Skip to content

Commit 1f3ceb6

Browse files
Denys Kondratenkodenisok
Denys Kondratenko
authored and
denisok
committed
add distributed snapshotter
1 parent 09bede3 commit 1f3ceb6

File tree

3 files changed

+131
-3
lines changed

3 files changed

+131
-3
lines changed

‎deploy/kubernetes-distributed/deploy.sh

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -119,9 +119,19 @@ function version_gt() {
119119
}
120120

121121

122+
# In addition, the RBAC rules can be overridden separately.
123+
# For snapshotter 2.0+, the directory has changed.
124+
SNAPSHOTTER_RBAC_RELATIVE_PATH="rbac.yaml"
125+
if version_gt $(rbac_version "${BASE_DIR}/hostpath/csi-hostpath-plugin.yaml" csi-snapshotter "${UPDATE_RBAC_RULES}") "v1.255.255"; then
126+
SNAPSHOTTER_RBAC_RELATIVE_PATH="csi-snapshotter/rbac-csi-snapshotter.yaml"
127+
fi
128+
122129
CSI_PROVISIONER_RBAC_YAML="https://raw.githubusercontent.com/kubernetes-csi/external-provisioner/$(rbac_version "${BASE_DIR}/hostpath/csi-hostpath-plugin.yaml" csi-provisioner false)/deploy/kubernetes/rbac.yaml"
123130
: ${CSI_PROVISIONER_RBAC:=https://raw.githubusercontent.com/kubernetes-csi/external-provisioner/$(rbac_version "${BASE_DIR}/hostpath/csi-hostpath-plugin.yaml" csi-provisioner "${UPDATE_RBAC_RULES}")/deploy/kubernetes/rbac.yaml}
124131

132+
CSI_SNAPSHOTTER_RBAC_YAML="https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/$(rbac_version "${BASE_DIR}/hostpath/csi-hostpath-plugin.yaml" csi-snapshotter false)/deploy/kubernetes/${SNAPSHOTTER_RBAC_RELATIVE_PATH}"
133+
: ${CSI_SNAPSHOTTER_RBAC:=https://raw.githubusercontent.com/kubernetes-csi/external-snapshotter/$(rbac_version "${BASE_DIR}/hostpath/csi-hostpath-plugin.yaml" csi-snapshotter "${UPDATE_RBAC_RULES}")/deploy/kubernetes/${SNAPSHOTTER_RBAC_RELATIVE_PATH}}
134+
125135
# Some images are not affected by *_REGISTRY/*_TAG and IMAGE_* variables.
126136
# The default is to update unless explicitly excluded.
127137
update_image () {
@@ -135,7 +145,7 @@ run () {
135145

136146
# rbac rules
137147
echo "applying RBAC rules"
138-
for component in CSI_PROVISIONER; do
148+
for component in CSI_PROVISIONER CSI_SNAPSHOTTER; do
139149
eval current="\${${component}_RBAC}"
140150
eval original="\${${component}_RBAC_YAML}"
141151
if [ "$current" != "$original" ]; then
@@ -174,7 +184,7 @@ done
174184
# changed via CSI_PROVISIONER_TAG, so we cannot just check for the version currently
175185
# listed in the YAML file.
176186
case "$CSI_PROVISIONER_TAG" in
177-
*) csistoragecapacities_api=v1beta1;; # we currently always use that version
187+
*) csistoragecapacities_api=v1;; # we currently always use that version
178188
esac
179189
get_csistoragecapacities=$(kubectl get csistoragecapacities.${csistoragecapacities_api}.storage.k8s.io 2>&1 || true)
180190
if echo "$get_csistoragecapacities" | grep -q "the server doesn't have a resource type"; then

