[feat][helm] kubeconfig path flag option for controller server + SA/RBAC toggles for controller and node

docs/deployment.md

@@ -74,6 +74,73 @@ _See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documen
 - Modify variables using the `--set var=value` flag or by providing a custom `values.yaml` with `-f custom-values.yaml`.
 - For a comprehensive list of configurable variables, refer to [`helm-chart/csi-driver/values.yaml`](https://github.com/linode/linode-blockstorage-csi-driver/blob/main/helm-chart/csi-driver/values.yaml).
 
+###### Controller kubeconfig (optional)
+
+If your environment requires the controller to use a kubeconfig file explicitly, enable the controller kubeconfig by providing the following values. The Secret will be mounted as a directory and the sidecars will read the file `<mountDir>/<secretKey>`.
+
+```yaml
+controller:
+  kubeconfig:
+    mountDir: /etc/kubeconfig
+    secretName: csi-kubeconfig
+    secretKey: external-kubeconfig
+```
+
+Helm example:
+
+```sh
+helm install linode-csi-driver \
+  --set apiToken="$LINODE_API_TOKEN" \
+  --set region="$REGION" \
+  --set controller.kubeconfig.mountDir=/etc/kubeconfig \
+  --set controller.kubeconfig.secretName=csi-kubeconfig \
+  --set controller.kubeconfig.secretKey=external-kubeconfig \
+  linode-csi/linode-blockstorage-csi-driver
+```
+
+The Secret should contain a key named `external-kubeconfig` (or your chosen `secretKey`). For example:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: csi-kubeconfig
+  namespace: kube-system
+stringData:
+  external-kubeconfig: |
+    # contents of your kubeconfig file
+```
+
+###### Controller ServiceAccount and RBAC toggles
+
+By default, the chart creates the controller ServiceAccount and its RBAC ClusterRoleBindings. You can disable these if you want to manage them externally. The controller ServiceAccount name defaults to `csi-controller-sa`.
+
+```yaml
+controller:
+  serviceAccount:
+    enabled: true   # set to false to skip creating the SA (still referenced by the StatefulSet)
+    name: ""        # optionally override the ServiceAccount name (defaults to "csi-controller-sa")
+  rbac:
+    enabled: true   # set to false to skip creating controller ClusterRoleBindings
+```
+
+When `controller.serviceAccount.enabled=false`, ensure a ServiceAccount named `csi-controller-sa` exists in the target namespace.
+
+###### DaemonSet ServiceAccount and RBAC toggles
+
+By default, the chart also creates the node DaemonSet ServiceAccount and its RBAC ClusterRoleBinding. You can disable these if you manage them externally. The node ServiceAccount name defaults to `csi-node-sa`.
+
+```yaml
+daemonSet:
+  serviceAccount:
+    enabled: true   # set to false to skip creating the node SA (DaemonSet will omit serviceAccount when false)
+    name: ""        # optionally override the ServiceAccount name (defaults to "csi-node-sa")
+  rbac:
+    enabled: true   # set to false to skip creating the node ClusterRoleBinding
+```
+
+When `daemonSet.serviceAccount.enabled=false`, ensure a ServiceAccount named `csi-node-sa` exists in the target namespace if you intend to set it explicitly on the DaemonSet yourself.
+
 ##### 👉 Recommendation
 
 Use a custom `values.yaml` file to override variables to avoid template rendering errors.

helm-chart/csi-driver/templates/_helpers.tpl

@@ -54,7 +54,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 Create the name of the service account to use
 */}}
 {{- define "csi-driver.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create }}
+{{- if .Values.serviceAccount.enabled }}
 {{- default (include "csi-driver.fullname" .) .Values.serviceAccount.name }}
 {{- else }}
 {{- default "default" .Values.serviceAccount.name }}

helm-chart/csi-driver/templates/csi-controller-attacher-binding-rbac.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.controller.rbac.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -8,5 +9,7 @@ roleRef:
   name: external-attacher-role
 subjects:
 - kind: ServiceAccount
-  name: csi-controller-sa
+  name: {{ default "csi-controller-sa" .Values.controller.serviceAccount.name }}
   namespace: {{ required ".Values.namespace required" .Values.namespace }}
+{{- end }}
+

helm-chart/csi-driver/templates/csi-controller-provisioner-binding-rbac.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.controller.rbac.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -8,5 +9,6 @@ roleRef:
   name: external-provisioner-role
 subjects:
 - kind: ServiceAccount
-  name: csi-controller-sa
+  name: {{ default "csi-controller-sa" .Values.controller.serviceAccount.name }}
   namespace: {{ required ".Values.namespace required" .Values.namespace }}
+{{- end }}

helm-chart/csi-driver/templates/csi-controller-resizer-binding-rbac.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.controller.rbac.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -8,5 +9,6 @@ roleRef:
   name: external-resizer-role
 subjects:
 - kind: ServiceAccount
-  name: csi-controller-sa
+  name: {{ default "csi-controller-sa" .Values.controller.serviceAccount.name }}
   namespace: {{ required ".Values.namespace required" .Values.namespace }}
+{{- end }}

helm-chart/csi-driver/templates/csi-controller-serviceaccount.yaml

@@ -1,5 +1,7 @@
+{{- if .Values.controller.serviceAccount.enabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: csi-controller-sa
+  name: {{ default "csi-controller-sa" .Values.controller.serviceAccount.name }}
   namespace: {{ required ".Values.namespace required" .Values.namespace }}
+{{- end }}

helm-chart/csi-driver/templates/csi-linode-controller.yaml

@@ -36,6 +36,11 @@ spec:
             - --csi-address=$(ADDRESS)
             - --feature-gates=Topology=true
             - --v=2
+            {{- with .Values.controller.kubeconfig }}
+              {{- if and .mountDir .secretKey }}
+            - --kubeconfig={{ printf "%s/%s" .mountDir .secretKey }}
+              {{- end }}
+            {{- end }}
             {{- if .Values.enableMetrics}}
             - --metrics-address={{ .Values.csiProvisioner.metrics.address }}
             {{- end }}
@@ -59,10 +64,22 @@ spec:
           volumeMounts:
             - mountPath: /var/lib/csi/sockets/pluginproxy/
               name: socket-dir
+            {{- with .Values.controller.kubeconfig }}
+              {{- if and .mountDir .secretName }}
+            - mountPath: {{ .mountDir }}
+              name: controller-kubeconfig
+              readOnly: true
+              {{- end }}
+            {{- end }}
         - args:
             - --v=2
             - --csi-address=$(ADDRESS)
             - --timeout=30s
+            {{- with .Values.controller.kubeconfig }}
+              {{- if and .mountDir .secretKey }}
+            - --kubeconfig={{ printf "%s/%s" .mountDir .secretKey }}
+              {{- end }}
+            {{- end }}
             {{- if .Values.enableMetrics}}
             - --metrics-address={{ .Values.csiAttacher.metrics.address }}
             {{- end }}
@@ -86,9 +103,21 @@ spec:
           volumeMounts:
             - mountPath: /var/lib/csi/sockets/pluginproxy/
               name: socket-dir
+            {{- with .Values.controller.kubeconfig }}
+              {{- if and .mountDir .secretName }}
+            - mountPath: {{ .mountDir }}
+              name: controller-kubeconfig
+              readOnly: true
+              {{- end }}
+            {{- end }}
         - args:
             - --v=2
             - --csi-address=$(ADDRESS)
+            {{- with .Values.controller.kubeconfig }}
+              {{- if and .mountDir .secretKey }}
+            - --kubeconfig={{ printf "%s/%s" .mountDir .secretKey }}
+              {{- end }}
+            {{- end }}
             {{- if .Values.enableMetrics}}
             - --metrics-address={{ .Values.csiResizer.metrics.address }}
             {{- end }}
@@ -112,6 +141,13 @@ spec:
           volumeMounts:
             - mountPath: /var/lib/csi/sockets/pluginproxy/
               name: socket-dir
+            {{- with .Values.controller.kubeconfig }}
+              {{- if and .mountDir .secretName }}
+            - mountPath: {{ .mountDir }}
+              name: controller-kubeconfig
+              readOnly: true
+              {{- end }}
+            {{- end }}
         - args:
             - --v=2
           env:
@@ -162,7 +198,9 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-      serviceAccount: csi-controller-sa
+      {{- if .Values.controller.serviceAccount.enabled }}
+      serviceAccount: {{ default "csi-controller-sa" .Values.controller.serviceAccount.name }}
+      {{- end }}
       {{- if .Values.controller.nodeSelector }}
       nodeSelector:
         {{- toYaml .Values.controller.nodeSelector | nindent 8 }}
@@ -194,6 +232,16 @@ spec:
             path: /dev
             type: Directory
           name: dev
+        {{- with .Values.controller.kubeconfig }}
+          {{- if and .secretName .secretKey }}
+        - name: controller-kubeconfig
+          secret:
+            secretName: {{ .secretName }}
+            items:
+              - key: {{ .secretKey }}
+                path: {{ .secretKey }}
+          {{- end }}
+        {{- end }}
         {{- with .Values.csiLinodePlugin.volumes }}
         {{- toYaml . | nindent 8 }}
         {{- end }}

helm-chart/csi-driver/templates/csi-node-serviceaccount.yaml

@@ -1,5 +1,7 @@
+{{- if .Values.daemonSet.serviceAccount.enabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: csi-node-sa
+  name: {{ default "csi-node-sa" .Values.daemonSet.serviceAccount.name }}
   namespace: {{ required ".Values.namespace required" .Values.namespace }}
+{{- end }}

helm-chart/csi-driver/templates/daemonset.yaml

@@ -104,7 +104,9 @@ spec:
         {{- end }}
       hostNetwork: true
       priorityClassName: system-node-critical
-      serviceAccount: csi-node-sa
+      {{- if .Values.daemonSet.serviceAccount.enabled }}
+      serviceAccount: {{ default "csi-node-sa" .Values.daemonSet.serviceAccount.name }}
+      {{- end }}
       tolerations:
       - effect: NoSchedule
         operator: Exists

helm-chart/csi-driver/templates/linode-csi-binding-rbac.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.daemonSet.rbac.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -9,5 +10,6 @@ roleRef:
   name: linode-csi-role
 subjects:
 - kind: ServiceAccount
-  name: csi-node-sa
+  name: {{ default "csi-node-sa" .Values.daemonSet.serviceAccount.name }}
   namespace: {{ required ".Values.namespace required" .Values.namespace }}
+{{- end }}

helm-chart/csi-driver/values.yaml

@@ -97,12 +97,26 @@ csiNodeDriverRegistrar:
 
 controller:
   enabled: true
+  kubeconfig:
+    mountDir: ""
+    secretName: ""
+    secretKey: ""
+  serviceAccount:
+    enabled: true
+    name: "csi-controller-sa"
+  rbac:
+    enabled: true
   nodeSelector: {}
   affinity: {}
   tolerations: []
 
 daemonSet:
   enabled: true
+  serviceAccount:
+    enabled: true
+    name: "csi-node-sa"
+  rbac:
+    enabled: true
 # Add custom annotations to all pods
 podAnnotations: {}