Upgrade node manager to v0.0.6

mhmxs · mhmxs · commit a795ffe9e96d · 2022-04-08T14:38:08.000+02:00
diff --git a/.github/workflows/pre-release.yaml b/.github/workflows/pre-release.yaml
@@ -15,7 +15,7 @@ env:
     RELATED_IMAGE_CSIV1_EXTERNAL_RESIZER=quay.io/k8scsi/csi-resizer:v1.1.0
     RELATED_IMAGE_STORAGEOS_INIT=storageos/init:v2.1.2
     RELATED_IMAGE_STORAGEOS_NODE=soegarots/node:v2-release-v2.7.0-24
-    RELATED_IMAGE_NODE_MANAGER=storageos/node-manager:v0.0.5
+    RELATED_IMAGE_NODE_MANAGER=storageos/node-manager:v0.0.6
     RELATED_IMAGE_UPGRADE_GUARD=storageos/upgrade-guard:v0.0.4
     RELATED_IMAGE_CSIV1_NODE_DRIVER_REGISTRAR=quay.io/k8scsi/csi-node-driver-registrar:v2.1.0
     RELATED_IMAGE_CSIV1_LIVENESS_PROBE=quay.io/k8scsi/livenessprobe:v2.2.0
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -16,7 +16,7 @@ env:
     RELATED_IMAGE_CSIV1_EXTERNAL_RESIZER=quay.io/k8scsi/csi-resizer:v1.1.0
     RELATED_IMAGE_STORAGEOS_INIT=storageos/init:v2.1.2
     RELATED_IMAGE_STORAGEOS_NODE=soegarots/node:v2-release-v2.7.0-24
-    RELATED_IMAGE_NODE_MANAGER=storageos/node-manager:v0.0.5
+    RELATED_IMAGE_NODE_MANAGER=storageos/node-manager:v0.0.6
     RELATED_IMAGE_UPGRADE_GUARD=storageos/upgrade-guard:v0.0.4
     RELATED_IMAGE_CSIV1_NODE_DRIVER_REGISTRAR=quay.io/k8scsi/csi-node-driver-registrar:v2.1.0
     RELATED_IMAGE_CSIV1_LIVENESS_PROBE=quay.io/k8scsi/livenessprobe:v2.2.0
diff --git a/Makefile b/Makefile
@@ -84,7 +84,7 @@ EXTERNAL_ATTACHER_IMAGE ?= quay.io/k8scsi/csi-attacher:v3.1.0
 EXTERNAL_RESIZER_IMAGE ?= quay.io/k8scsi/csi-resizer:v1.1.0
 INIT_IMAGE ?= storageos/init:v2.1.2
 NODE_IMAGE ?= soegarots/node:v2-release-v2.7.0-24
-NODE_MANAGER_VERSION ?= v0.0.5
+NODE_MANAGER_VERSION ?= v0.0.6
 NODE_MANAGER_IMAGE ?= storageos/node-manager:$(NODE_MANAGER_VERSION)
 NODE_MANAGER_MANIFESTS_IMAGE ?= storageos/node-manager-manifests:$(NODE_MANAGER_VERSION)
 UPGRADE_GUARD_IMAGE ?= storageos/upgrade-guard:v0.0.4
diff --git a/bundle/manifests/storageos-related-images_v1_configmap.yaml b/bundle/manifests/storageos-related-images_v1_configmap.yaml
@@ -6,7 +6,7 @@ data:
   RELATED_IMAGE_CSIV1_EXTERNAL_RESIZER: quay.io/k8scsi/csi-resizer:v1.1.0
   RELATED_IMAGE_CSIV1_LIVENESS_PROBE: quay.io/k8scsi/livenessprobe:v2.2.0
   RELATED_IMAGE_CSIV1_NODE_DRIVER_REGISTRAR: quay.io/k8scsi/csi-node-driver-registrar:v2.1.0
-  RELATED_IMAGE_NODE_MANAGER: storageos/node-manager:v0.0.5
+  RELATED_IMAGE_NODE_MANAGER: storageos/node-manager:v0.0.6
   RELATED_IMAGE_PORTAL_MANAGER: storageos/portal-manager:v1.0.2
   RELATED_IMAGE_STORAGEOS_INIT: storageos/init:v2.1.2
   RELATED_IMAGE_STORAGEOS_NODE: soegarots/node:v2-release-v2.7.0-24
diff --git a/bundle/manifests/storageosoperator.clusterserviceversion.yaml b/bundle/manifests/storageosoperator.clusterserviceversion.yaml
@@ -608,6 +608,18 @@ spec:
           - get
           - list
           - watch
+        - apiGroups:
+          - security.openshift.io
+          resourceNames:
+          - privileged
+          resources:
+          - securitycontextconstraints
+          verbs:
+          - create
+          - delete
+          - get
+          - update
+          - use
         - apiGroups:
           - storageos.com
           resources:
diff --git a/channels/1.23 b/channels/1.23
@@ -6,7 +6,7 @@ manifests:
 - name: node
   version: 2.5.0
 - name: node-manager
-  version: 0.0.5
+  version: 0.0.6
 - name: portal-manager
   version: 1.0.2
 - name: scheduler
diff --git a/channels/1.24 b/channels/1.24
@@ -6,7 +6,7 @@ manifests:
 - name: node
   version: 2.5.0
 - name: node-manager
-  version: 0.0.5
+  version: 0.0.6
 - name: portal-manager
   version: 1.0.2
 - name: scheduler
diff --git a/channels/packages/node-manager/0.0.6/clusterrole-storageos-node-manager.yaml b/channels/packages/node-manager/0.0.6/clusterrole-storageos-node-manager.yaml
@@ -0,0 +1,46 @@
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  labels:
+    app: storageos
+    app.kubernetes.io/component: node-manager
+  name: storageos:node-manager
+rules:
+- apiGroups:
+  - api.storageos.com
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - api.storageos.com
+  resources:
+  - volumes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - privileged
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - create
+  - delete
+  - get
+  - update
+  - use
+- apiGroups:
+  - storageos.com
+  resources:
+  - storageosclusters
+  verbs:
+  - get
+  - list
+  - watch
diff --git a/channels/packages/node-manager/0.0.6/clusterrole-storageos-proxy-node-manager.yaml b/channels/packages/node-manager/0.0.6/clusterrole-storageos-proxy-node-manager.yaml
@@ -0,0 +1,21 @@
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: storageos
+    app.kubernetes.io/component: node-manager
+  name: storageos:proxy:node-manager
+rules:
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create
diff --git a/channels/packages/node-manager/0.0.6/clusterrolebinding-storageos-node-manager.yaml b/channels/packages/node-manager/0.0.6/clusterrolebinding-storageos-node-manager.yaml
@@ -0,0 +1,16 @@
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: storageos
+    app.kubernetes.io/component: node-manager
+  name: storageos:node-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: storageos:node-manager
+subjects:
+- kind: ServiceAccount
+  name: storageos-node-manager
+  namespace: storageos
diff --git a/channels/packages/node-manager/0.0.6/clusterrolebinding-storageos-proxy-node-manager.yaml b/channels/packages/node-manager/0.0.6/clusterrolebinding-storageos-proxy-node-manager.yaml
@@ -0,0 +1,16 @@
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: storageos
+    app.kubernetes.io/component: node-manager
+  name: storageos:proxy:node-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: storageos:proxy:node-manager
+subjects:
+- kind: ServiceAccount
+  name: storageos-node-manager
+  namespace: node-manager-system
diff --git a/channels/packages/node-manager/0.0.6/configmap-storageos-node-manager.yaml b/channels/packages/node-manager/0.0.6/configmap-storageos-node-manager.yaml
@@ -0,0 +1,23 @@
+
+apiVersion: v1
+data:
+  node_manager_config.yaml: |
+    apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
+    kind: ControllerManagerConfig
+    health:
+      healthProbeBindAddress: :8081
+    metrics:
+      bindAddress: 127.0.0.1:8080
+    webhook:
+      port: 9443
+    leaderElection:
+      leaderElect: true
+      resourceNamespace: storageos
+      resourceName: storageos-node-manager
+kind: ConfigMap
+metadata:
+  labels:
+    app: storageos
+    app.kubernetes.io/component: node-manager
+  name: storageos-node-manager
+  namespace: storageos
diff --git a/channels/packages/node-manager/0.0.6/deployment-storageos-node-manager.yaml b/channels/packages/node-manager/0.0.6/deployment-storageos-node-manager.yaml
@@ -0,0 +1,101 @@
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: storageos
+    app.kubernetes.io/component: node-manager
+    control-plane: storageos-node-manager
+  name: storageos-node-manager
+  namespace: storageos
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: storageos
+      app.kubernetes.io/component: node-manager
+      control-plane: storageos-node-manager
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: storageos
+        app.kubernetes.io/component: node-manager
+        control-plane: storageos-node-manager
+    spec:
+      affinity:
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchLabels:
+                app: storageos
+                app.kubernetes.io/component: control-plane
+            topologyKey: kubernetes.io/hostname
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchLabels:
+                app: storageos
+                app.kubernetes.io/component: node-manager
+            topologyKey: kubernetes.io/hostname
+      containers:
+      - args:
+        - --config=node_manager_config.yaml
+        command:
+        - /node-manager
+        image: controller:latest
+        imagePullPolicy: IfNotPresent
+        name: manager
+        securityContext:
+          allowPrivilegeEscalation: false
+        volumeMounts:
