ .Values.priorityClassName | default "system-cluster-critical" }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity: {{ toYaml . | nindent 8 }}
|
||||
priorityClassName: {{ default .Values.priorityClassName .Values.controller.priorityClassName }}
|
||||
{{- with default .Values.affinity .Values.controller.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
tolerations:
|
||||
{{- if .Values.tolerateAllTaints }}
|
||||
- operator: Exists
|
||||
{{- else }}
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- operator: Exists
|
||||
effect: NoExecute
|
||||
tolerationSeconds: 300
|
||||
{{- with default .Values.tolerations .Values.controller.tolerations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.topologySpreadConstraints }}
|
||||
{{- $tscLabelSelector := dict "labelSelector" ( dict "matchLabels" ( dict "app" "ebs-csi-controller" ) ) }}
|
||||
{{- if or .Values.controller.topologySpreadConstraints .Values.topologySpreadConstraints }}
|
||||
{{- $tscLabelSelector := dict "labelSelector" ( dict "matchLabels" ( dict "app" "ebs-csi-controller" ) ) }}
|
||||
{{- $constraints := list }}
|
||||
{{- range default .Values.topologySpreadConstraints .Values.controller.topologySpreadConstraints }}
|
||||
{{- $constraints = mustAppend $constraints (mergeOverwrite . $tscLabelSelector) }}
|
||||
{{- end }}
|
||||
topologySpreadConstraints:
|
||||
{{- range .Values.topologySpreadConstraints }}
|
||||
- {{ mergeOverwrite . $tscLabelSelector | toJson }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $constraints | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: ebs-plugin
|
||||
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
||||
|
|
@ -61,17 +67,24 @@ spec:
|
|||
# - {all,controller,node} # specify the driver mode
|
||||
{{- end }}
|
||||
- --endpoint=$(CSI_ENDPOINT)
|
||||
{{- if .Values.extraVolumeTags }}
|
||||
{{- if or .Values.controller.extraVolumeTags .Values.extraVolumeTags }}
|
||||
{{- include "aws-ebs-csi-driver.extra-volume-tags" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.k8sTagClusterId }}
|
||||
- --k8s-tag-cluster-id={{ .Values.k8sTagClusterId }}
|
||||
{{- with default .Values.k8sTagClusterId .Values.controller.k8sTagClusterId }}
|
||||
- --k8s-tag-cluster-id={{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.httpEndpoint }}
|
||||
- --http-endpoint={{ . }}
|
||||
{{- end }}
|
||||
- --logtostderr
|
||||
- --v={{ .Values.logLevel }}
|
||||
- --v={{ .Values.controller.logLevel }}
|
||||
env:
|
||||
- name: CSI_ENDPOINT
|
||||
value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
- name: CSI_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: AWS_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
|
|
@ -84,9 +97,9 @@ spec:
|
|||
name: aws-secret
|
||||
key: access_key
|
||||
optional: true
|
||||
{{- if .Values.region }}
|
||||
{{- with default .Values.region .Values.controller.region }}
|
||||
- name: AWS_REGION
|
||||
value: {{ .Values.region }}
|
||||
value: {{ . }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.extraVars }}
|
||||
{{- range $key, $val := .Values.controller.extraVars }}
|
||||
|
|
@ -94,17 +107,18 @@ spec:
|
|||
value: "{{ $val }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: NO_PROXY
|
||||
value: {{ .Values.proxy.no_proxy | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
{{- include "aws-ebs-csi-driver.http-proxy" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.env.ebsPlugin }}
|
||||
{{- . | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /var/lib/csi/sockets/pluginproxy/
|
||||
- name: aws-token
|
||||
mountPath: "/var/run/secrets/sts.amazonaws.com/serviceaccount/"
|
||||
readOnly: true
|
||||
ports:
|
||||
- name: healthz
|
||||
containerPort: 9808
|
||||
|
|
@ -125,111 +139,104 @@ spec:
|
|||
timeoutSeconds: 3
|
||||
periodSeconds: 10
|
||||
failureThreshold: 5
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- with default .Values.resources (default .Values.controller.resources .Values.controller.containerResources.ebsPlugin) }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: csi-provisioner
|
||||
image: {{ printf "%s:%s" .Values.sidecars.provisionerImage.repository .Values.sidecars.provisionerImage.tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- --v={{ .Values.logLevel }}
|
||||
{{- if .Values.enableVolumeScheduling }}
|
||||
- --v={{ .Values.controller.logLevel }}
|
||||
- --feature-gates=Topology=true
|
||||
{{- end}}
|
||||
{{- if .Values.extraCreateMetadata }}
|
||||
{{- if or .Values.controller.extraCreateMetadata .Values.extraCreateMetadata }}
|
||||
- --extra-create-metadata
|
||||
{{- end}}
|
||||
- --leader-election={{ ternary "true" "false" ( gt (.Values.replicaCount|int) 1 ) }}
|
||||
- --leader-election=true
|
||||
- --default-fstype=ext4
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: NO_PROXY
|
||||
value: {{ .Values.proxy.no_proxy | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
{{- include "aws-ebs-csi-driver.http-proxy" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.env.provisioner }}
|
||||
{{- . | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /var/lib/csi/sockets/pluginproxy/
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- with default .Values.resources (default .Values.controller.resources .Values.controller.containerResources.provisioner) }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: csi-attacher
|
||||
image: {{ printf "%s:%s" .Values.sidecars.attacherImage.repository .Values.sidecars.attacherImage.tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- --v={{ .Values.logLevel }}
|
||||
- --leader-election={{ ternary "true" "false" ( gt (.Values.replicaCount|int) 1 ) }}
|
||||
- --v={{ .Values.controller.logLevel }}
|
||||
- --leader-election=true
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: NO_PROXY
|
||||
value: {{ .Values.proxy.no_proxy | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
{{- include "aws-ebs-csi-driver.http-proxy" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.env.attacher }}
|
||||
{{- . | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /var/lib/csi/sockets/pluginproxy/
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- with default .Values.resources (default .Values.controller.resources .Values.controller.containerResources.attacher) }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.enableVolumeSnapshot }}
|
||||
{{- if or .Values.enableVolumeSnapshot (.Capabilities.APIVersions.Has "snapshot.storage.k8s.io/v1") }}
|
||||
- name: csi-snapshotter
|
||||
image: {{ printf "%s:%s" .Values.sidecars.snapshotterImage.repository .Values.sidecars.snapshotterImage.tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- --leader-election={{ ternary "true" "false" ( gt (.Values.replicaCount|int) 1 ) }}
|
||||
- --leader-election=true
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: NO_PROXY
|
||||
value: {{ .Values.proxy.no_proxy | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
{{- include "aws-ebs-csi-driver.http-proxy" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.env.snapshotter }}
|
||||
{{- . | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /var/lib/csi/sockets/pluginproxy/
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- with default .Values.resources (default .Values.controller.resources .Values.controller.containerResources.snapshotter) }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.enableVolumeResizing }}
|
||||
{{- end }}
|
||||
- name: csi-resizer
|
||||
image: {{ printf "%s:%s" .Values.sidecars.resizerImage.repository .Values.sidecars.resizerImage.tag }}
|
||||
imagePullPolicy: Always
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- --v={{ .Values.logLevel }}
|
||||
- --v={{ .Values.controller.logLevel }}
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: NO_PROXY
|
||||
value: {{ .Values.proxy.no_proxy | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
{{- include "aws-ebs-csi-driver.http-proxy" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.env.resizer }}
|
||||
{{- . | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /var/lib/csi/sockets/pluginproxy/
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- with default .Values.resources (default .Values.controller.resources .Values.controller.containerResources.resizer) }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: liveness-probe
|
||||
image: {{ printf "%s:%s" .Values.sidecars.livenessProbeImage.repository .Values.sidecars.livenessProbeImage.tag }}
|
||||
args:
|
||||
|
|
@ -237,8 +244,9 @@ spec:
|
|||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /csi
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- with default .Values.resources (default .Values.controller.resources .Values.controller.containerResources.liveness) }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
|
|
@ -249,3 +257,10 @@ spec:
|
|||
volumes:
|
||||
- name: socket-dir
|
||||
emptyDir: {}
|
||||
- name: aws-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
expirationSeconds: 86400
|
||||
audience: "sts.amazonaws.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
apiVersion: storage.k8s.io/v1beta1
|
||||
apiVersion: {{ ternary "storage.k8s.io/v1" "storage.k8s.io/v1beta1" (semverCompare ">=1.18.0-0" .Capabilities.KubeVersion.Version) }}
|
||||
kind: CSIDriver
|
||||
metadata:
|
||||
name: ebs.csi.aws.com
|
||||
|
|
|
|||
|
|
@ -0,0 +1,185 @@
|
|||
kind: DaemonSet
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: ebs-csi-node-windows
|
||||
namespace: kube-system
|
||||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ebs-csi-node
|
||||
{{- include "aws-ebs-csi-driver.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ebs-csi-node
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 8 }}
|
||||
{{- if .Values.node.podAnnotations }}
|
||||
annotations: {{ toYaml .Values.node.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: eks.amazonaws.com/compute-type
|
||||
operator: NotIn
|
||||
values:
|
||||
- fargate
|
||||
nodeSelector:
|
||||
kubernetes.io/os: windows
|
||||
{{- with .Values.node.nodeSelector }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ .Values.serviceAccount.node.name }}
|
||||
priorityClassName: {{ .Values.node.priorityClassName | default "system-cluster-critical" }}
|
||||
tolerations:
|
||||
{{- if .Values.node.tolerateAllTaints }}
|
||||
- operator: Exists
|
||||
{{- else }}
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- operator: Exists
|
||||
effect: NoExecute
|
||||
tolerationSeconds: 300
|
||||
{{- end }}
|
||||
{{- with .Values.node.tolerations }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: ebs-plugin
|
||||
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
||||
args:
|
||||
- node
|
||||
- --endpoint=$(CSI_ENDPOINT)
|
||||
{{- if .Values.volumeAttachLimit }}
|
||||
- --volume-attach-limit={{ .Values.volumeAttachLimit }}
|
||||
{{- end }}
|
||||
- --logtostderr
|
||||
- --v=5
|
||||
env:
|
||||
- name: CSI_ENDPOINT
|
||||
value: unix:/csi/csi.sock
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: NO_PROXY
|
||||
value: {{ .Values.proxy.no_proxy | quote }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: kubelet-dir
|
||||
mountPath: C:\var\lib\kubelet
|
||||
mountPropagation: "None"
|
||||
- name: plugin-dir
|
||||
mountPath: C:\csi
|
||||
- name: csi-proxy-disk-pipe
|
||||
mountPath: \\.\pipe\csi-proxy-disk-v1beta2
|
||||
- name: csi-proxy-volume-pipe
|
||||
mountPath: \\.\pipe\csi-proxy-volume-v1beta2
|
||||
- name: csi-proxy-filesystem-pipe
|
||||
mountPath: \\.\pipe\csi-proxy-filesystem-v1beta1
|
||||
ports:
|
||||
- name: healthz
|
||||
containerPort: 9808
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: healthz
|
||||
initialDelaySeconds: 10
|
||||
timeoutSeconds: 3
|
||||
periodSeconds: 10
|
||||
failureThreshold: 5
|
||||
{{- if .Values.node.resources }}
|
||||
{{- with .Values.node.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: node-driver-registrar
|
||||
image: {{ printf "%s:%s" .Values.sidecars.nodeDriverRegistrarImage.repository .Values.sidecars.nodeDriverRegistrarImage.tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
|
||||
- --v=5
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: unix:/csi/csi.sock
|
||||
- name: DRIVER_REG_SOCK_PATH
|
||||
value: C:\var\lib\kubelet\plugins\ebs.csi.aws.com\csi.sock
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: NO_PROXY
|
||||
value: {{ .Values.proxy.no_proxy | quote }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: plugin-dir
|
||||
mountPath: C:\csi
|
||||
- name: registration-dir
|
||||
mountPath: C:\registration
|
||||
{{- if .Values.node.resources }}
|
||||
{{- with .Values.node.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: liveness-probe
|
||||
image: {{ printf "%s:%s" .Values.sidecars.livenessProbeImage.repository .Values.sidecars.livenessProbeImage.tag }}
|
||||
args:
|
||||
- --csi-address=unix:/csi/csi.sock
|
||||
volumeMounts:
|
||||
- name: plugin-dir
|
||||
mountPath: C:\csi
|
||||
{{- if .Values.node.resources }}
|
||||
{{- with .Values.node.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: kubelet-dir
|
||||
hostPath:
|
||||
path: C:\var\lib\kubelet
|
||||
type: Directory
|
||||
- name: plugin-dir
|
||||
hostPath:
|
||||
path: C:\var\lib\kubelet\plugins\ebs.csi.aws.com
|
||||
type: DirectoryOrCreate
|
||||
- name: registration-dir
|
||||
hostPath:
|
||||
path: C:\var\lib\kubelet\plugins_registry
|
||||
type: Directory
|
||||
- name: csi-proxy-disk-pipe
|
||||
hostPath:
|
||||
path: \\.\pipe\csi-proxy-disk-v1beta2
|
||||
type: ""
|
||||
- name: csi-proxy-volume-pipe
|
||||
hostPath:
|
||||
path: \\.\pipe\csi-proxy-volume-v1beta2
|
||||
type: ""
|
||||
- name: csi-proxy-filesystem-pipe
|
||||
hostPath:
|
||||
path: \\.\pipe\csi-proxy-filesystem-v1beta1
|
||||
type: ""
|
||||
|
|
@ -15,8 +15,12 @@ spec:
|
|||
labels:
|
||||
app: ebs-csi-node
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 8 }}
|
||||
{{- if .Values.node.podAnnotations }}
|
||||
annotations: {{ toYaml .Values.node.podAnnotations | nindent 8 }}
|
||||
{{- if .Values.node.podLabels }}
|
||||
{{- toYaml .Values.node.podLabels | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.node.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
affinity:
|
||||
|
|
@ -31,11 +35,10 @@ spec:
|
|||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
{{- with .Values.node.nodeSelector }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
hostNetwork: true
|
||||
serviceAccountName: {{ .Values.serviceAccount.node.name }}
|
||||
priorityClassName: {{ .Values.node.priorityClassName | default "system-cluster-critical" }}
|
||||
priorityClassName: {{ .Values.node.priorityClassName | default "system-node-critical" }}
|
||||
tolerations:
|
||||
{{- if .Values.node.tolerateAllTaints }}
|
||||
- operator: Exists
|
||||
|
|
@ -47,7 +50,7 @@ spec:
|
|||
tolerationSeconds: 300
|
||||
{{- end }}
|
||||
{{- with .Values.node.tolerations }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: ebs-plugin
|
||||
|
|
@ -57,22 +60,24 @@ spec:
|
|||
args:
|
||||
- node
|
||||
- --endpoint=$(CSI_ENDPOINT)
|
||||
{{- if .Values.volumeAttachLimit }}
|
||||
- --volume-attach-limit={{ .Values.volumeAttachLimit }}
|
||||
{{- with default .Values.volumeAttachLimit .Values.node.volumeAttachLimit }}
|
||||
- --volume-attach-limit={{ . }}
|
||||
{{- end }}
|
||||
- --logtostderr
|
||||
- --v={{ .Values.logLevel }}
|
||||
- --v={{ .Values.node.logLevel }}
|
||||
env:
|
||||
- name: CSI_ENDPOINT
|
||||
value: unix:/csi/csi.sock
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: NO_PROXY
|
||||
value: {{ .Values.proxy.no_proxy | quote }}
|
||||
{{- end }}
|
||||
- name: CSI_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
{{- include "aws-ebs-csi-driver.http-proxy" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.node.env.ebsPlugin }}
|
||||
{{- . | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: kubelet-dir
|
||||
mountPath: /var/lib/kubelet
|
||||
|
|
@ -93,47 +98,35 @@ spec:
|
|||
timeoutSeconds: 3
|
||||
periodSeconds: 10
|
||||
failureThreshold: 5
|
||||
{{- if .Values.node.resources }}
|
||||
{{- with .Values.node.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with default .Values.resources (default .Values.node.resources .Values.node.containerResources.ebsPlugin) }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: node-driver-registrar
|
||||
image: {{ printf "%s:%s" .Values.sidecars.nodeDriverRegistrarImage.repository .Values.sidecars.nodeDriverRegistrarImage.tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
|
||||
- --v={{ .Values.logLevel }}
|
||||
- --v={{ .Values.node.logLevel }}
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /csi/csi.sock
|
||||
- name: DRIVER_REG_SOCK_PATH
|
||||
value: /var/lib/kubelet/plugins/ebs.csi.aws.com/csi.sock
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: NO_PROXY
|
||||
value: {{ .Values.proxy.no_proxy | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
{{- include "aws-ebs-csi-driver.http-proxy" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.node.env.nodeDriverRegistrar }}
|
||||
{{- . | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: plugin-dir
|
||||
mountPath: /csi
|
||||
- name: registration-dir
|
||||
mountPath: /registration
|
||||
{{- if .Values.node.resources }}
|
||||
{{- with .Values.node.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with default .Values.resources (default .Values.node.resources .Values.node.containerResources.nodeDriverRegistrar) }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: liveness-probe
|
||||
image: {{ printf "%s:%s" .Values.sidecars.livenessProbeImage.repository .Values.sidecars.livenessProbeImage.tag }}
|
||||
|
|
@ -142,14 +135,9 @@ spec:
|
|||
volumeMounts:
|
||||
- name: plugin-dir
|
||||
mountPath: /csi
|
||||
{{- if .Values.node.resources }}
|
||||
{{- with .Values.node.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with default .Values.resources (default .Values.node.resources .Values.node.containerResources.liveness) }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
|
|
@ -160,15 +148,15 @@ spec:
|
|||
volumes:
|
||||
- name: kubelet-dir
|
||||
hostPath:
|
||||
path: /var/lib/kubelet
|
||||
path: {{ .Values.node.kubeletPath }}
|
||||
type: Directory
|
||||
- name: plugin-dir
|
||||
hostPath:
|
||||
path: /var/lib/kubelet/plugins/ebs.csi.aws.com/
|
||||
path: {{ printf "%s/plugins/ebs.csi.aws.com/" (trimSuffix "/" .Values.node.kubeletPath) }}
|
||||
type: DirectoryOrCreate
|
||||
- name: registration-dir
|
||||
hostPath:
|
||||
path: /var/lib/kubelet/plugins_registry/
|
||||
path: {{ printf "%s/plugins_registry/" (trimSuffix "/" .Values.node.kubeletPath) }}
|
||||
type: Directory
|
||||
- name: device-dir
|
||||
hostPath:
|
||||
|
|
|
|||
|
|
@ -0,0 +1,17 @@
|
|||
{{- $replicas := (default .Values.replicaCount .Values.controller.replicaCount) | int }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: ebs-csi-controller
|
||||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ebs-csi-controller
|
||||
{{- include "aws-ebs-csi-driver.selectorLabels" . | nindent 6 }}
|
||||
{{- if le $replicas 2 }}
|
||||
maxUnavailable: 1
|
||||
{{- else }}
|
||||
minAvailable: 2
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{{- if .Values.enableVolumeSnapshot }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: ebs-snapshot-controller
|
||||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ebs-snapshot-controller
|
||||
{{- include "aws-ebs-csi-driver.selectorLabels" . | nindent 6 }}
|
||||
maxUnavailable: 1
|
||||
{{- end }}
|
||||
|
|
@ -1,4 +1,3 @@
|
|||
{{- if .Values.enableVolumeSnapshot }}
|
||||
---
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -7,8 +6,6 @@ metadata:
|
|||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "watch", "list", "delete", "update", "create"]
|
||||
|
||||
{{- end }}
|
||||
- apiGroups: [ "coordination.k8s.io" ]
|
||||
resources: [ "leases" ]
|
||||
verbs: [ "get", "watch", "list", "delete", "update", "create" ]
|
||||
|
|
|
|||
|
|
@ -1,4 +1,3 @@
|
|||
{{- if .Values.enableVolumeSnapshot }}
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
|
@ -14,5 +13,3 @@ roleRef:
|
|||
kind: Role
|
||||
name: ebs-snapshot-controller-leaderelection
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -6,7 +6,8 @@ metadata:
|
|||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.controller.annotations }}
|
||||
annotations: {{ toYaml . | nindent 4 }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if eq .Release.Name "kustomize" }}
|
||||
#Enable if EKS IAM for SA is used
|
||||
|
|
|
|||
|
|
@ -6,6 +6,7 @@ metadata:
|
|||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.node.annotations }}
|
||||
annotations: {{ toYaml . | nindent 4 }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,3 @@
|
|||
{{- if .Values.enableVolumeSnapshot }}
|
||||
{{- if .Values.serviceAccount.snapshot.create }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
|
@ -8,7 +7,7 @@ metadata:
|
|||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.snapshot.annotations }}
|
||||
annotations: {{ toYaml . | nindent 4 }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ apiVersion: apps/v1
|
|||
metadata:
|
||||
name: ebs-snapshot-controller
|
||||
labels:
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 4 }}
|
||||
spec:
|
||||
serviceName: ebs-snapshot-controller
|
||||
replicas: 1
|
||||
|
|
@ -18,41 +18,46 @@ spec:
|
|||
labels:
|
||||
app: ebs-snapshot-controller
|
||||
{{- include "aws-ebs-csi-driver.labels" . | nindent 8 }}
|
||||
{{- if .Values.snapshotController.podLabels }}
|
||||
{{- toYaml .Values.snapshotController.podLabels | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.snapshotController.podAnnotations }}
|
||||
annotations: {{ toYaml .Values.snapshotController.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ .Values.serviceAccount.snapshot.name }}
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
{{- with .Values.nodeSelector }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
priorityClassName: {{ .Values.priorityClassName | default "system-cluster-critical" }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity: {{ toYaml . | nindent 8 }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
tolerations:
|
||||
{{- if .Values.tolerateAllTaints }}
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- operator: Exists
|
||||
{{- end }}
|
||||
effect: NoExecute
|
||||
tolerationSeconds: 300
|
||||
{{- with .Values.tolerations }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: snapshot-controller
|
||||
image: {{ printf "%s:%s" .Values.snapshotController.repository .Values.snapshotController.tag }}
|
||||
{{- with .Values.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
env:
|
||||
{{- if .Values.proxy.http_proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ .Values.proxy.http_proxy | quote }}
|
||||
- name: NO_PROXY
|
||||
value: {{ .Values.proxy.no_proxy | quote }}
|
||||
{{- end }}
|
||||
{{- include "aws-ebs-csi-driver.http-proxy" . | nindent 12 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- --v={{ .Values.logLevel }}
|
||||
- --v=2
|
||||
- --leader-election=false
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
|
|
@ -60,4 +65,4 @@ spec:
|
|||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -4,11 +4,11 @@ kind: StorageClass
|
|||
apiVersion: storage.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ .name }}
|
||||
{{- if .annotations }}
|
||||
annotations: {{- .annotations | toYaml | trim | nindent 4 }}
|
||||
{{- with .annotations }}
|
||||
annotations: {{- . | toYaml | trim | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .labels }}
|
||||
labels: {{- .labels | toYaml | trim | nindent 4 }}
|
||||
{{- with .labels }}
|
||||
labels: {{- . | toYaml | trim | nindent 4 }}
|
||||
{{- end }}
|
||||
provisioner: ebs.csi.aws.com
|
||||
{{ omit (dict "volumeBindingMode" "WaitForFirstConsumer" | merge .) "name" "annotations" "labels" | toYaml }}
|
||||
|
|
|
|||
|
|
@ -2,22 +2,18 @@
|
|||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
replicaCount: 2
|
||||
|
||||
image:
|
||||
repository: k8s.gcr.io/provider-aws/aws-ebs-csi-driver
|
||||
tag: "v0.10.0"
|
||||
tag: "v1.1.1"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
logLevel: 5
|
||||
|
||||
sidecars:
|
||||
provisionerImage:
|
||||
repository: k8s.gcr.io/sig-storage/csi-provisioner
|
||||
tag: "v2.0.2"
|
||||
tag: "v2.1.1"
|
||||
attacherImage:
|
||||
repository: k8s.gcr.io/sig-storage/csi-attacher
|
||||
tag: "v3.0.0"
|
||||
tag: "v3.1.0"
|
||||
snapshotterImage:
|
||||
repository: k8s.gcr.io/sig-storage/csi-snapshotter
|
||||
tag: "v3.0.3"
|
||||
|
|
@ -29,97 +25,128 @@ sidecars:
|
|||
tag: "v1.0.0"
|
||||
nodeDriverRegistrarImage:
|
||||
repository: k8s.gcr.io/sig-storage/csi-node-driver-registrar
|
||||
tag: "v2.0.1"
|
||||
tag: "v2.1.0"
|
||||
|
||||
snapshotController:
|
||||
repository: k8s.gcr.io/sig-storage/snapshot-controller
|
||||
tag: "v3.0.3"
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
proxy: {}
|
||||
# http_proxy:
|
||||
# no_proxy:
|
||||
proxy:
|
||||
http_proxy:
|
||||
no_proxy:
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
# True if enable volume scheduling for dynamic volume provisioning
|
||||
enableVolumeScheduling: true
|
||||
|
||||
# True if enable volume resizing
|
||||
enableVolumeResizing: false
|
||||
nameOverride:
|
||||
fullnameOverride:
|
||||
|
||||
# True if enable volume snapshot
|
||||
enableVolumeSnapshot: false
|
||||
|
||||
# The "maximum number of attachable volumes" per node
|
||||
volumeAttachLimit: ""
|
||||
# Moving to values under controller
|
||||
affinity: {}
|
||||
extraCreateMetadata: true
|
||||
extraVolumeTags: {}
|
||||
k8sTagClusterId:
|
||||
nodeSelector: {}
|
||||
podAnnotations: {}
|
||||
priorityClassName: "system-cluster-critical"
|
||||
region:
|
||||
replicaCount: 2
|
||||
resources: {}
|
||||
tolerations: []
|
||||
topologySpreadConstraints: []
|
||||
|
||||
resources:
|
||||
{}
|
||||
controller:
|
||||
affinity: {}
|
||||
# True if enable volume scheduling for dynamic volume provisioning
|
||||
env:
|
||||
ebsPlugin: []
|
||||
provisioner: []
|
||||
attacher: []
|
||||
snapshotter: []
|
||||
resizer: []
|
||||
# If set, add pv/pvc metadata to plugin create requests as parameters.
|
||||
extraCreateMetadata: true
|
||||
# Will be removed in later version in favor of env.ebsPlugin
|
||||
extraVars: {}
|
||||
# Extra volume tags to attach to each dynamically provisioned volume.
|
||||
# ---
|
||||
# extraVolumeTags:
|
||||
# key1: value1
|
||||
# key2: value2
|
||||
extraVolumeTags: {}
|
||||
httpEndpoint:
|
||||
# ID of the Kubernetes cluster used for tagging provisioned EBS volumes (optional).
|
||||
k8sTagClusterId:
|
||||
logLevel: 2
|
||||
nodeSelector: {}
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
priorityClassName:
|
||||
# AWS region to use. If not specified then the region will be looked up via the AWS EC2 metadata
|
||||
# service.
|
||||
# ---
|
||||
# region: us-east-1
|
||||
region:
|
||||
replicaCount:
|
||||
resources: {}
|
||||
containerResources:
|
||||
ebsPlugin: {}
|
||||
provisioner: {}
|
||||
attacher: {}
|
||||
snapshotter: {}
|
||||
resizer: {}
|
||||
liveness: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# Note that you will need to set resource requests if you want the cluster autoscaler to
|
||||
# scale your nodes when you increase/decrease the number of ebs-csi-controller replicas.
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
tolerations: []
|
||||
# TSCs without the label selector stanza
|
||||
#
|
||||
# Example:
|
||||
#
|
||||
# topologySpreadConstraints:
|
||||
# - maxSkew: 1
|
||||
# topologyKey: topology.kubernetes.io/zone
|
||||
# whenUnsatisfiable: ScheduleAnyway
|
||||
# - maxSkew: 1
|
||||
# topologyKey: kubernetes.io/hostname
|
||||
# whenUnsatisfiable: ScheduleAnyway
|
||||
topologySpreadConstraints: []
|
||||
|
||||
priorityClassName: ""
|
||||
nodeSelector: {}
|
||||
tolerateAllTaints: false
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
# TSCs without the label selector stanza
|
||||
#
|
||||
# Example:
|
||||
#
|
||||
# topologySpreadConstraints:
|
||||
# - maxSkew: 1
|
||||
# topologyKey: topology.kubernetes.io/zone
|
||||
# whenUnsatisfiable: ScheduleAnyway
|
||||
# - maxSkew: 1
|
||||
# topologyKey: kubernetes.io/hostname
|
||||
# whenUnsatisfiable: ScheduleAnyway
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
# Extra volume tags to attach to each dynamically provisioned volume.
|
||||
# ---
|
||||
# extraVolumeTags:
|
||||
# key1: value1
|
||||
# key2: value2
|
||||
extraVolumeTags: {}
|
||||
|
||||
# If set, add pv/pvc metadata to plugin create requests as parameters.
|
||||
extraCreateMetadata: false
|
||||
|
||||
# ID of the Kubernetes cluster used for tagging provisioned EBS volumes (optional).
|
||||
k8sTagClusterId: ""
|
||||
|
||||
# AWS region to use. If not specified then the region will be looked up via the AWS EC2 metadata
|
||||
# service.
|
||||
# ---
|
||||
# region: us-east-1
|
||||
region: ""
|
||||
|
||||
# Additonal environment variables for the controller
|
||||
controller:
|
||||
extraVars: {}
|
||||
# Moving to values under node
|
||||
# The "maximum number of attachable volumes" per node
|
||||
volumeAttachLimit:
|
||||
|
||||
node:
|
||||
priorityClassName: ""
|
||||
env:
|
||||
ebsPlugin: []
|
||||
nodeDriverRegistrar: []
|
||||
kubeletPath: /var/lib/kubelet
|
||||
logLevel: 2
|
||||
priorityClassName:
|
||||
nodeSelector: {}
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
tolerateAllTaints: false
|
||||
tolerations: []
|
||||
resources: {}
|
||||
containerResources:
|
||||
ebsPlugin: {}
|
||||
nodeDriverRegistrar: {}
|
||||
liveness: {}
|
||||
volumeAttachLimit:
|
||||
|
||||
serviceAccount:
|
||||
controller:
|
||||
|
|
|
|||
|
|
@ -1,420 +0,0 @@
|
|||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (devel)
|
||||
api-approved.kubernetes.io: "https://github.com/kubernetes-csi/external-snapshotter/pull/139"
|
||||
creationTimestamp: null
|
||||
name: volumesnapshotclasses.snapshot.storage.k8s.io
|
||||
spec:
|
||||
group: snapshot.storage.k8s.io
|
||||
names:
|
||||
kind: VolumeSnapshotClass
|
||||
listKind: VolumeSnapshotClassList
|
||||
plural: volumesnapshotclasses
|
||||
singular: volumesnapshotclass
|
||||
scope: Cluster
|
||||
preserveUnknownFields: false
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
description: VolumeSnapshotClass specifies parameters that a underlying storage
|
||||
system uses when creating a volume snapshot. A specific VolumeSnapshotClass
|
||||
is used by specifying its name in a VolumeSnapshot object. VolumeSnapshotClasses
|
||||
are non-namespaced
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
|
||||
type: string
|
||||
deletionPolicy:
|
||||
description: deletionPolicy determines whether a VolumeSnapshotContent created
|
||||
through the VolumeSnapshotClass should be deleted when its bound VolumeSnapshot
|
||||
is deleted. Supported values are "Retain" and "Delete". "Retain" means
|
||||
that the VolumeSnapshotContent and its physical snapshot on underlying
|
||||
storage system are kept. "Delete" means that the VolumeSnapshotContent
|
||||
and its physical snapshot on underlying storage system are deleted. Required.
|
||||
enum:
|
||||
- Delete
|
||||
- Retain
|
||||
type: string
|
||||
driver:
|
||||
description: driver is the name of the storage driver that handles this
|
||||
VolumeSnapshotClass. Required.
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
parameters:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: parameters is a key-value map with storage driver specific
|
||||
parameters for creating snapshots. These values are opaque to Kubernetes.
|
||||
type: object
|
||||
required:
|
||||
- deletionPolicy
|
||||
- driver
|
||||
type: object
|
||||
version: v1beta1
|
||||
versions:
|
||||
- name: v1beta1
|
||||
served: true
|
||||
storage: true
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (devel)
|
||||
api-approved.kubernetes.io: "https://github.com/kubernetes-csi/external-snapshotter/pull/139"
|
||||
creationTimestamp: null
|
||||
name: volumesnapshotcontents.snapshot.storage.k8s.io
|
||||
spec:
|
||||
group: snapshot.storage.k8s.io
|
||||
names:
|
||||
kind: VolumeSnapshotContent
|
||||
listKind: VolumeSnapshotContentList
|
||||
plural: volumesnapshotcontents
|
||||
singular: volumesnapshotcontent
|
||||
scope: Cluster
|
||||
subresources:
|
||||
status: {}
|
||||
preserveUnknownFields: false
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
description: VolumeSnapshotContent represents the actual "on-disk" snapshot
|
||||
object in the underlying storage system
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
spec:
|
||||
description: spec defines properties of a VolumeSnapshotContent created
|
||||
by the underlying storage system. Required.
|
||||
properties:
|
||||
deletionPolicy:
|
||||
description: deletionPolicy determines whether this VolumeSnapshotContent
|
||||
and its physical snapshot on the underlying storage system should
|
||||
be deleted when its bound VolumeSnapshot is deleted. Supported values
|
||||
are "Retain" and "Delete". "Retain" means that the VolumeSnapshotContent
|
||||
and its physical snapshot on underlying storage system are kept. "Delete"
|
||||
means that the VolumeSnapshotContent and its physical snapshot on
|
||||
underlying storage system are deleted. In dynamic snapshot creation
|
||||
case, this field will be filled in with the "DeletionPolicy" field
|
||||
defined in the VolumeSnapshotClass the VolumeSnapshot refers to. For
|
||||
pre-existing snapshots, users MUST specify this field when creating
|
||||
the VolumeSnapshotContent object. Required.
|
||||
enum:
|
||||
- Delete
|
||||
- Retain
|
||||
type: string
|
||||
driver:
|
||||
description: driver is the name of the CSI driver used to create the
|
||||
physical snapshot on the underlying storage system. This MUST be the
|
||||
same as the name returned by the CSI GetPluginName() call for that
|
||||
driver. Required.
|
||||
type: string
|
||||
source:
|
||||
description: source specifies from where a snapshot will be created.
|
||||
This field is immutable after creation. Required.
|
||||
properties:
|
||||
snapshotHandle:
|
||||
description: snapshotHandle specifies the CSI "snapshot_id" of a
|
||||
pre-existing snapshot on the underlying storage system. This field
|
||||
is immutable.
|
||||
type: string
|
||||
volumeHandle:
|
||||
description: volumeHandle specifies the CSI "volume_id" of the volume
|
||||
from which a snapshot should be dynamically taken from. This field
|
||||
is immutable.
|
||||
type: string
|
||||
type: object
|
||||
volumeSnapshotClassName:
|
||||
description: name of the VolumeSnapshotClass to which this snapshot
|
||||
belongs.
|
||||
type: string
|
||||
volumeSnapshotRef:
|
||||
description: volumeSnapshotRef specifies the VolumeSnapshot object to
|
||||
which this VolumeSnapshotContent object is bound. VolumeSnapshot.Spec.VolumeSnapshotContentName
|
||||
field must reference to this VolumeSnapshotContent's name for the
|
||||
bidirectional binding to be valid. For a pre-existing VolumeSnapshotContent
|
||||
object, name and namespace of the VolumeSnapshot object MUST be provided
|
||||
for binding to happen. This field is immutable after creation. Required.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: 'If referring to a piece of an object instead of an
|
||||
entire object, this string should contain a valid JSON/Go field
|
||||
access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within
|
||||
a pod, this would take on a value like: "spec.containers{name}"
|
||||
(where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]"
|
||||
(container with index 2 in this pod). This syntax is chosen only
|
||||
to have some well-defined way of referencing a part of an object.
|
||||
TODO: this design is not final and this field is subject to change
|
||||
in the future.'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||
type: string
|
||||
namespace:
|
||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: 'Specific resourceVersion to which this reference is
|
||||
made, if any. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#concurrency-control-and-consistency'
|
||||
type: string
|
||||
uid:
|
||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- deletionPolicy
|
||||
- driver
|
||||
- source
|
||||
- volumeSnapshotRef
|
||||
type: object
|
||||
status:
|
||||
description: status represents the current information of a snapshot.
|
||||
properties:
|
||||
creationTime:
|
||||
description: creationTime is the timestamp when the point-in-time snapshot
|
||||
is taken by the underlying storage system. In dynamic snapshot creation
|
||||
case, this field will be filled in with the "creation_time" value
|
||||
returned from CSI "CreateSnapshotRequest" gRPC call. For a pre-existing
|
||||
snapshot, this field will be filled with the "creation_time" value
|
||||
returned from the CSI "ListSnapshots" gRPC call if the driver supports
|
||||
it. If not specified, it indicates the creation time is unknown. The
|
||||
format of this field is a Unix nanoseconds time encoded as an int64.
|
||||
On Unix, the command `date +%s%N` returns the current time in nanoseconds
|
||||
since 1970-01-01 00:00:00 UTC.
|
||||
format: int64
|
||||
type: integer
|
||||
error:
|
||||
description: error is the latest observed error during snapshot creation,
|
||||
if any.
|
||||
properties:
|
||||
message:
|
||||
description: 'message is a string detailing the encountered error
|
||||
during snapshot creation if specified. NOTE: message may be logged,
|
||||
and it should not contain sensitive information.'
|
||||
type: string
|
||||
time:
|
||||
description: time is the timestamp when the error was encountered.
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
readyToUse:
|
||||
description: readyToUse indicates if a snapshot is ready to be used
|
||||
to restore a volume. In dynamic snapshot creation case, this field
|
||||
will be filled in with the "ready_to_use" value returned from CSI
|
||||
"CreateSnapshotRequest" gRPC call. For a pre-existing snapshot, this
|
||||
field will be filled with the "ready_to_use" value returned from the
|
||||
CSI "ListSnapshots" gRPC call if the driver supports it, otherwise,
|
||||
this field will be set to "True". If not specified, it means the readiness
|
||||
of a snapshot is unknown.
|
||||
type: boolean
|
||||
restoreSize:
|
||||
description: restoreSize represents the complete size of the snapshot
|
||||
in bytes. In dynamic snapshot creation case, this field will be filled
|
||||
in with the "size_bytes" value returned from CSI "CreateSnapshotRequest"
|
||||
gRPC call. For a pre-existing snapshot, this field will be filled
|
||||
with the "size_bytes" value returned from the CSI "ListSnapshots"
|
||||
gRPC call if the driver supports it. When restoring a volume from
|
||||
this snapshot, the size of the volume MUST NOT be smaller than the
|
||||
restoreSize if it is specified, otherwise the restoration will fail.
|
||||
If not specified, it indicates that the size is unknown.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
snapshotHandle:
|
||||
description: snapshotHandle is the CSI "snapshot_id" of a snapshot on
|
||||
the underlying storage system. If not specified, it indicates that
|
||||
dynamic snapshot creation has either failed or it is still in progress.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
version: v1beta1
|
||||
versions:
|
||||
- name: v1beta1
|
||||
served: true
|
||||
storage: true
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: (devel)
|
||||
api-approved.kubernetes.io: "https://github.com/kubernetes-csi/external-snapshotter/pull/139"
|
||||
creationTimestamp: null
|
||||
name: volumesnapshots.snapshot.storage.k8s.io
|
||||
spec:
|
||||
group: snapshot.storage.k8s.io
|
||||
names:
|
||||
kind: VolumeSnapshot
|
||||
listKind: VolumeSnapshotList
|
||||
plural: volumesnapshots
|
||||
singular: volumesnapshot
|
||||
scope: Namespaced
|
||||
subresources:
|
||||
status: {}
|
||||
preserveUnknownFields: false
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
description: VolumeSnapshot is a user's request for either creating a point-in-time
|
||||
snapshot of a persistent volume, or binding to a pre-existing snapshot.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
spec:
|
||||
description: 'spec defines the desired characteristics of a snapshot requested
|
||||
by a user. More info: https://kubernetes.io/docs/concepts/storage/volume-snapshots#volumesnapshots
|
||||
Required.'
|
||||
properties:
|
||||
source:
|
||||
description: source specifies where a snapshot will be created from.
|
||||
This field is immutable after creation. Required.
|
||||
properties:
|
||||
persistentVolumeClaimName:
|
||||
description: persistentVolumeClaimName specifies the name of the
|
||||
PersistentVolumeClaim object in the same namespace as the VolumeSnapshot
|
||||
object where the snapshot should be dynamically taken from. This
|
||||
field is immutable.
|
||||
type: string
|
||||
volumeSnapshotContentName:
|
||||
description: volumeSnapshotContentName specifies the name of a pre-existing
|
||||
VolumeSnapshotContent object. This field is immutable.
|
||||
type: string
|
||||
type: object
|
||||
volumeSnapshotClassName:
|
||||
description: 'volumeSnapshotClassName is the name of the VolumeSnapshotClass
|
||||
requested by the VolumeSnapshot. If not specified, the default snapshot
|
||||
class will be used if one exists. If not specified, and there is no
|
||||
default snapshot class, dynamic snapshot creation will fail. Empty
|
||||
string is not allowed for this field. TODO(xiangqian): a webhook validation
|
||||
on empty string. More info: https://kubernetes.io/docs/concepts/storage/volume-snapshot-classes'
|
||||
type: string
|
||||
required:
|
||||
- source
|
||||
type: object
|
||||
status:
|
||||
description: 'status represents the current information of a snapshot. NOTE:
|
||||
status can be modified by sources other than system controllers, and must
|
||||
not be depended upon for accuracy. Controllers should only use information
|
||||
from the VolumeSnapshotContent object after verifying that the binding
|
||||
is accurate and complete.'
|
||||
properties:
|
||||
boundVolumeSnapshotContentName:
|
||||
description: 'boundVolumeSnapshotContentName represents the name of
|
||||
the VolumeSnapshotContent object to which the VolumeSnapshot object
|
||||
is bound. If not specified, it indicates that the VolumeSnapshot object
|
||||
has not been successfully bound to a VolumeSnapshotContent object
|
||||
yet. NOTE: Specified boundVolumeSnapshotContentName alone does not
|
||||
mean binding is valid. Controllers MUST always verify bidirectional
|
||||
binding between VolumeSnapshot and VolumeSnapshotContent to
|
||||
avoid possible security issues.'
|
||||
type: string
|
||||
creationTime:
|
||||
description: creationTime is the timestamp when the point-in-time snapshot
|
||||
is taken by the underlying storage system. In dynamic snapshot creation
|
||||
case, this field will be filled in with the "creation_time" value
|
||||
returned from CSI "CreateSnapshotRequest" gRPC call. For a pre-existing
|
||||
snapshot, this field will be filled with the "creation_time" value
|
||||
returned from the CSI "ListSnapshots" gRPC call if the driver supports
|
||||
it. If not specified, it indicates that the creation time of the snapshot
|
||||
is unknown.
|
||||
format: date-time
|
||||
type: string
|
||||
error:
|
||||
description: error is the last observed error during snapshot creation,
|
||||
if any. This field could be helpful to upper level controllers(i.e.,
|
||||
application controller) to decide whether they should continue on
|
||||
waiting for the snapshot to be created based on the type of error
|
||||
reported.
|
||||
properties:
|
||||
message:
|
||||
description: 'message is a string detailing the encountered error
|
||||
during snapshot creation if specified. NOTE: message may be logged,
|
||||
and it should not contain sensitive information.'
|
||||
type: string
|
||||
time:
|
||||
description: time is the timestamp when the error was encountered.
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
readyToUse:
|
||||
description: readyToUse indicates if a snapshot is ready to be used
|
||||
to restore a volume. In dynamic snapshot creation case, this field
|
||||
will be filled in with the "ready_to_use" value returned from CSI
|
||||
"CreateSnapshotRequest" gRPC call. For a pre-existing snapshot, this
|
||||
field will be filled with the "ready_to_use" value returned from the
|
||||
CSI "ListSnapshots" gRPC call if the driver supports it, otherwise,
|
||||
this field will be set to "True". If not specified, it means the readiness
|
||||
of a snapshot is unknown.
|
||||
type: boolean
|
||||
restoreSize:
|
||||
description: restoreSize represents the complete size of the snapshot
|
||||
in bytes. In dynamic snapshot creation case, this field will be filled
|
||||
in with the "size_bytes" value returned from CSI "CreateSnapshotRequest"
|
||||
gRPC call. For a pre-existing snapshot, this field will be filled
|
||||
with the "size_bytes" value returned from the CSI "ListSnapshots"
|
||||
gRPC call if the driver supports it. When restoring a volume from
|
||||
this snapshot, the size of the volume MUST NOT be smaller than the
|
||||
restoreSize if it is specified, otherwise the restoration will fail.
