Move CSI charts to separate chart and cleanup loader code

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
2025-08-02 12:06:09 -04:00 · 2023-06-26 10:13:28 +02:00 · 2023-06-26 10:13:28 +02:00 · ea5c83587c
commit ea5c83587c
parent cb22a25144
124 changed files with 547 additions and 2290 deletions
--- a/cli/internal/helm/testdata/GCP/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/cluster_setup.yaml
+++ b/cli/internal/helm/testdata/GCP/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/cluster_setup.yaml
@ -1,308 +0,0 @@
-##### Node Service Account, Roles, RoleBindings
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: csi-gce-pd-node-sa
-  namespace: testNamespace
-
---
-
-##### Controller Service Account, Roles, Rolebindings
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: csi-gce-pd-controller-sa
-  namespace: testNamespace
-
---
-
-# xref: https://github.com/kubernetes-csi/external-provisioner/blob/master/deploy/kubernetes/rbac.yaml
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: csi-gce-pd-provisioner-role
-rules:
-  - apiGroups: [""]
-    resources: ["persistentvolumes"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims"]
-    verbs: ["get", "list", "watch", "update"]
-  - apiGroups: ["storage.k8s.io"]
-    resources: ["storageclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["list", "watch", "create", "update", "patch"]
-  - apiGroups: ["storage.k8s.io"]
-    resources: ["csinodes"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["snapshot.storage.k8s.io"]
-    resources: ["volumesnapshots"]
-    verbs: ["get", "list"]
-  - apiGroups: ["snapshot.storage.k8s.io"]
-    resources: ["volumesnapshotcontents"]
-    verbs: ["get", "list"]
-  # Access to volumeattachments is only needed when the CSI driver
-  # has the PUBLISH_UNPUBLISH_VOLUME controller capability.
-  # In that case, external-provisioner will watch volumeattachments
-  # to determine when it is safe to delete a volume.
-  - apiGroups: ["storage.k8s.io"]
-    resources: ["volumeattachments"]
-    verbs: ["get", "list", "watch"]
-
---
-
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: csi-gce-pd-controller-provisioner-binding
-subjects:
-  - kind: ServiceAccount
-    name: csi-gce-pd-controller-sa
-    namespace: testNamespace
-roleRef:
-  kind: ClusterRole
-  name: csi-gce-pd-provisioner-role
-  apiGroup: rbac.authorization.k8s.io
-
---
-
-# xref: https://github.com/kubernetes-csi/external-attacher/blob/master/deploy/kubernetes/rbac.yaml
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: csi-gce-pd-attacher-role
-rules:
-  - apiGroups: [""]
-    resources: ["persistentvolumes"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["storage.k8s.io"]
-    resources: ["csinodes"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["storage.k8s.io"]
-    resources: ["volumeattachments"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["storage.k8s.io"]
-    resources: ["volumeattachments/status"]
-    verbs: ["patch"]
-
---
-
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: csi-gce-pd-controller-attacher-binding
-subjects:
-  - kind: ServiceAccount
-    name: csi-gce-pd-controller-sa
-    namespace: testNamespace
-roleRef:
-  kind: ClusterRole
-  name: csi-gce-pd-attacher-role
-  apiGroup: rbac.authorization.k8s.io
-
---
-
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: csi-gce-pd-controller
-value: 900000000
-globalDefault: false
-description: "This priority class should be used for the GCE PD CSI driver controller deployment only."
-
---
-
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: csi-gce-pd-node
-value: 900001000
-globalDefault: false
-description: "This priority class should be used for the GCE PD CSI driver node deployment only."
-
---
-
-# Resizer must be able to work with PVCs, PVs, SCs.
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: csi-gce-pd-resizer-role
-rules:
-  - apiGroups: [""]
-    resources: ["persistentvolumes"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims/status"]
-    verbs: ["update", "patch"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["list", "watch", "create", "update", "patch"]
-  # If handle-volume-inuse-error=true, the pod specific rbac is needed
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list", "watch"]
-
---
-
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: csi-gce-pd-resizer-binding
-subjects:
-  - kind: ServiceAccount
-    name: csi-gce-pd-controller-sa
-    namespace: testNamespace
-roleRef:
-  kind: ClusterRole
-  name: csi-gce-pd-resizer-role
-  apiGroup: rbac.authorization.k8s.io
-
---
-
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: csi-gce-pd-controller-deploy
-rules:
-  - apiGroups: ["policy"]
-    resources: ["podsecuritypolicies"]
-    verbs: ["use"]
-    resourceNames:
-      - csi-gce-pd-controller-psp
-
---
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: csi-gce-pd-controller-deploy
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: csi-gce-pd-controller-deploy
-subjects:
-  - kind: ServiceAccount
-    name: csi-gce-pd-controller-sa
-    namespace: testNamespace
-
---
-
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: csi-gce-pd-node-deploy
-rules:
-  - apiGroups: ['policy']
-    resources: ['podsecuritypolicies']
-    verbs:     ['use']
-    resourceNames:
-    - csi-gce-pd-node-psp
-
---
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: csi-gce-pd-node
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: csi-gce-pd-node-deploy
-subjects:
- kind: ServiceAccount
-  name: csi-gce-pd-node-sa
-  namespace: testNamespace
-
---
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: csi-gce-pd-controller
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: csi-gce-pd-node-deploy
-subjects:
- kind: ServiceAccount
-  name: csi-gce-pd-controller-sa
-  namespace: testNamespace
-
---
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: csi-gce-pd-snapshotter-role
-rules:
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["list", "watch", "create", "update", "patch"]
-  # Secrets resource omitted since GCE PD snapshots does not require them
-  - apiGroups: ["snapshot.storage.k8s.io"]
-    resources: ["volumesnapshotclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["snapshot.storage.k8s.io"]
-    resources: ["volumesnapshotcontents"]
-    verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
-  - apiGroups: ["snapshot.storage.k8s.io"]
-    resources: ["volumesnapshotcontents/status"]
-    verbs: ["update", "patch"]
-
---
-
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: csi-gce-pd-controller-snapshotter-binding
-subjects:
-  - kind: ServiceAccount
-    name: csi-gce-pd-controller-sa
-    namespace: testNamespace
-roleRef:
-  kind: ClusterRole
-  name: csi-gce-pd-snapshotter-role
-  apiGroup: rbac.authorization.k8s.io
-
---
-
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: csi-gce-pd-leaderelection-role
-  namespace: testNamespace
-  labels:
-    k8s-app: gcp-compute-persistent-disk-csi-driver
-rules:
- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["get", "watch", "list", "delete", "update", "create"]
-
---
-
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: csi-gce-pd-controller-leaderelection-binding
-  namespace: testNamespace
-  labels:
-    k8s-app: gcp-compute-persistent-disk-csi-driver
-subjects:
- kind: ServiceAccount
-  name: csi-gce-pd-controller-sa
-  namespace: testNamespace
-roleRef:
-  kind: Role
-  name: csi-gce-pd-leaderelection-role
-  apiGroup: rbac.authorization.k8s.io
--- a/cli/internal/helm/testdata/GCP/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/controller.yaml
+++ b/cli/internal/helm/testdata/GCP/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/controller.yaml
@ -1,171 +0,0 @@
-kind: Deployment
-apiVersion: apps/v1
-metadata:
-  name: csi-gce-pd-controller
-  namespace: testNamespace
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: gcp-compute-persistent-disk-csi-driver
-  template:
-    metadata:
-      labels:
-        app: gcp-compute-persistent-disk-csi-driver
-    spec:
-      tolerations:
-        - effect: NoSchedule
-          key: node-role.kubernetes.io/control-plane
-          operator: Exists
-        - effect: NoSchedule
-          key: node-role.kubernetes.io/master
-          operator: Exists
-        - effect: NoSchedule
-          key: node.cloudprovider.kubernetes.io/uninitialized
-          operator: Exists
-        - effect: NoSchedule
-          key: node.kubernetes.io/not-ready
-          operator: Exists
-      nodeSelector:
-        kubernetes.io/os: linux
-        node-role.kubernetes.io/control-plane: ""
-      serviceAccountName: csi-gce-pd-controller-sa
-      priorityClassName: csi-gce-pd-controller
-      containers:
-        - name: csi-provisioner
-          image: csi-provisioner:v0.0.0
-          imagePullPolicy: IfNotPresent
-          args:
-            - "--v=5"
-            - "--csi-address=/csi/csi.sock"
-            - "--feature-gates=Topology=true"
-            - "--http-endpoint=:22011"
-            - "--leader-election-namespace=$(PDCSI_NAMESPACE)"
-            - "--timeout=250s"
-            - "--extra-create-metadata"
-          # - "--run-controller-service=false"  # disable the controller service of the CSI driver
-          # - "--run-node-service=false"        # disable the node service of the CSI driver
-            - "--leader-election"
-            - "--default-fstype=ext4"
-            - "--controller-publish-readonly=true"
-          env:
-            - name: PDCSI_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          ports:
-            - containerPort: 22011
-              name: http-endpoint
-              protocol: TCP
-          livenessProbe:
-            failureThreshold: 1
-            httpGet:
-              path: /healthz/leader-election
-              port: http-endpoint
-            initialDelaySeconds: 10
-            timeoutSeconds: 10
-            periodSeconds: 20
-          volumeMounts:
-            - name: socket-dir
-              mountPath: /csi
-        - name: csi-attacher
-          image: csi-attacher:v0.0.0
-          imagePullPolicy: IfNotPresent
-          args:
-            - "--v=5"
-            - "--csi-address=/csi/csi.sock"
-            - "--http-endpoint=:22012"
-            - "--leader-election"
-            - "--leader-election-namespace=$(PDCSI_NAMESPACE)"
-            - "--timeout=250s"
-          env:
-            - name: PDCSI_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          ports:
-            - containerPort: 22012
-              name: http-endpoint
-              protocol: TCP
-          livenessProbe:
-            failureThreshold: 1
-            httpGet:
-              path: /healthz/leader-election
-              port: http-endpoint
-            initialDelaySeconds: 10
-            timeoutSeconds: 10
-            periodSeconds: 20
-          volumeMounts:
-            - name: socket-dir
-              mountPath: /csi
-        - name: csi-resizer
-          image: csi-resizer:v0.0.0
-          imagePullPolicy: IfNotPresent
-          args:
-            - "--v=5"
-            - "--csi-address=/csi/csi.sock"
-            - "--http-endpoint=:22013"
-            - "--leader-election"
-            - "--leader-election-namespace=$(PDCSI_NAMESPACE)"
-            - "--handle-volume-inuse-error=false"
-          env:
-            - name: PDCSI_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          ports:
-            - containerPort: 22013
-              name: http-endpoint
-              protocol: TCP
-          livenessProbe:
-            failureThreshold: 1
-            httpGet:
-              path: /healthz/leader-election
-              port: http-endpoint
-            initialDelaySeconds: 10
-            timeoutSeconds: 10
-            periodSeconds: 20
-          volumeMounts:
-            - name: socket-dir
-              mountPath: /csi
-        - name: csi-snapshotter
-          image: csi-snapshotter:v0.0.0
-          imagePullPolicy: IfNotPresent
-          args:
-            - "--v=5"
-            - "--csi-address=/csi/csi.sock"
-            - "--metrics-address=:22014"
-            - "--leader-election"
-            - "--leader-election-namespace=$(PDCSI_NAMESPACE)"
-            - "--timeout=300s"
-          env:
-            - name: PDCSI_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - name: socket-dir
-              mountPath: /csi
-        - name: gce-pd-driver
-          # Don't change base image without changing pdImagePlaceholder in
-          # test/k8s-integration/main.go
-          image: csi-driver:v0.0.0
-          imagePullPolicy: IfNotPresent
-          args:
-            - "--v=5"
-            - "--endpoint=unix:/csi/csi.sock"
-          env:
-            - name: GOOGLE_APPLICATION_CREDENTIALS
-              value: "/etc/cloud-sa/key.json"
-          volumeMounts:
-            - name: socket-dir
-              mountPath: /csi
-            - name: cloud-sa-volume
-              readOnly: true
-              mountPath: "/etc/cloud-sa"
-      volumes:
-        - name: socket-dir
-          emptyDir: {}
-        - name: cloud-sa-volume
-          secret:
-            secretName: gcekey
--- a/cli/internal/helm/testdata/GCP/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/node.yaml
+++ b/cli/internal/helm/testdata/GCP/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/node.yaml
@ -1,112 +0,0 @@
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  name: csi-gce-pd-node
-  namespace: testNamespace
-spec:
-  selector:
-    matchLabels:
-      app: gcp-compute-persistent-disk-csi-driver
-  template:
-    metadata:
-      labels:
-        app: gcp-compute-persistent-disk-csi-driver
-    spec:
-      priorityClassName: csi-gce-pd-node
-      serviceAccountName: csi-gce-pd-node-sa
-      nodeSelector:
-        kubernetes.io/os: linux
-      containers:
-        - name: csi-driver-registrar
-          image: csi-registrar:v0.0.0
-          imagePullPolicy: IfNotPresent
-          args:
-            - "--v=5"
-            - "--csi-address=/csi/csi.sock"
-            - "--kubelet-registration-path=/var/lib/kubelet/plugins/gcp.csi.confidential.cloud/csi.sock"
-          env:
-            - name: KUBE_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-          volumeMounts:
-            - name: plugin-dir
-              mountPath: /csi
-            - name: registration-dir
-              mountPath: /registration
-        - name: gce-pd-driver
-          image: csi-driver:v0.0.0
-          imagePullPolicy: IfNotPresent
-          args:
-            - "--v=5"
-            - "--endpoint=unix:/csi/csi.sock"
-            - "--run-controller-service=false"
-            - "--kms-addr=key-service.testNamespace:9000"
-          securityContext:
-            privileged: true
-          volumeMounts:
-            - name: kubelet-dir
-              mountPath: /var/lib/kubelet
-              mountPropagation: "Bidirectional"
-            - name: plugin-dir
-              mountPath: /csi
-            - name: device-dir
-              mountPath: /dev
-            # The following mounts are required to trigger host udevadm from
-            # container
-            # But we don't want that, because it breaks cryptsetup
-            # - name: udev-rules-etc
-            #   mountPath: /etc/udev
-            # - name: udev-rules-lib
-            #   mountPath: /lib/udev
-            # - name: udev-socket
-            #   mountPath: /run/udev
-            - name: sys
-              mountPath: /sys
-            - name: cryptsetup
-              mountPath: /run/cryptsetup
-      volumes:
-        - name: registration-dir
-          hostPath:
-            path: /var/lib/kubelet/plugins_registry/
-            type: Directory
-        - name: kubelet-dir
-          hostPath:
-            path: /var/lib/kubelet
-            type: Directory
-        - name: plugin-dir
-          hostPath:
-            path: /var/lib/kubelet/plugins/gcp.csi.confidential.cloud/
-            type: DirectoryOrCreate
-        - name: device-dir
-          hostPath:
-            path: /dev
-            type: Directory
-        # The following mounts are required to trigger host udevadm from
-        # container
-        # But we don't want that, because it breaks cryptsetup
-        # - name: udev-rules-etc
-        #   hostPath:
-        #     path: /etc/udev
-        #     type: Directory
-        # - name: udev-rules-lib
-        #   hostPath:
-        #     path: /lib/udev
-        #     type: Directory
-        # - name: udev-socket
-        #   hostPath:
-        #     path: /run/udev
-        #     type: Directory
-        - name: sys
-          hostPath:
-            path: /sys
-            type: Directory
-        - name: cryptsetup
-          hostPath:
-            path: /run/cryptsetup
-            type: Directory
-      # https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
-      # See "special case". This will tolerate everything. Node component should
-      # be scheduled on all nodes.
-      tolerations:
-        - operator: Exists
--- a/cli/internal/helm/testdata/GCP/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/storageclass_default.yaml
+++ b/cli/internal/helm/testdata/GCP/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/storageclass_default.yaml
@ -1,12 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  annotations:
-    storageclass.kubernetes.io/is-default-class: "true"
-  name: encrypted-rwo
-parameters:
-  type: pd-balanced
-provisioner: gcp.csi.confidential.cloud
-allowVolumeExpansion: true
-reclaimPolicy: Delete
-volumeBindingMode: Immediate
--- a/cli/internal/helm/testdata/GCP/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/storageclass_integrity.yaml
+++ b/cli/internal/helm/testdata/GCP/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/storageclass_integrity.yaml
@ -1,12 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  annotations:
-  name: integrity-encrypted-rwo
-parameters:
-  type: pd-ssd
-  csi.storage.k8s.io/fstype: ext4-integrity
-provisioner: gcp.csi.confidential.cloud
-allowVolumeExpansion: false
-reclaimPolicy: Delete
-volumeBindingMode: Immediate
--- a/cli/internal/helm/testdata/GCP/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/v1_csidriver.yaml
+++ b/cli/internal/helm/testdata/GCP/constellation-services/charts/gcp-compute-persistent-disk-csi-driver/templates/v1_csidriver.yaml
@ -1,7 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: CSIDriver
-metadata:
-  name: gcp.csi.confidential.cloud
-spec:
-  attachRequired: true
-  podInfoOnMount: false