hpe-csi-k8s-1.14.yaml

# Configuration to deploy the HPE CSI driver compatible with
# Kubernetes = v1.14
#
# example usage: kubectl create -f <this_file>

---

#############################################
############  HPE Node Info CRD  ############
#############################################

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  creationTimestamp: null
  name: hpenodeinfos.storage.hpe.com
spec:
  group: storage.hpe.com
  names:
    kind: HPENodeInfo
    plural: hpenodeinfos
  scope: Cluster
  validation:
    openAPIV3Schema:
      properties:
        hpeNodes:
          description: List of HPE nodes configured for storage access.
          items:
            properties:
              uuid:
                description: The UUID of the node.
                type: string
              iqns:
                description: List of IQNs configured on the node.
                items:
                  type: string
                type: array
              chapUser:
                  description: The CHAP User Name
                  type: string
              chapPassword:
                 description: The CHAP Password
                 type: string
              networks:
                description: List of networks configured on the node.
                items:
                  type: string
                type: array
              wwpns:
                description: List of WWPNs configured on the node.
                items:
                  type: string
                type: array
          type: array
  version: v1
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []

---

################# CSI Driver CRD ###########
apiVersion: storage.k8s.io/v1beta1
kind: CSIDriver
metadata:
  name: csi.hpe.com
spec:
  podInfoOnMount: true

---

#########################################
############  Snapshot CRDs  ############
#########################################

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: volumesnapshotclasses.snapshot.storage.k8s.io
spec:
  group: snapshot.storage.k8s.io
  names:
    kind: VolumeSnapshotClass
    plural: volumesnapshotclasses
  scope: Cluster
  version: v1alpha1

---

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: volumesnapshotcontents.snapshot.storage.k8s.io
spec:
  group: snapshot.storage.k8s.io
  names:
    kind: VolumeSnapshotContent
    plural: volumesnapshotcontents
  scope: Cluster
  version: v1alpha1

---

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: volumesnapshots.snapshot.storage.k8s.io
spec:
  group: snapshot.storage.k8s.io
  names:
    kind: VolumeSnapshot
    plural: volumesnapshots
  scope: Namespaced
  version: v1alpha1
  subresources:
    status: {}

---

#############################################
############  Controller driver  ############
#############################################

kind: Deployment
apiVersion: apps/v1
metadata:
  name: hpe-csi-controller
  namespace: kube-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hpe-csi-controller
  template:
    metadata:
      labels:
        app: hpe-csi-controller
        role: hpe-csi
    spec:
      priorityClassName: system-cluster-critical
      serviceAccount: hpe-csi-controller-sa
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      containers:
        - name: csi-provisioner
          image: quay.io/k8scsi/csi-provisioner:v1.4.0-rc1
          args:
            - "--csi-address=$(ADDRESS)"
            - "--v=5"
            - "--timeout=30s"
          env:
            - name: ADDRESS
              value: /var/lib/csi/sockets/pluginproxy/csi.sock
          imagePullPolicy: "Always"
          volumeMounts:
            - name: socket-dir
              mountPath: /var/lib/csi/sockets/pluginproxy/
        - name: csi-attacher
          image: quay.io/k8scsi/csi-attacher:v1.2.0
          args:
            - "--v=5"
            - "--csi-address=$(ADDRESS)"
          env:
            - name: ADDRESS
              value: /var/lib/csi/sockets/pluginproxy/csi.sock
          imagePullPolicy: "Always"
          volumeMounts:
            - name: socket-dir
              mountPath: /var/lib/csi/sockets/pluginproxy/
        - name: csi-snapshotter
          image: quay.io/k8scsi/csi-snapshotter:v1.2.0
          args:
            - "--csi-address=$(ADDRESS)"
            - "--v=5"
          env:
            - name: ADDRESS
              value: /var/lib/csi/sockets/pluginproxy/csi.sock
          imagePullPolicy: "Always"
          volumeMounts:
            - name: socket-dir
              mountPath: /var/lib/csi/sockets/pluginproxy/
        - name: csi-resizer
          image: quay.io/k8scsi/csi-resizer:v0.1.0
          args:
            - "--csi-address=$(ADDRESS)"
            - "--v=5"
          env:
            - name: ADDRESS
              value: /var/lib/csi/sockets/pluginproxy/csi.sock
          imagePullPolicy: "Always"
          volumeMounts:
            - name: socket-dir
              mountPath: /var/lib/csi/sockets/pluginproxy/
        - name: hpe-csi-driver
          image: hpestorage/csi-driver:v1.0.0-beta
          args :
            - "--endpoint=$(CSI_ENDPOINT)"
            - "--flavor=kubernetes"
          env:
            - name: CSI_ENDPOINT
              value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock
          imagePullPolicy: "Always"
          volumeMounts:
            - name: socket-dir
              mountPath: /var/lib/csi/sockets/pluginproxy/
            - name: log-dir
              mountPath: /var/log
            - name: k8s
              mountPath: /etc/kubernetes
            - name: hpeconfig
              mountPath: /etc/hpe-storage
      volumes:
        - name: socket-dir
          emptyDir: {}
        - name: log-dir
          hostPath:
            path: /var/log
        - name: k8s
          hostPath:
             path: /etc/kubernetes/
        - name: hpeconfig
          hostPath:
              path: /etc/hpe-storage/

---

kind: ServiceAccount
apiVersion: v1
metadata:
  name: hpe-csi-controller-sa
  namespace: kube-system

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hpe-csi-provisioner-role
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get", "list", "create"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["create", "get", "list", "watch", "update", "delete"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["create", "get", "list", "watch", "update", "delete"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["create", "get", "list", "watch", "update", "delete"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["list", "watch", "create", "update", "patch"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshots"]
    verbs: ["get", "list"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshotcontents"]
    verbs: ["get", "list"]


---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hpe-csi-provisioner-binding
subjects:
  - kind: ServiceAccount
    name: hpe-csi-controller-sa
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: hpe-csi-provisioner-role
  apiGroup: rbac.authorization.k8s.io

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hpe-csi-attacher-role
rules:
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["csinodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["volumeattachments"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["volumeattachments/status"]
    verbs: ["get", "list", "watch", "update", "create", "delete"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "watch", "list"]

---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hpe-csi-attacher-binding
subjects:
  - kind: ServiceAccount
    name: hpe-csi-controller-sa
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: hpe-csi-attacher-role
  apiGroup: rbac.authorization.k8s.io

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hpe-csi-snapshotter-role
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["list", "watch", "create", "update", "patch"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshots"]
    verbs: ["create", "update", "delete", "get", "list", "watch"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshots/status"]
    verbs: ["update"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshotcontents"]
    verbs: ["create", "update", "delete", "get", "list", "watch"]
  - apiGroups: ["snapshot.storage.k8s.io"]
    resources: ["volumesnapshotclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "watch", "create", "delete", "update"]

---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hpe-csi-snapshotter-binding
subjects:
  - kind: ServiceAccount
    name: hpe-csi-controller-sa
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: hpe-csi-snapshotter-role
  apiGroup: rbac.authorization.k8s.io

---
# Resizer must be able to work with PVCs, PVs, SCs.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: external-resizer-role
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "update", "patch"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims/status"]
    verbs: ["update", "patch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["list", "watch", "create", "update", "patch"]

---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: csi-resizer-role
subjects:
  - kind: ServiceAccount
    name: hpe-csi-controller-sa
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: external-resizer-role
  apiGroup: rbac.authorization.k8s.io

---

# Resizer must be able to work with end point in current namespace
# if (and only if) leadership election is enabled
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: kube-system
  name: external-resizer-cfg
rules:
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "watch", "list", "delete", "update", "create"]

---

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: csi-resizer-role-cfg
  namespace: kube-system
subjects:
  - kind: ServiceAccount
    name: hpe-csi-controller-sa
    namespace: kube-system
roleRef:
  kind: Role
  name: external-resizer-cfg
  apiGroup: rbac.authorization.k8s.io

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hpe-csi-driver-role
  namespace: kube-system
rules:
  - apiGroups: ["storage.hpe.com"]
    resources: ["hpenodeinfos"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["get"]

---

#######################################
############  Node driver  ############
#######################################

