Skip to content

Commit 761680c

Browse files
ashimagarg27Bhagyashreek8mssachan
authored
Changes related to GRPC server (#64)
* nitContainer to install s3fs on worker noe * Update init container image and host network permissions * cos apis Signed-off-by: Ashima-Ashima1 <[email protected]> * cos apis Signed-off-by: Ashima-Ashima1 <[email protected]> * cos apis Signed-off-by: Ashima-Ashima1 <[email protected]> * cos apis Signed-off-by: Ashima-Ashima1 <[email protected]> * update gomod Signed-off-by: Ashima-Ashima1 <[email protected]> * update crds Signed-off-by: Ashima-Ashima1 <[email protected]> * cos apis Signed-off-by: Ashima-Ashima1 <[email protected]> * remove host access to initContainer * resolve merge conflicts and rebase branch Signed-off-by: Ashima-Ashima1 <[email protected]> * update go.mod Signed-off-by: Ashima-Ashima1 <[email protected]> * cos apis Signed-off-by: Ashima-Ashima1 <[email protected]> * remove initContainer on node_csi pod * remove initContainer on node_csi pod * FIx contants * Update node server security contexts --------- Signed-off-by: Ashima-Ashima1 <[email protected]> Co-authored-by: bhagyak1 <[email protected]> Co-authored-by: Mayank Sachan <[email protected]>
1 parent 723ee0c commit 761680c

12 files changed

+154
-142
lines changed

‎.secrets.baseline

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"files": "go.sum|^.secrets.baseline$",
44
"lines": null
55
},
6-
"generated_at": "2024-11-25T05:25:45Z",
6+
"generated_at": "2025-05-22T09:04:02Z",
77
"plugins_used": [
88
{
99
"name": "AWSKeyDetector"

‎Makefile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -196,8 +196,8 @@ CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
196196
ENVTEST ?= $(LOCALBIN)/setup-envtest
197197

198198
## Tool Versions
199-
KUSTOMIZE_VERSION ?= v5.5.0
200-
CONTROLLER_TOOLS_VERSION ?= v0.16.4
199+
KUSTOMIZE_VERSION ?= v5.6.0
200+
CONTROLLER_TOOLS_VERSION ?= v0.17.3
201201

202202
KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
203203
.PHONY: kustomize

‎config/crd/bases/objectdriver.csi.ibm.com_ibmobjectcsis.yaml

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.16.4
6+
controller-gen.kubebuilder.io/version: v0.17.3
77
name: ibmobjectcsis.objectdriver.csi.ibm.com
88
spec:
99
group: objectdriver.csi.ibm.com
@@ -329,7 +329,6 @@ spec:
329329
pod labels will be ignored. The default value is empty.
330330
The same key is forbidden to exist in both matchLabelKeys and labelSelector.
331331
Also, matchLabelKeys cannot be set when labelSelector isn't set.
332-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
333332
items:
334333
type: string
335334
type: array
@@ -344,7 +343,6 @@ spec:
344343
pod labels will be ignored. The default value is empty.
345344
The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
346345
Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
347-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
348346
items:
349347
type: string
350348
type: array
@@ -511,7 +509,6 @@ spec:
511509
pod labels will be ignored. The default value is empty.
512510
The same key is forbidden to exist in both matchLabelKeys and labelSelector.
513511
Also, matchLabelKeys cannot be set when labelSelector isn't set.
514-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
515512
items:
516513
type: string
517514
type: array
@@ -526,7 +523,6 @@ spec:
526523
pod labels will be ignored. The default value is empty.
527524
The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
528525
Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
529-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
530526
items:
531527
type: string
532528
type: array
@@ -691,7 +687,6 @@ spec:
691687
pod labels will be ignored. The default value is empty.
692688
The same key is forbidden to exist in both matchLabelKeys and labelSelector.
693689
Also, matchLabelKeys cannot be set when labelSelector isn't set.
694-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
695690
items:
696691
type: string
697692
type: array
@@ -706,7 +701,6 @@ spec:
706701
pod labels will be ignored. The default value is empty.
707702
The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
708703
Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
709-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
710704
items:
711705
type: string
712706
type: array
@@ -873,7 +867,6 @@ spec:
873867
pod labels will be ignored. The default value is empty.
874868
The same key is forbidden to exist in both matchLabelKeys and labelSelector.
875869
Also, matchLabelKeys cannot be set when labelSelector isn't set.
876-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
877870
items:
878871
type: string
879872
type: array
@@ -888,7 +881,6 @@ spec:
888881
pod labels will be ignored. The default value is empty.
889882
The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
890883
Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
891-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
892884
items:
893885
type: string
894886
type: array
@@ -1344,7 +1336,6 @@ spec:
13441336
pod labels will be ignored. The default value is empty.
13451337
The same key is forbidden to exist in both matchLabelKeys and labelSelector.
13461338
Also, matchLabelKeys cannot be set when labelSelector isn't set.
1347-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
13481339
items:
13491340
type: string
13501341
type: array
@@ -1359,7 +1350,6 @@ spec:
13591350
pod labels will be ignored. The default value is empty.
13601351
The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
13611352
Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1362-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
13631353
items:
13641354
type: string
13651355
type: array
@@ -1526,7 +1516,6 @@ spec:
15261516
pod labels will be ignored. The default value is empty.
15271517
The same key is forbidden to exist in both matchLabelKeys and labelSelector.
15281518
Also, matchLabelKeys cannot be set when labelSelector isn't set.
1529-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
15301519
items:
15311520
type: string
15321521
type: array
@@ -1541,7 +1530,6 @@ spec:
15411530
pod labels will be ignored. The default value is empty.
15421531
The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
15431532
Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1544-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
15451533
items:
15461534
type: string
15471535
type: array
@@ -1706,7 +1694,6 @@ spec:
17061694
pod labels will be ignored. The default value is empty.
17071695
The same key is forbidden to exist in both matchLabelKeys and labelSelector.
17081696
Also, matchLabelKeys cannot be set when labelSelector isn't set.
1709-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
17101697
items:
17111698
type: string
17121699
type: array
@@ -1721,7 +1708,6 @@ spec:
17211708
pod labels will be ignored. The default value is empty.
17221709
The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
17231710
Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1724-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
17251711
items:
17261712
type: string
17271713
type: array
@@ -1888,7 +1874,6 @@ spec:
18881874
pod labels will be ignored. The default value is empty.
18891875
The same key is forbidden to exist in both matchLabelKeys and labelSelector.
18901876
Also, matchLabelKeys cannot be set when labelSelector isn't set.
1891-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
18921877
items:
18931878
type: string
18941879
type: array
@@ -1903,7 +1888,6 @@ spec:
19031888
pod labels will be ignored. The default value is empty.
19041889
The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
19051890
Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
1906-
This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
19071891
items:
19081892
type: string
19091893
type: array

‎config/crd/bases/objectdriver.csi.ibm.com_recoverstalevolumes.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33
kind: CustomResourceDefinition
44
metadata:
55
annotations:
6-
controller-gen.kubebuilder.io/version: v0.16.4
6+
controller-gen.kubebuilder.io/version: v0.17.3
77
name: recoverstalevolumes.objectdriver.csi.ibm.com
88
spec:
99
group: objectdriver.csi.ibm.com

‎config/manager/kustomization.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ kind: Kustomization
55
images:
66
- name: controller
77
newName: icr.io/ibm/ibm-object-csi-driver-operator
8-
newTag: v0.1.17
8+
newTag: v0.1.18
99
commonLabels:
1010
app.kubernetes.io/managed-by: ibm-object-csi-driver-operator
1111
app.kubernetes.io/part-of: ibm-object-csi-driver

‎config/manager/manager.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ spec:
101101
cpu: 500m
102102
memory: 500Mi
103103
requests:
104-
cpu: 10m
104+
cpu: 50m
105105
memory: 128Mi
106106
serviceAccountName: controller-manager
107107
terminationGracePeriodSeconds: 10

‎config/samples/csi_v1alpha1_ibmobjectcsi.yaml

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ spec:
1414
# and csi-provisioner and livenessprobe sidecars.
1515
controller:
1616
repository: icr.io/ibm/ibm-object-csi-driver
17-
tag: "v0.1.17"
17+
tag: "v0.1.18"
1818
imagePullPolicy: IfNotPresent
1919
resources:
2020
limits:
@@ -35,15 +35,6 @@ spec:
3535
- controller
3636
topologyKey: topology.kubernetes.io/zone
3737
weight: 100
38-
- podAffinityTerm:
39-
labelSelector:
40-
matchExpressions:
41-
- key: app.kubernetes.io/component
42-
operator: In
43-
values:
44-
- controller
45-
topologyKey: topology.kubernetes.io/zone
46-
weight: 100
4738
nodeAffinity:
4839
requiredDuringSchedulingIgnoredDuringExecution:
4940
nodeSelectorTerms:
@@ -57,8 +48,15 @@ spec:
5748
# and csi-node-driver-registrar and livenessprobe sidecars.
5849
node:
5950
repository: icr.io/ibm/ibm-object-csi-driver
60-
tag: "v0.1.17"
51+
tag: "v0.1.18"
6152
imagePullPolicy: Always
53+
resources:
54+
limits:
55+
cpu: 120m
56+
memory: 300Mi
57+
requests:
58+
cpu: 30m
59+
memory: 75Mi
6260

6361
sidecars:
6462
- name: csi-node-driver-registrar

‎controllers/constants/constants.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ const (
7272
CSINodeSCCClusterRole = "node-scc-clusterrole"
7373
CSINodeSCCClusterRoleBinding = "node-scc-clusterrolebinding"
7474
CSINodePriorityClassName = "system-node-critical"
75+
CSIControllerPriorityClassName = "system-cluster-critical"
7576

7677
ResourceReqLimitsConfigMap = "cos-csi-driver-configmap"
7778
ObjectCSIDriver = "ibm-object-csi"

‎controllers/syncer/csi_controller.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,7 @@ func (s *csiControllerSyncer) ensurePodSpec() corev1.PodSpec {
9191
Affinity: s.driver.Spec.Controller.Affinity,
9292
Tolerations: s.driver.Spec.Controller.Tolerations,
9393
ServiceAccountName: constants.GetResourceName(constants.CSIControllerServiceAccount),
94+
PriorityClassName: constants.CSIControllerPriorityClassName,
9495
}
9596
}
9697

‎controllers/syncer/csi_node.go

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ func (s *csiNodeSyncer) ensurePodSpec() corev1.PodSpec {
9393
SecurityContext: &corev1.PodSecurityContext{
9494
RunAsNonRoot: util.True(),
9595
RunAsUser: func(uid int64) *int64 { return &uid }(2121),
96+
RunAsGroup: func(uid int64) *int64 { return &uid }(2121),
9697
},
9798
Affinity: s.driver.Spec.Node.Affinity,
9899
Tolerations: s.driver.Spec.Node.Tolerations,
@@ -138,7 +139,7 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container {
138139

139140
nodePlugin.SecurityContext = &corev1.SecurityContext{
140141
RunAsNonRoot: util.False(),
141-
Privileged: util.True(),
142+
Privileged: util.True(), // Revisit if node server needs privileged permission
142143
RunAsUser: func(uid int64) *int64 { return &uid }(0),
143144
}
144145
fillSecurityContextCapabilities(
@@ -154,9 +155,10 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container {
154155
"--v=5",
155156
},
156157
)
157-
registrar.SecurityContext = &corev1.SecurityContext{RunAsNonRoot: util.False(),
158-
RunAsUser: func(uid int64) *int64 { return &uid }(0),
159-
Privileged: util.False(),
158+
registrar.SecurityContext = &corev1.SecurityContext{
159+
RunAsNonRoot: util.False(),
160+
RunAsUser: func(uid int64) *int64 { return &uid }(0),
161+
Privileged: util.False(),
160162
}
161163
fillSecurityContextCapabilities(registrar.SecurityContext)
162164
registrar.ImagePullPolicy = s.getCSINodeDriverRegistrarPullPolicy()
@@ -171,10 +173,6 @@ func (s *csiNodeSyncer) ensureContainersSpec() []corev1.Container {
171173
healthPortArg,
172174
},
173175
)
174-
livenessProbe.SecurityContext = &corev1.SecurityContext{RunAsNonRoot: util.False(),
175-
RunAsUser: func(uid int64) *int64 { return &uid }(0),
176-
Privileged: util.False(),
177-
}
178176
fillSecurityContextCapabilities(livenessProbe.SecurityContext)
179177
livenessProbe.ImagePullPolicy = s.getCSINodeDriverRegistrarPullPolicy()
180178
livenessProbe.Resources = getSidecarResourceRequests(s.driver, constants.LivenessProbe)
@@ -267,6 +265,15 @@ func (s *csiNodeSyncer) getVolumeMountsFor(name string) []corev1.VolumeMount {
267265
Name: "host-log",
268266
MountPath: "/host/var/log",
269267
},
268+
{
269+
Name: "coscsi-socket",
270+
MountPath: "/var/lib/coscsi.sock",
271+
ReadOnly: false,
272+
},
273+
{
274+
Name: "coscsi-mounter-config",
275+
MountPath: "/var/lib/cos-csi",
276+
},
270277
}
271278

272279
case constants.CSINodeDriverRegistrar:
@@ -301,6 +308,8 @@ func (s *csiNodeSyncer) ensureVolumes() []corev1.Volume {
301308
ensureVolume("fuse-device", ensureHostPathVolumeSource("/dev/fuse", "")),
302309
ensureVolume("log-dev", ensureHostPathVolumeSource("/dev/log", "")),
303310
ensureVolume("host-log", ensureHostPathVolumeSource("/var/log", "")),
311+
ensureVolume("coscsi-socket", ensureHostPathVolumeSource("/var/lib/coscsi.sock", "Socket")),
312+
ensureVolume("coscsi-mounter-config", ensureHostPathVolumeSource("/var/lib/cos-csi", "DirectoryOrCreate")),
304313
}
305314
}
306315

0 commit comments

Comments
 (0)