update
This commit is contained in:
havelight-ee
@@ -0,0 +1,6 @@
|
||||
---
|
||||
azure_csi_use_instance_metadata: true
|
||||
azure_csi_controller_replicas: 2
|
||||
azure_csi_plugin_image_tag: latest
|
||||
azure_csi_controller_affinity: {}
|
||||
azure_csi_node_affinity: {}
|
||||
@@ -0,0 +1,54 @@
|
||||
---
|
||||
- name: Azure CSI Driver | check azure_csi_tenant_id value
|
||||
fail:
|
||||
msg: "azure_csi_tenant_id is missing"
|
||||
when: azure_csi_tenant_id is not defined or not azure_csi_tenant_id
|
||||
|
||||
- name: Azure CSI Driver | check azure_csi_subscription_id value
|
||||
fail:
|
||||
msg: "azure_csi_subscription_id is missing"
|
||||
when: azure_csi_subscription_id is not defined or not azure_csi_subscription_id
|
||||
|
||||
- name: Azure CSI Driver | check azure_csi_aad_client_id value
|
||||
fail:
|
||||
msg: "azure_csi_aad_client_id is missing"
|
||||
when: azure_csi_aad_client_id is not defined or not azure_csi_aad_client_id
|
||||
|
||||
- name: Azure CSI Driver | check azure_csi_aad_client_secret value
|
||||
fail:
|
||||
msg: "azure_csi_aad_client_secret is missing"
|
||||
when: azure_csi_aad_client_secret is not defined or not azure_csi_aad_client_secret
|
||||
|
||||
- name: Azure CSI Driver | check azure_csi_resource_group value
|
||||
fail:
|
||||
msg: "azure_csi_resource_group is missing"
|
||||
when: azure_csi_resource_group is not defined or not azure_csi_resource_group
|
||||
|
||||
- name: Azure CSI Driver | check azure_csi_location value
|
||||
fail:
|
||||
msg: "azure_csi_location is missing"
|
||||
when: azure_csi_location is not defined or not azure_csi_location
|
||||
|
||||
- name: Azure CSI Driver | check azure_csi_subnet_name value
|
||||
fail:
|
||||
msg: "azure_csi_subnet_name is missing"
|
||||
when: azure_csi_subnet_name is not defined or not azure_csi_subnet_name
|
||||
|
||||
- name: Azure CSI Driver | check azure_csi_security_group_name value
|
||||
fail:
|
||||
msg: "azure_csi_security_group_name is missing"
|
||||
when: azure_csi_security_group_name is not defined or not azure_csi_security_group_name
|
||||
|
||||
- name: Azure CSI Driver | check azure_csi_vnet_name value
|
||||
fail:
|
||||
msg: "azure_csi_vnet_name is missing"
|
||||
when: azure_csi_vnet_name is not defined or not azure_csi_vnet_name
|
||||
|
||||
- name: Azure CSI Driver | check azure_csi_vnet_resource_group value
|
||||
fail:
|
||||
msg: "azure_csi_vnet_resource_group is missing"
|
||||
when: azure_csi_vnet_resource_group is not defined or not azure_csi_vnet_resource_group
|
||||
|
||||
- name: "Azure CSI Driver | check azure_csi_use_instance_metadata is a bool"
|
||||
assert:
|
||||
that: azure_csi_use_instance_metadata | type_debug == 'bool'
|
||||
@@ -0,0 +1,44 @@
|
||||
---
|
||||
- include_tasks: azure-credential-check.yml
|
||||
|
||||
- name: Azure CSI Driver | Write Azure CSI cloud-config
|
||||
template:
|
||||
src: "azure-csi-cloud-config.j2"
|
||||
dest: "{{ kube_config_dir }}/azure_csi_cloud_config"
|
||||
group: "{{ kube_cert_group }}"
|
||||
mode: 0640
|
||||
when: inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
- name: Azure CSI Driver | Get base64 cloud-config
|
||||
slurp:
|
||||
src: "{{ kube_config_dir }}/azure_csi_cloud_config"
|
||||
register: cloud_config_secret
|
||||
when: inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
- name: Azure CSI Driver | Generate Manifests
|
||||
template:
|
||||
src: "{{ item.file }}.j2"
|
||||
dest: "{{ kube_config_dir }}/{{ item.file }}"
|
||||
mode: 0644
|
||||
with_items:
|
||||
- {name: azure-csi-azuredisk-driver, file: azure-csi-azuredisk-driver.yml}
|
||||
- {name: azure-csi-cloud-config-secret, file: azure-csi-cloud-config-secret.yml}
|
||||
- {name: azure-csi-azuredisk-controller, file: azure-csi-azuredisk-controller-rbac.yml}
|
||||
- {name: azure-csi-azuredisk-controller, file: azure-csi-azuredisk-controller.yml}
|
||||
- {name: azure-csi-azuredisk-node-rbac, file: azure-csi-azuredisk-node-rbac.yml}
|
||||
- {name: azure-csi-azuredisk-node, file: azure-csi-azuredisk-node.yml}
|
||||
register: azure_csi_manifests
|
||||