kind: DaemonSet
apiVersion: apps/v1beta2
metadata:
  name: hpe-csi-node
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: hpe-csi-node
  template:
    metadata:
      labels:
        app: hpe-csi-node
        role: hpe-csi
    spec:
      priorityClassName: system-node-critical
      serviceAccount: hpe-csi-node-sa
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      containers:
        - name: csi-node-driver-registrar
          image: quay.io/k8scsi/csi-node-driver-registrar:v1.1.0
          args:
            - "--csi-address=$(ADDRESS)"
            - "--kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)"
            - "--v=5"
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "rm -rf /registration/csi.hpe.com /registration/csi.hpe.com-reg.sock"]
          env:
            - name: ADDRESS
              value: /csi/csi.sock
            - name: DRIVER_REG_SOCK_PATH
              value: /var/lib/kubelet/plugins/csi.hpe.com/csi.sock
          volumeMounts:
            - name: plugin-dir
              mountPath: /csi/
            - name: registration-dir
              mountPath: /registration
        - name: hpe-csi-driver
          image: hpestorage/csi-driver:v1.0.0-beta
          args :
            - "--endpoint=$(CSI_ENDPOINT)"
            - "--node-service"
            - "--flavor=kubernetes"
          env:
            - name: CSI_ENDPOINT
              value: unix:///csi/csi.sock
          imagePullPolicy: "Always"
          securityContext:
            privileged: true
            capabilities:
              add: ["SYS_ADMIN"]
            allowPrivilegeEscalation: true
          volumeMounts:
            - name: plugin-dir
              mountPath: /csi
            - name: pods-mount-dir
              mountPath: /var/lib/kubelet
              # needed so that any mounts setup inside this container are
              # propagated back to the host machine.
              mountPropagation: "Bidirectional"
            - name: device-dir
              mountPath: /dev
            - name: log-dir
              mountPath: /var/log
            - name: var-lib-iscsi
              mountPath: /var/lib/iscsi
            - name: etc-iscsi
              mountPath: /etc/iscsi
            - name: etc-multipath
              mountPath: /etc/multipath
            - name: etc-multipath-conf
              mountPath: /etc/multipath.conf
            - name: etc-redhat-release
              mountPath: /etc/redhat-release
            - name: etc-os-release
              mountPath: /etc/os-release
            - name: etc-hpe-storage-dir
              mountPath: /etc/hpe-storage
            - name: etc-kubernetes
              mountPath: /etc/kubernetes
            - name: sys
              mountPath: /sys
            - name: iscsiadm
              mountPath: /sbin/iscsiadm
            - name: runlock
              mountPath: /run/lock
            - name: lib-modules
              mountPath: /lib/modules
            - name: runsystemd
              mountPath: /run/systemd
            - name: libsystemd
              mountPath: /lib/systemd/system
            - name: usrlocal
              mountPath: /usr_local
      volumes:
        - name: registration-dir
          hostPath:
            path: /var/lib/kubelet/plugins_registry
        - name: plugin-dir
          hostPath:
            path: /var/lib/kubelet/plugins/csi.hpe.com
        - name: pods-mount-dir
          hostPath:
            path: /var/lib/kubelet
        - name: device-dir
          hostPath:
            path: /dev
        - name: log-dir
          hostPath:
            path: /var/log
        - name: var-lib-iscsi
          hostPath:
            path: /var/lib/iscsi
        - name: etc-iscsi
          hostPath:
            path: /etc/iscsi
        - name: etc-multipath
          hostPath:
            path: /etc/multipath
        - name: etc-multipath-conf
          hostPath:
            path: /etc/multipath.conf
            type: FileOrCreate
        - name: etc-redhat-release
          hostPath:
            path: /etc/redhat-release
            type: FileOrCreate
        - name: etc-os-release
          hostPath:
            path: /etc/os-release
            type: FileOrCreate
        - name: etc-hpe-storage-dir
          hostPath:
            path: /etc/hpe-storage
        - name: etc-kubernetes
          hostPath:
            path: /etc/kubernetes
        - name: iscsiadm
          hostPath:
            path: /sbin/iscsiadm
            type: FileOrCreate
        - name: runlock
          hostPath:
            path: /run/lock
        - name: lib-modules
          hostPath:
            path: /lib/modules
        - name: runsystemd
          hostPath:
            path: /run/systemd
        - name: libsystemd
          hostPath:
            path: /lib/systemd/system
        - name: usrlocal
          hostPath:
            path: /usr
        - name: sys
          hostPath:
            path: /sys

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: hpe-csi-node-sa
  namespace: kube-system

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hpe-csi-driver-registrar-role
  namespace: kube-system
rules:
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]

---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hpe-csi-driver-registrar-binding
subjects:
  - kind: ServiceAccount
    name: hpe-csi-node-sa
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: hpe-csi-driver-registrar-role
  apiGroup: rbac.authorization.k8s.io

---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hpe-csi-driver-binding
subjects:
  - kind: ServiceAccount
    name: hpe-csi-controller-sa
    namespace: kube-system
  - kind: ServiceAccount
    name: hpe-csi-node-sa
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: hpe-csi-driver-role
  apiGroup: rbac.authorization.k8s.io