# Exascaler CSI Driver (1.0.0)
#
# In production, each CSI driver deployment has to be customized to avoid conflicts,
# use non-default namespace and different names for non-namespaced entities like the ClusterRole
#
# Install to Openshift:
# $ oc apply -f deploy/openshift/exascaler-csi-file-driver.yaml
#

# ----------------------
# Exascaler CSI Driver
# ----------------------

apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
  name: exa.csi.ddn.com
spec:
  attachRequired: false
  podInfoOnMount: false
---


# ----
# RBAC
# ----

apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-driver
  namespace: openshift-kmm
---

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: sa-driver
rules:
- apiGroups:
  - security.openshift.io
  resources:
  - securitycontextconstraints
  verbs:
  - use
  resourceNames:
  - sa-driver
---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: sa-driver
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: sa-driver
subjects:
- kind: ServiceAccount
  name: sa-driver
userNames:
- system:serviceaccount:openshift-kmm:sa-driver
---

allowHostDirVolumePlugin: true
allowHostIPC: true
allowHostNetwork: true
allowHostPID: true
allowHostPorts: true
allowPrivilegeEscalation: true
allowPrivilegedContainer: true
allowedCapabilities: null
apiVersion: security.openshift.io/v1
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
groups: []
kind: SecurityContextConstraints
metadata:
  annotations:
    kubernetes.io/description: this is a custom SCC which combines the allowances of hostnetwork and hostmount-anyuid
  name: sa-driver
priority: null
readOnlyRootFilesystem: false
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: RunAsAny
users:
- system:serviceaccount:openshift-kmm:sa-driver
volumes:
- configMap
- downwardAPI
- emptyDir
- hostPath
- nfs
- persistentVolumeClaim
- projected
- secret
---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: exascaler-driver-role
rules:
- apiGroups:
  - ""
  resources:
  - persistentvolumes
  verbs:
  - get
  - list
  - watch
  - create
  - delete
  - patch
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
  - create
  - delete
- apiGroups:
  - "storage.k8s.io"
  resources:
  - volumeattachments
  verbs:
  - get
  - list
  - watch
  - create
  - delete
  - update
  - patch
- apiGroups:
  - "storage.k8s.io"
  resources:
  - volumeattachments/status
  verbs:
  - get
  - list
  - watch
  - create
  - delete
  - update
  - patch
- apiGroups:
  - ""
  resources:
  - persistentvolumeclaims
  verbs:
  - get
  - list
  - watch
  - update
  - patch
- apiGroups:
  - ""
  resources:
  - persistentvolumeclaims/status
  verbs:
  - get
  - list
  - watch
  - update
  - patch
- apiGroups:
  - storage.k8s.io
  resources:
  - storageclasses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - list
  - watch
  - create
  - update
  - patch
- apiGroups:
  - storage.k8s.io
  resources:
  - csinodes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes
  - pods
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - watch
  - list
  - delete
  - update
  - create
- apiGroups:
  - snapshot.storage.k8s.io
  resources:
  - volumesnapshotclasses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - snapshot.storage.k8s.io
  resources:
  - volumesnapshotcontents
  verbs:
  - create
  - get
  - list
  - watch
  - update
  - delete
  - patch
- apiGroups:
  - snapshot.storage.k8s.io
  resources:
  - volumesnapshots
  verbs:
  - get
  - list
  - watch
  - update
- apiGroups:
  - snapshot.storage.k8s.io
  resources:
  - volumesnapshots/status
  verbs:
  - update
- apiGroups:
  - snapshot.storage.k8s.io
  resources:
  - volumesnapshotcontents/status
  verbs:
  - update
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
  - update
---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: exascaler-driver-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: exascaler-driver-role
subjects:
- kind: ServiceAccount
  name: sa-driver
  namespace: openshift-kmm
---

# ---------------------------------
# Exascaler CSI Controller Server
# ---------------------------------
#
# Runs single driver controller server (driver + provisioner + attacher + snapshotter) on one of the nodes.
# Controller driver deployment does not support running multiple replicas.
#
apiVersion: apps/v1
kind: Deployment
metadata:
  name: exascaler-csi-controller
  namespace: openshift-kmm
spec:
  selector:
    matchLabels:
      app: exascaler-csi-controller
  template:
    metadata:
      labels:
        app: exascaler-csi-controller
    spec:
      serviceAccount: sa-driver
      hostNetwork: true
      securityContext:
        runAsUser: 0
      containers:
      - name: csi-provisioner
        image: registry.k8s.io/sig-storage/csi-provisioner:v3.6.3
        imagePullPolicy: IfNotPresent
        args:
          - --csi-address=/csi/csi.sock
          - --volume-name-prefix=pvc-exa
          - --strict-topology
          - --immediate-topology=false
          - --feature-gates=Topology=true
          - --timeout=120m
        volumeMounts:
          - name: socket-dir
            mountPath: /csi
      - name: csi-attacher
        image: registry.k8s.io/sig-storage/csi-attacher:v4.4.0
        imagePullPolicy: IfNotPresent
        args:
          - --csi-address=$(ADDRESS)
          - --v=2
          - --leader-election=true
        env:
          - name: ADDRESS
            value: /csi/csi.sock
        volumeMounts:
          - name: socket-dir
            mountPath: /csi/
      - name: csi-snapshotter
        image: registry.k8s.io/sig-storage/csi-snapshotter:v5.0.1
        imagePullPolicy: IfNotPresent
        args:
          - -v=3
          - --csi-address=/var/lib/csi/sockets/pluginproxy/csi.sock
          - --timeout=120m
        volumeMounts:
          - name: socket-dir
            mountPath: /var/lib/csi/sockets/pluginproxy
      - name: csi-resizer
        image: k8s.gcr.io/sig-storage/csi-resizer:v1.4.0
        args:
          - "--csi-address=$(ADDRESS)"
        env:
          - name: ADDRESS
            value: /csi/csi.sock
        imagePullPolicy: IfNotPresent
        volumeMounts:
          - name: socket-dir
            mountPath: /csi/
      - image: quay.io/ddn/exascaler-openshift-file-driver:v2.2.6
        imagePullPolicy: Always
        args:
          - --nodeid=$(KUBE_NODE_NAME)
          - --endpoint=unix:///csi/csi.sock
          - --role=controller
        env:
          - name: KUBE_NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
        securityContext:
          allowPrivilegeEscalation: true
          privileged: true
        name: driver
        volumeMounts:
        - mountPath: /csi
          name: socket-dir
        - name: secret
          mountPath: /config
          readOnly: true
        - name: dev
          mountPath: /dev

      volumes:
      - name: dev
        hostPath:
          path: /dev
          type: Directory
      - name: socket-dir
        hostPath:
          path: /var/lib/kubelet/plugins/exa.csi.ddn.com/
          type: DirectoryOrCreate
      - name: secret
        secret:
          secretName: exascaler-csi-file-driver-config
---

# ---------------------------
# Exascaler CSI Node Server
# ---------------------------
#
# Runs driver node server (driver + registrar) on each node
#
kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: exascaler-csi-node
spec:
  selector:
    matchLabels:
      app: exascaler-csi-node
  template:
    metadata:
      labels:
        app: exascaler-csi-node
    spec:
      serviceAccount: sa-driver
      hostNetwork: true
      containers:
        # driver-registrar: sidecar container that:
        # 1) registers the CSI driver with kubelet
        # 2) adds the drivers custom NodeId to a label on the Kubernetes Node API Object
        - name: driver-registrar
          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.9.0
          imagePullPolicy: IfNotPresent
          args:
            - --v=5
            - --csi-address=/csi/csi.sock
            - --kubelet-registration-path=/var/lib/kubelet/plugins_registry/exa.csi.ddn.com/csi.sock
          livenessProbe:
            exec:
              command:
              - /csi-node-driver-registrar
              - --kubelet-registration-path=/var/lib/kubelet/plugins_registry/exa.csi.ddn.com/csi.sock
              - --mode=kubelet-registration-probe
            initialDelaySeconds: 30
            timeoutSeconds: 15
          env:
            - name: KUBE_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            - name: socket-dir
              mountPath: /csi
            - name: registration-dir
              mountPath: /registration
        - name: driver
          securityContext:
            privileged: true
            allowPrivilegeEscalation: true
          image: quay.io/ddn/exascaler-openshift-file-driver:v2.2.6
          imagePullPolicy: Always
          args:
            - --nodeid=$(KUBE_NODE_NAME)
            - --endpoint=unix:///csi/csi.sock
            - --role=node
          env:
            - name: KUBE_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            - name: kubelet-dir
              mountPath: /var/lib/kubelet
              mountPropagation: "Bidirectional"
            - name: dev
              mountPath: /dev
            - name: socket-dir
              mountPath: /csi
            - name: secret
              mountPath: /config
      volumes:
        - name: kubelet-dir
          hostPath:
            path: /var/lib/kubelet
            type: Directory
        - name: dev
          hostPath:
            path: /dev
            type: Directory
        - name: socket-dir
          hostPath:
            path: /var/lib/kubelet/plugins_registry/exa.csi.ddn.com/
            type: DirectoryOrCreate
        - name: registration-dir
          hostPath:
            path: /var/lib/kubelet/plugins_registry/
            type: Directory
        - name: secret
          secret:
            secretName: exascaler-csi-file-driver-config
---