From 33bb391ad881bf18574ff0a336f8a9830fbd6fbf Mon Sep 17 00:00:00 2001 From: Mikk Tendermann Date: Tue, 19 May 2026 15:07:22 +0300 Subject: [PATCH 1/4] Do not hardcode object names to allow multiple csi-diver-lvm s per cluster This is needed for example in case if user has many kinds of disks (SSD/HDD/NVME) and wants to choose per PVC what backing solution to use --- charts/csi-driver-lvm/templates/common.yaml | 2 +- .../csi-driver-lvm/templates/daemonset.yaml | 40 +++++++++---------- .../templates/eviction-controller.yaml | 16 ++++---- .../templates/storageclasses.yaml | 24 +++++------ 4 files changed, 41 insertions(+), 41 deletions(-) diff --git a/charts/csi-driver-lvm/templates/common.yaml b/charts/csi-driver-lvm/templates/common.yaml index 955e1f82..46ac8eee 100644 --- a/charts/csi-driver-lvm/templates/common.yaml +++ b/charts/csi-driver-lvm/templates/common.yaml @@ -2,7 +2,7 @@ apiVersion: storage.k8s.io/v1 kind: CSIDriver metadata: - name: {{ .Values.lvm.driverName }} + name: {{ .Release.Name }} labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} diff --git a/charts/csi-driver-lvm/templates/daemonset.yaml b/charts/csi-driver-lvm/templates/daemonset.yaml index bbc8b2aa..d95159d0 100644 --- a/charts/csi-driver-lvm/templates/daemonset.yaml +++ b/charts/csi-driver-lvm/templates/daemonset.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: csi-driver-lvm + name: {{ .Release.Name }} labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} @@ -10,7 +10,7 @@ metadata: kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: csi-driver-lvm + name: {{ .Release.Name }} labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} @@ -52,24 +52,24 @@ rules: kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: csi-driver-lvm + name: {{ .Release.Name }} labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} subjects: - kind: ServiceAccount - name: csi-driver-lvm + name: {{ .Release.Name }} namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: csi-driver-lvm + name: {{ .Release.Name }} apiGroup: rbac.authorization.k8s.io --- {{- if and .Values.rbac.pspEnabled (.Capabilities.APIVersions.Has "policy/v1beta1") }} apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: - name: csi-driver-lvm + name: {{ .Release.Name }} labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} @@ -77,7 +77,7 @@ spec: allowedHostPaths: - pathPrefix: /lib/modules - pathPrefix: {{ .Values.lvm.hostWritePath }}/cache - - pathPrefix: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Values.lvm.storageClassStub }} + - pathPrefix: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Release.Name }} - pathPrefix: {{ .Values.lvm.hostWritePath }}/backup - pathPrefix: {{ .Values.lvm.hostWritePath }}/lock - pathPrefix: {{ .Values.kubernetes.kubeletPath }}/plugins @@ -103,7 +103,7 @@ spec: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: - name: csi-driver-lvm + name: {{ .Release.Name }} labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} @@ -121,23 +121,23 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: - name: csi-driver-lvm + name: {{ .Release.Name }} labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role - name: csi-driver-lvm + name: {{ .Release.Name }} subjects: - kind: ServiceAccount - name: csi-driver-lvm + name: {{ .Release.Name }} namespace: {{ .Release.Namespace }} --- apiVersion: apps/v1 kind: DaemonSet metadata: - name: csi-driver-lvm + name: {{ .Release.Name }} labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} @@ -145,13 +145,13 @@ spec: revisionHistoryLimit: 10 selector: matchLabels: - app: csi-driver-lvm + app: {{ .Release.Name }} template: metadata: labels: - app: csi-driver-lvm + app: {{ .Release.Name }} spec: - serviceAccountName: csi-driver-lvm + serviceAccountName: {{ .Release.Name }} {{- if .Values.tolerations.plugin }} tolerations: {{ toYaml .Values.tolerations.plugin | indent 8 }} @@ -223,7 +223,7 @@ spec: args: - --v=5 - --csi-address=/csi/csi.sock - - --kubelet-registration-path={{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Values.lvm.storageClassStub }}/csi.sock + - --kubelet-registration-path={{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Release.Name }}/csi.sock env: - name: KUBE_NODE_NAME valueFrom: @@ -241,18 +241,18 @@ spec: volumeMounts: - mountPath: /csi name: socket-dir - - mountPath: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Values.lvm.storageClassStub }} + - mountPath: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Release.Name }} name: socket-dir - mountPath: /registration name: registration-dir - name: csi-driver-lvm args: - - --drivername={{ .Values.lvm.driverName }} + - --drivername={{ .Release.Name }} - --endpoint=/csi/csi.sock - --hostwritepath={{ .Values.lvm.hostWritePath }} - --devices={{ .Values.lvm.devicePattern }} - --nodeid=$(KUBE_NODE_NAME) - - --vgname={{ .Values.lvm.vgName }} + - --vgname={{ .Release.Name }} - --log-level={{ .Values.lvm.logLevel }} env: - name: KUBE_NODE_NAME @@ -331,7 +331,7 @@ spec: terminationGracePeriodSeconds: 30 volumes: - hostPath: - path: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Values.lvm.storageClassStub }} + path: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Release.Name }} type: DirectoryOrCreate name: socket-dir - hostPath: diff --git a/charts/csi-driver-lvm/templates/eviction-controller.yaml b/charts/csi-driver-lvm/templates/eviction-controller.yaml index 2df60cac..fea015ce 100644 --- a/charts/csi-driver-lvm/templates/eviction-controller.yaml +++ b/charts/csi-driver-lvm/templates/eviction-controller.yaml @@ -3,7 +3,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: csi-driver-lvm-controller + name: {{ .Release.Name }}-controller labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} @@ -11,7 +11,7 @@ metadata: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: csi-driver-lvm-controller + name: {{ .Release.Name }}-controller labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} @@ -74,23 +74,23 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: csi-driver-lvm-controller + name: {{ .Release.Name }}-controller labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: csi-driver-lvm-controller + name: {{ .Release.Name }}-controller subjects: - kind: ServiceAccount - name: csi-driver-lvm-controller + name: {{ .Release.Name }}-controller namespace: {{ .Release.Namespace }} --- apiVersion: apps/v1 kind: Deployment metadata: - name: csi-driver-lvm-controller + name: {{ .Release.Name }}-controller labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} @@ -117,7 +117,7 @@ spec: - --provisioner-name={{ .Values.lvm.driverName }} image: "{{ .Values.evictionControllerImage.repository }}:{{ .Values.evictionControllerImage.tag }}" imagePullPolicy: {{ .Values.evictionControllerImage.pullPolicy }} - name: csi-driver-lvm-controller + name: {{ .Release.Name }}-controller ports: [] securityContext: allowPrivilegeEscalation: false @@ -145,6 +145,6 @@ spec: memory: 64Mi volumeMounts: [] volumes: [] - serviceAccountName: csi-driver-lvm-controller + serviceAccountName: {{ .Release.Name }}-controller terminationGracePeriodSeconds: 10 {{- end }} diff --git a/charts/csi-driver-lvm/templates/storageclasses.yaml b/charts/csi-driver-lvm/templates/storageclasses.yaml index c04b5cb0..73c3b720 100644 --- a/charts/csi-driver-lvm/templates/storageclasses.yaml +++ b/charts/csi-driver-lvm/templates/storageclasses.yaml @@ -4,7 +4,7 @@ apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: - name: {{ .Values.lvm.storageClassStub }}-linear + name: {{ .Release.Name }}-linear {{- if not (empty $storageClass.additionalAnnotations) }} annotations: {{- $storageClass.additionalAnnotations | toYaml | nindent 4 -}} @@ -12,7 +12,7 @@ metadata: labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} -provisioner: {{ .Values.lvm.driverName }} +provisioner: {{ .Release.Name }} reclaimPolicy: {{ $storageClass.reclaimPolicy }} volumeBindingMode: WaitForFirstConsumer allowVolumeExpansion: true @@ -25,7 +25,7 @@ parameters: apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: - name: {{ .Values.lvm.storageClassStub }}-mirror + name: {{ .Release.Name }}-mirror {{- if not (empty $storageClass.additionalAnnotations) }} annotations: {{- $storageClass.additionalAnnotations | toYaml | nindent 4 -}} @@ -33,7 +33,7 @@ metadata: labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} -provisioner: {{ .Values.lvm.driverName }} +provisioner: {{ .Release.Name }} reclaimPolicy: {{ $storageClass.reclaimPolicy }} volumeBindingMode: WaitForFirstConsumer allowVolumeExpansion: true @@ -46,7 +46,7 @@ parameters: apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: - name: {{ .Values.lvm.storageClassStub }}-striped + name: {{ .Release.Name }}-striped {{- if not (empty $storageClass.additionalAnnotations) }} annotations: {{- $storageClass.additionalAnnotations | toYaml | nindent 4 -}} @@ -54,7 +54,7 @@ metadata: labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} -provisioner: {{ .Values.lvm.driverName }} +provisioner: {{ .Release.Name }} reclaimPolicy: {{ $storageClass.reclaimPolicy }} volumeBindingMode: WaitForFirstConsumer allowVolumeExpansion: true @@ -67,7 +67,7 @@ parameters: apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: - name: {{ .Values.lvm.storageClassStub }}-linear-encrypted + name: {{ .Release.Name }}-linear-encrypted {{- if not (empty $storageClass.additionalAnnotations) }} annotations: {{- $storageClass.additionalAnnotations | toYaml | nindent 4 -}} @@ -75,7 +75,7 @@ metadata: labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} -provisioner: {{ .Values.lvm.driverName }} +provisioner: {{ .Release.Name }} reclaimPolicy: {{ $storageClass.reclaimPolicy }} volumeBindingMode: WaitForFirstConsumer allowVolumeExpansion: true @@ -91,7 +91,7 @@ parameters: apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: - name: {{ .Values.lvm.storageClassStub }}-mirror-encrypted + name: {{ .Release.Name }}-mirror-encrypted {{- if not (empty $storageClass.additionalAnnotations) }} annotations: {{- $storageClass.additionalAnnotations | toYaml | nindent 4 -}} @@ -99,7 +99,7 @@ metadata: labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} -provisioner: {{ .Values.lvm.driverName }} +provisioner: {{ .Release.Name }} reclaimPolicy: {{ $storageClass.reclaimPolicy }} volumeBindingMode: WaitForFirstConsumer allowVolumeExpansion: true @@ -115,7 +115,7 @@ parameters: apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: - name: {{ .Values.lvm.storageClassStub }}-striped-encrypted + name: {{ .Release.Name }}-striped-encrypted {{- if not (empty $storageClass.additionalAnnotations) }} annotations: {{- $storageClass.additionalAnnotations | toYaml | nindent 4 -}} @@ -123,7 +123,7 @@ metadata: labels: heritage: {{ .Release.Service }} release: {{ .Release.Name }} -provisioner: {{ .Values.lvm.driverName }} +provisioner: {{ .Release.Name }} reclaimPolicy: {{ $storageClass.reclaimPolicy }} volumeBindingMode: WaitForFirstConsumer allowVolumeExpansion: true From 1ef42623766bda730dae4bf6a65cfb3c0df51856 Mon Sep 17 00:00:00 2001 From: Mikk Tendermann Date: Wed, 20 May 2026 14:07:55 +0300 Subject: [PATCH 2/4] use helpers create secrets for encryption by automatically, and preserve them between helm deploys --- charts/csi-driver-lvm/templates/_helpers.tpl | 113 ++++++++++++ charts/csi-driver-lvm/templates/common.yaml | 6 +- .../csi-driver-lvm/templates/daemonset.yaml | 62 +++---- .../templates/eviction-controller.yaml | 40 ++-- .../templates/storageclasses.yaml | 173 +++++------------- charts/csi-driver-lvm/values.yaml | 53 +++--- 6 files changed, 229 insertions(+), 218 deletions(-) create mode 100644 charts/csi-driver-lvm/templates/_helpers.tpl diff --git a/charts/csi-driver-lvm/templates/_helpers.tpl b/charts/csi-driver-lvm/templates/_helpers.tpl new file mode 100644 index 00000000..8a9220c6 --- /dev/null +++ b/charts/csi-driver-lvm/templates/_helpers.tpl @@ -0,0 +1,113 @@ +{{/* vim: set filetype=mustache: */}} + +{{- define "csi-driver-lvm.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{- define "csi-driver-lvm.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "csi-driver-lvm.labels" -}} +release: {{ .Release.Name }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{ if .Values.labels }} +{{ .Values.labels | toYaml}} +{{- end }} +{{- end }} + +{{- define "csi-driver-lvm.csi-driver.fullname" -}} +{{- default (include "csi-driver-lvm.fullname" .) .Values.lvm.driverName | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{- define "csi-driver-lvm.csi-driver.vgname" -}} +{{- default (include "csi-driver-lvm.fullname" .) .Values.lvm.vgName | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{- define "csi-driver-lvm.serviceaccount.fullname" -}} +{{- include "csi-driver-lvm.fullname" . }} +{{- end }} +{{- define "csi-driver-lvm.clusterrole.fullname" -}} +{{- include "csi-driver-lvm.fullname" . }} +{{- end }} +{{- define "csi-driver-lvm.clusterrolebinding.fullname" -}} +{{- include "csi-driver-lvm.fullname" . }} +{{- end }} +{{- define "csi-driver-lvm.podsecuritypolicy.fullname" -}} +{{- include "csi-driver-lvm.fullname" . }} +{{- end }} +{{- define "csi-driver-lvm.role.fullname" -}} +{{- include "csi-driver-lvm.fullname" . }} +{{- end }} +{{- define "csi-driver-lvm.rolebinding.fullname" -}} +{{- include "csi-driver-lvm.fullname" . }} +{{- end }} +{{- define "csi-driver-lvm.daemonset.fullname" -}} +{{- include "csi-driver-lvm.fullname" . }} +{{- end }} +{{- define "csi-driver-lvm.daemonset.selectorlabels" -}} +app: {{ include "csi-driver-lvm.fullname" . }} +{{- end }} + +{{/* + EVICTION CONTROLLER +*/}} +{{- define "csi-driver-lvm.eviction.fullname" -}} +{{- printf "%s-controller" (include "csi-driver-lvm.fullname" .) | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- define "csi-driver-lvm.eviction.serviceaccount.fullname" -}} +{{- include "csi-driver-lvm.eviction.fullname" . }} +{{- end }} +{{- define "csi-driver-lvm.eviction.clusterrole.fullname" -}} +{{- include "csi-driver-lvm.eviction.fullname" . }} +{{- end }} +{{- define "csi-driver-lvm.eviction.clusterrolebinding.fullname" -}} +{{- include "csi-driver-lvm.eviction.fullname" . }} +{{- end }} +{{- define "csi-driver-lvm.eviction.deployment.fullname" -}} +{{- include "csi-driver-lvm.eviction.fullname" . }} +{{- end }} +{{- define "csi-driver-lvm.eviction.selectorlabels" -}} +app: {{ include "csi-driver-lvm.eviction.fullname" . }} +{{- end }} + +{{/* + STORAGECLASS +*/}} +{{- define "csi-driver-lvm.storageclass.fullname" -}} +{{- printf "%s-%s" (include "csi-driver-lvm.fullname" .global ) .storageclass.name }} +{{- end }} + +{{- define "csi-driver-lvm.storageclass.parameters" -}} +{{- .storageclass.parameters | toYaml }} +{{- if and .storageclass.parameters.encryption (eq .storageclass.parameters.encryption "true" ) }} +{{- if empty (index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-name") }} +csi.storage.k8s.io/node-stage-secret-name: {{ include "csi-driver-lvm.storageclass.encryption.secret.fullname" . }} +{{- end }} +{{- if empty (index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-namespace") }} +csi.storage.k8s.io/node-stage-secret-namespace: {{ include "csi-driver-lvm.storageclass.encryption.secret.namespace" . }} +{{- end }} +{{- end }} +{{- end }} + +{{- define "csi-driver-lvm.storageclass.encryption.secret.fullname" -}} +{{- printf "%s-%s" (include "csi-driver-lvm.fullname" .global ) .storageclass.name }} +{{- end }} +{{- define "csi-driver-lvm.storageclass.encryption.secret.namespace" -}} +{{ .global.Release.Namespace }} +{{- end }} \ No newline at end of file diff --git a/charts/csi-driver-lvm/templates/common.yaml b/charts/csi-driver-lvm/templates/common.yaml index 46ac8eee..02383471 100644 --- a/charts/csi-driver-lvm/templates/common.yaml +++ b/charts/csi-driver-lvm/templates/common.yaml @@ -2,10 +2,8 @@ apiVersion: storage.k8s.io/v1 kind: CSIDriver metadata: - name: {{ .Release.Name }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.csi-driver.fullname" . }} + labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }} spec: volumeLifecycleModes: - Persistent diff --git a/charts/csi-driver-lvm/templates/daemonset.yaml b/charts/csi-driver-lvm/templates/daemonset.yaml index d95159d0..2f35efe3 100644 --- a/charts/csi-driver-lvm/templates/daemonset.yaml +++ b/charts/csi-driver-lvm/templates/daemonset.yaml @@ -2,18 +2,14 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ .Release.Name }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.serviceaccount.fullname" . }} + labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }} --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.clusterrole.fullname" . }} + labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }} rules: - apiGroups: [""] resources: ["persistentvolumes"] @@ -52,27 +48,23 @@ rules: kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ .Release.Name }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.clusterrolebinding.fullname" . }} + labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }} subjects: - kind: ServiceAccount - name: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.serviceaccount.fullname" . }} namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.clusterrole.fullname" . }} apiGroup: rbac.authorization.k8s.io --- {{- if and .Values.rbac.pspEnabled (.Capabilities.APIVersions.Has "policy/v1beta1") }} apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: - name: {{ .Release.Name }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.podsecuritypolicy.fullname" . }} + labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }} spec: allowedHostPaths: - pathPrefix: /lib/modules @@ -103,10 +95,8 @@ spec: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: - name: {{ .Release.Name }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.role.fullname" . }} + labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }} rules: - apiGroups: - policy @@ -121,37 +111,31 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: - name: {{ .Release.Name }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.rolebinding.fullname" . }} + labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role - name: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.role.fullname" . }} subjects: - kind: ServiceAccount - name: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.serviceaccount.fullname" . }} namespace: {{ .Release.Namespace }} --- apiVersion: apps/v1 kind: DaemonSet metadata: - name: {{ .Release.Name }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.daemonset.fullname" . }} + labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }} spec: revisionHistoryLimit: 10 selector: - matchLabels: - app: {{ .Release.Name }} + matchLabels: {{ include "csi-driver-lvm.daemonset.selectorlabels" . | nindent 6 }} template: metadata: - labels: - app: {{ .Release.Name }} + labels: {{ include "csi-driver-lvm.daemonset.selectorlabels" . | nindent 8 }} spec: - serviceAccountName: {{ .Release.Name }} + serviceAccountName: {{ include "csi-driver-lvm.serviceaccount.fullname" . }} {{- if .Values.tolerations.plugin }} tolerations: {{ toYaml .Values.tolerations.plugin | indent 8 }} @@ -247,12 +231,12 @@ spec: name: registration-dir - name: csi-driver-lvm args: - - --drivername={{ .Release.Name }} + - --drivername={{ include "csi-driver-lvm.csi-driver.fullname" . }} - --endpoint=/csi/csi.sock - --hostwritepath={{ .Values.lvm.hostWritePath }} - --devices={{ .Values.lvm.devicePattern }} - --nodeid=$(KUBE_NODE_NAME) - - --vgname={{ .Release.Name }} + - --vgname={{ include "csi-driver-lvm.csi-driver.vgname" . }} - --log-level={{ .Values.lvm.logLevel }} env: - name: KUBE_NODE_NAME diff --git a/charts/csi-driver-lvm/templates/eviction-controller.yaml b/charts/csi-driver-lvm/templates/eviction-controller.yaml index fea015ce..8a8e1a47 100644 --- a/charts/csi-driver-lvm/templates/eviction-controller.yaml +++ b/charts/csi-driver-lvm/templates/eviction-controller.yaml @@ -3,18 +3,14 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ .Release.Name }}-controller - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.eviction.serviceaccount.fullname" . }} + labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ .Release.Name }}-controller - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.eviction.clusterrole.fullname" . }} + labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }} rules: - apiGroups: - coordination.k8s.io @@ -74,35 +70,29 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ .Release.Name }}-controller - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.eviction.clusterrolebinding.fullname" . }} + labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ .Release.Name }}-controller + name: {{ include "csi-driver-lvm.eviction.clusterrole.fullname" . }} subjects: - kind: ServiceAccount - name: {{ .Release.Name }}-controller + name: {{ include "csi-driver-lvm.eviction.serviceaccount.fullname" . }} namespace: {{ .Release.Namespace }} --- apiVersion: apps/v1 kind: Deployment metadata: - name: {{ .Release.Name }}-controller - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + name: {{ include "csi-driver-lvm.eviction.deployment.fullname" . }} + labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }} spec: selector: - matchLabels: - app: csi-driver-lvm-controller + matchLabels: {{ include "csi-driver-lvm.eviction.selectorlabels" . | nindent 6 }} replicas: 1 template: metadata: - labels: - app: csi-driver-lvm-controller + labels: {{ include "csi-driver-lvm.eviction.selectorlabels" . | nindent 8 }} spec: securityContext: runAsNonRoot: true @@ -114,10 +104,10 @@ spec: args: - --leader-elect - --health-probe-bind-address=:8081 - - --provisioner-name={{ .Values.lvm.driverName }} + - --provisioner-name={{ include "csi-driver-lvm.csi-driver.fullname" . }} image: "{{ .Values.evictionControllerImage.repository }}:{{ .Values.evictionControllerImage.tag }}" imagePullPolicy: {{ .Values.evictionControllerImage.pullPolicy }} - name: {{ .Release.Name }}-controller + name: {{ include "csi-driver-lvm.eviction.deployment.fullname" . }} ports: [] securityContext: allowPrivilegeEscalation: false @@ -145,6 +135,6 @@ spec: memory: 64Mi volumeMounts: [] volumes: [] - serviceAccountName: {{ .Release.Name }}-controller + serviceAccountName: {{ include "csi-driver-lvm.eviction.serviceaccount.fullname" . }} terminationGracePeriodSeconds: 10 {{- end }} diff --git