zfssa-5-canary: replace the dependabot branch with one that compiles and works

deploy/helm/k8s-1.20/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+name: zfssa-csi
+version: 1.1.0
+description: Deploys Oracle ZFS Storage Appliance CSI Plugin.

deploy/helm/k8s-1.20/templates/00-zfssa-csi-secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+stringData:
+  zfssa.yaml: |
+    username: {{ .Values.zfssaInformation.username }}
+    password: {{ .Values.zfssaInformation.password }}
+kind: Secret
+metadata:
+  name: oracle.zfssa.csi.node
+  namespace: {{ .Values.deployment.namespace }}

deploy/helm/k8s-1.20/templates/01-zfssa-csi-certs.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+data:
+  zfssa.crt: {{ .Values.zfssaInformation.cert }}
+kind: Secret
+metadata:
+  name: oracle.zfssa.csi.node.certs
+type: Opaque
+

deploy/helm/k8s-1.20/templates/02-zfssa-csi-rbac.yaml

@@ -0,0 +1,84 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: zfssa-csi
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: zfssa-csi-role
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list", "watch", "update", "create", "delete", "patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["csinodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattachments"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattachments/status"]
+    verbs: ["patch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims/status"]
+    verbs: ["patch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["list", "watch", "create", "update", "patch", "delete", "get"]
+  - apiGroups: ["csi.storage.k8s.io"]
+    resources: ["csinodeinfos"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["endpoints"]
+    verbs: ["get", "list", "watch", "create", "update"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotcontents"]
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshots"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: [ "snapshot.storage.k8s.io" ]
+    resources: [ "volumesnapshotcontents/status" ]
+    verbs: [ "update" ]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["create", "list", "watch", "delete"]
+  - apiGroups: ["csi.storage.k8s.io"]
+    resources: ["csidrivers"]
+    verbs: ["create", "delete"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "create", "update"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: zfssa-csi-role-binding
+subjects:
+  - kind: ServiceAccount
+    name: zfssa-csi
+    namespace: {{ .Values.deployment.namespace }}
+roleRef:
+  kind: ClusterRole
+  name: zfssa-csi-role
+  apiGroup: rbac.authorization.k8s.io

deploy/helm/k8s-1.20/templates/03-zfssa-csi-driver.yaml

@@ -0,0 +1,139 @@
+# Service defined here, plus serviceName below in StatefulSet,
+# are needed only because of condition explained in
+# https://github.com/kubernetes/kubernetes/issues/69608
+---
+apiVersion: storage.k8s.io/v1
+kind: CSIDriver
+metadata:
+  name: zfssa-csi-driver
+  namespace: {{ .Values.deployment.namespace }}
+spec:
+  attachRequired: true
+  podInfoOnMount: true
+  volumeLifecycleModes:
+    - Persistent
+
+---
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  name: zfssa-csi-nodeplugin
+  namespace: {{ .Values.deployment.namespace }}
+spec:
+  selector:
+    matchLabels:
+      app: zfssa-csi-nodeplugin
+  template:
+    metadata:
+      labels:
+        app: zfssa-csi-nodeplugin
+    spec:
+      serviceAccount: zfssa-csi
+      hostNetwork: true
+      containers:
+        - name: node-driver-registrar
+          image: {{ .Values.image.sidecarBase }}{{ .Values.images.csiNodeDriverRegistrar.name }}:{{ .Values.images.csiNodeDriverRegistrar.tag }}
+          args:
+            - --v=5
+            - --csi-address=/plugin/csi.sock
+            - --kubelet-registration-path=/var/lib/kubelet/plugins/com.oracle.zfssabs/csi.sock
+          imagePullPolicy:  {{ .Values.image.pullPolicy }}
+          securityContext:
+            # This is necessary only for systems with SELinux, where
+            # non-privileged sidecar containers cannot access unix domain socket
+            # created by privileged CSI driver container.
+            privileged: true
+          env:
+            - name: KUBE_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+          volumeMounts:
+            - name: socket-dir
+              mountPath: {{ .Values.paths.pluginDir.mountPath }}
+            - name: registration-dir
+              mountPath: /registration
+
+        - name: zfssabs
+          image: {{ .Values.image.zfssaBase }}{{ .Values.images.zfssaCsiDriver.name }}:{{ .Values.images.zfssaCsiDriver.tag }}
+          args:
+            - "--drivername=zfssa-csi-driver.oracle.com"
+            - "--v=5"
+            - "--endpoint=$(CSI_ENDPOINT)"
+            - "--nodeid=$(NODE_NAME)"
+          env:
+            - name: CSI_ENDPOINT
+              value: unix://plugin/csi.sock
+            - name: LOG_LEVEL
+              value: "5"
+            - name: ZFSSA_TARGET
+              value: {{ .Values.zfssaInformation.target }}
+            - name: ZFSSA_INSECURE
+              value: "False"
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: HOST_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.hostIP
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+          imagePullPolicy:  {{ .Values.image.pullPolicy }}
+          securityContext:
+            privileged: true
+          volumeMounts:
+            - name: socket-dir
+              mountPath: {{ .Values.paths.pluginDir.mountPath }}
+            - name: mountpoint-dir
+              mountPath: /var/lib/kubelet/pods
+              mountPropagation: Bidirectional
+            - name: plugins-dir
+              mountPath: /var/lib/kubelet/plugins
+              mountPropagation: Bidirectional
+            - name: dev-dir
+              mountPath: /dev
+            - name: zfssa-credentials
+              mountPath: "/mnt/zfssa"
+              readOnly: true
+            - name: certs
+              mountPath: "/mnt/certs"
+              readOnly: true
+      volumes:
+        - name: socket-dir
+          hostPath:
+            path: {{ .Values.paths.pluginDir.hostPath }}
+            type: DirectoryOrCreate
+        - name: mountpoint-dir
+          hostPath:
+            path: /var/lib/kubelet/pods
+            type: DirectoryOrCreate
+        - name: registration-dir
+          hostPath:
+            path: /var/lib/kubelet/plugins_registry
+            type: Directory
+        - name: plugins-dir
+          hostPath:
+            path: /var/lib/kubelet/plugins
+            type: Directory
+        - name: dev-dir
+          hostPath:
+            path: /dev
+            type: Directory
+        - name: zfssa-credentials
+          secret:
+            secretName: oracle.zfssa.csi.node
+            items:
+              - key: zfssa.yaml
+                path: zfssa.yaml
+        - name: certs
+          secret:
+            secretName: oracle.zfssa.csi.node.certs
+            items:
+              - key: zfssa.crt
+                path: zfssa.crt

