From ce897de3582ef7e178bffb7977f250be081c39d7 Mon Sep 17 00:00:00 2001 From: jprdonnelly Date: Tue, 3 Sep 2019 13:21:21 -0400 Subject: [PATCH] nfs-provisioner -> helm chart Switched to using nfs-server-provisioner helm chart. Now using a PVC/PV attached to a specific node using local-storage --- .gitignore | 1 + nfs-provisioner/nfs-class.yaml | 4 +- nfs-provisioner/nfs-helm-pvc.yaml | 23 ++++ nfs-provisioner/nfs-helm-values.yaml | 88 ++++++++++++++ nfs-provisioner/psp.yaml | 23 ++++ nfs-provisioner/rbac.yaml | 61 ++++++++++ nfs-provisioner/statefulSet.yaml | 87 ++++++++++++++ nfs-provisioner/uber.yaml | 173 +++++++++++++++++++++++++++ 8 files changed, 459 insertions(+), 1 deletion(-) create mode 100644 nfs-provisioner/nfs-helm-pvc.yaml create mode 100644 nfs-provisioner/nfs-helm-values.yaml create mode 100644 nfs-provisioner/psp.yaml create mode 100644 nfs-provisioner/rbac.yaml create mode 100644 nfs-provisioner/statefulSet.yaml create mode 100644 nfs-provisioner/uber.yaml diff --git a/.gitignore b/.gitignore index a7e3a5f..5fe90d7 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,4 @@ ubuntu-bionic-18.04-cloudimg-console.log *.id ubuntu-bionic-18.04-cloudimg-console.log *.log +*.log diff --git a/nfs-provisioner/nfs-class.yaml b/nfs-provisioner/nfs-class.yaml index 6b3affd..0399b7c 100644 --- a/nfs-provisioner/nfs-class.yaml +++ b/nfs-provisioner/nfs-class.yaml @@ -2,4 +2,6 @@ kind: StorageClass apiVersion: storage.k8s.io/v1 metadata: name: nfs-dynamic -provisioner: example.com/nfs \ No newline at end of file +provisioner: provisioner.local/nfs +mountOptions: + - vers=4.1 \ No newline at end of file diff --git a/nfs-provisioner/nfs-helm-pvc.yaml b/nfs-provisioner/nfs-helm-pvc.yaml new file mode 100644 index 0000000..6f1a632 --- /dev/null +++ b/nfs-provisioner/nfs-helm-pvc.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +kind: PersistentVolume +metadata: + name: nfs-provisioner-vol +spec: + capacity: + storage: 100Gi + # volumeMode field requires BlockVolume Alpha feature gate to be enabled. + volumeMode: Filesystem + accessModes: + - ReadWriteOnce + persistentVolumeReclaimPolicy: Delete + storageClassName: local-storage + local: + path: /storage/dynamic + nodeAffinity: + required: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/hostname + operator: In + values: + - k8s-nfs \ No newline at end of file diff --git a/nfs-provisioner/nfs-helm-values.yaml b/nfs-provisioner/nfs-helm-values.yaml new file mode 100644 index 0000000..40262ec --- /dev/null +++ b/nfs-provisioner/nfs-helm-values.yaml @@ -0,0 +1,88 @@ +# Default values for nfs-provisioner. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +# imagePullSecrets: + +image: + repository: quay.io/kubernetes_incubator/nfs-provisioner + pullPolicy: IfNotPresent + +service: + type: ClusterIP + + nfsPort: 2049 + mountdPort: 20048 + rpcbindPort: 51413 + # nfsNodePort: + # mountdNodePort: + # rpcbindNodePort: + + externalIPs: [] + +persistence: + enabled: true + + ## Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + storageClass: "local-storage" + + accessMode: ReadWriteOnce + size: 100Gi + +## For creating the StorageClass automatically: +storageClass: + create: true + + ## Set a provisioner name. If unset, a name will be generated. + provisionerName: "provisioner.local/nfs" + + ## Set StorageClass as the default StorageClass + ## Ignored if storageClass.create is false + defaultClass: true + + ## Set a StorageClass name + ## Ignored if storageClass.create is false + name: nfs-dynamic + + # set to null to prevent expansion + allowVolumeExpansion: true + ## StorageClass parameters + parameters: {} + + mountOptions: + - vers=4.1 + - noatime + + ## ReclaimPolicy field of the class, which can be either Delete or Retain + reclaimPolicy: Delete + +## For RBAC support: +rbac: + create: true + + ## Ignored