a/charts/csi-driver-lvm/templates/storageclasses.yaml b/charts/csi-driver-lvm/templates/storageclasses.yaml index 73c3b720..4bb35fab 100644 --- a/charts/csi-driver-lvm/templates/storageclasses.yaml +++ b/charts/csi-driver-lvm/templates/storageclasses.yaml @@ -1,135 +1,54 @@ ---- -{{- $storageClass := .Values.storageClasses.linear -}} -{{ if $storageClass.enabled }} -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: {{ .Release.Name }}-linear -{{- if not (empty $storageClass.additionalAnnotations) }} - annotations: - {{- $storageClass.additionalAnnotations | toYaml | nindent 4 -}} -{{ end }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -provisioner: {{ .Release.Name }} -reclaimPolicy: {{ $storageClass.reclaimPolicy }} -volumeBindingMode: WaitForFirstConsumer -allowVolumeExpansion: true -parameters: - type: "linear" -{{ end }} ---- -{{- $storageClass := .Values.storageClasses.mirror -}} -{{ if $storageClass.enabled }} -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: {{ .Release.Name }}-mirror -{{- if not (empty $storageClass.additionalAnnotations) }} - annotations: - {{- $storageClass.additionalAnnotations | toYaml | nindent 4 -}} -{{ end }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -provisioner: {{ .Release.Name }} -reclaimPolicy: {{ $storageClass.reclaimPolicy }} -volumeBindingMode: WaitForFirstConsumer -allowVolumeExpansion: true -parameters: - type: "mirror" -{{ end }} ---- -{{- $storageClass := .Values.storageClasses.striped -}} -{{ if $storageClass.enabled }} -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: {{ .Release.Name }}-striped -{{- if not (empty $storageClass.additionalAnnotations) }} - annotations: - {{- $storageClass.additionalAnnotations | toYaml | nindent 4 -}} -{{ end }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -provisioner: {{ .Release.Name }} -reclaimPolicy: {{ $storageClass.reclaimPolicy }} -volumeBindingMode: WaitForFirstConsumer -allowVolumeExpansion: true -parameters: - type: "striped" -{{ end }} ---- -{{- $storageClass := .Values.storageClasses.linearEncrypted -}} -{{ if $storageClass.enabled }} +{{- range .Values.storageClasses }} +{{- if .enabled }} apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: - name: {{ .Release.Name }}-linear-encrypted -{{- if not (empty $storageClass.additionalAnnotations) }} + name: {{ include "csi-driver-lvm.storageclass.fullname" (dict "global" $ "storageclass" .) }} +{{- if not (empty .additionalAnnotations) }} annotations: - {{- $storageClass.additionalAnnotations | toYaml | nindent 4 -}} -{{ end }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -provisioner: {{ .Release.Name }} -reclaimPolicy: {{ $storageClass.reclaimPolicy }} -volumeBindingMode: WaitForFirstConsumer + {{- .additionalAnnotations | toYaml | nindent 4 -}} +{{- end }} + labels: {{- include "csi-driver-lvm.labels" $ | nindent 4 }} +provisioner: {{ include "csi-driver-lvm.csi-driver.fullname" $ }} +reclaimPolicy: {{ .reclaimPolicy }} +volumeBindingMode: {{ default "WaitForFirstConsumer" .volumeBindingMode }} allowVolumeExpansion: true -parameters: - type: "linear" - encryption: "true" - csi.storage.k8s.io/node-stage-secret-name: {{ $storageClass.encryptionSecret.name }} - csi.storage.k8s.io/node-stage-secret-namespace: {{ $storageClass.encryptionSecret.namespace }} -{{ end }} +parameters: {{ include "csi-driver-lvm.storageclass.parameters" (dict "global" $ "storageclass" .) | nindent 2 }} --- -{{- $storageClass := .Values.storageClasses.mirrorEncrypted -}} -{{ if $storageClass.enabled }} -apiVersion: storage.k8s.io/v1 -kind: StorageClass + +{{- if and .parameters.encryption (eq .parameters.encryption "true" ) }} + +{{- $secretName := (include "csi-driver-lvm.storageclass.encryption.secret.fullname" (dict "global" $ "storageclass" .)) }} +{{- if not (empty (index .parameters "csi.storage.k8s.io/node-stage-secret-name")) }} +{{- $secretName := (index .parameters "csi.storage.k8s.io/node-stage-secret-name") }} +{{- end }} + +{{- $secretNamespace := (include "csi-driver-lvm.storageclass.encryption.secret.namespace" (dict "global" $ "storageclass" .)) }} +{{- if not (empty (index .parameters "csi.storage.k8s.io/node-stage-secret-namespace")) }} +{{- $secretNamespace := (index .parameters "csi.storage.k8s.io/node-stage-secret-namespace") }} +{{- end }} + +{{- $oldSecret := (lookup "v1" "Secret" $secretNamespace $secretName) }} + +apiVersion: v1 +kind: Secret metadata: - name: {{ .Release.Name }}-mirror-encrypted -{{- if not (empty $storageClass.additionalAnnotations) }} - annotations: - {{- $storageClass.additionalAnnotations | toYaml | nindent 4 -}} -{{ end }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -provisioner: {{ .Release.Name }} -reclaimPolicy: {{ $storageClass.reclaimPolicy }} -volumeBindingMode: WaitForFirstConsumer -allowVolumeExpansion: true -parameters: - type: "mirror" - encryption: "true" - csi.storage.k8s.io/node-stage-secret-name: {{ $storageClass.encryptionSecret.name }} - csi.storage.k8s.io/node-stage-secret-namespace: {{ $storageClass.encryptionSecret.namespace }} -{{ end }} + name: {{ $secretName }} + namespace: {{ $secretNamespace }} + labels: {{- include "csi-driver-lvm.labels" $ | nindent 4 }} +type: Opaque +data: + {{- if not (empty .passphrase) }} + passphrase: {{ .passphrase | b64enc | quote }} + {{- else }} + {{- if $oldSecret }} + passphrase: {{ $oldSecret.data.passphrase }} + {{- else }} + passphrase: {{ randAlphaNum 32 | b64enc | quote }} + {{- end }} + {{- end }} --- -{{- $storageClass := .Values.storageClasses.stripedEncrypted -}} -{{ if $storageClass.enabled }} -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: {{ .Release.Name }}-striped-encrypted -{{- if not (empty $storageClass.additionalAnnotations) }} - annotations: - {{- $storageClass.additionalAnnotations | toYaml | nindent 4 -}} -{{ end }} - labels: - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -provisioner: {{ .Release.Name }} -reclaimPolicy: {{ $storageClass.reclaimPolicy }} -volumeBindingMode: WaitForFirstConsumer -allowVolumeExpansion: true -parameters: - type: "striped" - encryption: "true" - csi.storage.k8s.io/node-stage-secret-name: {{ $storageClass.encryptionSecret.name }} - csi.storage.k8s.io/node-stage-secret-namespace: {{ $storageClass.encryptionSecret.namespace }} -{{ end }} +{{- end }} + +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/csi-driver-lvm/values.yaml b/charts/csi-driver-lvm/values.yaml index 805bb4e7..9c5bfe55 100644 --- a/charts/csi-driver-lvm/values.yaml +++ b/charts/csi-driver-lvm/values.yaml @@ -7,9 +7,9 @@ lvm: hostWritePath: /etc/lvm # these are primariliy for testing purposes - vgName: csi-lvm - driverName: lvm.csi.metal-stack.io - storageClassStub: csi-driver-lvm + # vgName: csi-lvm + # driverName: lvm.csi.metal-stack.io + # storageClassStub: csi-driver-lvm logLevel: info rbac: @@ -42,41 +42,48 @@ kubernetes: kubeletPath: /var/lib/kubelet storageClasses: - linear: + - name: linear enabled: true additionalAnnotations: [] - # this might be used to mark one of the StorageClasses as default: - # storageclass.kubernetes.io/is-default-class: "true" reclaimPolicy: Delete - striped: + parameters: + type: "linear" + - name: striped enabled: true additionalAnnotations: [] reclaimPolicy: Delete - mirror: + parameters: + type: "striped" + - name: mirror enabled: true additionalAnnotations: [] reclaimPolicy: Delete - linearEncrypted: - enabled: false + parameters: + type: "mirror" + - name: linear-encrypted + enabled: true additionalAnnotations: [] reclaimPolicy: Delete - encryptionSecret: - name: csi-lvm-encryption-secret - namespace: default - stripedEncrypted: - enabled: false + parameters: + type: "linear" + encryption: "true" + - name: striped-encrypted + enabled: true additionalAnnotations: [] reclaimPolicy: Delete - encryptionSecret: - name: csi-lvm-encryption-secret - namespace: default - mirrorEncrypted: - enabled: false + parameters: + type: "striped" + encryption: "true" + - name: mirror-encrypted + enabled: true additionalAnnotations: [] reclaimPolicy: Delete - encryptionSecret: - name: csi-lvm-encryption-secret - namespace: default + # passphrase: "encryption-passphrase" + parameters: + type: "mirror" + encryption: "true" + # csi.storage.k8s.io/node-stage-secret-name: "testsecret" + # csi.storage.k8s.io/node-stage-secret-namespace: "testsecretnamespace" nodeSelector: # The plugin daemonset will run on all nodes if it has a toleration, From 79a14fc78b99ebd0a4928f9954412acc174778b8 Mon Sep 17 00:00:00 2001 From: Mikk Tendermann Date: Wed, 20 May 2026 14:23:17 +0300 Subject: [PATCH 3/4] secret needs to be restored even if you provide secret namespace and name --- charts/csi-driver-lvm/templates/_helpers.tpl | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/charts/csi-driver-lvm/templates/_helpers.tpl b/charts/csi-driver-lvm/templates/_helpers.tpl index 8a9220c6..5750d2b2 100644 --- a/charts/csi-driver-lvm/templates/_helpers.tpl +++ b/charts/csi-driver-lvm/templates/_helpers.tpl @@ -90,7 +90,7 @@ app: {{ include "csi-driver-lvm.eviction.fullname" . }} STORAGECLASS */}} {{- define "csi-driver-lvm.storageclass.fullname" -}} -{{- printf "%s-%s" (include "csi-driver-lvm.fullname" .global ) .storageclass.name }} +{{- printf "%s-%s" (include "csi-driver-lvm.fullname" .global ) .storageclass.name | trunc 63 | trimSuffix "-" }} {{- end }} {{- define "csi-driver-lvm.storageclass.parameters" -}} @@ -106,8 +106,17 @@ csi.storage.k8s.io/node-stage-secret-namespace: {{ include "csi-driver-lvm.stora {{- end }} {{- define "csi-driver-lvm.storageclass.encryption.secret.fullname" -}} -{{- printf "%s-%s" (include "csi-driver-lvm.fullname" .global ) .storageclass.name }} +{{- if not (empty (index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-name")) }} +{{- index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-name" }} +{{- else }} +{{- printf "%s-%s" (include "csi-driver-lvm.fullname" .global ) .storageclass.name | trunc 63 | trimSuffix "-" }} +{{- end }} {{- end }} + {{- define "csi-driver-lvm.storageclass.encryption.secret.namespace" -}} -{{ .global.Release.Namespace }} +{{- if not (empty (index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-namespace")) }} +{{- index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-namespace" }} +{{- else }} +{{- printf "%s-%s" (include "csi-driver-lvm.fullname" .global ) .storageclass.name | trunc 63 | trimSuffix "-" }} +{{- end }} {{- end }} \ No newline at end of file From 4ba5ccd2b57bbb758200f9077cd22d064a32b5ed Mon Sep 17 00:00:00 2001 From: Mikk Tendermann Date: Wed, 20 May 2026 14:34:00 +0300 Subject: [PATCH 4/4] generate plugin fullaname fix using namespace --- charts/csi-driver-lvm/templates/_helpers.tpl | 6 +++++- charts/csi-driver-lvm/templates/daemonset.yaml | 8 ++++---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/charts/csi-driver-lvm/templates/_helpers.tpl b/charts/csi-driver-lvm/templates/_helpers.tpl index 5750d2b2..43b241b5 100644 --- a/charts/csi-driver-lvm/templates/_helpers.tpl +++ b/charts/csi-driver-lvm/templates/_helpers.tpl @@ -17,6 +17,10 @@ {{- end }} {{- end }} +{{- define "csi-driver-lvm.plugin.fullname" -}} +{{- include "csi-driver-lvm.fullname" . }} +{{- end }} + {{/* Common labels */}} @@ -117,6 +121,6 @@ csi.storage.k8s.io/node-stage-secret-namespace: {{ include "csi-driver-lvm.stora {{- if not (empty (index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-namespace")) }} {{- index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-namespace" }} {{- else }} -{{- printf "%s-%s" (include "csi-driver-lvm.fullname" .global ) .storageclass.name | trunc 63 | trimSuffix "-" }} +{{- .global.Release.Namespace }} {{- end }} {{- end }} \ No newline at end of file diff --git a/charts/csi-driver-lvm/templates/daemonset.yaml b/charts/csi-driver-lvm/templates/daemonset.yaml index 2f35efe3..3751f0c1 100644 --- a/charts/csi-driver-lvm/templates/daemonset.yaml +++ b/charts/csi-driver-lvm/templates/daemonset.yaml @@ -69,7 +69,7 @@ spec: allowedHostPaths: - pathPrefix: /lib/modules - pathPrefix: {{ .Values.lvm.hostWritePath }}/cache - - pathPrefix: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Release.Name }} + - pathPrefix: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ include "csi-driver-lvm.plugin.fullname" . }} - pathPrefix: {{ .Values.lvm.hostWritePath }}/backup - pathPrefix: {{ .Values.lvm.hostWritePath }}/lock - pathPrefix: {{ .Values.kubernetes.kubeletPath }}/plugins @@ -207,7 +207,7 @@ spec: args: - --v=5 - --csi-address=/csi/csi.sock - - --kubelet-registration-path={{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Release.Name }}/csi.sock + - --kubelet-registration-path={{ .Values.kubernetes.kubeletPath }}/plugins/{{ include "csi-driver-lvm.plugin.fullname" . }}/csi.sock env: - name: KUBE_NODE_NAME valueFrom: @@ -225,7 +225,7 @@ spec: volumeMounts: - mountPath: /csi name: socket-dir - - mountPath: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Release.Name }} + - mountPath: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ include "csi-driver-lvm.plugin.fullname" . }} name: socket-dir - mountPath: /registration name: registration-dir @@ -315,7 +315,7 @@ spec: terminationGracePeriodSeconds: 30 volumes: - hostPath: - path: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Release.Name }} + path: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ include "csi-driver-lvm.plugin.fullname" . }} type: DirectoryOrCreate name: socket-dir - hostPath: