Initial commit

charts/localpv-provisioner/templates/NOTES.txt

@@ -0,0 +1,9 @@
+The OpenEBS Dynamic LocalPV Provisioner has been installed.
+Check its status by running:
+$ kubectl get pods -n {{ .Release.Namespace }}
+
+Get started with the Dynamic LocalPV Provisioner Quickstart guide at:
+https://github.com/openebs/dynamic-localpv-provisioner/blob/develop/docs/quickstart.md
+
+For more information, visit our Slack at https://kubernetes.slack.com/messages/openebs or view 
+the OpenEBS documentation online at https://openebs.io/docs

charts/localpv-provisioner/templates/_helpers.tpl

@@ -0,0 +1,91 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "localpv.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified localpv provisioner name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "localpv.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "localpv.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+
+{{/*
+Meta labels
+*/}}
+{{- define "localpv.common.metaLabels" -}}
+chart: {{ template "localpv.chart" . }}
+heritage: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels
+*/}}
+{{- define "localpv.selectorLabels" -}}
+app: {{ template "localpv.name" . }}
+release: {{ .Release.Name }}
+component: {{ .Values.localpv.name | quote }}
+{{- end -}}
+
+{{/*
+Component labels
+*/}}
+{{- define "localpv.componentLabels" -}}
+openebs.io/component-name: openebs-{{ .Values.localpv.name }}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "localpv.labels" -}}
+{{ include "localpv.common.metaLabels" . }}
+{{ include "localpv.selectorLabels" . }}
+{{ include "localpv.componentLabels" . }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "localpv.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "localpv.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Creates the tolerations based on the global tolerations, with early eviction
+Usage:
+{{ include "tolerations_with_early_eviction" . }}
+*/}}
+{{- define "tolerations_with_early_eviction" -}}
+{{- if .Values.earlyEvictionTolerations }}
+    {{- toYaml .Values.earlyEvictionTolerations | nindent 8 }}
+{{- end }}
+{{- if .Values.localpv.tolerations }}
+    {{- toYaml .Values.localpv.tolerations | nindent 8 }}
+{{- end }}
+{{- end }}

charts/localpv-provisioner/templates/deployment.yaml

@@ -0,0 +1,133 @@
+{{- if .Values.localpv.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "localpv.fullname" . }}
+  {{- with .Values.localpv.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "localpv.labels" . | nindent 4 }}
+    {{- if .Values.extraLabels -}}
+      {{- toYaml .Values.extraLabels | nindent 4 }}
+    {{- end }}
+spec:
+  replicas: {{ .Values.localpv.replicas }}
+  strategy:
+    type: "Recreate"
+    rollingUpdate: null
+  selector:
+    matchLabels:
+      {{- include "localpv.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.localpv.podAnnotations }}
+      annotations: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "localpv.labels" . | nindent 8 }}
+        {{- if .Values.extraLabels -}}
+          {{- toYaml .Values.extraLabels | nindent 8 }}
+        {{- end }}
+        {{- with .Values.localpv.podLabels }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.loggingLabels}}
+          {{ toYaml . | nindent 8 -}}
+        {{- end}}
+    spec:
+    {{- if .Values.localpv.priorityClassName }}
+      priorityClassName: {{ tpl .Values.localpv.priorityClassName . }}
+    {{- end }}
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      serviceAccountName: {{ template "localpv.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+      - name: {{ template "localpv.fullname" . }}
+        image: "{{ with .Values.localpv.image.registry | default .Values.global.imageRegistry | trimSuffix "/" }}{{ . }}/{{ end }}{{ .Values.localpv.image.repository }}:{{ .Values.localpv.image.tag }}"
+        imagePullPolicy: {{ .Values.localpv.image.pullPolicy }}
+        resources:
+{{ toYaml .Values.localpv.resources | indent 10 }}
+        env:
+        # OPENEBS_IO_K8S_MASTER enables openebs provisioner to connect to K8s
+        # based on this address. This is ignored if empty.
+        # This is supported for openebs provisioner version 0.5.2 onwards
+        #- name: OPENEBS_IO_K8S_MASTER
+        #  value: "http://10.128.0.12:8080"
+        # OPENEBS_IO_KUBE_CONFIG enables openebs provisioner to connect to K8s
+        # based on this config. This is ignored if empty.
+        # This is supported for openebs provisioner version 0.5.2 onwards
+        #- name: OPENEBS_IO_KUBE_CONFIG
+        #  value: "/home/ubuntu/.kube/config"
+        - name: OPENEBS_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        # OPENEBS_SERVICE_ACCOUNT provides the service account of this pod as
+        # environment variable
+        - name: OPENEBS_SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        # OPENEBS_IO_BASE_PATH is the environment variable that provides the
+        # default base path on the node where host-path PVs will be provisioned.
+        - name: OPENEBS_IO_ENABLE_ANALYTICS
+          value: "{{ .Values.analytics.enabled }}"
+        {{- if .Values.analytics.gaId }}
+        - name: GA_ID
+          value: {{ .Values.analytics.gaId | quote }}
+        {{- end }}
+        {{- if .Values.analytics.gaKey }}
+        - name: GA_KEY
+          value: {{ .Values.analytics.gaKey | quote }}
+        {{- end }}
+        - name: OPENEBS_IO_BASE_PATH
+          value: "{{ .Values.localpv.basePath }}"
+        - name: OPENEBS_IO_HELPER_IMAGE
+          value: "{{ with .Values.helperPod.image.registry | default .Values.global.imageRegistry | trimSuffix "/" }}{{ . }}/{{ end }}{{ .Values.helperPod.image.repository }}:{{ .Values.helperPod.image.tag }}"
+        - name: OPENEBS_IO_HELPER_POD_HOST_NETWORK
+          value: "{{ .Values.helperPod.hostNetwork }}"
+        - name: OPENEBS_IO_INSTALLER_TYPE
+          value: "localpv-charts-helm"
+        # LEADER_ELECTION_ENABLED is used to enable/disable leader election. By default
+        # leader election is enabled.
+        - name: LEADER_ELECTION_ENABLED
+          value: "{{ .Values.localpv.enableLeaderElection }}"
+{{- if .Values.imagePullSecrets }}
+        - name: OPENEBS_IO_IMAGE_PULL_SECRETS
+          value: "{{- range $index, $secret := .Values.imagePullSecrets}}{{if $index}},{{end}}{{ $secret.name }}{{- end}}"
+{{- end }}
+        # Process name used for matching is limited to the 15 characters
+        # present in the pgrep output.
+        # So fullname can't be used here with pgrep (>15 chars).A regular expression
+        # that matches the entire command name has to specified.
+        # Anchor `^` : matches any string that starts with `provisioner-loc`
+        # `.*`: matches any string that has `provisioner-loc` followed by zero or more char
+        livenessProbe:
+          exec:
+            command:
+            - sh
+            - -c
+            - test `pgrep -c "^provisioner-loc.*"` = 1
+          initialDelaySeconds: {{ .Values.localpv.healthCheck.initialDelaySeconds }}
+          periodSeconds: {{ .Values.localpv.healthCheck.periodSeconds }}
+{{- if .Values.localpv.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.localpv.nodeSelector | indent 8 }}
+{{- end }}
+{{- if $tolerations := include "tolerations_with_early_eviction" . }}
+      tolerations: {{ $tolerations }}
+{{- end }}
+{{- if .Values.localpv.affinity }}
+      affinity:
+{{ toYaml .Values.localpv.affinity | indent 8 }}
+{{- end }}
+{{- end }}

charts/localpv-provisioner/templates/hostpath-class.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.hostpathClass.enabled }}
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: {{ tpl (.Values.hostpathClass.name) .}}
+  annotations:
+    openebs.io/cas-type: local
+    cas.openebs.io/config: |
+      - name: StorageType
+        value: "hostpath"
+{{- if or .Values.localpv.basePath .Values.hostpathClass.basePath }}
+      - name: BasePath
+        value: {{ tpl (.Values.hostpathClass.basePath | default .Values.localpv.basePath | quote) . }}
+{{- end }}
+{{- if .Values.hostpathClass.nodeAffinityLabels }}
+      - name: NodeAffinityLabels
+        list:
+{{ toYaml .Values.hostpathClass.nodeAffinityLabels | indent 10 }}
+{{- end }}
+{{- if .Values.hostpathClass.xfsQuota.enabled }}
+      - name: XFSQuota
+        enabled: "{{ .Values.hostpathClass.xfsQuota.enabled }}"
+        data:
+          softLimitGrace: "{{ .Values.hostpathClass.xfsQuota.softLimitGrace }}"
+          hardLimitGrace: "{{ .Values.hostpathClass.xfsQuota.hardLimitGrace }}"
+{{- end }}
+{{- if .Values.hostpathClass.ext4Quota.enabled }}
+      - name: EXT4Quota
+        enabled: "{{ .Values.hostpathClass.ext4Quota.enabled }}"
+        data:
+          softLimitGrace: "{{ .Values.hostpathClass.ext4Quota.softLimitGrace }}"
+          hardLimitGrace: "{{ .Values.hostpathClass.ext4Quota.hardLimitGrace }}"
+{{- end }}
+{{- if .Values.hostpathClass.isDefaultClass }}
+    storageclass.kubernetes.io/is-default-class: "true"
+{{- end }}
+{{- if .Values.extraLabels }}
+  labels: {{- toYaml .Values.extraLabels | nindent 4 -}}
+{{- end }}
+provisioner: openebs.io/local
+volumeBindingMode: WaitForFirstConsumer
+reclaimPolicy: {{ .Values.hostpathClass.reclaimPolicy }}
+{{- end }}

charts/localpv-provisioner/templates/psp.yaml

@@ -0,0 +1,33 @@
+{{- if .Values.rbac.pspEnabled }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "localpv.fullname" . }}-psp
+  {{- with .Values.localpv.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "localpv.labels" . | nindent 4 }}
+    {{- if .Values.extraLabels -}}
+      {{- toYaml .Values.extraLabels | nindent 4 }}
+    {{- end }}
+spec:
+  privileged: {{ .Values.localpv.privileged }}
+  allowPrivilegeEscalation: true
+  allowedCapabilities: ['*']
+  volumes: ['*']
+  hostNetwork: true
+  hostPorts:
+  - min: 0
+    max: 65535
+  hostIPC: true
+  hostPID: true
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'RunAsAny'
+  fsGroup:
+    rule: 'RunAsAny'
+{{- end }}

charts/localpv-provisioner/templates/rbac.yaml

@@ -0,0 +1,117 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "localpv.serviceAccountName" . }}
+  labels:
+    {{- include "localpv.labels" . | nindent 4 }}
+    {{- if .Values.extraLabels -}}
+      {{- toYaml .Values.extraLabels | nindent 4 }}
+    {{- end }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- if .Values.rbac.create }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "localpv.fullname" . }}
+  {{- with .Values.localpv.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "localpv.labels" . | nindent 4 }}
+    {{- if .Values.extraLabels -}}
+      {{- toYaml .Values.extraLabels | nindent 4 }}
+    {{- end }}
+rules:
+- apiGroups: ["*"]
+  resources: ["nodes"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["*"]
+  resources: ["namespaces", "pods", "events", "endpoints"]
+  verbs: ["*"]
+- apiGroups: ["*"]
+  resources: ["resourcequotas", "limitranges"]
+  verbs: ["list", "watch"]
+- apiGroups: ["*"]
+  resources: ["storageclasses", "persistentvolumeclaims", "persistentvolumes"]
+  verbs: ["*"]
+- apiGroups: ["apiextensions.k8s.io"]
+  resources: ["customresourcedefinitions"]
+  verbs: [ "get", "list", "create", "update", "delete", "patch"]
+- apiGroups: ["openebs.io"]
+  resources: [ "*"]
+  verbs: ["*" ]
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs: ["get", "create", "update"]
+- nonResourceURLs: ["/metrics"]
+  verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "localpv.fullname" . }}
+  {{- with .Values.localpv.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "localpv.labels" . | nindent 4 }}
+    {{- if .Values.extraLabels -}}
+      {{- toYaml .Values.extraLabels | nindent 4 }}
+    {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "localpv.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "localpv.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- if .Values.rbac.pspEnabled }}
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ template "localpv.fullname" . }}-psp
+  {{- with .Values.localpv.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "localpv.labels" . | nindent 4 }}
+    {{- if .Values.extraLabels -}}
+      {{- toYaml .Values.extraLabels | nindent 4 }}
+    {{- end }}
+rules:
+- apiGroups: ['policy']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+  - {{ template "localpv.fullname" . }}-psp
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "localpv.fullname" . }}-psp
+  {{- with .Values.localpv.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "localpv.labels" . | nindent 4 }}
+    {{- if .Values.extraLabels -}}
+      {{- toYaml .Values.extraLabels | nindent 4 }}
+    {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "localpv.fullname" . }}-psp
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "localpv.serviceAccountName" . }}
+    namespace: {{ $.Release.Namespace }}
+{{- end }}
+{{- end }}