Initial commit

charts/lvm-localpv/templates/NOTES.txt

@@ -0,0 +1,5 @@
+The OpenEBS LVM LocalPV has been installed. Check its status by running:
+$ kubectl get pods -n {{ .Release.Namespace }} -l role=openebs-lvm
+
+For more information, visit our Slack at https://openebs.io/community or view 
+the documentation online at http://docs.openebs.io/.

charts/lvm-localpv/templates/_helpers.tpl

@@ -0,0 +1,145 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "lvmlocalpv.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified localpv provisioner name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "lvmlocalpv.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "lvmlocalpv.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+
+{{/*
+Create the name of the service account for controller
+*/}}
+{{- define "lvmlocalpv.lvmController.serviceAccountName" -}}
+{{- if .Values.serviceAccount.lvmController.create }}
+{{- default (include "lvmlocalpv.fullname" .) .Values.serviceAccount.lvmController.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.lvmController.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "lvmlocalpv.lvmNode.serviceAccountName" -}}
+{{- if .Values.serviceAccount.lvmNode.create }}
+{{- default (include "lvmlocalpv.fullname" .) .Values.serviceAccount.lvmNode.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.lvmNode.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Define meta labels for openebs lvm-localpv components
+*/}}
+{{- define "lvmlocalpv.common.metaLabels" -}}
+chart: {{ template "lvmlocalpv.chart" . }}
+heritage: {{ .Release.Service }}
+openebs.io/version: {{ .Chart.AppVersion | quote }}
+role: {{ .Values.role | quote }}
+{{- end -}}
+
+{{/*
+Create match labels for openebs lvm-localpv controller
+*/}}
+{{- define "lvmlocalpv.lvmController.matchLabels" -}}
+app: {{ .Values.lvmController.componentName | quote }}
+release: {{ .Release.Name }}
+component: {{ .Values.lvmController.componentName | quote }}
+{{- end -}}
+
+{{/*
+Create component labels for lvmlocalpv controller
+*/}}
+{{- define "lvmlocalpv.lvmController.componentLabels" -}}
+openebs.io/component-name: {{ .Values.lvmController.componentName | quote }}
+{{- end -}}
+
+
+{{/*
+Create labels for openebs lvm-localpv controller
+*/}}
+{{- define "lvmlocalpv.lvmController.labels" -}}
+{{ include "lvmlocalpv.common.metaLabels" . }}
+{{ include "lvmlocalpv.lvmController.matchLabels" . }}
+{{ include "lvmlocalpv.lvmController.componentLabels" . }}
+{{- end -}}
+
+{{/*
+Create match labels for openebs lvm-localpv node daemon
+*/}}
+{{- define "lvmlocalpv.lvmNode.matchLabels" -}}
+name: {{ .Values.lvmNode.componentName | quote }}
+release: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Create component labels openebs lvm-localpv node daemon
+*/}}
+{{- define "lvmlocalpv.lvmNode.componentLabels" -}}
+openebs.io/component-name: {{ .Values.lvmNode.componentName | quote }}
+{{- end -}}
+
+
+{{/*
+Create labels for openebs lvm-localpv node daemon
+*/}}
+{{- define "lvmlocalpv.lvmNode.labels" -}}
+{{ include "lvmlocalpv.common.metaLabels" . }}
+{{ include "lvmlocalpv.lvmNode.matchLabels" . }}
+{{ include "lvmlocalpv.lvmNode.componentLabels" . }}
+{{- end -}}
+
+{{/*
+Create the name of the priority class for csi node plugin
+*/}}
+{{- define "lvmlocalpv.lvmNode.priorityClassName" -}}
+{{- if .Values.lvmNode.priorityClass.create }}
+{{- printf "%s-%s" .Release.Name .Values.lvmNode.priorityClass.name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s" .Values.lvmNode.priorityClass.name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the priority class for csi controller plugin
+*/}}
+{{- define "lvmlocalpv.lvmController.priorityClassName" -}}
+{{- if .Values.lvmController.priorityClass.create }}
+{{- printf "%s-%s" .Release.Name .Values.lvmController.priorityClass.name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s" .Values.lvmController.priorityClass.name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Ensure that the path to kubelet ends with a slash
+*/}}
+{{- define "lvmlocalpv.lvmNode.kubeletDir" -}}
+{{- printf "%s/" (.Values.lvmNode.kubeletDir | trimSuffix "/") -}}
+{{- end }}

charts/lvm-localpv/templates/csidriver.yaml

@@ -0,0 +1,10 @@
+# Create the CSI Driver object
+apiVersion: storage.k8s.io/v1
+kind: CSIDriver
+metadata:
+  name: local.csi.openebs.io
+spec:
+  # do not require volumeattachment
+  attachRequired: false
+  podInfoOnMount: true
+  storageCapacity: {{ .Values.storageCapacity }}

charts/lvm-localpv/templates/lvm-controller.yaml

@@ -0,0 +1,163 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "lvmlocalpv.fullname" . }}-controller
+  {{- with .Values.lvmController.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "lvmlocalpv.lvmController.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "lvmlocalpv.lvmController.matchLabels" . | nindent 6 }}
+  replicas: {{ .Values.lvmController.replicas }}
+  template:
+    metadata:
+      {{- with .Values.lvmController.podAnnotations }}
+      annotations: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "lvmlocalpv.lvmController.labels" . | nindent 8 }}
+        {{- with .Values.lvmController.podLabels}}
+        {{ toYaml . | nindent 8 }}
+        {{- end}}
+        {{- with .Values.loggingLabels}}
+        {{ toYaml . | nindent 8 }}
+        {{- end}}
+    spec:
+{{- if .Values.lvmController.priorityClass.create }}
+      priorityClassName: {{ template "lvmlocalpv.lvmController.priorityClassName" . }}
+{{- end }}
+      serviceAccountName: {{ .Values.serviceAccount.lvmController.name }}
+      containers:
+        - name: {{ .Values.lvmController.resizer.name }}
+          image: "{{ .Values.lvmController.resizer.image.registry }}{{ .Values.lvmController.resizer.image.repository }}:{{ .Values.lvmController.resizer.image.tag }}"
+          args:
+            - "--v={{ .Values.lvmController.logLevel }}"
+            - "--csi-address=$(ADDRESS)"
+            {{- if gt (int .Values.lvmController.replicas) 1 }}
+            - "--leader-election"
+            {{- end }}
+          env:
+            - name: ADDRESS
+              value: /var/lib/csi/sockets/pluginproxy/csi.sock
+          imagePullPolicy: {{ .Values.lvmController.resizer.image.pullPolicy }}
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+          resources:
+            {{- toYaml .Values.lvmController.resources | nindent 12 }}
+        - name: {{ .Values.lvmController.snapshotter.name }}
+          image: "{{ .Values.lvmController.snapshotter.image.registry }}{{ .Values.lvmController.snapshotter.image.repository }}:{{ .Values.lvmController.snapshotter.image.tag }}"
+          imagePullPolicy: {{ .Values.lvmController.snapshotter.image.pullPolicy }}
+          args:
+            - "--csi-address=$(ADDRESS)"
+            {{- if gt (int .Values.lvmController.replicas) 1 }}
+            - "--leader-election"
+            {{- end }}
+          env:
+            - name: ADDRESS
+              value: /var/lib/csi/sockets/pluginproxy/csi.sock
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+          resources:
+            {{- toYaml .Values.lvmController.resources | nindent 12 }}
+        - name: {{ .Values.lvmController.snapshotController.name }}
+          image: "{{ .Values.lvmController.snapshotController.image.registry }}{{ .Values.lvmController.snapshotController.image.repository }}:{{ .Values.lvmController.snapshotController.image.tag }}"
+          args:
+            - "--v={{ .Values.lvmController.logLevel }}"
+            {{- if gt (int .Values.lvmController.replicas) 1 }}
+            - "--leader-election=true"
+            {{- end }}
+          imagePullPolicy: {{ .Values.lvmController.snapshotController.image.pullPolicy }}
+          resources:
+            {{- toYaml .Values.lvmController.resources | nindent 12 }}
+        - name: {{ .Values.lvmController.provisioner.name }}
+          image: "{{ .Values.lvmController.provisioner.image.registry }}{{ .Values.lvmController.provisioner.image.repository }}:{{ .Values.lvmController.provisioner.image.tag }}"
+          imagePullPolicy: {{ .Values.lvmController.provisioner.image.pullPolicy }}
+          args:
+            - "--csi-address=$(ADDRESS)"
+            - "--v={{ .Values.lvmController.logLevel }}"
+            - "--feature-gates=Topology=true"
+            - "--strict-topology"
+            {{- if gt (int .Values.lvmController.replicas) 1 }}
+            - "--leader-election"
+            {{- end }}
+            - "--enable-capacity={{ .Values.storageCapacity }}"
+            - "--extra-create-metadata=true"
+            - "--default-fstype=ext4"
+          env:
+            - name: ADDRESS
+              value: /var/lib/csi/sockets/pluginproxy/csi.sock
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+          resources:
+            {{- toYaml .Values.lvmController.resources | nindent 12 }}
+        - name: {{ .Values.lvmPlugin.name }}
+          image: "{{ .Values.lvmPlugin.image.registry }}{{ .Values.lvmPlugin.image.repository }}:{{ .Values.lvmPlugin.image.tag }}"
+          imagePullPolicy: {{ .Values.lvmPlugin.image.pullPolicy }}
+          env:
+            - name: OPENEBS_CONTROLLER_DRIVER
+              value: controller
+            - name: OPENEBS_CSI_ENDPOINT
+              value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock
+            - name: OPENEBS_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: OPENEBS_IO_INSTALLER_TYPE
+              value: "lvm-localpv-helm"
+            - name: OPENEBS_IO_ENABLE_ANALYTICS
+              value: "{{ .Values.analytics.enabled }}"
+            {{- if .Values.analytics.gaId }}
+            - name: GA_ID
+              value: {{ .Values.analytics.gaId | quote }}
+            {{- end }}
+            {{- if .Values.analytics.gaKey }}
+            - name: GA_KEY
+              value: {{ .Values.analytics.gaKey | quote }}
+            {{- end }}
+          args :
+            - "--endpoint=$(OPENEBS_CSI_ENDPOINT)"
+            - "--plugin=$(OPENEBS_CONTROLLER_DRIVER)"
+            - "--kube-api-qps={{ .Values.lvmController.kubeClientRateLimiter.qps }}"
+            - "--kube-api-burst={{ .Values.lvmController.kubeClientRateLimiter.burst }}"
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+          resources:
+            {{- toYaml .Values.lvmController.resources | nindent 12 }}
+      volumes:
+        - name: socket-dir
+          emptyDir: {}
+{{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.imagePullSecrets | indent 8 }}
+{{- end }}
+{{- if .Values.lvmController.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.lvmController.nodeSelector | indent 8 }}
+{{- end }}
+{{- if .Values.lvmController.securityContext }}
+      securityContext:
+{{ toYaml .Values.lvmController.securityContext | indent 8 }}
+{{- end }}
+{{- if .Values.lvmController.tolerations }}
+      tolerations:
+{{ toYaml .Values.lvmController.tolerations | indent 8 }}
+{{- end }}
+{{- if .Values.lvmController.topologySpreadConstraints }}
+      topologySpreadConstraints:
+{{ toYaml .Values.lvmController.topologySpreadConstraints | indent 8 }}
+{{- end }}

charts/lvm-localpv/templates/lvm-node-service.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.lvmPlugin.metricsPort }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "lvmlocalpv.fullname" . }}-node-service
+  labels:
+    {{- include "lvmlocalpv.lvmNode.labels" . | nindent 4 }}
+spec:
+  clusterIP: None
+  ports:
+    - name: metrics
+      port: {{ .Values.lvmPlugin.metricsPort }}
+      targetPort: {{ .Values.lvmPlugin.metricsPort }}
+  selector:
+    {{- with .Values.lvmNode.podLabels }}
+    {{ toYaml . | nindent 4 }}
+    {{- end }}
+{{- end }}

charts/lvm-localpv/templates/lvm-node-servicemonitor.yaml

@@ -0,0 +1,23 @@
+{{- if and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) .Values.lvmNode.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ template "lvmlocalpv.fullname" . }}-node-servicemonitor
+  namespace: {{- .Release.Namespace }}
+  labels:
+    #release: prometheus  # Adjust to match your Prometheus Operator's release name
+    {{- .Values.lvmNode.serviceMonitor.labels | toYaml | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+    {{- include "lvmlocalpv.lvmNode.labels" . | nindent 6 }}
+  namespaceSelector:
+    matchNames:
+      - {{- .Release.Namespace }}
+  endpoints:
+    - port: metrics
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+{{- end }}
+

charts/lvm-localpv/templates/lvm-node.yaml

@@ -0,0 +1,161 @@
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  name: {{ template "lvmlocalpv.fullname" . }}-node
+  {{- with .Values.lvmNode.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "lvmlocalpv.lvmNode.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "lvmlocalpv.lvmNode.matchLabels" . | nindent 6 }}
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 100%
+    type: RollingUpdate
+  template:
+    metadata:
+      {{- with .Values.lvmNode.podAnnotations }}
+      annotations: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "lvmlocalpv.lvmNode.labels" . | nindent 8 }}
+        {{- with .Values.lvmNode.podLabels}}
+        {{ toYaml . | nindent 8 }}
+        {{- end}}
+        {{- with .Values.loggingLabels}}
+        {{ toYaml . | nindent 8 }}
+        {{- end}}
+    spec:
+{{- if .Values.lvmNode.priorityClass.create }}
+      priorityClassName: {{ template "lvmlocalpv.lvmNode.priorityClassName" . }}
+{{- end }}
+      serviceAccountName: {{ .Values.serviceAccount.lvmNode.name }}
+      hostNetwork: {{ .Values.lvmNode.hostNetwork }}
+      containers:
+        - name: {{ .Values.lvmNode.driverRegistrar.name }}
+          image: "{{ .Values.lvmNode.driverRegistrar.image.registry }}{{ .Values.lvmNode.driverRegistrar.image.repository }}:{{ .Values.lvmNode.driverRegistrar.image.tag }}"
+          imagePullPolicy: {{ .Values.lvmNode.driverRegistrar.image.pullPolicy }}
+          args:
+            - "--v={{ .Values.lvmNode.logLevel }}"
+            - "--csi-address=$(ADDRESS)"
+            - "--kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)"
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "rm -rf /registration/lvm-localpv /registration/lvm-localpv-reg.sock"]
+          env:
+            - name: ADDRESS
+              value: /plugin/csi.sock
+            - name: DRIVER_REG_SOCK_PATH
+              value: {{ printf "%s%s" (include "lvmlocalpv.lvmNode.kubeletDir" .) "plugins/lvm-localpv/csi.sock" | quote }}
+            - name: KUBE_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: NODE_DRIVER
+              value: openebs-lvm
+          volumeMounts:
+            - name: plugin-dir
+              mountPath: /plugin
+            - name: registration-dir
+              mountPath: /registration
+          resources:
+            {{- toYaml .Values.lvmNode.resources | nindent 12 }}
+        - name: {{ .Values.lvmPlugin.name }}
+          securityContext:
+            privileged: true
+            allowPrivilegeEscalation: true
+          image: "{{ .Values.lvmPlugin.image.registry }}{{ .Values.lvmPlugin.image.repository }}:{{ .Values.lvmPlugin.image.tag }}"
+          imagePullPolicy: {{ .Values.lvmPlugin.image.pullPolicy }}
+          args:
+            - "--nodeid=$(OPENEBS_NODE_ID)"
+            - "--endpoint=$(OPENEBS_CSI_ENDPOINT)"
+            - "--plugin=$(OPENEBS_NODE_DRIVER)"
+            - "--kube-api-qps={{ .Values.lvmNode.kubeClientRateLimiter.qps }}"
+            - "--kube-api-burst={{ .Values.lvmNode.kubeClientRateLimiter.burst }}"
+            {{- if .Values.lvmPlugin.ioLimits.enabled }}
+            - "--setiolimits"
+            - "--container-runtime=$(CONTAINER_RUNTIME)"
+            - "--riops-per-gb=$(RIOPS_PER_GB)"
+            - "--wiops-per-gb=$(WIOPS_PER_GB)"
+            {{- end }}
+            {{- if .Values.lvmPlugin.metricsPort }}
+            - "--listen-address=$(METRICS_LISTEN_ADDRESS)"
+            {{- end }}
+          env:
+            - name: OPENEBS_NODE_ID
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: OPENEBS_CSI_ENDPOINT
+              value: unix:///plugin/csi.sock
+            - name: OPENEBS_NODE_DRIVER
+              value: agent
+            - name: OPENEBS_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            {{- if .Values.lvmPlugin.ioLimits.enabled }}
+            - name: CONTAINER_RUNTIME
+              value: {{ .Values.lvmPlugin.ioLimits.containerRuntime }}
+            - name: RIOPS_PER_GB
+              value: {{ .Values.lvmPlugin.ioLimits.readIopsPerGB }}
+            - name: WIOPS_PER_GB
+              value: {{ .Values.lvmPlugin.ioLimits.writeIopsPerGB }}
+            {{- end }}
+            {{- if .Values.lvmPlugin.metricsPort }}
+            - name: METRICS_LISTEN_ADDRESS
+              value: :{{ .Values.lvmPlugin.metricsPort }}
+            {{- end }}
+            {{- if .Values.lvmPlugin.allowedTopologies }}
+            - name: ALLOWED_TOPOLOGIES
+              value: {{ .Values.lvmPlugin.allowedTopologies }}
+            {{- end }}
+          volumeMounts:
+            - name: plugin-dir
+              mountPath: /plugin
+            - name: device-dir
+              mountPath: /dev
+            - name: pods-mount-dir
+              mountPath: {{ include "lvmlocalpv.lvmNode.kubeletDir" . | quote }}
+              # needed so that any mounts setup inside this container are
+              # propagated back to the host machine.
+              mountPropagation: "Bidirectional"
+          resources:
+            {{- toYaml .Values.lvmNode.resources | nindent 12 }}
+      volumes:
+        - name: device-dir
+          hostPath:
+            path: /dev
+            type: Directory
+        - name: registration-dir
+          hostPath:
+            path: {{ printf "%s%s" (include "lvmlocalpv.lvmNode.kubeletDir" .) "plugins_registry/" | quote }}
+            type: DirectoryOrCreate
+        - name: plugin-dir
+          hostPath:
+            path: {{ printf "%s%s" (include "lvmlocalpv.lvmNode.kubeletDir" .) "plugins/lvm-localpv/" | quote }}
+            type: DirectoryOrCreate
+        - name: pods-mount-dir
+          hostPath:
+            path: {{ include "lvmlocalpv.lvmNode.kubeletDir" . | quote }}
+            type: Directory
+{{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+{{ toYaml .Values.imagePullSecrets | indent 8 }}
+{{- end }}
+{{- if .Values.lvmNode.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.lvmNode.nodeSelector | indent 8 }}
+{{- end }}
+{{- if .Values.lvmNode.securityContext }}
+      securityContext:
+{{ toYaml .Values.lvmNode.securityContext | indent 8 }}
+{{- end }}
+{{- if .Values.lvmNode.tolerations }}
+      tolerations:
+{{ toYaml .Values.lvmNode.tolerations | indent 8 }}
+{{- end }}

charts/lvm-localpv/templates/priority-class.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.lvmController.priorityClass.create }}
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: {{ template "lvmlocalpv.lvmController.priorityClassName" . }}
+value: 900000000
+globalDefault: false
+description: "This priority class should be used for the CStor CSI driver controller deployment only."
+{{- end }}
+---
+{{- if .Values.lvmNode.priorityClass.create }}
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: {{ template "lvmlocalpv.lvmNode.priorityClassName" . }}
+value: 900001000
+globalDefault: false
+description: "This priority class should be used for the CStor CSI driver node deployment only."
+{{- end }}

charts/lvm-localpv/templates/psp.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.rbac.pspEnabled }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: openebs-lvm-node-psp
+  labels:
+    {{- include "lvmlocalpv.lvmNode.labels" . | nindent 4 }}
+spec:
+  privileged: true
+  allowPrivilegeEscalation: true
+  allowedCapabilities: ['*']
+  volumes: ['*']
+  hostNetwork: {{ .Values.lvmNode.hostNetwork}}
+  hostIPC: true
+  hostPID: true
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'RunAsAny'
+  fsGroup:
+    rule: 'RunAsAny'
+{{- end }}

charts/lvm-localpv/templates/rbac.yaml

@@ -0,0 +1,195 @@
+{{- if .Values.serviceAccount.lvmController.create -}}
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  name: {{ .Values.serviceAccount.lvmController.name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lvmlocalpv.lvmController.labels" . | nindent 4 }}
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: openebs-lvm-provisioner-role
+  labels:
+    {{- include "lvmlocalpv.lvmController.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumes", "services"]
+    verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims/status"]
+    verbs: ["update", "patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses", "csinodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [ "storage.k8s.io" ]
+    resources: [ "csistoragecapacities"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["list", "watch", "create", "update", "patch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "watch", "list", "delete", "update", "create"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["local.openebs.io"]
+    resources: ["lvmvolumes", "lvmsnapshots", "lvmnodes"]
+    verbs: ["*"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: openebs-lvm-provisioner-binding
+  labels:
+    {{- include "lvmlocalpv.lvmController.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount.lvmController.name }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: openebs-lvm-provisioner-role
+  apiGroup: rbac.authorization.k8s.io
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: openebs-lvm-snapshotter-role
+  labels:
+    {{- include "lvmlocalpv.lvmController.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["list", "watch", "create", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotcontents"]
+    verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshots"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotcontents/status"]
+    verbs: ["update"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshots/status"]
+    verbs: ["update"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["create", "list", "watch", "delete"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: openebs-lvm-snapshotter-binding
+  labels:
+    {{- include "lvmlocalpv.lvmController.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount.lvmController.name }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: openebs-lvm-snapshotter-role
+  apiGroup: rbac.authorization.k8s.io
+---
+{{- end }}
+
+{{- if .Values.serviceAccount.lvmNode.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.lvmNode.name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lvmlocalpv.lvmNode.labels" . | nindent 4 }}
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: openebs-lvm-driver-registrar-role
+  labels:
+    {{- include "lvmlocalpv.lvmNode.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumes", "nodes", "services"]
+    verbs: ["get", "list"]
+  - apiGroups: ["local.openebs.io"]
+    resources: ["lvmvolumes", "lvmsnapshots", "lvmnodes"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: openebs-lvm-driver-registrar-binding
+  labels:
+    {{- include "lvmlocalpv.lvmNode.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount.lvmNode.name }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: openebs-lvm-driver-registrar-role
+  apiGroup: rbac.authorization.k8s.io
+
+{{- if .Values.rbac.pspEnabled }}
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: openebs-lvm-node-role
+  labels:
+    {{- include "lvmlocalpv.lvmNode.labels" . | nindent 4 }}
+rules:
+- apiGroups: ['policy']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+  - openebs-lvm-node-psp
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: openebs-lvm-node-binding
+  labels:
+    {{- include "lvmlocalpv.lvmNode.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: openebs-lvm-node-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount.lvmNode.name }}
+    namespace: {{ $.Release.Namespace }}
+{{- end }}
+{{- end }}