when: inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
- name: Azure CSI Driver | Apply Manifests
|
||||
kube:
|
||||
kubectl: "{{ bin_dir }}/kubectl"
|
||||
filename: "{{ kube_config_dir }}/{{ item.item.file }}"
|
||||
state: "latest"
|
||||
with_items:
|
||||
- "{{ azure_csi_manifests.results }}"
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
- not item is skipped
|
||||
loop_control:
|
||||
label: "{{ item.item.file }}"
|
||||
@@ -0,0 +1,230 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: csi-azuredisk-controller-sa
|
||||
namespace: kube-system
|
||||
---
|
||||
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: azuredisk-external-provisioner-role
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumes"]
|
||||
verbs: ["get", "list", "watch", "create", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["storage.k8s.io"]
|
||||
resources: ["storageclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
||||
- apiGroups: ["storage.k8s.io"]
|
||||
resources: ["csinodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
||||
- apiGroups: ["snapshot.storage.k8s.io"]
|
||||
resources: ["volumesnapshots"]
|
||||
verbs: ["get", "list"]
|
||||
- apiGroups: ["snapshot.storage.k8s.io"]
|
||||
resources: ["volumesnapshotcontents"]
|
||||
verbs: ["get", "list"]
|
||||
---
|
||||
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: azuredisk-csi-provisioner-binding
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: csi-azuredisk-controller-sa
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: azuredisk-external-provisioner-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
---
|
||||
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: azuredisk-external-attacher-role
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumes"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["csi.storage.k8s.io"]
|
||||
resources: ["csinodeinfos"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["storage.k8s.io"]
|
||||
resources: ["volumeattachments"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: ["storage.k8s.io"]
|
||||
resources: ["volumeattachments/status"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
||||
---
|
||||
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: azuredisk-csi-attacher-binding
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: csi-azuredisk-controller-sa
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: azuredisk-external-attacher-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
---
|
||||
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: azuredisk-cluster-driver-registrar-role
|
||||
rules:
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["create", "list", "watch", "delete"]
|
||||
- apiGroups: ["csi.storage.k8s.io"]
|
||||
resources: ["csidrivers"]
|
||||
verbs: ["create", "delete"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
||||
---
|
||||
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: azuredisk-csi-driver-registrar-binding
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: csi-azuredisk-controller-sa
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: azuredisk-cluster-driver-registrar-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
---
|
||||
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: azuredisk-external-snapshotter-role
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["list", "watch", "create", "update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list"]
|
||||
- apiGroups: ["snapshot.storage.k8s.io"]
|
||||
resources: ["volumesnapshotclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["snapshot.storage.k8s.io"]
|
||||
resources: ["volumesnapshotcontents"]
|
||||
verbs: ["create", "get", "list", "watch", "update", "delete"]
|
||||
- apiGroups: ["snapshot.storage.k8s.io"]
|
||||
resources: ["volumesnapshotcontents/status"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["create", "list", "watch", "delete"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "watch", "list", "delete", "update", "create"]
|
||||
---
|
||||
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: azuredisk-csi-snapshotter-binding
