Deploy Ceph CSI driver from upstream templates

ceph-csi-rbd/Makefile

@@ -0,0 +1,37 @@
+.DEFAULT_GOAL := get-upstream
+
+VERSION=v3.13.0
+
+.PHONY: get-upstream
+get-upstream:
+	mkdir -p cluster
+	mkdir -p namespaced
+	# csi-nodeplugin-rbac.yaml
+	curl -Ls https://raw.githubusercontent.com/ceph/ceph-csi/refs/tags/$(VERSION)/deploy/rbd/kubernetes/csi-nodeplugin-rbac.yaml > /tmp/csi-nodeplugin-rbac.yaml
+	sd "namespace: default" "namespace: sys-ceph" /tmp/csi-nodeplugin-rbac.yaml
+	yq 'select(.kind=="ClusterRole")' /tmp/csi-nodeplugin-rbac.yaml > cluster/csi-nodeplugin-rbac.yaml
+	echo "---" >> cluster/csi-nodeplugin-rbac.yaml
+	yq 'select(.kind=="ClusterRoleBinding")' /tmp/csi-nodeplugin-rbac.yaml >> cluster/csi-nodeplugin-rbac.yaml
+	yq 'select(.kind=="ServiceAccount")' /tmp/csi-nodeplugin-rbac.yaml > namespaced/csi-nodeplugin-rbac.yaml
+	rm /tmp/csi-nodeplugin-rbac.yaml
+	# csi-provisioner-rbac.yaml
+	curl -Ls https://raw.githubusercontent.com/ceph/ceph-csi/refs/tags/$(VERSION)/deploy/rbd/kubernetes/csi-provisioner-rbac.yaml > /tmp/csi-provisioner-rbac.yaml
+	sd "namespace: default" "namespace: sys-ceph" /tmp/csi-provisioner-rbac.yaml
+	yq 'select(.kind=="ClusterRole")' /tmp/csi-provisioner-rbac.yaml > cluster/csi-provisioner-rbac.yaml
+	echo "---" >> cluster/csi-provisioner-rbac.yaml
+	yq 'select(.kind=="ClusterRoleBinding")' /tmp/csi-provisioner-rbac.yaml >> cluster/csi-provisioner-rbac.yaml
+	echo "---" >> cluster/csi-provisioner-rbac.yaml
+	yq 'select(.kind=="ServiceAccount")' /tmp/csi-provisioner-rbac.yaml > namespaced/csi-provisioner-rbac.yaml
+	echo "---" >> namespaced/csi-provisioner-rbac.yaml
+	yq 'select(.kind=="Role")' /tmp/csi-provisioner-rbac.yaml >> namespaced/csi-provisioner-rbac.yaml
+	echo "---" >> namespaced/csi-provisioner-rbac.yaml
+	yq 'select(.kind=="RoleBinding")' /tmp/csi-provisioner-rbac.yaml >> namespaced/csi-provisioner-rbac.yaml
+	rm /tmp/csi-provisioner-rbac.yaml
+	# csi-rbdplugin-provisioner.yaml
+	curl -Ls https://raw.githubusercontent.com/ceph/ceph-csi/refs/tags/$(VERSION)/deploy/rbd/kubernetes/csi-rbdplugin-provisioner.yaml > namespaced/csi-rbdplugin-provisioner.yaml
+	sd "namespace: default" "namespace: sys-ceph" namespaced/csi-rbdplugin-provisioner.yaml
+	# csi-rbdplugin.yaml
+	curl -Ls https://raw.githubusercontent.com/ceph/ceph-csi/refs/tags/v3.13.0/deploy/rbd/kubernetes/csi-rbdplugin.yaml > namespaced/csi-rbdplugin.yaml
+	sd "namespace: default" "namespace: sys-ceph" namespaced/csi-rbdplugin.yaml
+	# csidriver.yaml
+	curl -Ls https://raw.githubusercontent.com/ceph/ceph-csi/refs/tags/v3.13.0/deploy/rbd/kubernetes/csidriver.yaml > cluster/csidriver.yaml

ceph-csi-rbd/README.md

@@ -0,0 +1,2 @@
+Deploys ceph-csi from templates found at:
+https://github.com/ceph/ceph-csi/tree/devel/deploy/rbd/kubernetes

ceph-csi-rbd/cluster/csi-nodeplugin-rbac.yaml

@@ -0,0 +1,41 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rbd-csi-nodeplugin
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get"]
+  # allow to read Vault Token and connection options from the Tenants namespace
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["serviceaccounts"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattachments"]
+    verbs: ["list", "get"]
+  - apiGroups: [""]
+    resources: ["serviceaccounts/token"]
+    verbs: ["create"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rbd-csi-nodeplugin
+subjects:
+  - kind: ServiceAccount
+    name: rbd-csi-nodeplugin
+    # replace with non-default namespace name
+    namespace: sys-ceph
+roleRef:
+  kind: ClusterRole
+  name: rbd-csi-nodeplugin
+  apiGroup: rbac.authorization.k8s.io

ceph-csi-rbd/cluster/csi-provisioner-rbac.yaml

@@ -0,0 +1,83 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rbd-external-provisioner-runner
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["list", "watch", "create", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims/status"]
+    verbs: ["update", "patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshots"]
+    verbs: ["get", "list", "watch", "update", "patch", "create"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshots/status"]
+    verbs: ["get", "list", "patch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotcontents"]
+    verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattachments"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattachments/status"]
+    verbs: ["patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["csinodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotcontents/status"]
+    verbs: ["update", "patch"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["serviceaccounts"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["serviceaccounts/token"]
+    verbs: ["create"]
+  - apiGroups: ["groupsnapshot.storage.k8s.io"]
+    resources: ["volumegroupsnapshotclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["groupsnapshot.storage.k8s.io"]
+    resources: ["volumegroupsnapshotcontents"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["groupsnapshot.storage.k8s.io"]
+    resources: ["volumegroupsnapshotcontents/status"]
+    verbs: ["update", "patch"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rbd-csi-provisioner-role
+subjects:
+  - kind: ServiceAccount
+    name: rbd-csi-provisioner
+    # replace with non-default namespace name
+    namespace: sys-ceph
+roleRef:
+  kind: ClusterRole
+  name: rbd-external-provisioner-runner
+  apiGroup: rbac.authorization.k8s.io
+---

ceph-csi-rbd/cluster/csidriver.yaml

@@ -0,0 +1,17 @@
+#
+# /!\ DO NOT MODIFY THIS FILE
+#
+# This file has been automatically generated by Ceph-CSI yamlgen.
+# The source for the contents can be found in the api/deploy directory, make
+# your modifications there.
+#
+---
+apiVersion: storage.k8s.io/v1
+kind: CSIDriver
+metadata:
+  name: "rbd.csi.ceph.com"
+spec:
+  attachRequired: true
+  podInfoOnMount: false
+  seLinuxMount: true
+  fsGroupPolicy: File

ceph-csi-rbd/cluster/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - csidriver.yaml
+  - csi-nodeplugin-rbac.yaml
+  - csi-provisioner-rbac.yaml

ceph-csi-rbd/namespaced/csi-nodeplugin-rbac.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rbd-csi-nodeplugin
+  # replace with non-default namespace name
+  namespace: sys-ceph

ceph-csi-rbd/namespaced/csi-provisioner-rbac.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: rbd-csi-provisioner
+  # replace with non-default namespace name
+  namespace: sys-ceph
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  # replace with non-default namespace name
+  namespace: sys-ceph
+  name: rbd-external-provisioner-cfg
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch", "create", "update", "delete"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "watch", "list", "delete", "update", "create"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: rbd-csi-provisioner-role-cfg
+  # replace with non-default namespace name
+  namespace: sys-ceph
+subjects:
+  - kind: ServiceAccount
+    name: rbd-csi-provisioner
+    # replace with non-default namespace name
+    namespace: sys-ceph
+roleRef:
+  kind: Role
+  name: rbd-external-provisioner-cfg
+  apiGroup: rbac.authorization.k8s.io