|
||||
If not specified, it indicates that the size is unknown.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
version: v1beta1
|
||||
versions:
|
||||
- name: v1beta1
|
||||
served: true
|
||||
storage: true
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
|
@ -1,103 +0,0 @@
|
|||
diff -rtubN aws-ebs-csi-driver.orig/templates/controller.yaml aws-ebs-csi-driver/templates/controller.yaml
|
||||
--- aws-ebs-csi-driver.orig/templates/controller.yaml 2021-03-05 03:10:41.000000000 +0100
|
||||
+++ aws-ebs-csi-driver/templates/controller.yaml 2021-03-05 10:29:31.878615411 +0100
|
||||
@@ -68,7 +68,7 @@
|
||||
- --k8s-tag-cluster-id={{ .Values.k8sTagClusterId }}
|
||||
{{- end }}
|
||||
- --logtostderr
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.logLevel }}
|
||||
env:
|
||||
- name: CSI_ENDPOINT
|
||||
value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
@@ -126,14 +126,14 @@
|
||||
image: {{ printf "%s:%s" .Values.sidecars.provisionerImage.repository .Values.sidecars.provisionerImage.tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.logLevel }}
|
||||
{{- if .Values.enableVolumeScheduling }}
|
||||
- --feature-gates=Topology=true
|
||||
{{- end}}
|
||||
{{- if .Values.extraCreateMetadata }}
|
||||
- --extra-create-metadata
|
||||
{{- end}}
|
||||
- - --leader-election=true
|
||||
+ - --leader-election={{ ternary "true" "false" ( gt (.Values.replicaCount|int) 1 ) }}
|
||||
- --default-fstype=ext4
|
||||
env:
|
||||
- name: ADDRESS
|
||||
@@ -156,8 +156,8 @@
|
||||
image: {{ printf "%s:%s" .Values.sidecars.attacherImage.repository .Values.sidecars.attacherImage.tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- - --v=5
|
||||
- - --leader-election=true
|
||||
+ - --v={{ .Values.logLevel }}
|
||||
+ - --leader-election={{ ternary "true" "false" ( gt (.Values.replicaCount|int) 1 ) }}
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
@@ -180,7 +180,7 @@
|
||||
image: {{ printf "%s:%s" .Values.sidecars.snapshotterImage.repository .Values.sidecars.snapshotterImage.tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- - --leader-election=true
|
||||
+ - --leader-election={{ ternary "true" "false" ( gt (.Values.replicaCount|int) 1 ) }}
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
@@ -205,7 +205,7 @@
|
||||
imagePullPolicy: Always
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.logLevel }}
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
diff -rtubN aws-ebs-csi-driver.orig/templates/node.yaml aws-ebs-csi-driver/templates/node.yaml
|
||||
--- aws-ebs-csi-driver.orig/templates/node.yaml 2021-03-05 03:10:41.000000000 +0100
|
||||
+++ aws-ebs-csi-driver/templates/node.yaml 2021-03-05 10:30:07.391950366 +0100
|
||||
@@ -61,7 +61,7 @@
|
||||
- --volume-attach-limit={{ .Values.volumeAttachLimit }}
|
||||
{{- end }}
|
||||
- --logtostderr
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.logLevel }}
|
||||
env:
|
||||
- name: CSI_ENDPOINT
|
||||
value: unix:/csi/csi.sock
|
||||
@@ -107,7 +107,7 @@
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.logLevel }}
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /csi/csi.sock
|
||||
diff -rtubN aws-ebs-csi-driver.orig/templates/statefulset.yaml aws-ebs-csi-driver/templates/statefulset.yaml
|
||||
--- aws-ebs-csi-driver.orig/templates/statefulset.yaml 2021-03-05 03:10:41.000000000 +0100
|
||||
+++ aws-ebs-csi-driver/templates/statefulset.yaml 2021-03-05 10:29:31.881948744 +0100
|
||||
@@ -49,7 +49,7 @@
|
||||
value: {{ .Values.proxy.no_proxy | quote }}
|
||||
{{- end }}
|
||||
args:
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.logLevel }}
|
||||
- --leader-election=false
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
diff -rtubN aws-ebs-csi-driver.orig/values.yaml aws-ebs-csi-driver/values.yaml
|
||||
--- aws-ebs-csi-driver.orig/values.yaml 2021-03-05 03:10:41.000000000 +0100
|
||||
+++ aws-ebs-csi-driver/values.yaml 2021-03-05 10:29:31.881948744 +0100
|
||||
@@ -9,6 +9,8 @@
|
||||
tag: "v0.9.0"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
+logLevel: 5
|
||||
+
|
||||
sidecars:
|
||||
provisionerImage:
|
||||
repository: k8s.gcr.io/sig-storage/csi-provisioner
|
||||
|
|
@ -0,0 +1,87 @@
|
|||
diff -rtubN charts/aws-ebs-csi-driver/templates/controller.yaml charts/aws-ebs-csi-driver.zdt/templates/controller.yaml
|
||||
--- charts/aws-ebs-csi-driver/templates/controller.yaml 2021-06-17 22:22:22.000000000 +0200
|
||||
+++ charts/aws-ebs-csi-driver.zdt/templates/controller.yaml 2021-06-24 16:31:37.042386198 +0200
|
||||
@@ -116,6 +116,9 @@
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /var/lib/csi/sockets/pluginproxy/
|
||||
+ - name: aws-token
|
||||
+ mountPath: "/var/run/secrets/sts.amazonaws.com/serviceaccount/"
|
||||
+ readOnly: true
|
||||
ports:
|
||||
- name: healthz
|
||||
containerPort: 9808
|
||||
@@ -144,7 +147,7 @@
|
||||
image: {{ printf "%s:%s" .Values.sidecars.provisionerImage.repository .Values.sidecars.provisionerImage.tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.controller.logLevel }}
|
||||
- --feature-gates=Topology=true
|
||||
{{- if or .Values.controller.extraCreateMetadata .Values.extraCreateMetadata }}
|
||||
- --extra-create-metadata
|
||||
@@ -171,7 +174,7 @@
|
||||
image: {{ printf "%s:%s" .Values.sidecars.attacherImage.repository .Values.sidecars.attacherImage.tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.controller.logLevel }}
|
||||
- --leader-election=true
|
||||
env:
|
||||
- name: ADDRESS
|
||||
@@ -215,7 +218,7 @@
|
||||
imagePullPolicy: Always
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.controller.logLevel }}
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
@@ -252,3 +255,10 @@
|
||||
volumes:
|
||||
- name: socket-dir
|
||||
emptyDir: {}
|
||||
+ - name: aws-token
|
||||
+ projected:
|
||||
+ sources:
|
||||
+ - serviceAccountToken:
|
||||
+ path: token
|
||||
+ expirationSeconds: 86400
|
||||
+ audience: "sts.amazonaws.com"
|
||||
diff -rtubN charts/aws-ebs-csi-driver/templates/node.yaml charts/aws-ebs-csi-driver.zdt/templates/node.yaml
|
||||
--- charts/aws-ebs-csi-driver/templates/node.yaml 2021-06-17 22:22:22.000000000 +0200
|
||||
+++ charts/aws-ebs-csi-driver.zdt/templates/node.yaml 2021-06-24 15:03:44.532351851 +0200
|
||||
@@ -107,7 +107,7 @@
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.node.logLevel }}
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /csi/csi.sock
|
||||
diff -rtubN charts/aws-ebs-csi-driver/templates/snapshot-controller.yaml charts/aws-ebs-csi-driver.zdt/templates/snapshot-controller.yaml
|
||||
--- charts/aws-ebs-csi-driver/templates/snapshot-controller.yaml 2021-06-17 22:22:22.000000000 +0200
|
||||
+++ charts/aws-ebs-csi-driver.zdt/templates/snapshot-controller.yaml 2021-06-24 15:04:17.999018733 +0200
|
||||
@@ -57,7 +57,7 @@
|
||||
{{- include "aws-ebs-csi-driver.http-proxy" . | nindent 12 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- - --v=5
|
||||
+ - --v=2
|
||||
- --leader-election=false
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
diff -rtubN charts/aws-ebs-csi-driver/values.yaml charts/aws-ebs-csi-driver.zdt/values.yaml
|
||||
--- charts/aws-ebs-csi-driver/values.yaml 2021-06-17 22:22:22.000000000 +0200
|
||||
+++ charts/aws-ebs-csi-driver.zdt/values.yaml 2021-06-22 17:08:52.501232371 +0200
|
||||
@@ -56,7 +56,7 @@
|
||||
replicaCount: 2
|
||||
resources: {}
|
||||
tolerations: []
|
||||
-topologySpreadConstraints: []
|
||||
+topolk8sTagClusterIdogySpreadConstraints: []
|
||||
|
||||
controller:
|
||||
affinity: {}
|
||||
|
|
@ -1,8 +1,11 @@
|
|||
#!/bin/bash
|
||||
|
||||
VERSION=0.10.0
|
||||
VERSION=1.2.4
|
||||
|
||||
rm -rf charts/aws-ebs-csi-driver
|
||||
curl -L -s -o - https://github.com/kubernetes-sigs/aws-ebs-csi-driver/releases/download/helm-chart-aws-ebs-csi-driver-${VERSION}/aws-ebs-csi-driver-${VERSION}.tgz | tar xfz - -C charts
|
||||
|
||||
patch -d charts -i ../loglevel_leader.patch -p0 --no-backup-if-mismatch
|
||||
patch -i zdt.patch -p0 --no-backup-if-mismatch
|
||||
|
||||
# Remove duplicated CRDs
|
||||
rm -f charts/aws-ebs-csi-driver/templates/crds.yml
|
||||
|
|
|
|||
|
|
@ -1,33 +1,39 @@
|
|||
aws-ebs-csi-driver:
|
||||
replicaCount: 1
|
||||
logLevel: 1
|
||||
|
||||
enableVolumeScheduling: true
|
||||
enableVolumeResizing: true
|
||||
enableVolumeSnapshot: true
|
||||
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/master: ""
|
||||
controller:
|
||||
replicaCount: 1
|
||||
logLevel: 1
|
||||
|
||||
tolerations:
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/master: ""
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
|
||||
# aws-ebs-csi-driver.podAnnotations -- iam.amazonaws.com/role: <IAM role ARN> to assume
|
||||
podAnnotations: {}
|
||||
# iam.amazonaws.com/role: ''
|
||||
# k8sTagClusterId: <CLUSTER_NAME>
|
||||
|
||||
# aws-ebs-csi-driver.extraVolumeTags -- Optional tags to be added to each EBS volume
|
||||
extraVolumeTags: {}
|
||||
# Name: KubeZero-Cluster
|
||||
#env:
|
||||
# ebsPlugin:
|
||||
#- name: AWS_ROLE_ARN
|
||||
# value: "<ebs-csi-driver IAM ROLE ARN>"
|
||||
#- name: AWS_WEB_IDENTITY_TOKEN_FILE
|
||||
# value: "/var/run/secrets/sts.amazonaws.com/serviceaccount/token"
|
||||
#- name: AWS_STS_REGIONAL_ENDPOINTS
|
||||
# value: regional
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 24Mi
|
||||
limits:
|
||||
# cpu: 50m
|
||||
memory: 40Mi
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 24Mi
|
||||
limits:
|
||||
# cpu: 50m
|
||||
memory: 40Mi
|
||||
node:
|
||||
tolerations:
|
||||
- key: kubezero-workergroup
|
||||
effect: NoSchedule
|
||||
operator: Exists
|
||||
|
||||
storageClasses:
|
||||
- name: ebs-sc-gp2-xfs
|
||||
|
|
@ -46,3 +52,10 @@ aws-ebs-csi-driver:
|
|||
csi.storage.k8s.io/fstype: xfs
|
||||
type: gp3
|
||||
encrypted: "true"
|
||||
|
||||
# This will probably move to snapshot later on
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/master: ""
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
|
|
|
|||
|
|
@ -0,0 +1,75 @@
|
|||
diff -rtubN charts/aws-ebs-csi-driver/templates/controller.yaml charts/aws-ebs-csi-driver.zdt/templates/controller.yaml
|
||||
--- charts/aws-ebs-csi-driver/templates/controller.yaml 2021-06-17 22:22:22.000000000 +0200
|
||||
+++ charts/aws-ebs-csi-driver.zdt/templates/controller.yaml 2021-06-24 16:31:37.042386198 +0200
|
||||
@@ -116,6 +116,9 @@
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /var/lib/csi/sockets/pluginproxy/
|
||||
+ - name: aws-token
|
||||
+ mountPath: "/var/run/secrets/sts.amazonaws.com/serviceaccount/"
|
||||
+ readOnly: true
|
||||
ports:
|
||||
- name: healthz
|
||||
containerPort: 9808
|
||||
@@ -144,7 +147,7 @@
|
||||
image: {{ printf "%s:%s" .Values.sidecars.provisionerImage.repository .Values.sidecars.provisionerImage.tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.controller.logLevel }}
|
||||
- --feature-gates=Topology=true
|
||||
{{- if or .Values.controller.extraCreateMetadata .Values.extraCreateMetadata }}
|
||||
- --extra-create-metadata
|
||||
@@ -171,7 +174,7 @@
|
||||
image: {{ printf "%s:%s" .Values.sidecars.attacherImage.repository .Values.sidecars.attacherImage.tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.controller.logLevel }}
|
||||
- --leader-election=true
|
||||
env:
|
||||
- name: ADDRESS
|
||||
@@ -215,7 +218,7 @@
|
||||
imagePullPolicy: Always
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.controller.logLevel }}
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
@@ -252,3 +255,10 @@
|
||||
volumes:
|
||||
- name: socket-dir
|
||||
emptyDir: {}
|
||||
+ - name: aws-token
|
||||
+ projected:
|
||||
+ sources:
|
||||
+ - serviceAccountToken:
|
||||
+ path: token
|
||||
+ expirationSeconds: 86400
|
||||
+ audience: "sts.amazonaws.com"
|
||||
diff -rtubN charts/aws-ebs-csi-driver/templates/node.yaml charts/aws-ebs-csi-driver.zdt/templates/node.yaml
|
||||
--- charts/aws-ebs-csi-driver/templates/node.yaml 2021-06-17 22:22:22.000000000 +0200
|
||||
+++ charts/aws-ebs-csi-driver.zdt/templates/node.yaml 2021-06-24 15:03:44.532351851 +0200
|
||||
@@ -107,7 +107,7 @@
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
|
||||
- - --v=5
|
||||
+ - --v={{ .Values.node.logLevel }}
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /csi/csi.sock
|
||||
diff -rtubN charts/aws-ebs-csi-driver/templates/snapshot-controller.yaml charts/aws-ebs-csi-driver.zdt/templates/snapshot-controller.yaml
|
||||
--- charts/aws-ebs-csi-driver/templates/snapshot-controller.yaml 2021-06-17 22:22:22.000000000 +0200
|
||||
+++ charts/aws-ebs-csi-driver.zdt/templates/snapshot-controller.yaml 2021-06-24 15:04:17.999018733 +0200
|
||||
@@ -57,7 +57,7 @@
|
||||
{{- include "aws-ebs-csi-driver.http-proxy" . | nindent 12 }}
|
||||
{{- end }}
|
||||
args:
|
||||
- - --v=5
|
||||
+ - --v=2
|
||||
- --leader-election=false
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
|
|
@ -1,8 +1,8 @@
|
|||
apiVersion: v2
|
||||
name: kubezero-aws-efs-csi-driver
|
||||
description: KubeZero Umbrella Chart for aws-efs-csi-driver
|
||||
version: 0.3.5
|
||||
appVersion: 1.2.0
|
||||
version: 0.4.2
|
||||
appVersion: 1.3.2
|
||||
kubeVersion: ">=1.18.0-0"
|
||||
home: https://kubezero.com
|
||||
icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
|
||||
|
|
@ -21,5 +21,5 @@ dependencies:
|
|||
version: ">= 0.1.3"
|
||||
repository: https://zero-down-time.github.io/kubezero/
|
||||
- name: aws-efs-csi-driver
|
||||
version: 1.2.2
|
||||
version: 2.1.3
|
||||
# repository: https://kubernetes-sigs.github.io/aws-efs-csi-driver/
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# kubezero-aws-efs-csi-driver
|
||||
|
||||
 
|
||||
 
|
||||
|
||||
KubeZero Umbrella Chart for aws-efs-csi-driver
|
||||
|
||||
|
|
@ -23,7 +23,7 @@ Kubernetes: `>=1.18.0-0`
|
|||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| | aws-efs-csi-driver | 1.2.1 |
|
||||
| | aws-efs-csi-driver | 2.1.1 |
|
||||
| https://zero-down-time.github.io/kubezero/ | kubezero-lib | >= 0.1.3 |
|
||||
|
||||
## Storage Class
|
||||
|
|
@ -37,11 +37,16 @@ Details also see: [Reserve PV](https://kubernetes.io/docs/concepts/storage/persi
|
|||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| StorageClass.create | bool | `true` | |
|
||||
| StorageClass.default | bool | `false` | |
|
||||
| aws-efs-csi-driver.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].key | string | `"node.kubernetes.io/csi.efs.fs"` | |
|
||||
| aws-efs-csi-driver.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].operator | string | `"Exists"` | |
|
||||
| aws-efs-csi-driver.logLevel | int | `1` | |
|
||||
| aws-efs-csi-driver.resources.limits.memory | string | `"128Mi"` | |
|
||||
| aws-efs-csi-driver.resources.requests.cpu | string | `"20m"` | |
|
||||
| aws-efs-csi-driver.resources.requests.memory | string | `"64Mi"` | |
|
||||
| aws-efs-csi-driver.controller.create | bool | `true` | |
|
||||
| aws-efs-csi-driver.controller.logLevel | int | `1` | |
|
||||
| aws-efs-csi-driver.controller.nodeSelector."node-role.kubernetes.io/master" | string | `""` | |
|
||||
| aws-efs-csi-driver.controller.tolerations[0].effect | string | `"NoSchedule"` | |
|
||||
| aws-efs-csi-driver.controller.tolerations[0].key | string | `"node-role.kubernetes.io/master"` | |
|
||||
| aws-efs-csi-driver.node.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].key | string | `"node.kubernetes.io/csi.efs.fs"` | |
|
||||
| aws-efs-csi-driver.node.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].operator | string | `"Exists"` | |
|
||||
| aws-efs-csi-driver.node.logLevel | int | `1` | |
|
||||
| aws-efs-csi-driver.node.resources.limits.memory | string | `"128Mi"` | |
|
||||
| aws-efs-csi-driver.node.resources.requests.cpu | string | `"20m"` | |
|
||||
| aws-efs-csi-driver.node.resources.requests.memory | string | `"64Mi"` | |
|
||||
| aws-efs-csi-driver.replicaCount | int | `1` | |
|
||||
| aws-efs-csi-driver.storageClasses[0].name | string | `"efs-sc"` | |
|
||||
|
|
|
|||
|
|
@ -1,64 +0,0 @@
|
|||
diff -tubrN charts/aws-efs-csi-driver/templates/node-daemonset.yaml charts/aws-efs-csi-driver.zdt/templates/node-daemonset.yaml
|
||||
--- charts/aws-efs-csi-driver/templates/node-daemonset.yaml 2021-03-23 14:34:03.000000000 +0100
|
||||
+++ charts/aws-efs-csi-driver.zdt/templates/node-daemonset.yaml 2021-04-01 14:31:36.427375803 +0200
|
||||
@@ -40,15 +40,10 @@
|
||||
{{- with .Values.nodeSelector }}
|
||||
{{- . | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
+ {{- with .Values.affinity }}
|
||||
affinity:
|
||||
- nodeAffinity:
|
||||
- requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- nodeSelectorTerms:
|
||||
- - matchExpressions:
|
||||
- - key: eks.amazonaws.com/compute-type
|
||||
- operator: NotIn
|
||||
- values:
|
||||
- - fargate
|
||||
+ {{- . | toYaml | nindent 8 }}
|
||||