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: csi-azuredisk-controller-sa
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: azuredisk-external-snapshotter-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: azuredisk-external-resizer-role
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumes"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["persistentvolumeclaims/status"]
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["list", "watch", "create", "update", "patch"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: azuredisk-csi-resizer-role
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: csi-azuredisk-controller-sa
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: azuredisk-external-resizer-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: csi-azuredisk-controller-secret-role
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list"]
|
||||
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: csi-azuredisk-controller-secret-binding
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: csi-azuredisk-controller-sa
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: csi-azuredisk-controller-secret-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -0,0 +1,179 @@
|
||||
---
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: csi-azuredisk-controller
|
||||
namespace: kube-system
|
||||
spec:
|
||||
replicas: {{ azure_csi_controller_replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: csi-azuredisk-controller
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: csi-azuredisk-controller
|
||||
spec:
|
||||
hostNetwork: true
|
||||
serviceAccountName: csi-azuredisk-controller-sa
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
priorityClassName: system-cluster-critical
|
||||
tolerations:
|
||||
- key: "node-role.kubernetes.io/master"
|
||||
effect: "NoSchedule"
|
||||
- key: "node-role.kubernetes.io/control-plane"
|
||||
effect: "NoSchedule"
|
||||
{% if azure_csi_controller_affinity %}
|
||||
affinity:
|
||||
{{ azure_csi_controller_affinity | to_nice_yaml | indent(width=8) }}
|
||||
{% endif %}
|
||||
containers:
|
||||
- name: csi-provisioner
|
||||
image: {{ azure_csi_image_repo }}/csi-provisioner:{{ azure_csi_provisioner_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
args:
|
||||
- "--feature-gates=Topology=true"
|
||||
- "--csi-address=$(ADDRESS)"
|
||||
- "--v=2"
|
||||
- "--timeout=15s"
|
||||
- "--leader-election"
|
||||
- "--worker-threads=40"
|
||||
- "--extra-create-metadata=true"
|
||||
- "--strict-topology=true"
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /csi/csi.sock
|
||||
volumeMounts:
|
||||
- mountPath: /csi
|
||||
name: socket-dir
|
||||
resources:
|
||||
limits:
|
||||
memory: 500Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 20Mi
|
||||
- name: csi-attacher
|
||||
image: {{ azure_csi_image_repo }}/csi-attacher:{{ azure_csi_attacher_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
args:
|
||||
- "-v=2"
|
||||
- "-csi-address=$(ADDRESS)"
|
||||
- "-timeout=600s"
|
||||
- "-leader-election"
|
||||
- "-worker-threads=500"
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /csi/csi.sock
|
||||
volumeMounts:
|
||||
- mountPath: /csi
|
||||
name: socket-dir
|
||||
resources:
|
||||
limits:
|
||||
memory: 500Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 20Mi
|
||||
- name: csi-snapshotter
|
||||
image: {{ azure_csi_image_repo }}/csi-snapshotter:{{ azure_csi_snapshotter_image_tag }}
|
||||
args:
|
||||
- "-csi-address=$(ADDRESS)"
|
||||
- "-leader-election"
|
||||
- "-v=2"
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /csi/csi.sock
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /csi
|
||||
resources:
|
||||
limits:
|
||||
memory: 100Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 20Mi
|
||||
- name: csi-resizer
|
||||
image: {{ azure_csi_image_repo }}/csi-resizer:{{ azure_csi_resizer_image_tag }}
|
||||
args:
|
||||
- "-csi-address=$(ADDRESS)"
|
||||
- "-v=2"
|
||||
- "-leader-election"
|
||||
- '-handle-volume-inuse-error=false'
|
||||
- "-timeout=60s"
