feat: csi sample deploy

Dockerfile

@@ -26,7 +26,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -ldfl
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot
+FROM docker.io/debian:bookworm
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 65532:65532

Makefile

@@ -149,7 +149,7 @@ run: manifests generate fmt vet ## Run a controller from your host.
 # More info: https://docs.docker.com/develop/develop-images/build_enhancements/
 .PHONY: docker-build
 docker-build: test ## Build docker image with the manager.
-	$(CONTAINER_TOOL) build -t ${IMG} --build-arg LDFLAGS=$(LDFLAGS) .
+	$(CONTAINER_TOOL) build -t ${IMG} --build-arg LDFLAGS=$(LDFLAGS) --progress plain .
 
 .PHONY: docker-push
 docker-push: ## Push docker image with the manager.
@@ -168,7 +168,7 @@ docker-buildx: test ## Build and push docker image for the manager for cross-pla
 	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
 	- $(CONTAINER_TOOL) buildx create --name project-v3-builder
 	$(CONTAINER_TOOL) buildx use project-v3-builder
-	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --tag ${IMG} --build-arg $(LDFLAGS) -f Dockerfile.cross .
+	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --tag ${IMG} --build-arg LDFLAGS=$(LDFLAGS) -f Dockerfile.cross .
 	- $(CONTAINER_TOOL) buildx rm project-v3-builder
 	rm Dockerfile.cross
 

cmd/main.go

@@ -147,6 +147,7 @@ func runDriver(ctx context.Context, mgr ctrl.Manager) {
 
 	err := driver.Run(ctx, false)
 	if err != nil {
+		fmt.Println("Failed to run driver", "error", err.Error())
 		os.Exit(1)
 	}
 }

config/samples/csi/csi-pod.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: csi-pod
+  labels:
+    name: csi-pod
+spec:
+  containers:
+  - name: csi-pod
+    image: docker-test.zncdata.net/huagang/secret-operator@sha256:36a0d416c2d54589c006989d71f1593493b980b0385bcef6de3e2d91a49d594b
+    imagePullPolicy: Always
+    args:
+    - -endpoint=unix:///tmp/csi.sock
+    - -nodeid=$(NODE_NAME)
+    - -zap-log-level=10
+    resources:
+      limits:
+        memory: "128Mi"
+        cpu: "500m"

config/samples/csi/csidriver.yaml

@@ -0,0 +1,10 @@
+apiVersion: storage.k8s.io/v1
+kind: CSIDriver
+metadata:
+  name: secret.zncdata.dev
+spec:
+  podInfoOnMount: true
+  attachRequired: false
+  volumeLifecycleModes:
+  - Ephemeral
+  - Persistent

config/samples/csi/daemonset.yaml

@@ -0,0 +1,87 @@
+# daemonsets
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: zds-secret-operator
+spec:
+  selector:
+    matchLabels:
+      app: zds-secret-operator
+  template:
+    metadata:
+      labels:
+        app: zds-secret-operator
+    spec:
+      serviceAccountName: zds-operator
+      containers:
+      - name: secret-operator
+        image: docker.io/huagang/secret-operator:0.0.1
+        imagePullPolicy: Always
+        securityContext:
+          privileged: true
+          runAsUser: 0
+        env:
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        args:
+        - "-endpoint=unix:///csi/csi.sock"
+        - "-nodeid=$(NODE_NAME)"
+        volumeMounts:
+        - name: plugin-dir
+          mountPath: /csi
+        - name: mountpoint-dir
+          mountPath: /var/lib/kubelet/pods
+          mountPropagation: Bidirectional
+      - name: node-driver-registrar
+        image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.8.0
+        imagePullPolicy: IfNotPresent
+        args:
+        - --csi-address=/csi/csi.sock
+        - --kubelet-registration-path=/var/lib/kubelet/plugins/secret.zncdata.dev/csi.sock
+        livenessProbe:
+          exec:
+            command:
+            - /csi-node-driver-registrar
+            - --kubelet-registration-path=/var/lib/kubelet/plugins/secret.zncdata.dev/csi.sock
+            - --mode=kubelet-registration-probe
+          initialDelaySeconds: 30
+          timeoutSeconds: 15
+        volumeMounts:
+        - name: plugin-dir
+          mountPath: /csi
+        - name: registration-dir
+          mountPath: /registration
+      - name: csi-provisioner
+        image: registry.k8s.io/sig-storage/csi-provisioner:v3.5.0
+        imagePullPolicy: IfNotPresent
+        args:
+        - --csi-address=/csi/csi.sock
+        - --v=5
+        volumeMounts:
+        - name: plugin-dir
+          mountPath: /csi
+      - name: liveness-probe
+        image: registry.k8s.io/sig-storage/livenessprobe:v2.11.0
+        imagePullPolicy: IfNotPresent
+        args:
+        - --csi-address=unix:///csi/csi.sock
+        - --probe-timeout=5s
+        - --http-endpoint=0.0.0.0:9808
+        volumeMounts:
+        - name: plugin-dir
+          mountPath: /csi
+      volumes:
+      - name: mountpoint-dir
+        hostPath:
+          path: /var/lib/kubelet/pods
+          type: DirectoryOrCreate
+      - name: plugin-dir
+        hostPath:
+          path: /var/lib/kubelet/plugins/secret.zncdata.dev/
+          type: DirectoryOrCreate
+      - name: registration-dir
+        hostPath:
+          path: /var/lib/kubelet/plugins_registry/
+          type: DirectoryOrCreate

config/samples/csi/nginx-pod.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-pod
+  labels:
+    name: nginx-pod
+spec:
+  containers:
+  - name: nginx-pod
+    image: caddy:2.7.6
+    resources:
+      limits:
+        memory: "128Mi"
+        cpu: "500m"
+    ports:
+    - containerPort: 80
+    volumeMounts:
+    - name: foo
+      mountPath: /opt/foo
+  volumes:
+  - name: foo
+    ephemeral:
+      volumeClaimTemplate:
+        spec:
+          accessModes: ["ReadWriteOnce"]
+          storageClassName: "zncdata"
+          resources:
+            requests:
+              storage: 1Gi

config/samples/csi/pv.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: my-pv
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+  - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: zncdata
+  hostPath:
+    path: /tmp/my-pv

config/samples/csi/rbac.yaml

@@ -0,0 +1,80 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: zds-operator
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: zds-operator
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  - events
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - patch
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumes
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  - persistentvolumeclaims
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - storage.k8s.io
+  resources:
+  - csinodes
+  - storageclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - patch
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - privileged
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: zds-operator
+subjects:
+- kind: ServiceAccount
+  name: zds-operator
+  namespace: default
+roleRef:
+  kind: ClusterRole
+  name: zds-operator
+  apiGroup: rbac.authorization.k8s.io

config/samples/csi/storageclass.yaml

@@ -0,0 +1,8 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: zncdata
+provisioner: secret.zncdata.dev
+parameters:
+  type: gp2
+  fsType: ext4