+        - mountPath: /node_manager_config.yaml
+          name: storageos-node-manager
+          subPath: node_manager_config.yaml
+      - args:
+        - --secure-listen-address=0.0.0.0:8443
+        - --upstream=http://127.0.0.1:8080/
+        - --logtostderr=true
+        - --v=10
+        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
+        name: kube-rbac-proxy
+        ports:
+        - containerPort: 8443
+          name: https
+      priorityClassName: system-cluster-critical
+      restartPolicy: Always
+      securityContext:
+        runAsUser: 65532
+      serviceAccountName: storageos-node-manager
+      terminationGracePeriodSeconds: 30
+      tolerations:
+      - key: node.kubernetes.io/disk-pressure
+        operator: Exists
+      - key: node.kubernetes.io/memory-pressure
+        operator: Exists
+      - key: node.kubernetes.io/network-unavailable
+        operator: Exists
+      - key: node.kubernetes.io/not-ready
+        operator: Exists
+      - key: node.kubernetes.io/pid-pressure
+        operator: Exists
+      - key: node.kubernetes.io/unreachable
+        operator: Exists
+      - key: node.kubernetes.io/unschedulable
+        operator: Exists
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels:
+            app: storageos
+            app.kubernetes.io/component: node-manager
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+      volumes:
+      - configMap:
+          name: storageos-node-manager
+        name: storageos-node-manager
diff --git a/channels/packages/node-manager/0.0.6/kustomization.yaml b/channels/packages/node-manager/0.0.6/kustomization.yaml
@@ -0,0 +1,8 @@
+resources:
+- serviceaccount-storageos-node-manager.yaml
+- clusterrole-storageos-node-manager.yaml
+- clusterrole-storageos-proxy-node-manager.yaml
+- clusterrolebinding-storageos-node-manager.yaml
+- clusterrolebinding-storageos-proxy-node-manager.yaml
+- configmap-storageos-node-manager.yaml
+- deployment-storageos-node-manager.yaml
diff --git a/channels/packages/node-manager/0.0.6/serviceaccount-storageos-node-manager.yaml b/channels/packages/node-manager/0.0.6/serviceaccount-storageos-node-manager.yaml
@@ -0,0 +1,9 @@
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: storageos
+    app.kubernetes.io/component: node-manager
+  name: storageos-node-manager
+  namespace: storageos
diff --git a/channels/stable b/channels/stable
@@ -6,7 +6,7 @@ manifests:
 - name: node
   version: 2.5.0
 - name: node-manager
-  version: 0.0.5
+  version: 0.0.6
 - name: portal-manager
   version: 1.0.2
 - name: scheduler
diff --git a/config/manager/related_images_config.yaml b/config/manager/related_images_config.yaml
@@ -5,7 +5,7 @@ RELATED_IMAGE_CSIV1_EXTERNAL_ATTACHER_V3=quay.io/k8scsi/csi-attacher:v3.1.0
 RELATED_IMAGE_CSIV1_EXTERNAL_RESIZER=quay.io/k8scsi/csi-resizer:v1.1.0
 RELATED_IMAGE_STORAGEOS_INIT=storageos/init:v2.1.2
 RELATED_IMAGE_STORAGEOS_NODE=soegarots/node:v2-release-v2.7.0-24
-RELATED_IMAGE_NODE_MANAGER=storageos/node-manager:v0.0.5
+RELATED_IMAGE_NODE_MANAGER=storageos/node-manager:v0.0.6
 RELATED_IMAGE_UPGRADE_GUARD=storageos/upgrade-guard:v0.0.4
 RELATED_IMAGE_CSIV1_NODE_DRIVER_REGISTRAR=quay.io/k8scsi/csi-node-driver-registrar:v2.1.0
 RELATED_IMAGE_CSIV1_LIVENESS_PROBE=quay.io/k8scsi/livenessprobe:v2.2.0
diff --git a/config/rbac/bases/node_manager_role.yaml b/config/rbac/bases/node_manager_role.yaml
@@ -20,6 +20,18 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - privileged
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - create
+  - delete
+  - get
+  - update
+  - use
 - apiGroups:
   - storageos.com
   resources:
diff --git a/e2e/tests/deployment/stable/operator/07-assert.yaml b/e2e/tests/deployment/stable/operator/07-assert.yaml
@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/component: node-manager
     spec:
       containers:
-      - image: storageos/node-manager:v0.0.5
+      - image: storageos/node-manager:v0.0.6
         name: manager
       - image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
         name: kube-rbac-proxy
