---
# Source: exa-csi/templates/controller-driver.yaml
# ---------------------------------
# Exascaler CSI Controller Server
# ---------------------------------
#
# Runs single driver controller server (driver + provisioner + attacher + snapshotter) on one of the nodes
#

apiVersion: v1
kind: ServiceAccount
metadata:
  name: exascaler-csi-controller-service-account
  namespace: default
---
# Source: exa-csi/templates/metrics/rbac.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: exa-csi-metrics-sa
  namespace: default
---
# Source: exa-csi/templates/node-driver.yaml
# ---------------------------
# exascaler CSI Node Server
# ---------------------------
#
# Runs driver node server (driver + registrar) on each node
#

apiVersion: v1
kind: ServiceAccount
metadata:
  name: exascaler-csi-node-service-account
  namespace: default
---
# Source: exa-csi/templates/config.yaml
# This secret is used to set the initial credentials of the node container.
apiVersion: v1
kind: Secret
metadata:
  name: exascaler-csi-file-driver-config
  namespace: default
type: "Opaque"
data:
  exascaler-csi-file-driver-config.yaml: ZGVidWc6IHRydWUKZXhhc2NhbGVyX21hcDoKICBleGExOgogICAgZXhhRlM6IDEwLjIwNC44Ni4yMTdAdGNwOi90ZXN0ZnMKICAgIG1vdW50UG9pbnQ6IC9leGFGUwogICAgem9uZTogem9uZS0xCm9wZW5zaGlmdDogZmFsc2U=
---
# Source: exa-csi/templates/controller-driver.yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: exascaler-csi-controller-cluster-role
rules:
  - apiGroups: ['']
    resources: ['secrets']
    verbs: ['get', 'list', "watch"]
  - apiGroups: ['']
    resources: ['persistentvolumes']
    verbs: ['get', 'list', 'watch', 'create', 'update', 'delete'] # "update" for attacher
  - apiGroups: ['']
    resources: ['persistentvolumeclaims']
    verbs: ['get', 'list', 'watch', 'update']
  - apiGroups: ['storage.k8s.io']
    resources: ['storageclasses']
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['']
    resources: ['events']
    verbs: ['list', 'watch', 'create', 'update', 'patch']
  - apiGroups: ['snapshot.storage.k8s.io']
    resources: ['volumesnapshots']
    verbs: ['get', 'list']
  - apiGroups: ['snapshot.storage.k8s.io']
    resources: ['volumesnapshotcontents']
    verbs: ['get', 'list']
  # attacher specific
  - apiGroups: ['']
    resources: ['nodes', 'pods']
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['csi.storage.k8s.io']
    resources: ['csinodeinfos']
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['storage.k8s.io']
    resources: ['volumeattachments']
    verbs: ['get', 'list', 'watch', 'update']
  # snapshotter specific
  - apiGroups: ['snapshot.storage.k8s.io']
    resources: ['volumesnapshotclasses']
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['snapshot.storage.k8s.io']
    resources: ['volumesnapshotcontents']
    verbs: ['create', 'get', 'list', 'watch', 'update', 'delete', 'patch']
  - apiGroups: ['snapshot.storage.k8s.io']
    resources: ['volumesnapshots']
    verbs: ['get', 'list', 'watch', 'update']
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshots/status"]
    verbs: ["update"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshotcontents/status"]
    verbs: ["update"]
  - apiGroups: ['apiextensions.k8s.io']
    resources: ['customresourcedefinitions']
    verbs: ['create', 'list', 'watch', 'delete']
  - apiGroups: [""]
    resources: ["persistentvolumeclaims/status"]
    verbs: ["update", "patch"]
  # CSINode specific
  - apiGroups: ["storage.k8s.io"]
    resources: ["csinodes"]
    verbs: ["watch", "list", "get"]
---
# Source: exa-csi/templates/controller-driver.yaml
# External Resizer
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: csi-resizer-role
rules:
