selee
/
GPU-Live
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
GPU-Live/template/stg/ddn/ddn-install-running/exa-csi-driver-2.3.5/deploy/openshift/exascaler-csi-file-driver.yaml

493 lines
10 KiB
YAML
Raw Blame History

# Exascaler CSI Driver (1.0.0)
#
# In production, each CSI driver deployment has to be customized to avoid conflicts,
# use non-default namespace and different names for non-namespaced entities like the ClusterRole
#
# Install to Openshift:
# $ oc apply -f deploy/openshift/exascaler-csi-file-driver.yaml
#
# ----------------------
# Exascaler CSI Driver
# ----------------------
apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
name: exa.csi.ddn.com
spec:
attachRequired: false
podInfoOnMount: false
---
# ----
# RBAC
# ----
apiVersion: v1
kind: ServiceAccount
metadata:
name: sa-driver
namespace: openshift-kmm
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: sa-driver
rules:
- apiGroups:
- security.openshift.io
resources:
- securitycontextconstraints
verbs:
- use
resourceNames:
- sa-driver
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: sa-driver
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: sa-driver
subjects:
- kind: ServiceAccount
name: sa-driver
userNames:
- system:serviceaccount:openshift-kmm:sa-driver
---
allowHostDirVolumePlugin: true
allowHostIPC: true
allowHostNetwork: true
allowHostPID: true
allowHostPorts: true
allowPrivilegeEscalation: true
allowPrivilegedContainer: true
allowedCapabilities: null
apiVersion: security.openshift.io/v1
defaultAddCapabilities: null
fsGroup:
type: RunAsAny
groups: []
kind: SecurityContextConstraints
metadata:
annotations:
kubernetes.io/description: this is a custom SCC which combines the allowances of hostnetwork and hostmount-anyuid
name: sa-driver
priority: null
readOnlyRootFilesystem: false
runAsUser:
type: RunAsAny
seLinuxContext:
type: MustRunAs
supplementalGroups:
type: RunAsAny
users:
- system:serviceaccount:openshift-kmm:sa-driver
volumes:
- configMap
- downwardAPI
- emptyDir
- hostPath
- nfs
- persistentVolumeClaim
- projected
- secret
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: exascaler-driver-role
rules:
- apiGroups:
- ""
resources:
- persistentvolumes
verbs:
- get
- list
- watch
- create
- delete
- patch
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
- create
- delete
- apiGroups:
- "storage.k8s.io"
resources:
- volumeattachments
verbs:
- get
- list
- watch
- create
- delete
- update
- patch
- apiGroups:
- "storage.k8s.io"
resources:
- volumeattachments/status
verbs:
- get
- list
- watch
- create
- delete
- update
- patch
- apiGroups:
- ""
resources:
- persistentvolumeclaims
verbs:
- get
- list
- watch
- update
- patch
- apiGroups:
- ""
resources:
- persistentvolumeclaims/status
verbs:
- get
- list
- watch
- update
- patch
- apiGroups:
- storage.k8s.io
resources:
- storageclasses
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- events
verbs:
- list
- watch
- create
- update
- patch
- apiGroups:
- storage.k8s.io
resources:
- csinodes
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- nodes
- pods
verbs:
- get
- list
- watch
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- watch
- list
- delete
- update
- create
- apiGroups:
- snapshot.storage.k8s.io
resources:
- volumesnapshotclasses
verbs:
- get
- list
- watch
- apiGroups:
- snapshot.storage.k8s.io
resources:
- volumesnapshotcontents
verbs:
- create
- get
- list
- watch
- update
- delete
- patch
- apiGroups:
- snapshot.storage.k8s.io
resources:
- volumesnapshots
verbs:
- get
- list
- watch
- update
- apiGroups:
- snapshot.storage.k8s.io
resources:
- volumesnapshots/status
verbs:
- update
- apiGroups:
- snapshot.storage.k8s.io
resources:
- volumesnapshotcontents/status
verbs:
- update
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- get
- list
- watch
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: exascaler-driver-role-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: exascaler-driver-role
subjects:
- kind: ServiceAccount
name: sa-driver
namespace: openshift-kmm
---
# ---------------------------------
# Exascaler CSI Controller Server
# ---------------------------------
#
# Runs single driver controller server (driver + provisioner + attacher + snapshotter) on one of the nodes.
# Controller driver deployment does not support running multiple replicas.
#
apiVersion: apps/v1
kind: Deployment
metadata:
name: exascaler-csi-controller
namespace: openshift-kmm
spec:
selector:
matchLabels:
app: exascaler-csi-controller
template:
metadata:
labels:
app: exascaler-csi-controller
spec:
serviceAccount: sa-driver
hostNetwork: true
securityContext:
runAsUser: 0
containers:
- name: csi-provisioner
image: registry.k8s.io/sig-storage/csi-provisioner:v3.6.3
imagePullPolicy: IfNotPresent
args:
- --csi-address=/csi/csi.sock
- --volume-name-prefix=pvc-exa
- --strict-topology
- --immediate-topology=false
- --feature-gates=Topology=true
- --timeout=120m
volumeMounts:
- name: socket-dir
mountPath: /csi
- name: csi-attacher
image: registry.k8s.io/sig-storage/csi-attacher:v4.4.0
imagePullPolicy: IfNotPresent
args:
- --csi-address=$(ADDRESS)
- --v=2
- --leader-election=true
env:
- name: ADDRESS
value: /csi/csi.sock
volumeMounts:
- name: socket-dir
mountPath: /csi/
- name: csi-snapshotter
image: registry.k8s.io/sig-storage/csi-snapshotter:v5.0.1
imagePullPolicy: IfNotPresent
args:
- -v=3
- --csi-address=/var/lib/csi/sockets/pluginproxy/csi.sock
- --timeout=120m
volumeMounts:
- name: socket-dir
mountPath: /var/lib/csi/sockets/pluginproxy
- name: csi-resizer
image: k8s.gcr.io/sig-storage/csi-resizer:v1.4.0
args:
- "--csi-address=$(ADDRESS)"
env:
- name: ADDRESS
value: /csi/csi.sock
imagePullPolicy: IfNotPresent
volumeMounts:
- name: socket-dir
mountPath: /csi/
- image: quay.io/ddn/exascaler-openshift-file-driver:v2.3.5
imagePullPolicy: Always
args:
- --nodeid=$(KUBE_NODE_NAME)
- --endpoint=unix:///csi/csi.sock
- --role=controller
env:
- name: KUBE_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
securityContext:
allowPrivilegeEscalation: true
privileged: true
name: driver
volumeMounts:
- mountPath: /csi
name: socket-dir
- name: secret
mountPath: /config
readOnly: true
- name: dev
mountPath: /dev
volumes:
- name: dev
hostPath:
path: /dev
type: Directory
- name: socket-dir
hostPath:
path: /var/lib/kubelet/plugins/exa.csi.ddn.com/
type: DirectoryOrCreate
- name: secret
secret:
secretName: exascaler-csi-file-driver-config
---
# ---------------------------
# Exascaler CSI Node Server
# ---------------------------
#
# Runs driver node server (driver + registrar) on each node
#
kind: DaemonSet
apiVersion: apps/v1
metadata:
name: exascaler-csi-node
spec:
selector:
matchLabels:
app: exascaler-csi-node
template:
metadata:
labels:
app: exascaler-csi-node
spec:
serviceAccount: sa-driver
hostNetwork: true
containers:
# driver-registrar: sidecar container that:
# 1) registers the CSI driver with kubelet
# 2) adds the drivers custom NodeId to a label on the Kubernetes Node API Object
- name: driver-registrar
image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.9.0
imagePullPolicy: IfNotPresent
args:
- --v=5
- --csi-address=/csi/csi.sock
- --kubelet-registration-path=/var/lib/kubelet/plugins_registry/exa.csi.ddn.com/csi.sock
livenessProbe:
exec:
command:
- /csi-node-driver-registrar
- --kubelet-registration-path=/var/lib/kubelet/plugins_registry/exa.csi.ddn.com/csi.sock
- --mode=kubelet-registration-probe
initialDelaySeconds: 30
timeoutSeconds: 15
env:
- name: KUBE_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
volumeMounts:
- name: socket-dir
mountPath: /csi
- name: registration-dir
mountPath: /registration
- name: driver
securityContext:
privileged: true
allowPrivilegeEscalation: true
image: quay.io/ddn/exascaler-openshift-file-driver:v2.3.5
imagePullPolicy: Always
args:
- --nodeid=$(KUBE_NODE_NAME)
- --endpoint=unix:///csi/csi.sock
- --role=node
env:
- name: KUBE_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
volumeMounts:
- name: kubelet-dir
mountPath: /var/lib/kubelet
mountPropagation: "Bidirectional"
- name: dev
mountPath: /dev
- name: socket-dir
mountPath: /csi
- name: secret
mountPath: /config
volumes:
- name: kubelet-dir
hostPath:
path: /var/lib/kubelet
type: Directory
- name: dev
hostPath:
path: /dev
type: Directory
- name: socket-dir
hostPath:
path: /var/lib/kubelet/plugins_registry/exa.csi.ddn.com/
type: DirectoryOrCreate
- name: registration-dir
hostPath:
path: /var/lib/kubelet/plugins_registry/
type: Directory
- name: secret
secret:
secretName: exascaler-csi-file-driver-config
---
Reference in New Issue View Git Blame Copy Permalink