if rbac.create is true + ## + serviceAccountName: default + +resources: {} + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +nodeSelector: + kubernetes.io/hostname: "k8s-nfs" +tolerations: +- effect: NoSchedule + operator: Exists +affinity: {} \ No newline at end of file diff --git a/nfs-provisioner/psp.yaml b/nfs-provisioner/psp.yaml new file mode 100644 index 0000000..8219d68 --- /dev/null +++ b/nfs-provisioner/psp.yaml @@ -0,0 +1,23 @@ +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: nfs-provisioner +spec: + fsGroup: + rule: RunAsAny + allowedCapabilities: + - DAC_READ_SEARCH + - SYS_RESOURCE + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - configMap + - downwardAPI + - emptyDir + - persistentVolumeClaim + - secret + - hostPath \ No newline at end of file diff --git a/nfs-provisioner/rbac.yaml b/nfs-provisioner/rbac.yaml new file mode 100644 index 0000000..f0c0da0 --- /dev/null +++ b/nfs-provisioner/rbac.yaml @@ -0,0 +1,61 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: nfs-provisioner-runner +rules: + - apiGroups: [""] + resources: ["persistentvolumes"] + verbs: ["get", "list", "watch", "create", "delete"] + - apiGroups: [""] + resources: ["persistentvolumeclaims"] + verbs: ["get", "list", "watch", "update"] + - apiGroups: ["storage.k8s.io"] + resources: ["storageclasses"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "update", "patch"] + - apiGroups: [""] + resources: ["services", "endpoints"] + verbs: ["get"] + - apiGroups: ["extensions"] + resources: ["podsecuritypolicies"] + resourceNames: ["nfs-provisioner"] + verbs: ["use"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: run-nfs-provisioner +subjects: + - kind: ServiceAccount + name: nfs-provisioner + # replace with namespace where provisioner is deployed + namespace: default +roleRef: + kind: ClusterRole + name: nfs-provisioner-runner + apiGroup: rbac.authorization.k8s.io +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: leader-locking-nfs-provisioner +rules: + - apiGroups: [""] + resources: ["endpoints"] + verbs: ["get", "list", "watch", "create", "update", "patch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: leader-locking-nfs-provisioner +subjects: + - kind: ServiceAccount + name: nfs-provisioner + # replace with namespace where provisioner is deployed + namespace: default +roleRef: + kind: Role + name: leader-locking-nfs-provisioner + apiGroup: rbac.authorization.k8s.io \ No newline at end of file diff --git a/nfs-provisioner/statefulSet.yaml b/nfs-provisioner/statefulSet.yaml new file mode 100644 index 0000000..14a343c --- /dev/null +++ b/nfs-provisioner/statefulSet.yaml @@ -0,0 +1,87 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: nfs-provisioner +--- +kind: Service +apiVersion: v1 +metadata: + name: nfs-provisioner + labels: + app: nfs-provisioner +spec: + ports: + - name: nfs + port: 2049 + - name: mountd + port: 20048 + - name: rpcbind + port: 111 + - name: rpcbind-udp + port: 111 + protocol: UDP + selector: + app: nfs-provisioner +--- +kind: StatefulSet +apiVersion: apps/v1 +metadata: + name: nfs-provisioner +spec: + selector: + matchLabels: + app: nfs-provisioner + serviceName: "nfs-provisioner" + replicas: 1 + template: + metadata: + labels: + app: nfs-provisioner + spec: + serviceAccount: nfs-provisioner + nodeSelector: + role: nfs + tolerations: + - key: "special" + operator: "Exists" + effect: "NoExecute" + terminationGracePeriodSeconds: 10 + containers: + - name: nfs-provisioner + image: quay.io/kubernetes_incubator/nfs-provisioner:latest + ports: + - name: nfs + containerPort: 2049 + - name: mountd + containerPort: 20048 + - name: rpcbind + containerPort: 111 + - name: rpcbind-udp + containerPort: 111 + protocol: UDP + securityContext: + capabilities: + add: + - DAC_READ_SEARCH + - SYS_RESOURCE + args: + - "-provisioner=example.com/nfs" + env: + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SERVICE_NAME + value: nfs-provisioner + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + imagePullPolicy: "IfNotPresent" + volumeMounts: + - name: export-volume + mountPath: /export + volumes: + - name: export-volume + hostPath: + path: /storage/dynamic \ No newline at end of file diff --git a/nfs-provisioner/uber.yaml b/nfs-provisioner/uber.yaml new file mode 100644 index 0000000..fa282be --- /dev/null +++ b/nfs-provisioner/uber.yaml @@ -0,0 +1,173 @@ +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: nfs-provisioner +spec: + fsGroup: + rule: RunAsAny + allowedCapabilities: + - DAC_READ_SEARCH + - SYS_RESOURCE + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - configMap + - downwardAPI + - emptyDir + - persistentVolumeClaim + - secret + - hostPath +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: nfs-provisioner-runner +rules: + - apiGroups: [""] + resources: ["persistentvolumes"] + verbs: ["get", "list", "watch", "create", "delete"] + - apiGroups: [""] + resources: ["persistentvolumeclaims"] + verbs: ["get", "list", "watch", "update"] + - apiGroups: ["storage.k8s.io"] + resources: ["storageclasses"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "update", "patch"] + - apiGroups: [""] + resources: ["services", "endpoints"] + verbs: ["get"] + - apiGroups: ["extensions"] + resources: ["podsecuritypolicies"] + resourceNames: ["nfs-provisioner"] + verbs: ["use"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: run-nfs-provisioner +subjects: + - kind: ServiceAccount + name: nfs-provisioner + # replace with namespace where provisioner is deployed + namespace: default +roleRef: + kind: ClusterRole + name: nfs-provisioner-runner + apiGroup: rbac.authorization.k8s.io +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: leader-locking-nfs-provisioner +rules: + - apiGroups: [""] + resources: ["endpoints"] + verbs: ["get", "list", "watch", "create", "update", "patch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: leader-locking-nfs-provisioner +subjects: + - kind: ServiceAccount + name: nfs-provisioner + # replace with namespace where provisioner is deployed + namespace: default +roleRef: + kind: Role + name: leader-locking-nfs-provisioner + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: nfs-provisioner +--- +kind: Service +apiVersion: v1 +metadata: + name: nfs-provisioner + labels: + app: nfs-provisioner +spec: + ports: + - name: nfs + port: 2049 + - name: mountd + port: 20048 + - name: rpcbind + port: 111 + - name: rpcbind-udp + port: 111 + protocol: UDP + selector: + app: nfs-provisioner +--- +kind: StatefulSet +apiVersion: apps/v1 +metadata: + name: nfs-provisioner +spec: + selector: + matchLabels: + app: nfs-provisioner + serviceName: "nfs-provisioner" + replicas: 1 + template: + metadata: + labels: + app: nfs-provisioner + spec: + serviceAccount: nfs-provisioner + nodeSelector: + role: nfs + tolerations: + - key: "special" + operator: "Exists" + effect: "NoExecute" + terminationGracePeriodSeconds: 10 + containers: + - name: nfs-provisioner + image: quay.io/kubernetes_incubator/nfs-provisioner:latest + ports: + - name: nfs + containerPort: 2049 + - name: mountd + containerPort: 20048 + - name: rpcbind + containerPort: 111 + - name: rpcbind-udp + containerPort: 111 + protocol: UDP + securityContext: + capabilities: + add: + - DAC_READ_SEARCH + - SYS_RESOURCE + args: + - "-provisioner=example.com/nfs" + env: + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SERVICE_NAME + value: nfs-provisioner + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + imagePullPolicy: "IfNotPresent" + volumeMounts: + - name: export-volume + mountPath: /export + volumes: + - name: export-volume + hostPath: + path: /storage/dynamic \ No newline at end of file