+ {{- end }}
|
||||
hostNetwork: true
|
||||
{{- if .Values.dnsPolicy }}
|
||||
dnsPolicy: "{{ .Values.dnsPolicy }}"
|
||||
@@ -99,6 +94,10 @@
|
||||
timeoutSeconds: 3
|
||||
periodSeconds: 2
|
||||
failureThreshold: 5
|
||||
+ {{- with .Values.resources }}
|
||||
+ resources:
|
||||
+ {{- . | toYaml | nindent 12 }}
|
||||
+ {{- end }}
|
||||
- name: csi-driver-registrar
|
||||
image: {{ printf "%s:%s" .Values.sidecars.nodeDriverRegistrarImage.repository .Values.sidecars.nodeDriverRegistrarImage.tag }}
|
||||
args:
|
||||
diff -tubrN charts/aws-efs-csi-driver/values.yaml charts/aws-efs-csi-driver.zdt/values.yaml
|
||||
--- charts/aws-efs-csi-driver/values.yaml 2021-03-23 14:34:03.000000000 +0100
|
||||
+++ charts/aws-efs-csi-driver.zdt/values.yaml 2021-04-01 14:37:21.290724721 +0200
|
||||
@@ -11,8 +11,8 @@
|
||||
|
||||
sidecars:
|
||||
livenessProbeImage:
|
||||
- repository: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe
|
||||
- tag: v2.1.0-eks-1-18-1
|
||||
+ repository: k8s.gcr.io/sig-storage/livenessprobe
|
||||
+ tag: "v2.2.0"
|
||||
nodeDriverRegistrarImage:
|
||||
repository: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar
|
||||
tag: v2.0.1-eks-1-18-1
|
||||
@@ -43,7 +43,15 @@
|
||||
|
||||
tolerations: []
|
||||
|
||||
-affinity: {}
|
||||
+affinity:
|
||||
+ nodeAffinity:
|
||||
+ requiredDuringSchedulingIgnoredDuringExecution:
|
||||
+ nodeSelectorTerms:
|
||||
+ - matchExpressions:
|
||||
+ - key: eks.amazonaws.com/compute-type
|
||||
+ operator: NotIn
|
||||
+ values:
|
||||
+ - fargate
|
||||
|
||||
node:
|
||||
podAnnotations: {}
|
||||
|
|
@ -0,0 +1,112 @@
|
|||
# Helm chart
|
||||
|
||||
# v2.1.3
|
||||
* Bump app/driver version to `v1.3.2`
|
||||
|
||||
# v2.1.2
|
||||
* Add extra-create-metadata
|
||||
|
||||
# v2.1.1
|
||||
* Update app/driver version to `v1.3.1`
|
||||
|
||||
# v2.1.0
|
||||
|
||||
## New features
|
||||
* Update app/driver version to `v1.3.0`
|
||||
|
||||
## Bug fixes
|
||||
* Put comments back in place inside the values file ([#475](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/475), [@pierluigilenoci](https://github.com/pierluigilenoci))
|
||||
|
||||
# v2.0.1
|
||||
|
||||
## Bug fixes
|
||||
* Helm chart: fix reclaimPolicy and volumeBindingMode ([#464](https://github.com/kubernetes-sigs/aws-efs-csi-driver/pull/464), [@devinsmith911](https://github.com/devinsmith911))
|
||||
|
||||
|
||||
# v2.0.0
|
||||
|
||||
## Breaking changes
|
||||
|
||||
Multiple changes in values file at `sidecars`, `controller` and `node`
|
||||
|
||||
---
|
||||
```yaml
|
||||
sidecars:
|
||||
xxxxxxxxx:
|
||||
repository:
|
||||
tag:
|
||||
```
|
||||
|
||||
Moving to
|
||||
|
||||
```yaml
|
||||
sidecars:
|
||||
xxxxxxxxx:
|
||||
image:
|
||||
repository:
|
||||
tag:
|
||||
```
|
||||
|
||||
---
|
||||
```yaml
|
||||
podAnnotations:
|
||||
resources:
|
||||
nodeSelector:
|
||||
tolerations:
|
||||
affinity:
|
||||
```
|
||||
|
||||
Moving to
|
||||
|
||||
```yaml
|
||||
controller:
|
||||
podAnnotations:
|
||||
resources:
|
||||
nodeSelector:
|
||||
tolerations:
|
||||
affinity:
|
||||
```
|
||||
|
||||
---
|
||||
```yaml
|
||||
hostAliases:
|
||||
dnsPolicy:
|
||||
dnsConfig:
|
||||
```
|
||||
|
||||
Moving to
|
||||
|
||||
```yaml
|
||||
node:
|
||||
hostAliases:
|
||||
dnsPolicy:
|
||||
dnsConfig:
|
||||
```
|
||||
|
||||
---
|
||||
```yaml
|
||||
serviceAccount:
|
||||
controller:
|
||||
```
|
||||
|
||||
Moving to
|
||||
|
||||
```yaml
|
||||
controller:
|
||||
serviceAccount:
|
||||
```
|
||||
|
||||
## New features
|
||||
|
||||
* Chart API `v2` (requires Helm 3)
|
||||
* Set `resources` and `imagePullPolicy` fields independently for containers
|
||||
* Set `logLevel`, `affinity`, `nodeSelector`, `podAnnotations` and `tolerations` fields independently
|
||||
for Controller deployment and Node daemonset
|
||||
* Set `reclaimPolicy` and `volumeBindingMode` fields in storage class
|
||||
|
||||
## Fixes
|
||||
|
||||
* Fixing Controller deployment using `podAnnotations` and `tolerations` values from Node daemonset
|
||||
* Let the user define the whole `tolerations` array, default to `- operator: Exists`
|
||||
* Default `logLevel` lowered from `5` to `2`
|
||||
* Default `imagePullPolicy` everywhere set to `IfNotPresent`
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
apiVersion: v1
|
||||
appVersion: 1.2.0
|
||||
apiVersion: v2
|
||||
appVersion: 1.3.2
|
||||
description: A Helm chart for AWS EFS CSI Driver
|
||||
home: https://github.com/kubernetes-sigs/aws-efs-csi-driver
|
||||
keywords:
|
||||
|
|
@ -15,4 +15,4 @@ maintainers:
|
|||
name: aws-efs-csi-driver
|
||||
sources:
|
||||
- https://github.com/kubernetes-sigs/aws-efs-csi-driver
|
||||
version: 1.2.2
|
||||
version: 2.1.3
|
||||
|
|
|
|||
|
|
@ -49,8 +49,19 @@ Create the name of the service account to use
|
|||
*/}}
|
||||
{{- define "aws-efs-csi-driver.serviceAccountName" -}}
|
||||
{{- if .Values.controller.create -}}
|
||||
{{ default (include "aws-efs-csi-driver.fullname" .) .Values.serviceAccount.controller.name }}
|
||||
{{ default (include "aws-efs-csi-driver.fullname" .) .Values.controller.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.controller.name }}
|
||||
{{ default "default" .Values.controller.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a string out of the map for controller tags flag
|
||||
*/}}
|
||||
{{- define "aws-efs-csi-driver.tags" -}}
|
||||
{{- $tags := list -}}
|
||||
{{ range $key, $val := . }}
|
||||
{{- $tags = print $key ":" $val | append $tags -}}
|
||||
{{- end -}}
|
||||
{{- join " " $tags -}}
|
||||
{{- end -}}
|
||||
|
|
|
|||
|
|
@ -19,8 +19,8 @@ spec:
|
|||
app: efs-csi-controller
|
||||
app.kubernetes.io/name: {{ include "aws-efs-csi-driver.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- if .Values.node.podAnnotations }}
|
||||
annotations: {{ toYaml .Values.node.podAnnotations | nindent 8 }}
|
||||
{{- with .Values.controller.podAnnotations }}
|
||||
annotations: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
|
|
@ -31,37 +31,42 @@ spec:
|
|||
{{- end }}
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
{{- with .Values.nodeSelector }}
|
||||
{{- . | toYaml | nindent 8 }}
|
||||
{{- with .Values.controller.nodeSelector }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "aws-efs-csi-driver.serviceAccountName" . }}
|
||||
priorityClassName: system-cluster-critical
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
{{- with .Values.node.tolerations }}
|
||||
{{- . | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.tolerations }}
|
||||
tolerations: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: efs-plugin
|
||||
securityContext:
|
||||
privileged: true
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: IfNotPresent
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args:
|
||||
- --endpoint=$(CSI_ENDPOINT)
|
||||
- --logtostderr
|
||||
- --v=5
|
||||
# Uncomment below line to allow access point root directory to be deleted by controller.
|
||||
#- --delete-access-point-root-dir
|
||||
{{- if .Values.controller.tags }}
|
||||
- --tags={{ include "aws-efs-csi-driver.tags" .Values.controller.tags }}
|
||||
{{- end }}
|
||||
- --v={{ .Values.controller.logLevel }}
|
||||
- --delete-access-point-root-dir={{ hasKey .Values.controller "deleteAccessPointRootDir" | ternary .Values.controller.deleteAccessPointRootDir false }}
|
||||
env:
|
||||
- name: CSI_ENDPOINT
|
||||
value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
{{- if .Values.controller.extraEnv }}
|
||||
{{ toYaml .Values.controller.extraEnv | indent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /var/lib/csi/sockets/pluginproxy/
|
||||
- name: aws-token
|
||||
mountPath: "/var/run/secrets/sts.amazonaws.com/serviceaccount/"
|
||||
ports:
|
||||
- name: healthz
|
||||
containerPort: 9808
|
||||
containerPort: 9909
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
|
|
@ -71,12 +76,19 @@ spec:
|
|||
timeoutSeconds: 3
|
||||
periodSeconds: 10
|
||||
failureThreshold: 5
|
||||
{{- with .Values.controller.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: csi-provisioner
|
||||
image: {{ printf "%s:%s" .Values.sidecars.csiProvisionerImage.repository .Values.sidecars.csiProvisionerImage.tag }}
|
||||
image: {{ printf "%s:%s" .Values.sidecars.csiProvisioner.image.repository .Values.sidecars.csiProvisioner.image.tag }}
|
||||
imagePullPolicy: {{ .Values.sidecars.csiProvisioner.image.pullPolicy }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- --v=5
|
||||
- --v={{ .Values.controller.logLevel }}
|
||||
- --feature-gates=Topology=true
|
||||
{{- if .Values.controller.extraCreateMetadata }}
|
||||
- --extra-create-metadata
|
||||
{{- end }}
|
||||
- --leader-election
|
||||
env:
|
||||
- name: ADDRESS
|
||||
|
|
@ -84,15 +96,32 @@ spec:
|
|||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /var/lib/csi/sockets/pluginproxy/
|
||||
{{- with .Values.sidecars.csiProvisioner.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: liveness-probe
|
||||
image: {{ printf "%s:%s" .Values.sidecars.livenessProbeImage.repository .Values.sidecars.livenessProbeImage.tag }}
|
||||
image: {{ printf "%s:%s" .Values.sidecars.livenessProbe.image.repository .Values.sidecars.livenessProbe.image.tag }}
|
||||
imagePullPolicy: {{ .Values.sidecars.livenessProbe.image.pullPolicy }}
|
||||
args:
|
||||
- --csi-address=/csi/csi.sock
|
||||
- --health-port=9808
|
||||
- --health-port=9909
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /csi
|
||||
{{- with .Values.sidecars.livenessProbe.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: socket-dir
|
||||
emptyDir: {}
|
||||
- name: aws-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
expirationSeconds: 86400
|
||||
audience: "sts.amazonaws.com"
|
||||
{{- with .Values.controller.affinity }}
|
||||
affinity: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -1,11 +1,11 @@
|
|||
{{- if .Values.serviceAccount.controller.create }}
|
||||
{{- if .Values.controller.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "aws-efs-csi-driver.serviceAccountName" . }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ include "aws-efs-csi-driver.name" . }}
|
||||
{{- with .Values.serviceAccount.controller.annotations }}
|
||||
{{- with .Values.controller.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -40,6 +40,9 @@ rules:
|
|||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "watch", "list", "delete", "update", "create"]
|
||||
- apiGroups: [ "" ]
|
||||
resources: [ "secrets" ]
|
||||
verbs: [ "get", "watch", "list" ]
|
||||
|
||||
---
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
apiVersion: storage.k8s.io/v1beta1
|
||||
apiVersion: {{ ternary "storage.k8s.io/v1" "storage.k8s.io/v1beta1" (semverCompare ">=1.18.0-0" .Capabilities.KubeVersion.Version) }}
|
||||
kind: CSIDriver
|
||||
metadata:
|
||||
name: efs.csi.aws.com
|
||||
|
|
|
|||
|
|
@ -21,9 +21,9 @@ spec:
|
|||
annotations: {{ toYaml .Values.node.podAnnotations | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.hostAliases }}
|
||||
{{- with .Values.node.hostAliases }}
|
||||
hostAliases:
|
||||
{{- range $k, $v := .Values.hostAliases }}
|
||||
{{- range $k, $v := . }}
|
||||
- ip: {{ $v.ip }}
|
||||
hostnames:
|
||||
- {{ $k }}.efs.{{ $v.region }}.amazonaws.com
|
||||
|
|
@ -37,36 +37,32 @@ spec:
|
|||
{{- end }}
|
||||
nodeSelector:
|
||||
beta.kubernetes.io/os: linux
|
||||
{{- with .Values.nodeSelector }}
|
||||
{{- . | toYaml | nindent 8 }}
|
||||
{{- with .Values.node.nodeSelector }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
{{- with .Values.node.affinity }}
|
||||
affinity:
|
||||
{{- . | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
hostNetwork: true
|
||||
{{- if .Values.dnsPolicy }}
|
||||
dnsPolicy: "{{ .Values.dnsPolicy }}"
|
||||
{{- end }}
|
||||
{{- with .Values.dnsConfig }}
|
||||
dnsConfig:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
dnsPolicy: {{ .Values.node.dnsPolicy }}
|
||||
{{- with .Values.node.dnsConfig }}
|
||||
dnsConfig: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
priorityClassName: system-node-critical
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
{{- with .Values.node.tolerations }}
|
||||
{{- . | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.node.tolerations }}
|
||||
tolerations: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: efs-plugin
|
||||
securityContext:
|
||||
privileged: true
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args:
|
||||
- --endpoint=$(CSI_ENDPOINT)
|
||||
- --logtostderr
|
||||
- --v={{ .Values.logLevel }}
|
||||
- --v={{ .Values.node.logLevel }}
|
||||
env:
|
||||
- name: CSI_ENDPOINT
|
||||
value: unix:/csi/csi.sock
|
||||
|
|
@ -94,16 +90,16 @@ spec:
|
|||
timeoutSeconds: 3
|
||||
periodSeconds: 2
|
||||
failureThreshold: 5
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- . | toYaml | nindent 12 }}
|
||||
{{- with .Values.node.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: csi-driver-registrar
|
||||
image: {{ printf "%s:%s" .Values.sidecars.nodeDriverRegistrarImage.repository .Values.sidecars.nodeDriverRegistrarImage.tag }}
|
||||
image: {{ printf "%s:%s" .Values.sidecars.nodeDriverRegistrar.image.repository .Values.sidecars.nodeDriverRegistrar.image.tag }}
|
||||
imagePullPolicy: {{ .Values.sidecars.nodeDriverRegistrar.image.pullPolicy }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
|
||||
- --v={{ .Values.logLevel }}
|
||||
- --v={{ .Values.node.logLevel }}
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /csi/csi.sock
|
||||
|
|
@ -118,15 +114,22 @@ spec:
|
|||
mountPath: /csi
|
||||
- name: registration-dir
|
||||
mountPath: /registration
|
||||
{{- with .Values.sidecars.nodeDriverRegistrar.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: liveness-probe
|
||||
image: {{ printf "%s:%s" .Values.sidecars.livenessProbeImage.repository .Values.sidecars.livenessProbeImage.tag }}
|
||||
image: {{ printf "%s:%s" .Values.sidecars.livenessProbe.image.repository .Values.sidecars.livenessProbe.image.tag }}
|
||||
imagePullPolicy: {{ .Values.sidecars.livenessProbe.image.pullPolicy }}
|
||||
args:
|
||||
- --csi-address=/csi/csi.sock
|
||||
- --health-port=9809
|
||||
- --v={{ .Values.logLevel }}
|
||||
- --v={{ .Values.node.logLevel }}
|
||||
volumeMounts:
|
||||
- name: plugin-dir
|
||||
mountPath: /csi
|
||||
{{- with .Values.sidecars.livenessProbe.resources }}
|
||||
resources: {{ toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: kubelet-dir
|
||||
hostPath:
|
||||
|
|
|
|||
|
|
@ -3,13 +3,24 @@ kind: StorageClass
|
|||
apiVersion: storage.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ .name }}
|
||||
{{- with .annotations }}
|
||||
annotations:
|
||||
{{ toYaml . | indent 4 }}
|
||||
{{- end }}
|
||||
provisioner: efs.csi.aws.com
|
||||
{{- with .mountOptions }}
|
||||
mountOptions:
|
||||
mountOptions:
|
||||
{{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- with .parameters }}
|
||||
parameters:
|
||||
{{ toYaml . | indent 2 }}
|
||||
{{- end }}
|
||||
{{- with .reclaimPolicy }}
|
||||
reclaimPolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .volumeBindingMode }}
|
||||
volumeBindingMode: {{ . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
|
|
@ -2,98 +2,116 @@
|
|||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
replicaCount: 2
|
||||
|
||||
image:
|
||||
repository: amazon/aws-efs-csi-driver
|
||||
tag: "v1.2.0"
|
||||
tag: "v1.3.2"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
sidecars:
|
||||
livenessProbeImage:
|
||||
repository: k8s.gcr.io/sig-storage/livenessprobe
|
||||
tag: "v2.2.0"
|
||||
nodeDriverRegistrarImage:
|
||||
repository: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar
|
||||
tag: v2.0.1-eks-1-18-1
|
||||
csiProvisionerImage:
|
||||
repository: public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner
|
||||
tag: v2.0.3-eks-1-18-1
|
||||
livenessProbe:
|
||||
image:
|
||||
repository: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe
|
||||
tag: v2.2.0-eks-1-18-2
|
||||
pullPolicy: IfNotPresent
|
||||
resources: {}
|
||||
nodeDriverRegistrar:
|
||||
image:
|
||||
repository: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar
|
||||
tag: v2.1.0-eks-1-18-2
|
||||
pullPolicy: IfNotPresent
|
||||
resources: {}
|
||||
csiProvisioner:
|
||||
image:
|
||||
repository: public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner
|
||||
tag: v2.1.1-eks-1-18-2
|
||||
pullPolicy: IfNotPresent
|
||||
resources: {}
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
podAnnotations: {}
|
||||
## Controller deployment variables
|
||||
|
||||
resources:
|
||||
{}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: eks.amazonaws.com/compute-type
|
||||
operator: NotIn
|
||||
values:
|
||||
- fargate
|
||||
|
||||
node:
|
||||
controller:
|
||||
# Specifies whether a deployment should be created
|
||||
create: true
|
||||
# Number for the log level verbosity
|
||||
logLevel: 2
|
||||
# If set, add pv/pvc metadata to plugin create requests as parameters.
|
||||
extraCreateMetadata: true
|
||||
# Add additional tags to access points
|
||||
tags: {}
|
||||
# environment: prod
|
||||
# region: us-east-1
|
||||
# Enable if you want the controller to also delete the
|
||||
# path on efs when deleteing an access point
|
||||
deleteAccessPointRootDir: false
|
||||
podAnnotations: {}
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
|
||||
logLevel: 5
|
||||
|
||||
hostAliases:
|
||||
{}
|
||||
# for cross VPC EFS, you need to poison or overwrite the DNS for the efs volume as per
|
||||
# https://docs.aws.amazon.com/efs/latest/ug/efs-different-vpc.html#wt6-efs-utils-step3
|
||||
# implementing the suggested solution found here:
|
||||
# https://github.com/kubernetes-sigs/aws-efs-csi-driver/issues/240#issuecomment-676849346
|
||||
# EFS Vol ID, IP, Region
|
||||
# "fs-01234567":
|
||||
# ip: 10.10.2.2
|
||||
# region: us-east-2
|
||||
|
||||
dnsPolicy: ""
|
||||
dnsConfig:
|
||||
{}
|
||||
# Example config which uses the AWS nameservers
|
||||
# dnsPolicy: "None"
|
||||
# dnsConfig:
|
||||
# nameservers:
|
||||
# - 169.254.169.253
|
||||
|
||||
serviceAccount:
|
||||
controller:
|
||||
# Specifies whether a service account should be created
|
||||
affinity: {}
|
||||
# Specifies whether a service account should be created
|
||||
serviceAccount:
|
||||
create: true
|
||||
name: efs-csi-controller-sa
|
||||
annotations: {}
|
||||
## Enable if EKS IAM for SA is used
|
||||
# eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/efs-csi-role
|
||||
name: efs-csi-controller-sa
|
||||
|
||||
controller:
|
||||
create: true
|
||||
## Node daemonset variables
|
||||
|
||||
node:
|
||||
# Number for the log level verbosity
|
||||
logLevel: 2
|
||||
hostAliases: {}
|
||||
# For cross VPC EFS, you need to poison or overwrite the DNS for the efs volume as per
|
||||
# https://docs.aws.amazon.com/efs/latest/ug/efs-different-vpc.html#wt6-efs-utils-step3
|
||||
# implementing the suggested solution found here:
|
||||
# https://github.com/kubernetes-sigs/aws-efs-csi-driver/issues/240#issuecomment-676849346
|
||||
# EFS Vol ID, IP, Region
|
||||
# "fs-01234567":
|
||||
# ip: 10.10.2.2
|
||||
# region: us-east-2
|
||||
dnsPolicy: ClusterFirst
|
||||
dnsConfig: {}
|
||||
# Example config which uses the AWS nameservers
|
||||
# dnsPolicy: "None"
|
||||
# dnsConfig:
|
||||
# nameservers:
|
||||
# - 169.254.169.253
|
||||
podAnnotations: {}
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
nodeSelector: {}
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
|
||||
storageClasses: []
|
||||
# Add StorageClass resources like:
|
||||
# - name: efs-sc
|
||||
# annotations:
|
||||
# # Use that annotation if you want this to your default storageclass
|
||||
# storageclass.kubernetes.io/is-default-class: "true"
|
||||
# mountOptions:
|
||||
# - tls
|
||||
# parameters:
|
||||
|
|
@ -103,3 +121,5 @@ storageClasses: []
|
|||
# gidRangeStart: "1000"
|
||||
# gidRangeEnd: "2000"
|
||||
# basePath: "/dynamic_provisioning"
|
||||
# reclaimPolicy: Delete
|
||||
# volumeBindingMode: Immediate
|
||||
|
|
|
|||
|
|
@ -1,13 +0,0 @@
|
|||
{{- if .Values.StorageClass.create }}
|
||||
kind: StorageClass
|
||||
apiVersion: storage.k8s.io/v1
|
||||
metadata:
|
||||
name: efs-sc
|
||||
labels:
|
||||
{{ include "kubezero-lib.labels" . | indent 4 }}
|
||||
{{- if .Values.StorageClass.default }}
|
||||
annotations:
|
||||
storageclass.kubernetes.io/is-default-class: "true"
|
||||
{{- end }}
|
||||
provisioner: efs.csi.aws.com
|
||||
{{- end }}
|
||||
|
|
@ -1,8 +1,8 @@
|
|||
#!/bin/bash
|
||||
|
||||
VERSION=1.2.2
|
||||
VERSION=2.1.3
|
||||
|
||||
rm -rf charts/aws-efs-csi-driver
|
||||
curl -L -s -o - https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/download/helm-chart-aws-efs-csi-driver-${VERSION}/aws-efs-csi-driver-${VERSION}.tgz | tar xfz - -C charts
|
||||
|
||||
patch -i affinity_resources.patch -p0 --no-backup-if-mismatch
|
||||
patch -i zdt.patch -p0 --no-backup-if-mismatch
|
||||
|
|
|
|||
|
|
@ -1,24 +1,48 @@
|
|||
aws-efs-csi-driver:
|
||||
logLevel: 1
|
||||
replicaCount: 1
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 20m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
memory: 128Mi
|
||||
controller:
|
||||
create: true
|
||||
logLevel: 1
|
||||
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node.kubernetes.io/csi.efs.fs
|
||||
operator: Exists
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/master: ""
|
||||
|
||||
StorageClass:
|
||||
create: true
|
||||
default: false
|
||||
#extraEnv:
|
||||
#- name: AWS_ROLE_ARN
|
||||
# value: "<aws-efs-csi-driver IAM ROLE ARN>"
|
||||
#- name: AWS_WEB_IDENTITY_TOKEN_FILE
|
||||
# value: "/var/run/secrets/sts.amazonaws.com/serviceaccount/token"
|
||||
#- name: AWS_STS_REGIONAL_ENDPOINTS
|
||||
# value: regional
|
||||
|
||||
node:
|
||||
logLevel: 1
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 20m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
memory: 128Mi
|
||||
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node.kubernetes.io/csi.efs.fs
|
||||
operator: Exists
|
||||
tolerations:
|
||||
- key: kubezero-workergroup
|
||||
effect: NoSchedule
|
||||
operator: Exists
|
||||
|
||||
storageClasses:
|
||||
- name: efs-sc
|
||||
|
||||
#PersistentVolumes:
|
||||
# - name: example-pv
|
||||
|
|
|
|||
|
|
@ -0,0 +1,62 @@
|
|||
diff -tubNr charts/aws-efs-csi-driver/templates/controller-deployment.yaml charts/aws-efs-csi-driver.zdt/templates/controller-deployment.yaml
|
||||
--- charts/aws-efs-csi-driver/templates/controller-deployment.yaml 2021-06-25 22:43:06.000000000 +0200
|
||||
+++ charts/aws-efs-csi-driver.zdt/templates/controller-deployment.yaml 2021-07-15 00:37:28.960305011 +0200
|
||||
@@ -23,7 +23,6 @@
|
||||
annotations: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
- hostNetwork: true
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.imagePullSecrets }}
|
||||
@@ -57,9 +56,14 @@
|
||||
env:
|
||||
- name: CSI_ENDPOINT
|
||||
value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock
|
||||
+ {{- if .Values.controller.extraEnv }}
|
||||
+{{ toYaml .Values.controller.extraEnv | indent 12 }}
|
||||
+ {{- end }}
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /var/lib/csi/sockets/pluginproxy/
|
||||
+ - name: aws-token
|
||||
+ mountPath: "/var/run/secrets/sts.amazonaws.com/serviceaccount/"
|
||||
ports:
|
||||
- name: healthz
|
||||
containerPort: 9909
|
||||
@@ -110,6 +114,13 @@
|
||||
volumes:
|
||||
- name: socket-dir
|
||||
emptyDir: {}
|
||||
+ - name: aws-token
|
||||
+ projected:
|
||||
+ sources:
|
||||
+ - serviceAccountToken:
|
||||
+ path: token
|
||||
+ expirationSeconds: 86400
|
||||
+ audience: "sts.amazonaws.com"
|
||||
{{- with .Values.controller.affinity }}
|
||||
affinity: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
diff -tubNr charts/aws-efs-csi-driver/templates/node-daemonset.yaml charts/aws-efs-csi-driver.zdt/templates/node-daemonset.yaml
|
||||
--- charts/aws-efs-csi-driver/templates/node-daemonset.yaml 2021-06-25 22:43:06.000000000 +0200
|
||||
+++ charts/aws-efs-csi-driver.zdt/templates/node-daemonset.yaml 2021-07-15 00:14:58.680295564 +0200
|
||||
@@ -40,15 +40,10 @@
|
||||
{{- with .Values.node.nodeSelector }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
+ {{- with .Values.node.affinity }}
|
||||
affinity:
|
||||
- nodeAffinity:
|
||||
- requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- nodeSelectorTerms:
|
||||
- - matchExpressions:
|
||||
- - key: eks.amazonaws.com/compute-type
|
||||
- operator: NotIn
|
||||
- values:
|
||||
- - fargate
|
||||
+ {{- . | toYaml | nindent 8 }}
|
||||
+ {{- end }}
|
||||
hostNetwork: true
|
||||
dnsPolicy: {{ .Values.node.dnsPolicy }}
|
||||
{{- with .Values.node.dnsConfig }}
|
||||
|
|
@ -2,20 +2,20 @@ apiVersion: v2
|
|||
name: kubezero-cert-manager
|
||||
description: KubeZero Umbrella Chart for cert-manager
|
||||
type: application
|
||||
version: 0.5.0
|
||||
version: 0.6.1
|
||||
home: https://kubezero.com
|
||||
icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
|
||||
keywords:
|
||||
- kubezero
|
||||
- cert-manager
|
||||
maintainers:
|
||||
- name: Quarky9
|
||||
|
||||
dependencies:
|
||||
- name: kubezero-lib
|
||||
version: ">= 0.1.3"
|
||||
repository: https://zero-down-time.github.io/kubezero/
|
||||
- name: cert-manager
|
||||
version: 1.2.0
|
||||
repository: https://charts.jetstack.io
|
||||
version: 1.4.0
|
||||
condition: cert-manager.enabled
|
||||
repository: https://charts.jetstack.io
|
||||
kubeVersion: ">= 1.18.0"
|
||||
|
|
|
|||
|
|
@ -1,24 +1,18 @@
|
|||
# kubezero-cert-manager
|
||||
|
||||
 
|
||||
 
|
||||
|
||||
KubeZero Umbrella Chart for cert-manager
|
||||
|
||||
**Homepage:** <https://kubezero.com>
|
||||
|
||||
## Maintainers
|
||||
|
||||
| Name | Email | Url |
|
||||
| ---- | ------ | --- |
|
||||
| Quarky9 | | |
|
||||
|
||||
## Requirements
|
||||
|
||||
Kubernetes: `>= 1.18.0`
|
||||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| https://charts.jetstack.io | cert-manager | 1.2.0 |
|
||||
| https://charts.jetstack.io | cert-manager | 1.4.0 |
|
||||
| https://zero-down-time.github.io/kubezero/ | kubezero-lib | >= 0.1.3 |
|
||||
|
||||
## AWS - IAM Role
|
||||
|
|
@ -44,7 +38,6 @@ If your resolvers need additional sercrets like CloudFlare API tokens etc. make
|
|||
| cert-manager.ingressShim.defaultIssuerKind | string | `"ClusterIssuer"` | |
|
||||
| cert-manager.ingressShim.defaultIssuerName | string | `"letsencrypt-dns-prod"` | |
|
||||
| cert-manager.nodeSelector."node-role.kubernetes.io/master" | string | `""` | |
|
||||
| cert-manager.podAnnotations | object | `{}` | |
|
||||
| cert-manager.prometheus.servicemonitor.enabled | bool | `false` | |
|
||||
| cert-manager.tolerations[0].effect | string | `"NoSchedule"` | |
|
||||
| cert-manager.tolerations[0].key | string | `"node-role.kubernetes.io/master"` | |
|
||||
|
|
|
|||
|
|
@ -23,8 +23,28 @@ cert-manager:
|
|||
leaderElection:
|
||||
namespace: "cert-manager"
|
||||
|
||||
podAnnotations: {}
|
||||
# iam.amazonaws.com/role: ""
|
||||
# On AWS enable Projected Service Accounts to assume IAM role
|
||||
#extraEnv:
|
||||
#- name: AWS_ROLE_ARN
|
||||
# value: "<cert-manager IAM ROLE ARN>"
|
||||
#- name: AWS_WEB_IDENTITY_TOKEN_FILE
|
||||
# value: "/var/run/secrets/sts.amazonaws.com/serviceaccount/token"
|
||||
#- name: AWS_STS_REGIONAL_ENDPOINTS
|
||||
# value: regional
|
||||
|
||||
#volumes:
|
||||
#- name: aws-token
|
||||
# projected:
|
||||
# sources:
|
||||
# - serviceAccountToken:
|
||||
# path: token
|
||||
# expirationSeconds: 86400
|
||||
# audience: "sts.amazonaws.com"
|
||||
|
||||
#volumeMounts:
|
||||
#- name: aws-token
|
||||
# mountPath: "/var/run/secrets/sts.amazonaws.com/serviceaccount/"
|
||||
# readOnly: true
|
||||
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
|
|
|
|||
|
|
@ -2,8 +2,8 @@ apiVersion: v2
|
|||
name: kubezero-istio-ingress
|
||||
description: KubeZero Umbrella Chart for Istio based Ingress
|
||||
type: application
|
||||
version: 0.5.6
|
||||
appVersion: 1.9.3
|
||||
version: 0.6.1
|
||||
appVersion: 1.10.3
|
||||
home: https://kubezero.com
|
||||
icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
|
||||
keywords:
|
||||
|
|
@ -16,9 +16,9 @@ dependencies:
|
|||
version: ">= 0.1.3"
|
||||
repository: https://zero-down-time.github.io/kubezero/
|
||||
- name: istio-ingress
|
||||
version: 1.9.3
|
||||
version: 1.10.3
|
||||
condition: istio-ingress.enabled
|
||||
- name: istio-private-ingress
|
||||
version: 1.9.3
|
||||
version: 1.10.3
|
||||
condition: istio-private-ingress.enabled
|
||||
kubeVersion: ">= 1.18.0"
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# kubezero-istio-ingress
|
||||
|
||||
  
|
||||
  
|
||||
|
||||
KubeZero Umbrella Chart for Istio based Ingress