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /csi/csi.sock
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /csi
|
||||
resources:
|
||||
limits:
|
||||
memory: 500Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 20Mi
|
||||
- name: liveness-probe
|
||||
image: {{ azure_csi_image_repo }}/livenessprobe:{{ azure_csi_livenessprobe_image_tag }}
|
||||
args:
|
||||
- --csi-address=/csi/csi.sock
|
||||
- --probe-timeout=3s
|
||||
- --health-port=29602
|
||||
- --v=2
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /csi
|
||||
resources:
|
||||
limits:
|
||||
memory: 100Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 20Mi
|
||||
- name: azuredisk
|
||||
image: {{ azure_csi_plugin_image_repo }}/azuredisk-csi:{{ azure_csi_plugin_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
args:
|
||||
- "--v=5"
|
||||
- "--endpoint=$(CSI_ENDPOINT)"
|
||||
- "--metrics-address=0.0.0.0:29604"
|
||||
- "--disable-avset-nodes=true"
|
||||
- "--drivername=disk.csi.azure.com"
|
||||
- "--cloud-config-secret-name=cloud-config"
|
||||
- "--cloud-config-secret-namespace=kube-system"
|
||||
ports:
|
||||
- containerPort: 29602
|
||||
name: healthz
|
||||
protocol: TCP
|
||||
- containerPort: 29604
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: healthz
|
||||
initialDelaySeconds: 30
|
||||
timeoutSeconds: 10
|
||||
periodSeconds: 30
|
||||
env:
|
||||
- name: AZURE_CREDENTIAL_FILE
|
||||
value: "/etc/kubernetes/azure.json"
|
||||
- name: CSI_ENDPOINT
|
||||
value: unix:///csi/csi.sock
|
||||
volumeMounts:
|
||||
- mountPath: /csi
|
||||
name: socket-dir
|
||||
- mountPath: /etc/kubernetes/
|
||||
name: azure-cred
|
||||
readOnly: true
|
||||
resources:
|
||||
limits:
|
||||
memory: 500Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 20Mi
|
||||
volumes:
|
||||
- name: socket-dir
|
||||
emptyDir: {}
|
||||
- name: azure-cred
|
||||
secret:
|
||||
secretName: cloud-config
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: CSIDriver
|
||||
metadata:
|
||||
name: disk.csi.azure.com
|
||||
spec:
|
||||
attachRequired: true
|
||||
podInfoOnMount: true
|
||||
volumeLifecycleModes: # added in Kubernetes 1.16
|
||||
- Persistent
|
||||
@@ -0,0 +1,30 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: csi-azuredisk-node-sa
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: csi-azuredisk-node-secret-role
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list"]
|
||||
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: csi-azuredisk-node-secret-binding
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: csi-azuredisk-node-sa
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: csi-azuredisk-node-secret-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -0,0 +1,168 @@
|
||||
---
|
||||
kind: DaemonSet
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: csi-azuredisk-node
|
||||
namespace: kube-system
|
||||
spec:
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: csi-azuredisk-node
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: csi-azuredisk-node
|
||||
spec:
|
||||
hostNetwork: true
|
||||
dnsPolicy: Default
|
||||
serviceAccountName: csi-azuredisk-node-sa
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
{% if azure_csi_node_affinity %}
|
||||
affinity:
|
||||
{{ azure_csi_node_affinity | to_nice_yaml | indent(width=8) }}
|
||||
{% endif %}
|
||||
priorityClassName: system-node-critical
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
containers:
|
||||
- name: liveness-probe
|
||||
volumeMounts:
|
||||
- mountPath: /csi
|
||||
name: socket-dir
|
||||
image: {{ azure_csi_image_repo }}/livenessprobe:{{ azure_csi_livenessprobe_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
args:
|
||||
- --csi-address=/csi/csi.sock
|
||||
- --probe-timeout=3s
|
||||
- --health-port=29603
|
||||
- --v=2
|
||||
resources:
|
||||
limits:
|
||||
memory: 100Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 20Mi
|
||||
- name: node-driver-registrar
|
||||
image: {{ azure_csi_image_repo }}/csi-node-driver-registrar:{{ azure_csi_node_registrar_image_tag }}
|
||||
args:
|
||||
- --csi-address=$(ADDRESS)
