spec.yaml

# SOURCE: https://install.portworx.com/?mc=false&kbver=1.15.0&b=true&s=%2Fdev%2Fsdb&j=auto&c=px-cluster-d620cbe1-ad1c-4b44-be2e-043929a7080f&stork=true&lh=true&st=k8s&reg=registry.xxx.com%2Flibrary%2F&rsec=registrykey
---
kind: Service
apiVersion: v1
metadata:
  name: portworx-service
  namespace: kube-system
  labels:
    name: portworx
spec:
  selector:
    name: portworx
  type: NodePort
  ports:
    - name: px-api
      protocol: TCP
      port: 9001
      targetPort: 9001
    - name: px-kvdb
      protocol: TCP
      port: 9019
      targetPort: 9019
    - name: px-sdk
      protocol: TCP
      port: 9020
      targetPort: 9020
    - name: px-rest-gateway
      protocol: TCP
      port: 9021
      targetPort: 9021
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: volumeplacementstrategies.portworx.io
spec:
  group: portworx.io
  versions:
    - name: v1beta2
      served: true
      storage: true
    - name: v1beta1
      served: false
      storage: false
  scope: Cluster
  names:
    plural: volumeplacementstrategies
    singular: volumeplacementstrategy
    kind: VolumePlacementStrategy
    shortNames:
    - vps
    - vp
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: px-account
  namespace: kube-system
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
   name: node-get-put-list-role
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["watch", "get", "update", "list"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["delete", "get", "list", "watch", "update"]
- apiGroups: [""]
  resources: ["persistentvolumeclaims", "persistentvolumes"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "update", "create"]
- apiGroups: ["extensions"]
  resources: ["podsecuritypolicies"]
  resourceNames: ["privileged"]
  verbs: ["use"]
- apiGroups: ["portworx.io"]
  resources: ["volumeplacementstrategies"]
  verbs: ["get", "list"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: node-role-binding
subjects:
- kind: ServiceAccount
  name: px-account
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: node-get-put-list-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Namespace
metadata:
  name: portworx
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: px-role
  namespace: portworx
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "create", "update", "patch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: px-role-binding
  namespace: portworx
subjects:
- kind: ServiceAccount
  name: px-account
  namespace: kube-system
roleRef:
  kind: Role
  name: px-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: portworx
  namespace: kube-system
  annotations:
    portworx.com/install-source: "https://install.portworx.com/?mc=false&kbver=1.15.0&b=true&s=%2Fdev%2Fsdb&j=auto&c=px-cluster-d620cbe1-ad1c-4b44-be2e-043929a7080f&stork=true&lh=true&st=k8s&reg=registry.xxx.com%2Flibrary%2F&rsec=registrykey"
spec:
  minReadySeconds: 0
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  template:
    metadata:
      labels:
        name: portworx
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: px/enabled
                operator: NotIn
                values:
                - "false"
              - key: node-role.kubernetes.io/master
                operator: DoesNotExist
      hostNetwork: true
      hostPID: false
      imagePullSecrets:
        - name: "registrykey"
      containers:
        - name: portworx
          image: registry.xxx.com/library/oci-monitor:2.1.5
          imagePullPolicy: Always
          args:
            ["-c", "px-cluster-d620cbe1-ad1c-4b44-be2e-043929a7080f", "-s", "/dev/sdb", "-secret_type", "k8s", "-j", "auto", "-b", 
             "-x", "kubernetes"]
          env:
            - name: "AUTO_NODE_RECOVERY_TIMEOUT_IN_SECS"
              value: "1500"
            - name: "PX_TEMPLATE_VERSION"
              value: "v4"
            - name: REGISTRY_CONFIG
              valueFrom:
                secretKeyRef:
                  key: .dockerconfigjson
                  name: "registrykey"
            
          livenessProbe:
            periodSeconds: 30
            initialDelaySeconds: 840 # allow image pull in slow networks
            httpGet:
              host: 127.0.0.1
              path: /status
              port: 9001
          readinessProbe:
            periodSeconds: 10
            httpGet:
              host: 127.0.0.1
              path: /health
              port: 9015
          terminationMessagePath: "/tmp/px-termination-log"
          securityContext:
            privileged: true
          volumeMounts:
            - name: diagsdump
              mountPath: /var/cores
            - name: dockersock
              mountPath: /var/run/docker.sock
            - name: containerdsock
              mountPath: /run/containerd
            - name: criosock
              mountPath: /var/run/crio
            - name: crioconf
              mountPath: /etc/crictl.yaml
            - name: etcpwx
              mountPath: /etc/pwx
            - name: optpwx
              mountPath: /opt/pwx
            - name: procmount
              mountPath: /host_proc
            - name: sysdmount
              mountPath: /etc/systemd/system
            - name: journalmount1
