Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
126 changes: 126 additions & 0 deletions charts/csi-driver-lvm/templates/_helpers.tpl
Original file line number Diff line number Diff line change
@@ -0,0 +1,126 @@
{{/* vim: set filetype=mustache: */}}

{{- define "csi-driver-lvm.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}

{{- define "csi-driver-lvm.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}

{{- define "csi-driver-lvm.plugin.fullname" -}}
{{- include "csi-driver-lvm.fullname" . }}
{{- end }}

{{/*
Common labels
*/}}
{{- define "csi-driver-lvm.labels" -}}
release: {{ .Release.Name }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{ if .Values.labels }}
{{ .Values.labels | toYaml}}
{{- end }}
{{- end }}

{{- define "csi-driver-lvm.csi-driver.fullname" -}}
{{- default (include "csi-driver-lvm.fullname" .) .Values.lvm.driverName | trunc 63 | trimSuffix "-" }}
{{- end }}

{{- define "csi-driver-lvm.csi-driver.vgname" -}}
{{- default (include "csi-driver-lvm.fullname" .) .Values.lvm.vgName | trunc 63 | trimSuffix "-" }}
{{- end }}

{{- define "csi-driver-lvm.serviceaccount.fullname" -}}
{{- include "csi-driver-lvm.fullname" . }}
{{- end }}
{{- define "csi-driver-lvm.clusterrole.fullname" -}}
{{- include "csi-driver-lvm.fullname" . }}
{{- end }}
{{- define "csi-driver-lvm.clusterrolebinding.fullname" -}}
{{- include "csi-driver-lvm.fullname" . }}
{{- end }}
{{- define "csi-driver-lvm.podsecuritypolicy.fullname" -}}
{{- include "csi-driver-lvm.fullname" . }}
{{- end }}
{{- define "csi-driver-lvm.role.fullname" -}}
{{- include "csi-driver-lvm.fullname" . }}
{{- end }}
{{- define "csi-driver-lvm.rolebinding.fullname" -}}
{{- include "csi-driver-lvm.fullname" . }}
{{- end }}
{{- define "csi-driver-lvm.daemonset.fullname" -}}
{{- include "csi-driver-lvm.fullname" . }}
{{- end }}
{{- define "csi-driver-lvm.daemonset.selectorlabels" -}}
app: {{ include "csi-driver-lvm.fullname" . }}
{{- end }}

{{/*
EVICTION CONTROLLER
*/}}
{{- define "csi-driver-lvm.eviction.fullname" -}}
{{- printf "%s-controller" (include "csi-driver-lvm.fullname" .) | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- define "csi-driver-lvm.eviction.serviceaccount.fullname" -}}
{{- include "csi-driver-lvm.eviction.fullname" . }}
{{- end }}
{{- define "csi-driver-lvm.eviction.clusterrole.fullname" -}}
{{- include "csi-driver-lvm.eviction.fullname" . }}
{{- end }}
{{- define "csi-driver-lvm.eviction.clusterrolebinding.fullname" -}}
{{- include "csi-driver-lvm.eviction.fullname" . }}
{{- end }}
{{- define "csi-driver-lvm.eviction.deployment.fullname" -}}
{{- include "csi-driver-lvm.eviction.fullname" . }}
{{- end }}
{{- define "csi-driver-lvm.eviction.selectorlabels" -}}
app: {{ include "csi-driver-lvm.eviction.fullname" . }}
{{- end }}

{{/*
STORAGECLASS
*/}}
{{- define "csi-driver-lvm.storageclass.fullname" -}}
{{- printf "%s-%s" (include "csi-driver-lvm.fullname" .global ) .storageclass.name | trunc 63 | trimSuffix "-" }}
{{- end }}

{{- define "csi-driver-lvm.storageclass.parameters" -}}
{{- .storageclass.parameters | toYaml }}
{{- if and .storageclass.parameters.encryption (eq .storageclass.parameters.encryption "true" ) }}
{{- if empty (index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-name") }}
csi.storage.k8s.io/node-stage-secret-name: {{ include "csi-driver-lvm.storageclass.encryption.secret.fullname" . }}
{{- end }}
{{- if empty (index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-namespace") }}
csi.storage.k8s.io/node-stage-secret-namespace: {{ include "csi-driver-lvm.storageclass.encryption.secret.namespace" . }}
{{- end }}
{{- end }}
{{- end }}

{{- define "csi-driver-lvm.storageclass.encryption.secret.fullname" -}}
{{- if not (empty (index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-name")) }}
{{- index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-name" }}
{{- else }}
{{- printf "%s-%s" (include "csi-driver-lvm.fullname" .global ) .storageclass.name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}

{{- define "csi-driver-lvm.storageclass.encryption.secret.namespace" -}}
{{- if not (empty (index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-namespace")) }}
{{- index .storageclass.parameters "csi.storage.k8s.io/node-stage-secret-namespace" }}
{{- else }}
{{- .global.Release.Namespace }}
{{- end }}
{{- end }}
6 changes: 2 additions & 4 deletions charts/csi-driver-lvm/templates/common.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,8 @@
apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
name: {{ .Values.lvm.driverName }}
labels:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ include "csi-driver-lvm.csi-driver.fullname" . }}
labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }}
spec:
volumeLifecycleModes:
- Persistent
Expand Down
70 changes: 27 additions & 43 deletions charts/csi-driver-lvm/templates/daemonset.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,18 +2,14 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: csi-driver-lvm
labels:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ include "csi-driver-lvm.serviceaccount.fullname" . }}
labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }}
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: csi-driver-lvm
labels:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ include "csi-driver-lvm.clusterrole.fullname" . }}
labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }}
rules:
- apiGroups: [""]
resources: ["persistentvolumes"]
Expand Down Expand Up @@ -52,32 +48,28 @@ rules:
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: csi-driver-lvm
labels:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ include "csi-driver-lvm.clusterrolebinding.fullname" . }}
labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }}
subjects:
- kind: ServiceAccount
name: csi-driver-lvm
name: {{ include "csi-driver-lvm.serviceaccount.fullname" . }}
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: csi-driver-lvm
name: {{ include "csi-driver-lvm.clusterrole.fullname" . }}
apiGroup: rbac.authorization.k8s.io
---
{{- if and .Values.rbac.pspEnabled (.Capabilities.APIVersions.Has "policy/v1beta1") }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: csi-driver-lvm
labels:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ include "csi-driver-lvm.podsecuritypolicy.fullname" . }}
labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }}
spec:
allowedHostPaths:
- pathPrefix: /lib/modules
- pathPrefix: {{ .Values.lvm.hostWritePath }}/cache
- pathPrefix: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Values.lvm.storageClassStub }}
- pathPrefix: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ include "csi-driver-lvm.plugin.fullname" . }}
- pathPrefix: {{ .Values.lvm.hostWritePath }}/backup
- pathPrefix: {{ .Values.lvm.hostWritePath }}/lock
- pathPrefix: {{ .Values.kubernetes.kubeletPath }}/plugins
Expand All @@ -103,10 +95,8 @@ spec:
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: csi-driver-lvm
labels:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ include "csi-driver-lvm.role.fullname" . }}
labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }}
rules:
- apiGroups:
- policy
Expand All @@ -121,37 +111,31 @@ rules:
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: csi-driver-lvm
labels:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ include "csi-driver-lvm.rolebinding.fullname" . }}
labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: csi-driver-lvm
name: {{ include "csi-driver-lvm.role.fullname" . }}
subjects:
- kind: ServiceAccount
name: csi-driver-lvm
name: {{ include "csi-driver-lvm.serviceaccount.fullname" . }}
namespace: {{ .Release.Namespace }}
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: csi-driver-lvm
labels:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ include "csi-driver-lvm.daemonset.fullname" . }}
labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }}
spec:
revisionHistoryLimit: 10
selector:
matchLabels:
app: csi-driver-lvm
matchLabels: {{ include "csi-driver-lvm.daemonset.selectorlabels" . | nindent 6 }}
template:
metadata:
labels:
app: csi-driver-lvm
labels: {{ include "csi-driver-lvm.daemonset.selectorlabels" . | nindent 8 }}
spec:
serviceAccountName: csi-driver-lvm
serviceAccountName: {{ include "csi-driver-lvm.serviceaccount.fullname" . }}
{{- if .Values.tolerations.plugin }}
tolerations:
{{ toYaml .Values.tolerations.plugin | indent 8 }}
Expand Down Expand Up @@ -223,7 +207,7 @@ spec:
args:
- --v=5
- --csi-address=/csi/csi.sock
- --kubelet-registration-path={{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Values.lvm.storageClassStub }}/csi.sock

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

at least here, it must be ensured the the release.Name does not contain any dangerous characters.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am actually planning to create helpers for them

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Release.Name cannot really contain any dangerous characters, the only potentially dangerous character that can exist is a . but that needs to be in the middle of a name so .test or test. is not even allowed. Also only 1 consequent . is allowed(therefore test..test is not allowed). So only test.test is allowed

therefore {{ .Values.kubernetes.kubeletPath }}/plugins/test.test AFAIK should be totally fine and valid plugin folder

- --kubelet-registration-path={{ .Values.kubernetes.kubeletPath }}/plugins/{{ include "csi-driver-lvm.plugin.fullname" . }}/csi.sock
env:
- name: KUBE_NODE_NAME
valueFrom:
Expand All @@ -241,18 +225,18 @@ spec:
volumeMounts:
- mountPath: /csi
name: socket-dir
- mountPath: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Values.lvm.storageClassStub }}
- mountPath: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ include "csi-driver-lvm.plugin.fullname" . }}
name: socket-dir
- mountPath: /registration
name: registration-dir
- name: csi-driver-lvm
args:
- --drivername={{ .Values.lvm.driverName }}
- --drivername={{ include "csi-driver-lvm.csi-driver.fullname" . }}
- --endpoint=/csi/csi.sock
- --hostwritepath={{ .Values.lvm.hostWritePath }}
- --devices={{ .Values.lvm.devicePattern }}
- --nodeid=$(KUBE_NODE_NAME)
- --vgname={{ .Values.lvm.vgName }}
- --vgname={{ include "csi-driver-lvm.csi-driver.vgname" . }}
- --log-level={{ .Values.lvm.logLevel }}
env:
- name: KUBE_NODE_NAME
Expand Down Expand Up @@ -331,7 +315,7 @@ spec:
terminationGracePeriodSeconds: 30
volumes:
- hostPath:
path: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ .Values.lvm.storageClassStub }}
path: {{ .Values.kubernetes.kubeletPath }}/plugins/{{ include "csi-driver-lvm.plugin.fullname" . }}
type: DirectoryOrCreate
name: socket-dir
- hostPath:
Expand Down
40 changes: 15 additions & 25 deletions charts/csi-driver-lvm/templates/eviction-controller.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,18 +3,14 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: csi-driver-lvm-controller
labels:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ include "csi-driver-lvm.eviction.serviceaccount.fullname" . }}
labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: csi-driver-lvm-controller
labels:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ include "csi-driver-lvm.eviction.clusterrole.fullname" . }}
labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }}
rules:
- apiGroups:
- coordination.k8s.io
Expand Down Expand Up @@ -74,35 +70,29 @@ rules:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: csi-driver-lvm-controller
labels:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ include "csi-driver-lvm.eviction.clusterrolebinding.fullname" . }}
labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: csi-driver-lvm-controller
name: {{ include "csi-driver-lvm.eviction.clusterrole.fullname" . }}
subjects:
- kind: ServiceAccount
name: csi-driver-lvm-controller
name: {{ include "csi-driver-lvm.eviction.serviceaccount.fullname" . }}
namespace: {{ .Release.Namespace }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: csi-driver-lvm-controller
labels:
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ include "csi-driver-lvm.eviction.deployment.fullname" . }}
labels: {{- include "csi-driver-lvm.labels" . | nindent 4 }}
spec:
selector:
matchLabels:
app: csi-driver-lvm-controller
matchLabels: {{ include "csi-driver-lvm.eviction.selectorlabels" . | nindent 6 }}
replicas: 1
template:
metadata:
labels:
app: csi-driver-lvm-controller
labels: {{ include "csi-driver-lvm.eviction.selectorlabels" . | nindent 8 }}
spec:
securityContext:
runAsNonRoot: true
Expand All @@ -114,10 +104,10 @@ spec:
args:
- --leader-elect
- --health-probe-bind-address=:8081
- --provisioner-name={{ .Values.lvm.driverName }}
- --provisioner-name={{ include "csi-driver-lvm.csi-driver.fullname" . }}
image: "{{ .Values.evictionControllerImage.repository }}:{{ .Values.evictionControllerImage.tag }}"
imagePullPolicy: {{ .Values.evictionControllerImage.pullPolicy }}
name: csi-driver-lvm-controller
name: {{ include "csi-driver-lvm.eviction.deployment.fullname" . }}
ports: []
securityContext:
allowPrivilegeEscalation: false
Expand Down Expand Up @@ -145,6 +135,6 @@ spec:
memory: 64Mi
volumeMounts: []
volumes: []
serviceAccountName: csi-driver-lvm-controller
serviceAccountName: {{ include "csi-driver-lvm.eviction.serviceaccount.fullname" . }}
terminationGracePeriodSeconds: 10
{{- end }}
Loading