‎deploy/kubernetes-distributed/hostpath/csi-hostpath-plugin.yaml

Lines changed: 106 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,86 @@
1+
# All of the individual sidecar RBAC roles get bound
2+
# to this account.
3+
kind: ServiceAccount
4+
apiVersion: v1
5+
metadata:
6+
name: csi-hostpathplugin-sa
7+
namespace: default
8+
labels:
9+
app.kubernetes.io/instance: hostpath.csi.k8s.io
10+
app.kubernetes.io/part-of: csi-driver-host-path
11+
app.kubernetes.io/name: csi-hostpathplugin
12+
app.kubernetes.io/component: serviceaccount
13+
---
14+
apiVersion: rbac.authorization.k8s.io/v1
15+
kind: ClusterRoleBinding
16+
metadata:
17+
labels:
18+
app.kubernetes.io/instance: hostpath.csi.k8s.io
19+
app.kubernetes.io/part-of: csi-driver-host-path
20+
app.kubernetes.io/name: csi-hostpathplugin
21+
app.kubernetes.io/component: provisioner-cluster-role
22+
name: csi-hostpathplugin-provisioner-cluster-role
23+
roleRef:
24+
apiGroup: rbac.authorization.k8s.io
25+
kind: ClusterRole
26+
name: external-provisioner-runner
27+
subjects:
28+
- kind: ServiceAccount
29+
name: csi-hostpathplugin-sa
30+
namespace: default
31+
---
32+
apiVersion: rbac.authorization.k8s.io/v1
33+
kind: ClusterRoleBinding
34+
metadata:
35+
labels:
36+
app.kubernetes.io/instance: hostpath.csi.k8s.io
37+
app.kubernetes.io/part-of: csi-driver-host-path
38+
app.kubernetes.io/name: csi-hostpathplugin
39+
app.kubernetes.io/component: snapshotter-cluster-role
40+
name: csi-hostpathplugin-snapshotter-cluster-role
41+
roleRef:
42+
apiGroup: rbac.authorization.k8s.io
43+
kind: ClusterRole
44+
name: external-snapshotter-runner
45+
subjects:
46+
- kind: ServiceAccount
47+
name: csi-hostpathplugin-sa
48+
namespace: default
49+
---
50+
apiVersion: rbac.authorization.k8s.io/v1
51+
kind: RoleBinding
52+
metadata:
53+
labels:
54+
app.kubernetes.io/instance: hostpath.csi.k8s.io
55+
app.kubernetes.io/part-of: csi-driver-host-path
56+
app.kubernetes.io/name: csi-hostpathplugin
57+
app.kubernetes.io/component: provisioner-role
58+
name: csi-hostpathplugin-provisioner-role
59+
roleRef:
60+
apiGroup: rbac.authorization.k8s.io
61+
kind: Role
62+
name: external-provisioner-cfg
63+
subjects:
64+
- kind: ServiceAccount
65+
name: csi-hostpathplugin-sa
66+
---
67+
apiVersion: rbac.authorization.k8s.io/v1
68+
kind: RoleBinding
69+
metadata:
70+
labels:
71+
app.kubernetes.io/instance: hostpath.csi.k8s.io
72+
app.kubernetes.io/part-of: csi-driver-host-path
73+
app.kubernetes.io/name: csi-hostpathplugin
74+
app.kubernetes.io/component: snapshotter-role
75+
name: csi-hostpathplugin-snapshotter-role
76+
roleRef:
77+
apiGroup: rbac.authorization.k8s.io
78+
kind: Role
79+
name: external-snapshotter-leaderelection
80+
subjects:
81+
- kind: ServiceAccount
82+
name: csi-hostpathplugin-sa
83+
---
184
kind: DaemonSet
285
apiVersion: apps/v1
386
metadata:
@@ -22,7 +105,7 @@ spec:
22105
app.kubernetes.io/name: csi-hostpathplugin
23106
app.kubernetes.io/component: plugin
24107
spec:
25-
serviceAccountName: csi-provisioner
108+
serviceAccountName: csi-hostpathplugin-sa
26109
containers:
27110
- name: csi-provisioner
28111
image: registry.k8s.io/sig-storage/csi-provisioner:v3.3.0
@@ -128,6 +211,7 @@ spec:
128211
name: csi-data-dir
129212
- mountPath: /dev
130213
name: dev-dir
214+
131215
- name: liveness-probe
132216
volumeMounts:
133217
- mountPath: /csi
@@ -137,6 +221,27 @@ spec:
137221
- --csi-address=/csi/csi.sock
138222
- --health-port=9898
139223

224+
- name: csi-snapshotter
225+
image: registry.k8s.io/sig-storage/csi-snapshotter:v6.1.0
226+
args:
227+
- -v=5
228+
- --csi-address=/csi/csi.sock
229+
- --node-deployment
230+
env:
231+
- name: NODE_NAME
232+
valueFrom:
233+
fieldRef:
234+
apiVersion: v1
235+
fieldPath: spec.nodeName
236+
securityContext:
237+
# This is necessary only for systems with SELinux, where
238+
# non-privileged sidecar containers cannot access unix domain socket
239+
# created by privileged CSI driver container.
240+
privileged: true
241+
volumeMounts:
242+
- mountPath: /csi
243+
name: socket-dir
244+
140245
volumes:
141246
- hostPath:
142247
path: /var/lib/kubelet/plugins/csi-hostpath

‎deploy/kubernetes-distributed/hostpath/csi-hostpath-snapshotclass.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Usage of the v1 API implies that the cluster must have
2+
# external-snapshotter v4.x installed.
3+
apiVersion: snapshot.storage.k8s.io/v1
4+
kind: VolumeSnapshotClass
5+
metadata:
6+
name: csi-hostpath-snapclass
7+
labels:
8+
app.kubernetes.io/instance: hostpath.csi.k8s.io
9+
app.kubernetes.io/part-of: csi-driver-host-path
10+
app.kubernetes.io/name: csi-hostpath-snapclass
11+
app.kubernetes.io/component: volumesnapshotclass
12+
driver: hostpath.csi.k8s.io #csi-hostpath
13+
deletionPolicy: Delete

0 commit comments

Comments
 (0)