              mountPath: /var/run/log
              readOnly: true
            - name: journalmount2
              mountPath: /var/log
              readOnly: true
            - name: dbusmount
              mountPath: /var/run/dbus
      restartPolicy: Always
      serviceAccountName: px-account
      volumes:
        - name: diagsdump
          hostPath:
            path: /var/cores
        - name: dockersock
          hostPath:
            path: /var/run/docker.sock
        - name: containerdsock
          hostPath:
            path: /run/containerd
        - name: criosock
          hostPath:
            path: /var/run/crio
        - name: crioconf
          hostPath:
            path: /etc/crictl.yaml
            type: FileOrCreate
        - name: etcpwx
          hostPath:
            path: /etc/pwx
        - name: optpwx
          hostPath:
            path: /opt/pwx
        - name: procmount
          hostPath:
            path: /proc
        - name: sysdmount
          hostPath:
            path: /etc/systemd/system
        - name: journalmount1
          hostPath:
            path: /var/run/log
        - name: journalmount2
          hostPath:
            path: /var/log
        - name: dbusmount
          hostPath:
            path: /var/run/dbus
---
kind: Service
apiVersion: v1
metadata:
  name: portworx-api
  namespace: kube-system
  labels:
    name: portworx-api
spec:
  selector:
    name: portworx-api
  type: NodePort
  ports:
    - name: px-api
      protocol: TCP
      port: 9001
      targetPort: 9001
    - name: px-sdk
      protocol: TCP
      port: 9020
      targetPort: 9020
    - name: px-rest-gateway
      protocol: TCP
      port: 9021
      targetPort: 9021
---
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: portworx-api
  namespace: kube-system
spec:
  minReadySeconds: 0
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 100%
  template:
    metadata:
      labels:
        name: portworx-api
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: px/enabled
                operator: NotIn
                values:
                - "false"
              - key: node-role.kubernetes.io/master
                operator: DoesNotExist
      hostNetwork: true
      hostPID: false
      containers:
        - name: portworx-api
          image: registry.xxx.com/library/pause:3.1
          imagePullPolicy: Always
          readinessProbe:
            periodSeconds: 10
            httpGet:
              host: 127.0.0.1
              path: /status
              port: 9001
      restartPolicy: Always
      serviceAccountName: px-account


---
apiVersion: v1
kind: ConfigMap
metadata:
  name: stork-config
  namespace: kube-system
data:
  policy.cfg: |-
    {
      "kind": "Policy",
      "apiVersion": "v1",
      "extenders": [
        {
          "urlPrefix": "http://stork-service.kube-system:8099",
          "apiVersion": "v1beta1",
          "filterVerb": "filter",
          "prioritizeVerb": "prioritize",
          "weight": 5,
          "enableHttps": false,
          "nodeCacheCapable": false
        }
      ]
    }
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: stork-account
  namespace: kube-system
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
   name: stork-role
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: stork-role-binding
subjects:
- kind: ServiceAccount
  name: stork-account
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: stork-role
  apiGroup: rbac.authorization.k8s.io
---
kind: Service
apiVersion: v1
metadata:
  name: stork-service
  namespace: kube-system
spec:
  selector:
    name: stork
  ports:
    - protocol: TCP
      port: 8099
      targetPort: 8099
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations:
    scheduler.alpha.kubernetes.io/critical-pod: ""
  labels:
    tier: control-plane
  name: stork
  namespace: kube-system
spec:
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  replicas: 3
  template:
    metadata:
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ""
      labels:
        name: stork
        tier: control-plane
    spec:
      containers:
      - command:
        - /stork
        - --driver=pxd
        - --verbose
        - --leader-elect=true
        - --health-monitor-interval=120
        imagePullPolicy: Always
        image: registry.xxx.com/library/stork:2.2.5
        env:
        - name: "PX_SERVICE_NAME"
          value: "portworx-api"
        resources:
          requests:
            cpu: '0.1'
        name: stork
      hostPID: false
      imagePullSecrets:
        - name: "registrykey"
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: "name"
                    operator: In
                    values:
                    - stork
              topologyKey: "kubernetes.io/hostname"
      serviceAccountName: stork-account
---
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: stork-snapshot-sc
provisioner: stork-snapshot
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: stork-scheduler-account
  namespace: kube-system
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: stork-scheduler-role
rules:
  - apiGroups: [""]
    resources: ["endpoints"]
    verbs: ["get", "create", "update"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["create", "patch", "update"]
  - apiGroups: [""]
    resourceNames: ["kube-scheduler"]
    resources: ["endpoints"]
    verbs: ["delete", "get", "patch", "update"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["delete", "get", "list", "watch"]
  - apiGroups: [""]
    resources: ["bindings", "pods/binding"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["pods/status"]
    verbs: ["patch", "update"]
  - apiGroups: [""]
    resources: ["replicationcontrollers", "services"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps", "extensions"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["statefulsets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["policy"]
    resources: ["poddisruptionbudgets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims", "persistentvolumes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: stork-scheduler-role-binding
subjects:
- kind: ServiceAccount
  name: stork-scheduler-account
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: stork-scheduler-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  labels:
    component: scheduler
    tier: control-plane
    name: stork-scheduler
  name: stork-scheduler
  namespace: kube-system
spec:
  replicas: 3
  template:
    metadata:
      labels:
        component: scheduler
        tier: control-plane
      name: stork-scheduler
    spec:
      containers:
      - command:
        - /usr/local/bin/kube-scheduler
        - --address=0.0.0.0
        - --leader-elect=true
        - --scheduler-name=stork
        - --policy-configmap=stork-config
        - --policy-configmap-namespace=kube-system
        - --lock-object-name=stork-scheduler
        image: registry.xxx.com/library/kube-scheduler-amd64:v1.15.0
        livenessProbe:
          httpGet:
            path: /healthz
            port: 10251
          initialDelaySeconds: 15
        name: stork-scheduler
        readinessProbe:
          httpGet:
            path: /healthz
            port: 10251
        resources:
          requests:
            cpu: '0.1'
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: "name"
                    operator: In
                    values:
                    - stork-scheduler
              topologyKey: "kubernetes.io/hostname"
      hostPID: false
      imagePullSecrets:
        - name: "registrykey"
      serviceAccountName: stork-scheduler-account
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: px-lh-account
  namespace: kube-system
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: px-lh-role
  namespace: kube-system
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["list", "get"]
  - apiGroups:
        - extensions
        - apps
    resources:
        - deployments
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "create", "update"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "create", "update"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["create", "get", "list", "watch"]
  - apiGroups: ["stork.libopenstorage.org"]
    resources: ["clusterpairs","migrations","groupvolumesnapshots"]
    verbs: ["get", "list", "create", "update", "delete"]
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - alertmanagers
      - prometheuses
      - prometheuses/finalizers
      - servicemonitors
    verbs: ["*"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: px-lh-role-binding
  namespace: kube-system
subjects:
  - kind: ServiceAccount
    name: px-lh-account
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: px-lh-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Service
metadata:
  name: px-lighthouse
  namespace: kube-system
  labels:
    tier: px-web-console
spec:
  type: NodePort
  ports:
    - name: http
      port: 80
    - name: https
      port: 443
  selector:
    tier: px-web-console
---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: px-lighthouse
  namespace: kube-system
  labels:
    tier: px-web-console
spec:
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  selector:
    matchLabels:
      tier: px-web-console
  replicas: 1
  template:
    metadata:
      labels:
        tier: px-web-console
    spec:
      initContainers:
      - name: config-init
        image: registry.xxx.com/library/lh-config-sync:0.4
        imagePullPolicy: Always
        args:
        - "init"
        volumeMounts:
        - name: config
          mountPath: /config/lh
      containers:
      - name: px-lighthouse
        image: registry.xxx.com/library/px-lighthouse:2.0.4
        imagePullPolicy: Always
        args: [ "-kubernetes", "true" ]
        ports:
        - containerPort: 80
        - containerPort: 443
        volumeMounts:
        - name: config
          mountPath: /config/lh
      - name: config-sync
        image: registry.xxx.com/library/lh-config-sync:0.4
        imagePullPolicy: Always
        args:
        - "sync"
        volumeMounts:
        - name: config
          mountPath: /config/lh
      - name: stork-connector
        image: registry.xxx.com/library/lh-stork-connector:0.2
        imagePullPolicy: Always
      serviceAccountName: px-lh-account
      volumes:
      - name: config
        emptyDir: {}