node.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: topolvm-system
  name: node
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: topolvm-system:node
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch", "update", "patch"]
  - apiGroups: ["topolvm.cybozu.com"]
    resources: ["logicalvolumes", "logicalvolumes/status"]
    verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["csidrivers"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["policy"]
    resources: ["podsecuritypolicies"]
    verbs: ["use"]
    resourceNames: ["topolvm-node"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: topolvm-system:node
subjects:
  - kind: ServiceAccount
    name: node
    namespace: topolvm-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: topolvm-system:node

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  namespace: topolvm-system
  name: node
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: node
  template:
    metadata:
      labels:
        app.kubernetes.io/name: node
      annotations:
        prometheus.io/port: "8080"
    spec:
      serviceAccountName: node
      containers:
        - name: topolvm-node
          image: quay.io/cybozu/topolvm:0.2.2
          securityContext:
            privileged: true
          command:
            - /topolvm-node
            - --lvmd-socket=/run/lvmd/lvmd.sock
          ports:
            - containerPort: 9808
              name: healthz
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /healthz
              port: healthz
            failureThreshold: 3
            initialDelaySeconds: 10
            timeoutSeconds: 3
            periodSeconds: 60
          env:
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            - name: node-plugin-dir
              mountPath: /run/topolvm
            - name: lvmd-socket-dir
              mountPath: /run/lvmd
            - name: pod-volumes-dir
              mountPath: /var/lib/kubelet/pods
              mountPropagation: "Bidirectional"
            - name: csi-plugin-dir
              mountPath: /var/lib/kubelet/plugins/kubernetes.io/csi
              mountPropagation: "Bidirectional"

        - name: csi-registrar
          image: quay.io/cybozu/topolvm:0.2.2
          command:
            - /csi-node-driver-registrar
            - "--csi-address=/run/topolvm/csi-topolvm.sock"
            - "--kubelet-registration-path=/var/lib/kubelet/plugins/topolvm.cybozu.com/node/csi-topolvm.sock"
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "rm -rf /registration/topolvm.cybozu.com /registration/topolvm.cybozu.com-reg.sock"]
          volumeMounts:
            - name: node-plugin-dir
              mountPath: /run/topolvm
            - name: registration-dir
              mountPath: /registration

        - name: liveness-probe
          image: quay.io/cybozu/topolvm:0.2.2
          command:
            - /livenessprobe
            - "--csi-address=/run/topolvm/csi-topolvm.sock"
          volumeMounts:
            - name: node-plugin-dir
              mountPath: /run/topolvm

      volumes:
        - name: registration-dir
          hostPath:
            path: /var/lib/kubelet/plugins_registry/
            type: Directory
        - name: node-plugin-dir
          hostPath:
            path: /var/lib/kubelet/plugins/topolvm.cybozu.com/node
            type: DirectoryOrCreate
        - name: csi-plugin-dir
          hostPath:
            path: /var/lib/kubelet/plugins/kubernetes.io/csi
            type: DirectoryOrCreate
        - name: pod-volumes-dir
          hostPath:
            path: /var/lib/kubelet/pods/
            type: DirectoryOrCreate
        - name: lvmd-socket-dir
          hostPath:
            path: /run/topolvm
            type: Directory