|
||||
|
||||
|
|
@ -20,8 +20,8 @@ Kubernetes: `>= 1.18.0`
|
|||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| | istio-ingress | 1.9.3 |
|
||||
| | istio-private-ingress | 1.9.3 |
|
||||
| | istio-ingress | 1.10.2 |
|
||||
| | istio-private-ingress | 1.10.2 |
|
||||
| https://zero-down-time.github.io/kubezero/ | kubezero-lib | >= 0.1.3 |
|
||||
|
||||
## Values
|
||||
|
|
@ -30,10 +30,10 @@ Kubernetes: `>= 1.18.0`
|
|||
|-----|------|---------|-------------|
|
||||
| global.arch.amd64 | int | `2` | |
|
||||
| global.defaultPodDisruptionBudget.enabled | bool | `false` | |
|
||||
| global.jwtPolicy | string | `"first-party-jwt"` | |
|
||||
| global.logAsJson | bool | `true` | |
|
||||
| global.priorityClassName | string | `"system-cluster-critical"` | |
|
||||
| istio-ingress.dnsNames | list | `[]` | |
|
||||
| istio-ingress.certificates[0].dnsNames | list | `[]` | |
|
||||
| istio-ingress.certificates[0].name | string | `"ingress-cert"` | |
|
||||
| istio-ingress.enabled | bool | `false` | |
|
||||
| istio-ingress.gateways.istio-ingressgateway.autoscaleEnabled | bool | `false` | |
|
||||
| istio-ingress.gateways.istio-ingressgateway.configVolumes[0].configMapName | string | `"istio-gateway-bootstrap-config"` | |
|
||||
|
|
@ -69,10 +69,16 @@ Kubernetes: `>= 1.18.0`
|
|||
| istio-ingress.gateways.istio-ingressgateway.rollingMaxUnavailable | int | `0` | |
|
||||
| istio-ingress.gateways.istio-ingressgateway.type | string | `"NodePort"` | |
|
||||
| istio-ingress.meshConfig.defaultConfig.proxyMetadata | string | `nil` | |
|
||||
| istio-ingress.proxyProtocol | bool | `false` | |
|
||||
| istio-ingress.telemetry.enabled | bool | `false` | |
|
||||
| istio-private-ingress.dnsNames | list | `[]` | |
|
||||
| istio-private-ingress.certificates[0].dnsNames | list | `[]` | |
|
||||
| istio-private-ingress.certificates[0].name | string | `"private-ingress-cert"` | |
|
||||
| istio-private-ingress.enabled | bool | `false` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.autoscaleEnabled | bool | `false` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.configVolumes[0].configMapName | string | `"istio-gateway-bootstrap-config"` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.configVolumes[0].mountPath | string | `"/etc/istio/custom-bootstrap"` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.configVolumes[0].name | string | `"custom-bootstrap-volume"` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.env.ISTIO_BOOTSTRAP_OVERRIDE | string | `"/etc/istio/custom-bootstrap/custom_bootstrap.json"` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.externalTrafficPolicy | string | `"Local"` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.labels.app | string | `"istio-private-ingressgateway"` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.labels.istio | string | `"private-ingressgateway"` | |
|
||||
|
|
@ -97,16 +103,6 @@ Kubernetes: `>= 1.18.0`
|
|||
| istio-private-ingress.gateways.istio-ingressgateway.ports[2].port | int | `443` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.ports[2].protocol | string | `"TCP"` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.ports[2].targetPort | int | `8443` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.ports[3].name | string | `"tcp-istiod"` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.ports[3].nodePort | int | `31012` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.ports[3].port | int | `15012` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.ports[3].protocol | string | `"TCP"` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.ports[3].targetPort | int | `15012` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.ports[4].name | string | `"tls"` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.ports[4].nodePort | int | `31044` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.ports[4].port | int | `15443` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.ports[4].protocol | string | `"TCP"` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.ports[4].targetPort | int | `15443` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.replicaCount | int | `1` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.resources.limits.memory | string | `"512Mi"` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.resources.requests.cpu | string | `"50m"` | |
|
||||
|
|
@ -115,6 +111,7 @@ Kubernetes: `>= 1.18.0`
|
|||
| istio-private-ingress.gateways.istio-ingressgateway.rollingMaxUnavailable | int | `0` | |
|
||||
| istio-private-ingress.gateways.istio-ingressgateway.type | string | `"NodePort"` | |
|
||||
| istio-private-ingress.meshConfig.defaultConfig.proxyMetadata | string | `nil` | |
|
||||
| istio-private-ingress.proxyProtocol | bool | `false` | |
|
||||
| istio-private-ingress.telemetry.enabled | bool | `false` | |
|
||||
|
||||
## Resources
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
apiVersion: v1
|
||||
name: istio-ingress
|
||||
version: 1.9.3
|
||||
version: 1.10.3
|
||||
tillerVersion: ">=2.7.2"
|
||||
description: Helm chart for deploying Istio gateways
|
||||
keywords:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,3 @@
|
|||
|
||||
{{- $gateway := index .Values "gateways" "istio-ingressgateway" }}
|
||||
{{- if eq $gateway.injectionTemplate "" }}
|
||||
apiVersion: apps/v1
|
||||
|
|
@ -45,17 +44,14 @@ spec:
|
|||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "IngressGateways"
|
||||
sidecar.istio.io/inject: "{{- ne $gateway.injectionTemplate "" }}"
|
||||
sidecar.istio.io/inject: "false"
|
||||
annotations:
|
||||
{{- if .Values.meshConfig.enablePrometheusMerge }}
|
||||
prometheus.io/port: "15020"
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/path: "/stats/prometheus"
|
||||
{{- end }}
|
||||
sidecar.istio.io/inject: "{{- ne $gateway.injectionTemplate "" }}"
|
||||
{{- if ne $gateway.injectionTemplate "" }}
|
||||
inject.istio.io/templates: "{{ $gateway.injectionTemplate }}"
|
||||
{{- end}}
|
||||
sidecar.istio.io/inject: "false"
|
||||
{{- if $gateway.podAnnotations }}
|
||||
{{ toYaml $gateway.podAnnotations | indent 8 }}
|
||||
{{ end }}
|
||||
|
|
@ -219,13 +215,13 @@ spec:
|
|||
{{- if $.Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ $.Values.global.meshID }}"
|
||||
{{- else if $.Values.global.trustDomain | default (index .Values.meshConfig "trustDomain") }}
|
||||
{{- else if .Values.meshConfig.trustDomain }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ $.Values.global.trustDomain | default (index .Values.meshConfig "trustDomain") }}"
|
||||
value: "{{ .Values.meshConfig.trustDomain }}"
|
||||
{{- end }}
|
||||
{{- if .Values.global.trustDomain | default (index .Values.meshConfig "trustDomain") }}
|
||||
{{- if .Values.meshConfig.trustDomain }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ .Values.global.trustDomain | default (index .Values.meshConfig "trustDomain") }}"
|
||||
value: "{{ .Values.meshConfig.trustDomain }}"
|
||||
{{- end }}
|
||||
{{- if not $gateway.runAsRoot }}
|
||||
- name: ISTIO_META_UNPRIVILEGED_POD
|
||||
|
|
@ -233,7 +229,7 @@ spec:
|
|||
{{- end }}
|
||||
{{- range $key, $val := $gateway.env }}
|
||||
- name: {{ $key }}
|
||||
value: {{ $val }}
|
||||
value: "{{ $val }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
|
|
|
|||
|
|
@ -24,17 +24,8 @@ gateways:
|
|||
targetPort: 8443
|
||||
name: https
|
||||
protocol: TCP
|
||||
- port: 15012
|
||||
targetPort: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
# This is the port where sni routing happens
|
||||
- port: 15443
|
||||
targetPort: 15443
|
||||
name: tls
|
||||
protocol: TCP
|
||||
|
||||
# Scalability tunning
|
||||
# Scalability tuning
|
||||
# replicaCount: 1
|
||||
rollingMaxSurge: 100%
|
||||
rollingMaxUnavailable: 25%
|
||||
|
|
@ -174,7 +165,7 @@ global:
|
|||
hub: docker.io/istio
|
||||
|
||||
# Default tag for Istio images.
|
||||
tag: 1.9.3
|
||||
tag: 1.10.3
|
||||
|
||||
# Specify image pull policy if default behavior isn't desired.
|
||||
# Default behavior: latest images will be Always else IfNotPresent.
|
||||
|
|
@ -310,11 +301,14 @@ global:
|
|||
# Setting this port to a non-zero value enables STS server.
|
||||
servicePort: 0
|
||||
|
||||
# Deprecated, use meshConfig.trustDomain
|
||||
trustDomain: ""
|
||||
|
||||
meshConfig:
|
||||
enablePrometheusMerge: true
|
||||
|
||||
# The trust domain corresponds to the trust root of a system
|
||||
# Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
|
||||
trustDomain: "cluster.local"
|
||||
|
||||
defaultConfig:
|
||||
proxyMetadata: {}
|
||||
tracing:
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
apiVersion: v1
|
||||
name: istio-private-ingress
|
||||
version: 1.9.3
|
||||
version: 1.10.3
|
||||
tillerVersion: ">=2.7.2"
|
||||
description: Helm chart for deploying Istio gateways
|
||||
keywords:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,3 @@
|
|||
|
||||
{{- $gateway := index .Values "gateways" "istio-ingressgateway" }}
|
||||
{{- if eq $gateway.injectionTemplate "" }}
|
||||
apiVersion: apps/v1
|
||||
|
|
@ -45,17 +44,14 @@ spec:
|
|||
istio.io/rev: {{ .Values.revision | default "default" }}
|
||||
install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
|
||||
operator.istio.io/component: "IngressGateways"
|
||||
sidecar.istio.io/inject: "{{- ne $gateway.injectionTemplate "" }}"
|
||||
sidecar.istio.io/inject: "false"
|
||||
annotations:
|
||||
{{- if .Values.meshConfig.enablePrometheusMerge }}
|
||||
prometheus.io/port: "15020"
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/path: "/stats/prometheus"
|
||||
{{- end }}
|
||||
sidecar.istio.io/inject: "{{- ne $gateway.injectionTemplate "" }}"
|
||||
{{- if ne $gateway.injectionTemplate "" }}
|
||||
inject.istio.io/templates: "{{ $gateway.injectionTemplate }}"
|
||||
{{- end}}
|
||||
sidecar.istio.io/inject: "false"
|
||||
{{- if $gateway.podAnnotations }}
|
||||
{{ toYaml $gateway.podAnnotations | indent 8 }}
|
||||
{{ end }}
|
||||
|
|
@ -219,13 +215,13 @@ spec:
|
|||
{{- if $.Values.global.meshID }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ $.Values.global.meshID }}"
|
||||
{{- else if $.Values.global.trustDomain | default (index .Values.meshConfig "trustDomain") }}
|
||||
{{- else if .Values.meshConfig.trustDomain }}
|
||||
- name: ISTIO_META_MESH_ID
|
||||
value: "{{ $.Values.global.trustDomain | default (index .Values.meshConfig "trustDomain") }}"
|
||||
value: "{{ .Values.meshConfig.trustDomain }}"
|
||||
{{- end }}
|
||||
{{- if .Values.global.trustDomain | default (index .Values.meshConfig "trustDomain") }}
|
||||
{{- if .Values.meshConfig.trustDomain }}
|
||||
- name: TRUST_DOMAIN
|
||||
value: "{{ .Values.global.trustDomain | default (index .Values.meshConfig "trustDomain") }}"
|
||||
value: "{{ .Values.meshConfig.trustDomain }}"
|
||||
{{- end }}
|
||||
{{- if not $gateway.runAsRoot }}
|
||||
- name: ISTIO_META_UNPRIVILEGED_POD
|
||||
|
|
@ -233,7 +229,7 @@ spec:
|
|||
{{- end }}
|
||||
{{- range $key, $val := $gateway.env }}
|
||||
- name: {{ $key }}
|
||||
value: {{ $val }}
|
||||
value: "{{ $val }}"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata }}
|
||||
- name: {{ $key }}
|
||||
|
|
|
|||
|
|
@ -24,17 +24,8 @@ gateways:
|
|||
targetPort: 8443
|
||||
name: https
|
||||
protocol: TCP
|
||||
- port: 15012
|
||||
targetPort: 15012
|
||||
name: tcp-istiod
|
||||
protocol: TCP
|
||||
# This is the port where sni routing happens
|
||||
- port: 15443
|
||||
targetPort: 15443
|
||||
name: tls
|
||||
protocol: TCP
|
||||
|
||||
# Scalability tunning
|
||||
# Scalability tuning
|
||||
# replicaCount: 1
|
||||
rollingMaxSurge: 100%
|
||||
rollingMaxUnavailable: 25%
|
||||
|
|
@ -174,7 +165,7 @@ global:
|
|||
hub: docker.io/istio
|
||||
|
||||
# Default tag for Istio images.
|
||||
tag: 1.9.3
|
||||
tag: 1.10.3
|
||||
|
||||
# Specify image pull policy if default behavior isn't desired.
|
||||
# Default behavior: latest images will be Always else IfNotPresent.
|
||||
|
|
@ -310,11 +301,14 @@ global:
|
|||
# Setting this port to a non-zero value enables STS server.
|
||||
servicePort: 0
|
||||
|
||||
# Deprecated, use meshConfig.trustDomain
|
||||
trustDomain: ""
|
||||
|
||||
meshConfig:
|
||||
enablePrometheusMerge: true
|
||||
|
||||
# The trust domain corresponds to the trust root of a system
|
||||
# Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
|
||||
trustDomain: "cluster.local"
|
||||
|
||||
defaultConfig:
|
||||
proxyMetadata: {}
|
||||
tracing:
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{{- if or (index .Values "istio-ingress" "enabled") (index .Values "istio-private-ingress" "enabled") }}
|
||||
# https://www.envoyproxy.io/docs/envoy/v1.17.1/configuration/best_practices/edge#configuring-envoy-as-an-edge-proxy
|
||||
# https://github.com/istio/istio/issues/24715
|
||||
{{- if or (index .Values "istio-ingress" "enabled") (index .Values "istio-private-ingress" "enabled") }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{{- if or (index .Values "istio-ingress" "enabled") (index .Values "istio-private-ingress" "enabled") }}
|
||||
{{- if index .Values "istio-ingress" "enabled" }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
|
|
@ -7,6 +7,47 @@ metadata:
|
|||
labels:
|
||||
{{ include "kubezero-lib.labels" . | indent 4 }}
|
||||
spec:
|
||||
workloadSelector:
|
||||
labels:
|
||||
istio: ingressgateway
|
||||
configPatches:
|
||||
- applyTo: LISTENER
|
||||
patch:
|
||||
operation: MERGE
|
||||
value:
|
||||
socket_options:
|
||||
# SOL_SOCKET = 1
|
||||
# SO_KEEPALIVE = 9
|
||||
- level: 1
|
||||
name: 9
|
||||
int_value: 1
|
||||
state: STATE_LISTENING
|
||||
# IPPROTO_TCP = 6
|
||||
# TCP_KEEPIDLE = 4
|
||||
- level: 6
|
||||
name: 4
|
||||
int_value: 120
|
||||
state: STATE_LISTENING
|
||||
# TCP_KEEPINTVL = 5
|
||||
- level: 6
|
||||
name: 5
|
||||
int_value: 60
|
||||
state: STATE_LISTENING
|
||||
{{- end }}
|
||||
|
||||
{{- if index .Values "istio-private-ingress" "enabled" }}
|
||||
---
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: private-ingressgateway-listener-tcp-keepalive
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{ include "kubezero-lib.labels" . | indent 4 }}
|
||||
spec:
|
||||
workloadSelector:
|
||||
labels:
|
||||
istio: private-ingressgateway
|
||||
configPatches:
|
||||
- applyTo: LISTENER
|
||||
patch:
|
||||
|
|
|
|||
|
|
@ -0,0 +1,44 @@
|
|||
{{- if and (index .Values "istio-ingress" "enabled") (index .Values "istio-ingress" "proxyProtocol") }}
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: ingressgateway-proxy-protocol
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{ include "kubezero-lib.labels" . | indent 4 }}
|
||||
spec:
|
||||
workloadSelector:
|
||||
labels:
|
||||
istio: ingressgateway
|
||||
configPatches:
|
||||
- applyTo: LISTENER
|
||||
patch:
|
||||
operation: MERGE
|
||||
value:
|
||||
listener_filters:
|
||||
- name: envoy.listener.proxy_protocol
|
||||
- name: envoy.listener.tls_inspector
|
||||
{{- end }}
|
||||
|
||||
{{- if and (index .Values "istio-private-ingress" "enabled") (index .Values "istio-private-ingress" "proxyProtocol") }}
|
||||
---
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: private-ingressgateway-proxy-protocol
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{ include "kubezero-lib.labels" . | indent 4 }}
|
||||
spec:
|
||||
workloadSelector:
|
||||
labels:
|
||||
istio: private-ingressgateway
|
||||
configPatches:
|
||||
- applyTo: LISTENER
|
||||
patch:
|
||||
operation: MERGE
|
||||
value:
|
||||
listener_filters:
|
||||
- name: envoy.listener.proxy_protocol
|
||||
- name: envoy.listener.tls_inspector
|
||||
{{- end }}
|
||||
|
|
@ -1,35 +1,39 @@
|
|||
{{- if index .Values "istio-ingress" "dnsNames" }}
|
||||
{{- range $cert := (index .Values "istio-ingress" "certificates") }}
|
||||
{{- if $cert.dnsNames }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: ingress-cert
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ $cert.name }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{ include "kubezero-lib.labels" . | indent 4 }}
|
||||
{{ include "kubezero-lib.labels" $ | indent 4 }}
|
||||
spec:
|
||||
secretName: ingress-cert
|
||||
secretName: {{ $cert.name }}
|
||||
issuerRef:
|
||||
name: letsencrypt-dns-prod
|
||||
name: {{ default "letsencrypt-dns-prod" $cert.issuer }}
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
{{ toYaml (index .Values "istio-ingress" "dnsNames") | indent 4 }}
|
||||
{{ toYaml $cert.dnsNames | indent 4 }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if index .Values "istio-private-ingress" "dnsNames" }}
|
||||
---
|
||||
{{- range $cert := (index .Values "istio-private-ingress" "certificates") }}
|
||||
{{- if $cert.dnsNames }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: private-ingress-cert
|
||||
namespace: {{ .Release.Namespace }}
|
||||
name: {{ $cert.name }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{ include "kubezero-lib.labels" . | indent 4 }}
|
||||
{{ include "kubezero-lib.labels" $ | indent 4 }}
|
||||
spec:
|
||||
secretName: private-ingress-cert
|
||||
issuerRef:
|
||||
name: letsencrypt-dns-prod
|
||||
name: {{ default "letsencrypt-dns-prod" $cert.issuer }}
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
{{ toYaml (index .Values "istio-private-ingress" "dnsNames") | indent 4 }}
|
||||
{{ toYaml $cert.dnsNames | indent 4 }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{{- if and (index .Values "istio-ingress" "enabled") (index .Values "istio-ingress" "certificates") }}
|
||||
# https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/#configure-a-tls-ingress-gateway-for-multiple-hosts
|
||||
|
||||
{{- if and (index .Values "istio-ingress" "enabled") (index .Values "istio-ingress" "dnsNames") }}
|
||||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
|
|
@ -17,23 +17,25 @@ spec:
|
|||
name: http
|
||||
protocol: HTTP2
|
||||
hosts:
|
||||
{{- toYaml (index .Values "istio-ingress" "dnsNames") | nindent 4 }}
|
||||
{{- range $cert := (index .Values "istio-ingress" "certificates") }}
|
||||
{{- toYaml $cert.dnsNames | nindent 4 }}
|
||||
{{- end }}
|
||||
tls:
|
||||
httpsRedirect: true
|
||||
{{- range $cert := (index .Values "istio-ingress" "certificates") }}
|
||||
- port:
|
||||
number: 443
|
||||
name: https
|
||||
protocol: HTTPS
|
||||
hosts:
|
||||
{{- toYaml (index .Values "istio-ingress" "dnsNames") | nindent 4 }}
|
||||
{{- toYaml $cert.dnsNames | nindent 4 }}
|
||||
tls:
|
||||
mode: SIMPLE
|
||||
privateKey: /etc/istio/ingressgateway-certs/tls.key
|
||||
serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
|
||||
credentialName: ingress-cert
|
||||
credentialName: {{ $cert.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and (index .Values "istio-private-ingress" "enabled") (index .Values "istio-private-ingress" "dnsNames") }}
|
||||
{{- if and (index .Values "istio-private-ingress" "enabled") (index .Values "istio-private-ingress" "certificates") }}
|
||||
---
|
||||
apiVersion: networking.istio.io/v1beta1
|
||||
kind: Gateway
|
||||
|
|
@ -51,53 +53,62 @@ spec:
|
|||
name: http
|
||||
protocol: HTTP2
|
||||
hosts:
|
||||
{{- toYaml (index .Values "istio-private-ingress" "dnsNames") | nindent 4 }}
|
||||
{{- range $certs := (index .Values "istio-private-ingress" "certificates") }}
|
||||
{{- toYaml $certs.dnsNames | nindent 4 }}
|
||||
{{- end }}
|
||||
tls:
|
||||
httpsRedirect: true
|
||||
# All SSL hosts one entry per ingress-certificate
|
||||
{{- range $cert := (index .Values "istio-private-ingress" "certificates") }}
|
||||
- port:
|
||||
number: 443
|
||||
name: https
|
||||
protocol: HTTPS
|
||||
hosts:
|
||||
{{- toYaml (index .Values "istio-private-ingress" "dnsNames") | nindent 4 }}
|
||||
{{- toYaml $cert.dnsNames | nindent 4 }}
|
||||
tls:
|
||||
mode: SIMPLE
|
||||
privateKey: /etc/istio/ingressgateway-certs/tls.key
|
||||
serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
|
||||
credentialName: private-ingress-cert
|
||||
- port:
|
||||
number: 5672
|
||||
name: amqp
|
||||
protocol: TCP
|
||||
hosts:
|
||||
{{- toYaml (index .Values "istio-private-ingress" "dnsNames") | nindent 4 }}
|
||||
- port:
|
||||
number: 5671
|
||||
name: amqps
|
||||
protocol: TCP
|
||||
hosts:
|
||||
{{- toYaml (index .Values "istio-private-ingress" "dnsNames") | nindent 4 }}
|
||||
credentialName: {{ $cert.name }}
|
||||
- port:
|
||||
number: 24224
|
||||
name: fluentd-forward
|
||||
protocol: TLS
|
||||
hosts:
|
||||
{{- toYaml (index .Values "istio-private-ingress" "dnsNames") | nindent 4 }}
|
||||
{{- toYaml $cert.dnsNames | nindent 4 }}
|
||||
tls:
|
||||
mode: SIMPLE
|
||||
privateKey: /etc/istio/ingressgateway-certs/tls.key
|
||||
serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
|
||||
credentialName: private-ingress-cert
|
||||
credentialName: {{ $cert.name }}
|
||||
{{- end }}
|
||||
- port:
|
||||
number: 5672
|
||||
name: amqp
|
||||
protocol: TCP
|
||||
hosts:
|
||||
{{- range $certs := (index .Values "istio-private-ingress" "certificates") }}
|
||||
{{- toYaml $certs.dnsNames | nindent 4 }}
|
||||
{{- end }}
|
||||
- port:
|
||||
number: 5671
|
||||
name: amqps
|
||||
protocol: TCP
|
||||
hosts:
|
||||
{{- range $certs := (index .Values "istio-private-ingress" "certificates") }}
|
||||
{{- toYaml $certs.dnsNames | nindent 4 }}
|
||||
{{- end }}
|
||||
- port:
|
||||
number: 6379
|
||||
name: redis
|
||||
protocol: TCP
|
||||
hosts:
|
||||
{{- toYaml (index .Values "istio-private-ingress" "dnsNames") | nindent 4 }}
|
||||
{{- range $certs := (index .Values "istio-private-ingress" "certificates") }}
|
||||
{{- toYaml $certs.dnsNames | nindent 4 }}
|
||||
{{- end }}
|
||||
- port:
|
||||
number: 6380
|
||||
name: redis-1
|
||||
protocol: TCP
|
||||
hosts:
|
||||
{{- toYaml (index .Values "istio-private-ingress" "dnsNames") | nindent 4 }}
|
||||
{{- range $certs := (index .Values "istio-private-ingress" "certificates") }}
|
||||
{{- toYaml $certs.dnsNames | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -1,10 +1,9 @@
|
|||
# Make sure these values match kuberzero-istio !!!
|
||||
global:
|
||||
#hub: docker.io/istio
|
||||
#tag: 1.9.3
|
||||
#tag: 1.10.2
|
||||
|
||||
logAsJson: true
|
||||
jwtPolicy: first-party-jwt
|
||||
|
||||
priorityClassName: "system-cluster-critical"
|
||||
|
||||
|
|
@ -69,21 +68,13 @@ istio-ingress:
|
|||
targetPort: 8443
|
||||
nodePort: 30443
|
||||
protocol: TCP
|
||||
## multi-cluster - disabled on public LBs
|
||||
#- name: tcp-istiod
|
||||
# port: 15012
|
||||
# targetPort: 15012
|
||||
# nodePort: 30012
|
||||
# protocol: TCP
|
||||
## multi-cluster sni east-west
|
||||
#- name: tls
|
||||
# port: 15443
|
||||
# targetPort: 15443
|
||||
# nodePort: 30044
|
||||
# protocol: TCP
|
||||
|
||||
dnsNames: []
|
||||
# - '*.example.com'
|
||||
certificates:
|
||||
- name: ingress-cert
|
||||
dnsNames: []
|
||||
# - '*.example.com'
|
||||
|
||||
proxyProtocol: false
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
|
|
@ -123,8 +114,16 @@ istio-private-ingress:
|
|||
values: istio-private-ingressgateway
|
||||
type: NodePort
|
||||
podAnnotations:
|
||||
# sidecar.istio.io/bootstrapOverride: istio-gateway-bootstrap-config
|
||||
proxy.istio.io/config: '{ "terminationDrainDuration": "20s" }'
|
||||
|
||||
# custom hardened bootstrap config
|
||||
env:
|
||||
ISTIO_BOOTSTRAP_OVERRIDE: /etc/istio/custom-bootstrap/custom_bootstrap.json
|
||||
configVolumes:
|
||||
- name: custom-bootstrap-volume
|
||||
mountPath: /etc/istio/custom-bootstrap
|
||||
configMapName: istio-gateway-bootstrap-config
|
||||
|
||||
nodeSelector:
|
||||
node.kubernetes.io/ingress.private: "31080_31443"
|
||||
#nodeSelector: "31080_31443_31671_31672_31224"
|
||||
|
|
@ -143,18 +142,6 @@ istio-private-ingress:
|
|||
targetPort: 8443
|
||||
nodePort: 31443
|
||||
protocol: TCP
|
||||
# multi-cluster
|
||||
- name: tcp-istiod
|
||||
port: 15012
|
||||
targetPort: 15012
|
||||
nodePort: 31012
|
||||
protocol: TCP
|
||||
# multi-cluster sni east-west
|
||||
- name: tls
|
||||
port: 15443
|
||||
targetPort: 15443
|
||||
nodePort: 31044
|
||||
protocol: TCP
|
||||
#- name: fluentd-forward
|
||||
# port: 24224
|
||||
# nodePort: 31224
|
||||
|
|
@ -168,8 +155,12 @@ istio-private-ingress:
|
|||
# port: 6379
|
||||
# nodePort: 31379
|
||||
|
||||
dnsNames: []
|
||||
# - '*.example.com'
|
||||
certificates:
|
||||
- name: private-ingress-cert
|
||||
dnsNames: []
|
||||
#- '*.example.com'
|
||||
|
||||
proxyProtocol: false
|
||||
|
||||
meshConfig:
|
||||
defaultConfig:
|
||||
|
|
|
|||
|
|
@ -2,8 +2,8 @@ apiVersion: v2
|
|||
name: kubezero-istio
|
||||
description: KubeZero Umbrella Chart for Istio
|
||||
type: application
|
||||
version: 0.5.6
|
||||
appVersion: 1.9.3
|
||||
version: 0.6.1
|
||||
appVersion: 1.10.3
|
||||
home: https://kubezero.com
|
||||
icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
|
||||
keywords:
|
||||
|
|
@ -16,7 +16,7 @@ dependencies:
|
|||
version: ">= 0.1.3"
|
||||
repository: https://zero-down-time.github.io/kubezero/
|
||||
- name: base
|
||||
version: 1.9.3
|
||||
version: 1.10.3
|
||||
- name: istio-discovery
|
||||
version: 1.9.3
|
||||
version: 1.10.3
|
||||
kubeVersion: ">= 1.18.0"
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# kubezero-istio
|
||||
|
||||
  
|
||||
  
|
||||
|
||||
KubeZero Umbrella Chart for Istio
|
||||
|
||||
|
|
@ -20,8 +20,8 @@ Kubernetes: `>= 1.18.0`
|
|||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| | base | 1.9.3 |
|
||||
| | istio-discovery | 1.9.3 |
|
||||
| | base | 1.10.2 |
|
||||
| | istio-discovery | 1.10.2 |
|
||||
| https://zero-down-time.github.io/kubezero/ | kubezero-lib | >= 0.1.3 |
|
||||
|
||||
## Values
|
||||
|
|
@ -29,7 +29,6 @@ Kubernetes: `>= 1.18.0`
|
|||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| global.defaultPodDisruptionBudget.enabled | bool | `false` | |
|
||||
| global.jwtPolicy | string | `"first-party-jwt"` | |
|
||||
| global.logAsJson | bool | `true` | |
|
||||
| global.priorityClassName | string | `"system-cluster-critical"` | |
|
||||
| istio-discovery.meshConfig.accessLogEncoding | string | `"JSON"` | |
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
apiVersion: v1
|
||||
name: base
|
||||
version: 1.9.3
|
||||
version: 1.10.3
|
||||
tillerVersion: ">=2.7.2"
|
||||
description: Helm chart for deploying Istio cluster resources and CRDs
|
||||
keywords:
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,66 +1,48 @@
|
|||
# SYNC WITH manifests/charts/istio-operator/templates
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: istiooperators.install.istio.io
|
||||
labels:
|
||||
release: istio
|
||||
spec:
|
||||
additionalPrinterColumns:
|
||||
- JSONPath: .spec.revision
|
||||
description: Istio control plane revision
|
||||
name: Revision
|
||||
type: string
|
||||
- JSONPath: .status.status
|
||||
description: IOP current state
|
||||
type: string
|
||||
name: Status
|
||||
- JSONPath: .metadata.creationTimestamp
|
||||
description: 'CreationTimestamp is a timestamp representing the server time when
|
||||
this object was created. It is not guaranteed to be set in happens-before order
|
||||
across separate operations. Clients may not set this value. It is represented
|
||||
in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
|
||||
lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
|
||||
name: Age
|
||||
type: date
|
||||
conversion:
|
||||
strategy: None
|
||||
group: install.istio.io
|
||||
names:
|
||||
kind: IstioOperator
|
||||
listKind: IstioOperatorList
|
||||
plural: istiooperators
|
||||
singular: istiooperator
|
||||
shortNames:
|
||||
- iop
|
||||
- io
|
||||
scope: Namespaced
|
||||
subresources:
|
||||
status: {}
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values.
|
||||
More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase.
|
||||
More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
spec:
|
||||
description: 'Specification of the desired state of the istio control plane resource.
|
||||
More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
|
||||
type: object
|
||||
status:
|
||||
description: 'Status describes each of istio control plane component status at the current time.
|
||||
0 means NONE, 1 means UPDATING, 2 means HEALTHY, 3 means ERROR, 4 means RECONCILING.
|
||||
More info: https://github.com/istio/api/blob/master/operator/v1alpha1/istio.operator.v1alpha1.pb.html &
|
||||
https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status'
|
||||
type: object
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
- additionalPrinterColumns:
|
||||
- description: Istio control plane revision
|
||||
jsonPath: .spec.revision
|
||||
name: Revision
|
||||
type: string
|
||||
- description: IOP current state
|
||||
jsonPath: .status.status
|
||||
name: Status
|
||||
type: string
|
||||
- description: 'CreationTimestamp is a timestamp representing the server time
|
||||
when this object was created. It is not guaranteed to be set in happens-before
|
||||
order across separate operations. Clients may not set this value. It is represented
|
||||
in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
|
||||
lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
subresources:
|
||||
status: {}
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
served: true
|
||||
storage: true
|
||||
---
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
|
|
@ -19,11 +19,11 @@ rules:
|
|||
# istio configuration
|
||||
# removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
|
||||
# please proceed with caution
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io"]
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
resources: ["*"]
|
||||
{{- if .Values.global.istiod.enableAnalysis }}
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io"]
|
||||
- apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io"]
|
||||
verbs: ["update"]
|
||||
# TODO: should be on just */status but wildcard is not supported
|
||||
resources: ["*"]
|
||||
|
|
@ -97,12 +97,20 @@ rules:
|
|||
- apiGroups: ["networking.x-k8s.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
- apiGroups: ["networking.x-k8s.io"]
|
||||
resources: ["*"] # TODO: should be on just */status but wildcard is not supported
|
||||
verbs: ["update"]
|
||||
|
||||
# Needed for multicluster secret reading, possibly ingress certs in the future
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
|
||||
# Used for MCS serviceexport management
|
||||
- apiGroups: ["multicluster.x-k8s.io"]
|
||||
resources: ["serviceexports"]
|
||||
verbs: ["get", "watch", "list", "create", "delete"]
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{{- if .Values.global.configValidation }}
|
||||
apiVersion: admissionregistration.k8s.io/v1beta1
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: istiod-{{ .Values.global.istioNamespace }}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
apiVersion: v1
|
||||
name: istio-discovery
|
||||
version: 1.9.3
|
||||
version: 1.10.3
|
||||
tillerVersion: ">=2.7.2"
|
||||
description: Helm chart for istio control plane
|
||||
keywords:
|
||||
|
|
|
|||
|
|
@ -3,3 +3,7 @@ Minimal control plane for Istio. Pilot and mesh config are included.
|
|||
MCP and injector should optionally be installed in the same namespace. Alternatively remote
|
||||
address of an MCP server can be set.
|
||||
|
||||
|
||||
Thank you for installing Istio 1.10. Please take a few minutes to tell us about your install/upgrade experience!
|
||||
https://forms.gle/KjkrDnMPByq7akrYA"
|
||||
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue