Skip to content

Commit 81a7702

Browse files
cwraucwrau
committed
feat(cinder-csi-plugin): add splitMode
This allows the user to deploy the controller-manager split between the management cluster and the workload cluster.
1 parent ebe2fa6 commit 81a7702

File tree

10 files changed

+124
-16
lines changed

10 files changed

+124
-16
lines changed

‎charts/cinder-csi-plugin/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v1
22
appVersion: v1.34.1
33
description: Cinder CSI Chart for OpenStack
44
name: openstack-cinder-csi
5-
version: 2.34.3
5+
version: 2.35.0
66
home: https://github.com/kubernetes/cloud-provider-openstack
77
icon: https://github.com/kubernetes/kubernetes/blob/master/logo/logo.png
88
maintainers:

‎charts/cinder-csi-plugin/templates/cinder-csi-driver.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- if or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "workload") }}
12
apiVersion: storage.k8s.io/v1
23
kind: CSIDriver
34
metadata:
@@ -8,3 +9,4 @@ spec:
89
volumeLifecycleModes:
910
- Persistent
1011
- Ephemeral
12+
{{- end }}

‎charts/cinder-csi-plugin/templates/controllerplugin-deployment.yaml‎

Lines changed: 56 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- if or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "management") }}
12
kind: Deployment
23
apiVersion: apps/v1
34
metadata:
@@ -10,7 +11,7 @@ metadata:
1011
{{- toYaml . | nindent 4 }}
1112
{{- end }}
1213
spec:
13-
replicas: {{ .Values.csi.plugin.controllerPlugin.replicas }}
14+
replicas: {{ and .Values.splitMode.enabled (eq .Values.splitMode.type "management") | ternary .Values.splitMode.replicas .Values.csi.plugin.controllerPlugin.replicas }}
1415
strategy:
1516
type: {{ .Values.csi.plugin.controllerPlugin.strategy.type }}
1617
{{- if eq .Values.csi.plugin.controllerPlugin.strategy.type "RollingUpdate" }}
@@ -28,7 +29,11 @@ spec:
2829
annotations:
2930
{{- include "cinder-csi.controllerplugin.podAnnotations" . | nindent 8 }}
3031
spec:
31-
serviceAccount: csi-cinder-controller-sa
32+
{{- if .Values.splitMode.enabled }}
33+
automountServiceAccountToken: false
34+
{{- else }}
35+
serviceAccountName: csi-cinder-controller-sa
36+
{{- end }}
3237
securityContext:
3338
{{- toYaml .Values.csi.plugin.controllerPlugin.podSecurityContext | nindent 8 }}
3439
containers:
@@ -43,6 +48,9 @@ spec:
4348
- "--timeout={{ .Values.timeout }}"
4449
- "--leader-election=true"
4550
- "--default-fstype=ext4"
51+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "management") }}
52+
- "--kubeconfig=/etc/kubernetes/kubeconfig"
53+
{{- end }}
4654
{{- if .Values.csi.attacher.extraArgs }}
4755
{{- with .Values.csi.attacher.extraArgs }}
4856
{{- tpl . $ | trim | nindent 12 }}
@@ -57,6 +65,11 @@ spec:
5765
volumeMounts:
5866
- name: socket-dir
5967
mountPath: /var/lib/csi/sockets/pluginproxy/
68+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "management") }}
69+
- name: kubeconfig
70+
mountPath: /etc/kubernetes
71+
readOnly: true
72+
{{- end }}
6073
resources: {{ toYaml .Values.csi.attacher.resources | nindent 12 }}
6174
- name: csi-provisioner
6275
securityContext:
@@ -71,6 +84,9 @@ spec:
7184
- "--default-fstype=ext4"
7285
- "--feature-gates=Topology={{ .Values.csi.provisioner.topology }}"
7386
- "--extra-create-metadata"
87+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "management") }}
88+
- "--kubeconfig=/etc/kubernetes/kubeconfig"
89+
{{- end }}
7490
{{- if .Values.csi.provisioner.extraArgs }}
7591
{{- with .Values.csi.provisioner.extraArgs }}
7692
{{- tpl . $ | trim | nindent 12 }}
@@ -85,6 +101,11 @@ spec:
85101
volumeMounts:
86102
- name: socket-dir
87103
mountPath: /var/lib/csi/sockets/pluginproxy/
104+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "management") }}
105+
- name: kubeconfig
106+
mountPath: /etc/kubernetes
107+
readOnly: true
108+
{{- end }}
88109
resources: {{ toYaml .Values.csi.provisioner.resources | nindent 12 }}
89110
- name: csi-snapshotter
90111
securityContext:
@@ -96,6 +117,9 @@ spec:
96117
- "--csi-address=$(ADDRESS)"
97118
- "--timeout={{ .Values.timeout }}"
98119
- "--leader-election=true"
120+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "management") }}
121+
- "--kubeconfig=/etc/kubernetes/kubeconfig"
122+
{{- end }}
99123
{{- if .Values.csi.snapshotter.extraArgs }}
100124
{{- with .Values.csi.snapshotter.extraArgs }}
101125
{{- tpl . $ | trim | nindent 12 }}
@@ -110,6 +134,11 @@ spec:
110134
volumeMounts:
111135
- mountPath: /var/lib/csi/sockets/pluginproxy/
112136
name: socket-dir
137+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "management") }}
138+
- name: kubeconfig
139+
mountPath: /etc/kubernetes
140+
readOnly: true
141+
{{- end }}
113142
resources: {{ toYaml .Values.csi.snapshotter.resources | nindent 12 }}
114143
- name: csi-resizer
115144
securityContext:
@@ -122,6 +151,9 @@ spec:
122151
- "--timeout={{ .Values.timeout }}"
123152
- "--handle-volume-inuse-error=false"
124153
- "--leader-election=true"
154+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "management") }}
155+
- "--kubeconfig=/etc/kubernetes/kubeconfig"
156+
{{- end }}
125157
{{- if .Values.csi.resizer.extraArgs }}
126158
{{- with .Values.csi.resizer.extraArgs }}
127159
{{- tpl . $ | trim | nindent 12 }}
@@ -136,6 +168,11 @@ spec:
136168
volumeMounts:
137169
- name: socket-dir
138170
mountPath: /var/lib/csi/sockets/pluginproxy/
171+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "management") }}
172+
- name: kubeconfig
173+
mountPath: /etc/kubernetes
174+
readOnly: true
175+
{{- end }}
139176
resources: {{ toYaml .Values.csi.resizer.resources | nindent 12 }}
140177
- name: liveness-probe
141178
securityContext:
@@ -219,7 +256,12 @@ spec:
219256
volumeMounts:
220257
- name: socket-dir
221258
mountPath: /csi
222-
{{- with .Values.csi.plugin.volumeMounts }}
259+
{{- if .Values.secret.enabled }}
260+
- name: cloud-config
261+
mountPath: {{ .Values.secret.path }}
262+
readOnly: true
263+
{{- end }}
264+
{{- with .Values.splitMode.enabled | ternary .Values.splitMode.volumeMounts .Values.csi.plugin.volumeMounts }}
223265
{{- toYaml . | nindent 12 }}
224266
{{- end }}
225267
resources: {{ toYaml .Values.csi.plugin.resources | nindent 12 }}
@@ -235,11 +277,19 @@ spec:
235277
hostPath:
236278
path: /etc/config
237279
{{- end }}
238-
{{- with .Values.csi.plugin.volumes }}
280+
{{- with .Values.splitMode.enabled | ternary .Values.splitMode.volumes .Values.csi.plugin.volumes }}
239281
{{- toYaml . | nindent 8 }}
240282
{{- end }}
283+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "management") }}
284+
- name: kubeconfig
285+
secret:
286+
secretName: {{ .Values.splitMode.kubeconfig.secretName }}
287+
items:
288+
- key: {{ .Values.splitMode.kubeconfig.secretKey }}
289+
path: kubeconfig
290+
{{- end }}
241291
affinity: {{ toYaml .Values.csi.plugin.controllerPlugin.affinity | nindent 8 }}
242-
nodeSelector: {{ toYaml .Values.csi.plugin.controllerPlugin.nodeSelector | nindent 8 }}
292+
nodeSelector: {{ toYaml (and .Values.splitMode.enabled (eq .Values.splitMode.type "management") | ternary .Values.splitMode.nodeSelector .Values.csi.plugin.controllerPlugin.nodeSelector) | nindent 8 }}
243293
tolerations: {{ toYaml .Values.csi.plugin.controllerPlugin.tolerations | nindent 8 }}
244294
{{- with .Values.csi.plugin.controllerPlugin.hostAliases }}
245295
hostAliases:
@@ -252,3 +302,4 @@ spec:
252302
imagePullSecrets:
253303
{{- toYaml . | nindent 8 }}
254304
{{- end }}
305+
{{- end }}

‎charts/cinder-csi-plugin/templates/controllerplugin-podmonitor.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if .Values.csi.plugin.podMonitor.enabled }}
1+
{{- if and (or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "management")) .Values.csi.plugin.podMonitor.enabled }}
22
apiVersion: monitoring.coreos.com/v1
33
kind: PodMonitor
44
metadata:

‎charts/cinder-csi-plugin/templates/controllerplugin-rbac.yaml‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
1+
{{- if or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "workload") }}
12
# This YAML file contains RBAC API objects,
23
# which are necessary to run csi controller plugin
34

5+
{{- if not .Values.splitMode.enabled }}
46
apiVersion: v1
57
kind: ServiceAccount
68
metadata:
79
name: csi-cinder-controller-sa
810
namespace: {{ .Release.Namespace }}
911
---
12+
{{- end }}
1013
kind: ClusterRole
1114
apiVersion: rbac.authorization.k8s.io/v1
1215
metadata:
@@ -33,9 +36,15 @@ apiVersion: rbac.authorization.k8s.io/v1
3336
metadata:
3437
name: csi-attacher-binding
3538
subjects:
39+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "workload") }}
40+
- kind: User
41+
name: {{ .Values.splitMode.subject.name }}
42+
apiGroup: rbac.authorization.k8s.io
43+
{{- else }}
3644
- kind: ServiceAccount
3745
name: csi-cinder-controller-sa
3846
namespace: {{ .Release.Namespace }}
47+
{{- end }}
3948
roleRef:
4049
kind: ClusterRole
4150
name: csi-attacher-role
@@ -80,9 +89,15 @@ apiVersion: rbac.authorization.k8s.io/v1
8089
metadata:
8190
name: csi-provisioner-binding
8291
subjects:
92+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "workload") }}
93+
- kind: User
94+
name: {{ .Values.splitMode.subject.name }}
95+
apiGroup: rbac.authorization.k8s.io
96+
{{- else }}
8397
- kind: ServiceAccount
8498
name: csi-cinder-controller-sa
8599
namespace: {{ .Release.Namespace }}
100+
{{- end }}
86101
roleRef:
87102
kind: ClusterRole
88103
name: csi-provisioner-role
@@ -118,9 +133,15 @@ apiVersion: rbac.authorization.k8s.io/v1
118133
metadata:
119134
name: csi-snapshotter-binding
120135
subjects:
136+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "workload") }}
137+
- kind: User
138+
name: {{ .Values.splitMode.subject.name }}
139+
apiGroup: rbac.authorization.k8s.io
140+
{{- else }}
121141
- kind: ServiceAccount
122142
name: csi-cinder-controller-sa
123143
namespace: {{ .Release.Namespace }}
144+
{{- end }}
124145
roleRef:
125146
kind: ClusterRole
126147
name: csi-snapshotter-role
@@ -158,11 +179,17 @@ apiVersion: rbac.authorization.k8s.io/v1
158179
metadata:
159180
name: csi-resizer-binding
160181
subjects:
182+
{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "workload") }}
183+
- kind: User
184+
name: {{ .Values.splitMode.subject.name }}
185+
apiGroup: rbac.authorization.k8s.io
186+
{{- else }}
161187
- kind: ServiceAccount
162188
name: csi-cinder-controller-sa
163189
namespace: {{ .Release.Namespace }}
190+
{{- end }}
164191
roleRef:
165192
kind: ClusterRole
166193
name: csi-resizer-role
167194
apiGroup: rbac.authorization.k8s.io
168-
---
195+
{{- end }}

‎charts/cinder-csi-plugin/templates/custom_storageclass.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
{{- if .Values.storageClass.custom -}}
1+
{{- if and .Values.storageClass.custom (or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "workload")) -}}
22
{{ .Values.storageClass.custom }}
33
{{- end }}

‎charts/cinder-csi-plugin/templates/nodeplugin-daemonset.yaml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- if or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "workload") }}
12
kind: DaemonSet
23
apiVersion: apps/v1
34
metadata:
@@ -20,7 +21,7 @@ spec:
2021
annotations:
2122
{{- include "cinder-csi.nodeplugin.podAnnotations" . | nindent 8 }}
2223
spec:
23-
serviceAccount: csi-cinder-node-sa
24+
serviceAccountName: csi-cinder-node-sa
2425
hostNetwork: true
2526
dnsPolicy: {{ .Values.csi.plugin.nodePlugin.dnsPolicy }}
2627
securityContext:
@@ -133,7 +134,12 @@ spec:
133134
- name: pods-probe-dir
134135
mountPath: /dev
135136
mountPropagation: "HostToContainer"
136-
{{- with .Values.csi.plugin.volumeMounts }}
137+
{{- if .Values.secret.enabled }}
138+
- name: cloud-config
139+
mountPath: {{ .Values.secret.path }}
140+
readOnly: true
141+
{{- end }}
142+
{{- with .Values.splitMode.enabled | ternary .Values.splitMode.volumeMounts .Values.csi.plugin.volumeMounts }}
137143
{{- toYaml . | nindent 12 }}
138144
{{- end }}
139145
resources: {{ toYaml .Values.csi.plugin.resources | nindent 12 }}
@@ -167,7 +173,7 @@ spec:
167173
hostPath:
168174
path: /etc/config
169175
{{- end }}
170-
{{- with .Values.csi.plugin.volumes }}
176+
{{- with .Values.splitMode.enabled | ternary .Values.splitMode.volumes .Values.csi.plugin.volumes }}
171177
{{- toYaml . | nindent 8 }}
172178
{{- end }}
173179
affinity: {{ toYaml .Values.csi.plugin.nodePlugin.affinity | nindent 8 }}
@@ -184,3 +190,4 @@ spec:
184190
imagePullSecrets:
185191
{{- toYaml . | nindent 8 }}
186192
{{- end }}
193+
{{- end }}

‎charts/cinder-csi-plugin/templates/nodeplugin-rbac.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- if or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "workload") }}
12
apiVersion: v1
23
kind: ServiceAccount
34
metadata:
@@ -26,3 +27,4 @@ roleRef:
2627
kind: ClusterRole
2728
name: csi-nodeplugin-role
2829
apiGroup: rbac.authorization.k8s.io
30+
{{- end }}

‎charts/cinder-csi-plugin/templates/storageclass.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if .Values.storageClass.enabled }}
1+
{{- if and .Values.storageClass.enabled (or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "workload")) }}
22
apiVersion: storage.k8s.io/v1
33
kind: StorageClass
44
metadata:

‎charts/cinder-csi-plugin/values.yaml‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -85,9 +85,6 @@ csi:
8585
- name: cacert
8686
mountPath: /etc/cacert
8787
readOnly: true
88-
- name: cloud-config
89-
mountPath: /etc/config
90-
readOnly: true
9188
nodePlugin:
9289
dnsPolicy: ClusterFirstWithHostNet
9390
# Optional additional annotations to add to the nodePlugin Pods.
@@ -180,6 +177,7 @@ secret:
180177
hostMount: true
181178
create: false
182179
filename: cloud.conf
180+
path: /etc/config
183181
# name: cinder-csi-cloud-config
184182
# data:
185183
# cloud.conf: |-
@@ -233,3 +231,24 @@ imagePullSecrets: []
233231

234232
# add annotations to all pods, deployment, daemonset and podmonitor
235233
commonAnnotations: {}
234+
235+
# External mode for split-cluster deployments (e.g., Cluster API)
236+
# When disabled, deploys both controller and node plugin with standard RBAC
237+
splitMode:
238+
enabled: false
239+
# type: "management" - Deploy controller with external kubeconfig (management cluster)
240+
# type: "workload" - Deploy node plugin with RBAC for external controller (workload cluster)
241+
type: ""
242+
# Management cluster settings (type: management)
243+
kubeconfig:
244+
secretName: ""
245+
secretKey: value
246+
replicas: 1
247+
nodeSelector: {}
248+
# Workload cluster settings (type: workload)
249+
# The User subject name for controller RBAC (identity of external controller)
250+
subject:
251+
name: cinder-csi-controller
252+
# Volumes and volumeMounts for splitMode (overrides csi.plugin.volumes/volumeMounts)
253+
volumes: []
254+
volumeMounts: []

0 commit comments

Comments
 (0)