|
||||
- --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
|
||||
- --v=2
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /csi-node-driver-registrar
|
||||
- --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
|
||||
- --mode=kubelet-registration-probe
|
||||
initialDelaySeconds: 30
|
||||
timeoutSeconds: 15
|
||||
env:
|
||||
- name: ADDRESS
|
||||
value: /csi/csi.sock
|
||||
- name: DRIVER_REG_SOCK_PATH
|
||||
value: /var/lib/kubelet/plugins/disk.csi.azure.com/csi.sock
|
||||
volumeMounts:
|
||||
- name: socket-dir
|
||||
mountPath: /csi
|
||||
- name: registration-dir
|
||||
mountPath: /registration
|
||||
resources:
|
||||
limits:
|
||||
memory: 100Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 20Mi
|
||||
- name: azuredisk
|
||||
image: {{ azure_csi_plugin_image_repo }}/azuredisk-csi:{{ azure_csi_plugin_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
args:
|
||||
- "--v=5"
|
||||
- "--endpoint=$(CSI_ENDPOINT)"
|
||||
- "--nodeid=$(KUBE_NODE_NAME)"
|
||||
- "--metrics-address=0.0.0.0:29605"
|
||||
- "--enable-perf-optimization=true"
|
||||
- "--drivername=disk.csi.azure.com"
|
||||
- "--volume-attach-limit=-1"
|
||||
- "--cloud-config-secret-name=cloud-config"
|
||||
- "--cloud-config-secret-namespace=kube-system"
|
||||
ports:
|
||||
- containerPort: 29603
|
||||
name: healthz
|
||||
protocol: TCP
|
||||
- containerPort: 29605
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: healthz
|
||||
initialDelaySeconds: 30
|
||||
timeoutSeconds: 10
|
||||
periodSeconds: 30
|
||||
env:
|
||||
- name: AZURE_CREDENTIAL_FILE
|
||||
value: "/etc/kubernetes/azure.json"
|
||||
- name: CSI_ENDPOINT
|
||||
value: unix:///csi/csi.sock
|
||||
- name: KUBE_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: spec.nodeName
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
- mountPath: /csi
|
||||
name: socket-dir
|
||||
- mountPath: /var/lib/kubelet/
|
||||
mountPropagation: Bidirectional
|
||||
name: mountpoint-dir
|
||||
- mountPath: /etc/kubernetes/
|
||||
name: azure-cred
|
||||
- mountPath: /dev
|
||||
name: device-dir
|
||||
- mountPath: /sys/bus/scsi/devices
|
||||
name: sys-devices-dir
|
||||
- mountPath: /sys/class/scsi_host/
|
||||
name: scsi-host-dir
|
||||
resources:
|
||||
limits:
|
||||
memory: 200Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 20Mi
|
||||
volumes:
|
||||
- hostPath:
|
||||
path: /var/lib/kubelet/plugins/disk.csi.azure.com
|
||||
type: DirectoryOrCreate
|
||||
name: socket-dir
|
||||
- hostPath:
|
||||
path: /var/lib/kubelet/
|
||||
type: DirectoryOrCreate
|
||||
name: mountpoint-dir
|
||||
- hostPath:
|
||||
path: /var/lib/kubelet/plugins_registry/
|
||||
type: DirectoryOrCreate
|
||||
name: registration-dir
|
||||
- secret:
|
||||
defaultMode: 0644
|
||||
secretName: cloud-config
|
||||
name: azure-cred
|
||||
- hostPath:
|
||||
path: /dev
|
||||
type: Directory
|
||||
name: device-dir
|
||||
- hostPath:
|
||||
path: /sys/bus/scsi/devices
|
||||
type: Directory
|
||||
name: sys-devices-dir
|
||||
- hostPath:
|
||||
path: /sys/class/scsi_host/
|
||||
type: Directory
|
||||
name: scsi-host-dir
|
||||
@@ -0,0 +1,7 @@
|
||||
kind: Secret
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: cloud-config
|
||||
namespace: kube-system
|
||||
data:
|
||||
azure.json: {{ cloud_config_secret.content }}
|
||||
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"cloud":"AzurePublicCloud",
|
||||
"tenantId": "{{ azure_csi_tenant_id }}",
|
||||
"subscriptionId": "{{ azure_csi_subscription_id }}",
|
||||
"aadClientId": "{{ azure_csi_aad_client_id }}",
|
||||
"aadClientSecret": "{{ azure_csi_aad_client_secret }}",
|
||||
"location": "{{ azure_csi_location }}",
|
||||
"resourceGroup": "{{ azure_csi_resource_group }}",
|
||||
"vnetName": "{{ azure_csi_vnet_name }}",
|
||||
"vnetResourceGroup": "{{ azure_csi_vnet_resource_group }}",
|
||||
"subnetName": "{{ azure_csi_subnet_name }}",
|
||||
"securityGroupName": "{{ azure_csi_security_group_name }}",
|
||||
"useInstanceMetadata": {{ azure_csi_use_instance_metadata }},
|
||||
}
|
||||
Reference in New Issue
Block a user