csi-beegfs-node.yaml

# Copyright 2021 NetApp, Inc. All Rights Reserved.
# Licensed under the Apache License, Version 2.0.

# Do not modify this file. Changes may be overwritten in subsequent driver versions.

kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: csi-beegfs-node
spec:
  selector:
    matchLabels:
      app: csi-beegfs-node
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: beegfs
      labels:
        app: csi-beegfs-node
    spec:
      serviceAccountName: csi-beegfs-node-sa
      hostNetwork: true # Required to find an available connClientPortUDP on the host.
      containers:
        - name: node-driver-registrar
          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.8.0
          args:
            - --csi-address=/csi/csi.sock
            - --kubelet-registration-path=/var/lib/kubelet/plugins/beegfs.csi.netapp.com/csi.sock
            - -v=$(LOG_LEVEL)
          env:
            - name: LOG_LEVEL
              value: "3"
          securityContext:
            # On SELinux enabled systems, a non-privileged sidecar container cannot access the unix domain socket
            # created by the privileged driver container.
            privileged: true
          volumeMounts:
            - mountPath: /csi
              name: socket-dir
            - mountPath: /registration
              name: registration-dir
          resources:
            limits:
              memory: 128Mi
            requests:
              cpu: 80m
              memory: 10Mi
        - name: beegfs
          image: ghcr.io/thinkparq/beegfs-csi-driver:v1.6.0
          args:
            - --driver-name=beegfs.csi.netapp.com
            - --node-id=$(KUBE_NODE_NAME)
            - --endpoint=unix://csi/csi.sock
            - --config-path=/csi/config/csi-beegfs-config.yaml
            - --connauth-path=/csi/connauth/csi-beegfs-connauth.yaml
            - -v=$(LOG_LEVEL)
          env:
            - name: KUBE_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: LOG_LEVEL
              value: "3"
          securityContext:
            # Privileged is required for bidirectional mount propagation and to run the mount command.
            # Adding the SYS_ADMIN capability is insufficient in certain environments (e.g. when AppArmor is enabled).
            privileged: true
          ports:
            - containerPort: 9898
              hostPort: 9898 # Must be same as containerPort when hostNetwork=true.
              name: healthz
              protocol: TCP
          livenessProbe:
            failureThreshold: 5
            httpGet:
              path: /healthz
              port: healthz
            initialDelaySeconds: 10
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 3
          volumeMounts:
            - mountPath: /host
              mountPropagation: Bidirectional
              name: host-dir
              readOnly: true # We should NOT write arbitrarily to the host filesystem.
              # Because we chwrap mount/umount, we must propagate the container's /host mounts to the node.
            - mountPath: /var/lib/kubelet/pods
              # We must know whether a directory is a mount point in order to decide how to handle it.
              mountPropagation: HostToContainer
              name: pods-mount-dir
            - mountPath: /var/lib/kubelet/plugins/kubernetes.io/csi
              # We must know whether a directory is a mount point in order to decide how to handle it.
              mountPropagation: HostToContainer
              name: plugins-mount-dir
            - mountPath: /csi
              name: socket-dir
            - mountPath: /csi/config
              name: config-dir
            - mountPath: /csi/connauth
              name: connauth-dir
          resources:
            limits:
              memory: 128Mi
            requests:
              cpu: 100m
              memory: 20Mi
        - name: liveness-probe
          volumeMounts:
            - mountPath: /csi
              name: socket-dir
          image: registry.k8s.io/sig-storage/livenessprobe:v2.10.0
          args:
            - --csi-address=/csi/csi.sock
            - --health-port=9898
          resources:
            limits:
              memory: 128Mi
            requests:
              cpu: 60m
              memory: 20Mi
      volumes:
        # The plugin uses host-dir and chwrap to execute binaries installed on the host itself.
        - hostPath:
            path: /
            type: Directory
          name: host-dir
        # Kubernetes mounts pod volumes at locations like
        # /var/lib/kubelet/pods/########-####-####-####-############/volumes/kubernetes.io~csi/pvc-########/mount.
        - hostPath:
            path: /var/lib/kubelet/pods
            type: DirectoryOrCreate
          name: pods-mount-dir
        # Kubernetes mounts global volumes at locations like
        # /var/lib/kubelet/plugins/kubernetes.io/csi/pv/pvc-########/globalmount.
        - hostPath:
            path: /var/lib/kubelet/plugins/kubernetes.io/csi
            type: DirectoryOrCreate
          name: plugins-mount-dir
        - hostPath:
            path: /var/lib/kubelet/plugins_registry
            type: Directory
          name: registration-dir
        # The node services creates its socket in this directory. This is the same directory the controller service
        # (csi-beegfs-controller.yaml) stores client configuration files inside.
        - hostPath:
            path: /var/lib/kubelet/plugins/beegfs.csi.netapp.com
            type: DirectoryOrCreate
          name: socket-dir
        - configMap:
            name: csi-beegfs-config # kustomized
          name: config-dir
        - secret:
            secretName: csi-beegfs-connauth # kustomized
          name: connauth-dir