  # The following rule should be uncommented for plugins that require secrets
  # for provisioning.
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "update", "patch"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims/status"]
    verbs: ["update", "patch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["list", "watch", "create", "update", "patch"]
---
# Source: exa-csi/templates/metrics/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: exa-csi-metrics-clusterrole
rules:
- apiGroups: [""]
  resources: ["persistentvolumes", "persistentvolumeclaims", "nodes", "pods"]
  verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"]
  resources: ["storageclasses"]
  verbs: ["get", "list", "watch"]
---
# Source: exa-csi/templates/node-driver.yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: exascaler-csi-node-cluster-role
rules:
  - apiGroups: ['']
    resources: ['events']
    verbs: ['get', 'list', 'watch', 'create', 'update', 'patch']
  - apiGroups: ['']
    resources: ['nodes']
    verbs: ['get']
---
# Source: exa-csi/templates/controller-driver.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: exascaler-csi-controller-cluster-role-binding
subjects:
  - kind: ServiceAccount
    name: exascaler-csi-controller-service-account
    namespace: default
roleRef:
  kind: ClusterRole
  name: exascaler-csi-controller-cluster-role
  apiGroup: rbac.authorization.k8s.io
---
# Source: exa-csi/templates/controller-driver.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: csi-resizer-binding
subjects:
  - kind: ServiceAccount
    name: exascaler-csi-controller-service-account
    namespace: default
roleRef:
  kind: ClusterRole
  name: csi-resizer-role
  apiGroup: rbac.authorization.k8s.io
---
# Source: exa-csi/templates/metrics/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: exa-csi-metrics-clusterrole-binding
subjects:
- kind: ServiceAccount
  name: exa-csi-metrics-sa
  namespace: default
roleRef:
  kind: ClusterRole
  name: exa-csi-metrics-clusterrole
  apiGroup: rbac.authorization.k8s.io
---
# Source: exa-csi/templates/node-driver.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: exascaler-csi-node-cluster-role-binding
subjects:
  - kind: ServiceAccount
    name: exascaler-csi-node-service-account
    namespace: default
roleRef:
  kind: ClusterRole
  name: exascaler-csi-node-cluster-role
  apiGroup: rbac.authorization.k8s.io
---
# Source: exa-csi/templates/controller-driver.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: external-resizer-cfg
rules:
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  verbs: ["get", "watch", "list", "delete", "update", "create"]
---
# Source: exa-csi/templates/metrics/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: exa-csi-leader-election
  namespace: default
rules:
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  verbs: ["get", "watch", "list", "create", "update", "patch"]
---
# Source: exa-csi/templates/controller-driver.yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: csi-resizer-role-cfg
  namespace: default
subjects:
  - kind: ServiceAccount
    name: exascaler-csi-controller-service-account
    namespace: default
roleRef:
  kind: Role
  name: external-resizer-cfg
  apiGroup: rbac.authorization.k8s.io
---
# Source: exa-csi/templates/metrics/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: exa-csi-leader-election
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: exa-csi-leader-election
subjects:
- kind: ServiceAccount
  name: exa-csi-metrics-sa
  namespace: default
---
# Source: exa-csi/templates/controller-driver.yaml
kind: Service
apiVersion: v1
metadata:
  name: exascaler-csi-controller-service
  labels:
    app: exascaler-csi-controller
spec:
  selector:
    app: exascaler-csi-controller
  ports:
    - name: dummy
      port: 12345
---
# Source: exa-csi/templates/metrics/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: exa-csi-metrics-exporter
  namespace: default
spec:
  selector:
    matchLabels:
      app: exa-csi-metrics-exporter
  template:
    metadata:
      labels:
        app: exa-csi-metrics-exporter
    spec:
      serviceAccountName: exa-csi-metrics-sa
      automountServiceAccountToken: true    # Ensure token is mounted
      containers:
      - name: exporter
        imagePullPolicy: Always
        image: quay.io/ddn/exa-csi-metrics-exporter:v2.3.5
        securityContext:
          privileged: true
          capabilities:
            add: ['SYS_ADMIN']
          allowPrivilegeEscalation: true
        ports:
        - containerPort: 9200
          name: http
          hostPort: 32666
        env:
        - name: COLLECT_INTERVAL
          value: "30"
        - name: LOG_LEVEL
          value: "info"
        - name: PORT
          value: "9200"
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        volumeMounts:
        - name: secret
          mountPath: /config
          readOnly: true
        - name: ca-certificates
          mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          readOnly: true
        - name: host
          mountPath: /host
          mountPropagation: Bidirectional
      volumes:
      - name: secret
        secret:
          secretName: exascaler-csi-file-driver-config
      - name: host
        hostPath:
          path: /
          type: Directory
      - name: ca-certificates
        projected:
          sources:
          - serviceAccountToken:
              path: token
              expirationSeconds: 3600
          - configMap:
              name: kube-root-ca.crt   # Mount CA cert
              items:
              - key: ca.crt
                path: ca.crt
---
# Source: exa-csi/templates/node-driver.yaml
# exascaler Node Server as a daemon

kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: exascaler-csi-node
  namespace: default
spec:
  selector:
    matchLabels:
      app: exascaler-csi-node
  template:
    metadata:
      labels:
        app: exascaler-csi-node
    spec:
      serviceAccount: exascaler-csi-node-service-account
      priorityClassName: system-cluster-critical
      hostNetwork: true
      containers:
        # driver-registrar: sidecar container that:
        # 1) registers the CSI driver with kubelet
        # 2) adds the drivers custom NodeId to a label on the Kubernetes Node API Object
        - name: driver-registrar
          resources: 
            limits:
              cpu: 8
              memory: 512Mi
            requests:
              cpu: 2
              memory: 256Mi
          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.10.1
          imagePullPolicy: IfNotPresent
          args:
            - --v=5
            - --csi-address=/csi/csi.sock
            - --kubelet-registration-path=/var/lib/kubelet/plugins/exa.csi.ddn.com/csi.sock
          livenessProbe:
            exec:
              command:
              - /csi-node-driver-registrar
              - --kubelet-registration-path=/var/lib/kubelet/plugins/exa.csi.ddn.com/csi.sock
              - --mode=kubelet-registration-probe
            initialDelaySeconds: 30
            timeoutSeconds: 15
          env:
            - name: KUBE_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: GOMEMLIMIT
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.memory
            - name: GOMAXPROCS
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.cpu
          volumeMounts:
            - name: socket-dir
              mountPath: /csi
            - name: registration-dir
              mountPath: /registration
        - name: driver
          resources: 
            limits:
              cpu: 8
              memory: 512Mi
            requests:
              cpu: 2
              memory: 256Mi
          securityContext:
            privileged: true
            capabilities:
              add: ['SYS_ADMIN']
            allowPrivilegeEscalation: true
          image: "quay.io/ddn/exascaler-csi-file-driver:v2.3.5"
          imagePullPolicy: "Always"
          args:
            - --nodeid=$(KUBE_NODE_NAME)
            - --endpoint=unix://csi/csi.sock
            - --role=node
          env:
            - name: KUBE_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: GOMEMLIMIT
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.memory
            - name: GOMAXPROCS
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.cpu
          volumeMounts:
            - name: socket-dir
              mountPath: /csi
            - name: secret
              mountPath: /config
            - name: host
              mountPath: /host
              mountPropagation: Bidirectional
            - name: pods-mount-dir
              mountPath: /var/lib/kubelet/pods
              mountPropagation: Bidirectional
      volumes:
        - name: socket-dir
          hostPath:
            path: /var/lib/kubelet/plugins/exa.csi.ddn.com
            type: DirectoryOrCreate
        - name: registration-dir
          hostPath:
            path: /var/lib/kubelet/plugins_registry/
            type: Directory
        - name: pods-mount-dir
          hostPath:
            path: /var/lib/kubelet/pods
            type: Directory
        - name: host
          hostPath:
            path: /
            type: Directory
        - name: secret
          secret:
            secretName: exascaler-csi-file-driver-config
---
# Source: exa-csi/templates/controller-driver.yaml
kind: Deployment
apiVersion: apps/v1
metadata:
  name: exascaler-csi-controller
  namespace: default
spec:
  # serviceName: exascaler-csi-controller-service
  selector:
    matchLabels:
      app: exascaler-csi-controller # has to match .spec.template.metadata.labels
  template:
    metadata:
      labels:
        app: exascaler-csi-controller
    spec:
      serviceAccount: exascaler-csi-controller-service-account
      priorityClassName: system-cluster-critical
      containers:
        # csi-provisioner: sidecar container that watches Kubernetes PersistentVolumeClaim objects
        # and triggers CreateVolume/DeleteVolume against a CSI endpoint
        - name: csi-provisioner
          resources: 
            limits:
              cpu: 8
              memory: 512Mi
            requests:
              cpu: 2
              memory: 256Mi
          image: registry.k8s.io/sig-storage/csi-provisioner:v4.0.1
          imagePullPolicy: IfNotPresent
          args:
            - --csi-address=/var/lib/csi/sockets/pluginproxy/csi.sock
            - --volume-name-prefix=pvc-exa
            - --strict-topology
            - --immediate-topology=false
            - --feature-gates=Topology=true
            - --timeout=120m
          env:
            - name: GOMEMLIMIT
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.memory
            - name: GOMAXPROCS
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.cpu
          volumeMounts:
            - name: socket-dir
              mountPath: /var/lib/csi/sockets/pluginproxy
        - name: csi-attacher
          resources: 
            limits:
              cpu: 8
              memory: 512Mi
            requests:
              cpu: 2
              memory: 256Mi
          image: registry.k8s.io/sig-storage/csi-attacher:v4.5.1
          imagePullPolicy: IfNotPresent
          args:
            - --csi-address=$(ADDRESS)
            - --v=2
            - --leader-election=true
          env:
            - name: ADDRESS
              value: /var/lib/csi/sockets/pluginproxy/csi.sock
            - name: GOMEMLIMIT
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.memory
            - name: GOMAXPROCS
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.cpu
          volumeMounts:
            - name: socket-dir
              mountPath: /var/lib/csi/sockets/pluginproxy/
        - name: csi-snapshotter
          resources: 
            limits:
              cpu: 8
              memory: 512Mi
            requests:
              cpu: 2
              memory: 256Mi
          image: registry.k8s.io/sig-storage/csi-snapshotter:v5.0.1
          imagePullPolicy: IfNotPresent
          args:
            - -v=3
            - --csi-address=/var/lib/csi/sockets/pluginproxy/csi.sock
            - --timeout=120m
          volumeMounts:
            - name: socket-dir
              mountPath: /var/lib/csi/sockets/pluginproxy
          env:
            - name: GOMEMLIMIT
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.memory
            - name: GOMAXPROCS
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.cpu
        - name: csi-resizer
          resources: 
            limits:
              cpu: 8
              memory: 512Mi
            requests:
              cpu: 2
              memory: 256Mi
          image: registry.k8s.io/sig-storage/csi-resizer:v1.10.1
          imagePullPolicy: IfNotPresent
          args:
            - "--csi-address=$(ADDRESS)"
          env:
            - name: ADDRESS
              value: /var/lib/csi/sockets/pluginproxy/csi.sock
            - name: GOMEMLIMIT
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.memory
            - name: GOMAXPROCS
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.cpu
          volumeMounts:
            - name: socket-dir
              mountPath: /var/lib/csi/sockets/pluginproxy/
        - name: driver
          resources: 
            limits:
              cpu: 8
              memory: 512Mi
            requests:
              cpu: 2
              memory: 256Mi
          securityContext:
            privileged: true
            capabilities:
              add: ['SYS_ADMIN']
            allowPrivilegeEscalation: true
          image: "quay.io/ddn/exascaler-csi-file-driver:v2.3.5"
          imagePullPolicy: "Always"
          args:
            - --nodeid=$(KUBE_NODE_NAME)
            - --endpoint=unix://csi/csi.sock
            - --role=controller
          env:
            - name: KUBE_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: GOMEMLIMIT
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.memory
            - name: GOMAXPROCS
              valueFrom:
                resourceFieldRef:
                  divisor: "0"
                  resource: limits.cpu
          volumeMounts:
            - name: socket-dir
              mountPath: /csi
            - name: secret
              mountPath: /config
              readOnly: true
            - name: host
              mountPath: /host
              mountPropagation: Bidirectional
      volumes:
        - name: socket-dir
          emptyDir:
        - name: secret
          secret:
            secretName: exascaler-csi-file-driver-config
        - name: host
          hostPath:
            path: /
            type: Directory
---
# Source: exa-csi/templates/controller-driver.yaml
# ----------------------
# Exascaler CSI Driver
# ----------------------

apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
  name: exa.csi.ddn.com
spec:
  attachRequired: false
  podInfoOnMount: false
  fsGroupPolicy: File
---
# Source: exa-csi/templates/metrics/lease.yaml
apiVersion: coordination.k8s.io/v1
kind: Lease
metadata:
  name: exa-csi-metrics-exporter-leader-election
  namespace: default
spec:
  holderIdentity: ""
  leaseDurationSeconds: 15
  renewTime: null
  acquireTime: null
  leaseTransitions: 0