Skip to content

Commit 50baad1

Browse files
PhaowPhaow
authored
STOR-2263: Enable csi resize and inline volume support for smb csi driver (#358)
* STOR-2263: Enable csi resize and inline volume support for smb csi driver * fix: correct the smb csi driver role permission
1 parent 6ab7a9a commit 50baad1

16 files changed

+190
-2
lines changed

‎assets/overlays/samba/base/csi-driver-cluster-role-binding.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
kind: ClusterRoleBinding
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
metadata:
4+
name: smb-csi-driver-binding
5+
subjects:
6+
- kind: ServiceAccount
7+
name: smb-csi-driver-node-sa
8+
namespace: ${NODE_NAMESPACE}
9+
roleRef:
10+
kind: ClusterRole
11+
name: smb-csi-driver-role
12+
apiGroup: rbac.authorization.k8s.io

‎assets/overlays/samba/base/csi-driver-cluster-role.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# SMB CSI inline volume needs the get permission for secrets
2+
kind: ClusterRole
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
metadata:
5+
name: smb-csi-driver-role
6+
rules:
7+
- apiGroups: [""]
8+
resources: ["secrets"]
9+
verbs: ["get"]

‎assets/overlays/samba/base/csidriver.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@ apiVersion: storage.k8s.io/v1
22
kind: CSIDriver
33
metadata:
44
name: smb.csi.k8s.io
5+
labels:
6+
security.openshift.io/csi-ephemeral-volume-profile: "privileged"
57
spec:
68
attachRequired: false
79
podInfoOnMount: true
10+
volumeLifecycleModes:
11+
- Persistent
12+
- Ephemeral

‎assets/overlays/samba/generated/standalone/controller.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@
66
# provisioner.yaml: Loaded from common/sidecars/provisioner.yaml
77
# provisioner.yaml: Added arguments [--extra-create-metadata=true]
88
# Applied strategic merge patch provisioner.yaml
9+
# resizer.yaml: Loaded from common/sidecars/resizer.yaml
10+
# resizer.yaml: Added arguments [--timeout=120s -handle-volume-inuse-error=false]
11+
# Applied strategic merge patch resizer.yaml
912
# livenessprobe.yaml: Loaded from common/sidecars/livenessprobe.yaml
1013
# livenessprobe.yaml: Added arguments [--probe-timeout=3s]
1114
# Applied strategic merge patch livenessprobe.yaml
@@ -148,6 +151,52 @@ spec:
148151
volumeMounts:
149152
- mountPath: /etc/tls/private
150153
name: metrics-serving-cert
154+
- args:
155+
- --csi-address=/var/lib/csi/sockets/pluginproxy/csi.sock
156+
- --http-endpoint=localhost:8223
157+
- --leader-election
158+
- --leader-election-lease-duration=${LEADER_ELECTION_LEASE_DURATION}
159+
- --leader-election-renew-deadline=${LEADER_ELECTION_RENEW_DEADLINE}
160+
- --leader-election-retry-period=${LEADER_ELECTION_RETRY_PERIOD}
161+
- --leader-election-namespace=${NODE_NAMESPACE}
162+
- --v=${LOG_LEVEL}
163+
- --timeout=120s
164+
- -handle-volume-inuse-error=false
165+
env: []
166+
image: ${RESIZER_IMAGE}
167+
imagePullPolicy: IfNotPresent
168+
name: csi-resizer
169+
resources:
170+
requests:
171+
cpu: 10m
172+
memory: 50Mi
173+
terminationMessagePolicy: FallbackToLogsOnError
174+
volumeMounts:
175+
- mountPath: /var/lib/csi/sockets/pluginproxy/
176+
name: socket-dir
177+
- args:
178+
- --secure-listen-address=0.0.0.0:9223
179+
- --upstream=http://127.0.0.1:8223/
180+
- --tls-cert-file=/etc/tls/private/tls.crt
181+
- --tls-private-key-file=/etc/tls/private/tls.key
182+
- --tls-cipher-suites=${TLS_CIPHER_SUITES}
183+
- --tls-min-version=${TLS_MIN_VERSION}
184+
- --logtostderr=true
185+
image: ${KUBE_RBAC_PROXY_IMAGE}
186+
imagePullPolicy: IfNotPresent
187+
name: resizer-kube-rbac-proxy
188+
ports:
189+
- containerPort: 9223
190+
name: resizer-m
191+
protocol: TCP
192+
resources:
193+
requests:
194+
cpu: 10m
195+
memory: 20Mi
196+
terminationMessagePolicy: FallbackToLogsOnError
197+
volumeMounts:
198+
- mountPath: /etc/tls/private
199+
name: metrics-serving-cert
151200
- args:
152201
- --csi-address=/csi/csi.sock
153202
- --health-port=10307

‎assets/overlays/samba/generated/standalone/csi-driver-cluster-role-binding.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Generated file. Do not edit. Update using "make update".
2+
#
3+
# Loaded from overlays/samba/base/csi-driver-cluster-role-binding.yaml
4+
#
5+
#
6+
7+
apiVersion: rbac.authorization.k8s.io/v1
8+
kind: ClusterRoleBinding
9+
metadata:
10+
name: smb-csi-driver-binding
11+
roleRef:
12+
apiGroup: rbac.authorization.k8s.io
13+
kind: ClusterRole
14+
name: smb-csi-driver-role
15+
subjects:
16+
- kind: ServiceAccount
17+
name: smb-csi-driver-node-sa
18+
namespace: ${NODE_NAMESPACE}

‎assets/overlays/samba/generated/standalone/csi-driver-cluster-role.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Generated file. Do not edit. Update using "make update".
2+
#
3+
# Loaded from overlays/samba/base/csi-driver-cluster-role.yaml
4+
#
5+
#
6+
# SMB CSI inline volume needs the get permission for secrets
7+
8+
apiVersion: rbac.authorization.k8s.io/v1
9+
kind: ClusterRole
10+
metadata:
11+
name: smb-csi-driver-role
12+
rules:
13+
- apiGroups:
14+
- ""
15+
resources:
16+
- secrets
17+
verbs:
18+
- get

‎assets/overlays/samba/generated/standalone/csidriver.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,12 @@
77
apiVersion: storage.k8s.io/v1
88
kind: CSIDriver
99
metadata:
10+
labels:
11+
security.openshift.io/csi-ephemeral-volume-profile: privileged
1012
name: smb.csi.k8s.io
1113
spec:
1214
attachRequired: false
1315
podInfoOnMount: true
16+
volumeLifecycleModes:
17+
- Persistent
18+
- Ephemeral

‎assets/overlays/samba/generated/standalone/main_resizer_binding.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Generated file. Do not edit. Update using "make update".
2+
#
3+
# Loaded from base/rbac/main_resizer_binding.yaml
4+
# because it's needed by controller sidecar common/sidecars/resizer.yaml
5+
#
6+
#
7+
8+
apiVersion: rbac.authorization.k8s.io/v1
9+
kind: ClusterRoleBinding
10+
metadata:
11+
name: smb-csi-main-resizer-binding
12+
roleRef:
13+
apiGroup: rbac.authorization.k8s.io
14+
kind: ClusterRole
15+
name: openshift-csi-main-resizer-role
16+
subjects:
17+
- kind: ServiceAccount
18+
name: smb-csi-driver-controller-sa
19+
namespace: ${NODE_NAMESPACE}

‎assets/overlays/samba/generated/standalone/manifests.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,15 @@ controllerStaticAssetNames:
1111
guestStaticAssetNames:
1212
- configmap_and_secret_reader_provisioner_binding.yaml
1313
- controller_privileged_binding.yaml
14+
- csi-driver-cluster-role-binding.yaml
15+
- csi-driver-cluster-role.yaml
1416
- csidriver.yaml
1517
- lease_leader_election_binding.yaml
1618
- lease_leader_election_role.yaml
1719
- main_provisioner_binding.yaml
20+
- main_resizer_binding.yaml
1821
- node.yaml
1922
- node_privileged_binding.yaml
2023
- node_sa.yaml
2124
- privileged_role.yaml
25+
- storageclass_reader_resizer_binding.yaml

‎assets/overlays/samba/generated/standalone/service.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
# Loaded from base/controller_metrics_service.yaml
44
# Applied strategic merge patch common/metrics/service_add_port.yaml
55
# Applied strategic merge patch common/metrics/service_add_port.yaml
6+
# Applied strategic merge patch common/metrics/service_add_port.yaml
67
#
78
#
89

@@ -21,6 +22,10 @@ spec:
2122
port: 9222
2223
protocol: TCP
2324
targetPort: provisioner-m
25+
- name: resizer-m
26+
port: 9223
27+
protocol: TCP
28+
targetPort: resizer-m
2429
- name: driver-m
2530
port: 9221
2631
protocol: TCP

0 commit comments

Comments
 (0)