deploy/helm/k8s-1.20/templates/04-zfssa-csi-provisioner.yaml

@@ -0,0 +1,90 @@
+---
+kind: StatefulSet
+apiVersion: apps/v1
+metadata:
+  name: zfssa-csi-provisioner
+  namespace: {{ .Values.deployment.namespace }}
+spec:
+  serviceName: "zfssa-csi-provisioner"
+  replicas: 1
+  selector:
+    matchLabels:
+      app: zfssa-csi-provisioner
+  template:
+    metadata:
+      labels:
+        app: zfssa-csi-provisioner
+    spec:
+      affinity:
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - zfssa-csi-nodeplugin
+              topologyKey: kubernetes.io/hostname
+      serviceAccountName: zfssa-csi
+      containers:
+        - name: zfssa-csi-snapshotter
+          image: {{ .Values.image.sidecarBase }}{{ .Values.images.csiSnapshotter.name }}:{{ .Values.images.csiSnapshotter.tag }}
+          args:
+            - "--v=5"
+            - "--csi-address=$(ADDRESS)"
+            - "--leader-election=false"
+          env:
+            - name: ADDRESS
+              value: /plugin/csi.sock
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /plugin
+        - name: zfssa-csi-resizer
+          image: {{ .Values.image.sidecarBase }}{{ .Values.images.csiResizer.name }}:{{ .Values.images.csiResizer.tag }}
+          args:
+            - "--v=5"
+            - "--csi-address=$(ADDRESS)"
+            - "--leader-election"
+          env:
+            - name: ADDRESS
+              value: /plugin/csi.sock
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /plugin
+        - name: zfssa-csi-provisioner
+          image: {{ .Values.image.sidecarBase }}{{ .Values.images.csiProvisioner.name }}:{{ .Values.images.csiProvisioner.tag }}
+          args:
+            - -v=5
+            - --csi-address=/plugin/csi.sock
+            - --timeout=30s
+            - --feature-gates=Topology=true
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            # This is necessary only for systems with SELinux, where
+            # non-privileged sidecar containers cannot access unix domain socket
+            # created by privileged CSI driver container.
+            privileged: true
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /plugin
+        - name: zfssa-csi-attacher
+          image: {{ .Values.image.sidecarBase }}{{ .Values.images.csiAttacher.name }}:{{ .Values.images.csiAttacher.tag }}
+          args:
+            - --v=5
+            - --csi-address=/plugin/csi.sock
+            # securityContext:
+            # This is necessary only for systems with SELinux, where
+            # non-privileged sidecar containers cannot access unix domain socket
+            # created by privileged CSI driver container.
+            # privileged: true
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          volumeMounts:
+            - name: socket-dir
+              mountPath: {{ .Values.paths.pluginDir.mountPath }}
+      volumes:
+        - name: socket-dir
+          hostPath:
+            path: {{ .Values.paths.pluginDir.hostPath }}
+            type: DirectoryOrCreate

deploy/helm/k8s-1.20/values.yaml

@@ -0,0 +1,42 @@
+# Global docker image setting
+image:
+  sidecarBase: k8s.gcr.io/sig-storage/
+  zfssaBase: iad.ocir.io/zs/store/csi/
+  pullPolicy: Always
+
+# Define all the images that will be used during helm chart deployment
+images:
+  csiNodeDriverRegistrar:
+    name: csi-node-driver-registrar
+    tag: "v2.0.0"
+  zfssaCsiDriver:
+    name: zfssa-csi-driver
+    tag: "v1.1.0"
+  csiProvisioner:
+    name: csi-provisioner
+    tag: "v2.0.5"
+  csiAttacher:
+    name: csi-attacher
+    tag: "v3.0.2"
+  csiResizer:
+    name: csi-resizer
+    tag: "v1.1.0"
+  csiSnapshotter:
+    name: csi-snapshotter
+    tag: "v3.0.3"
+
+paths:
+  pluginDir:
+    hostPath: "/var/lib/kubelet/plugins/com.oracle.zfssabs"
+    mountPath: "/plugin"
+
+deployment:
+  namespace: default
+
+# ZFSSA-specific information
+# It is desirable to provision a normal login user with required authorizations.
+zfssaInformation:
+  username: text-string
+  password: text-string
+  target: text-string
+  cert: cert-base64-encoded