Add cpi 1.0.100

pull/1623/head
Steven Crespo 2021-11-18 13:23:19 -08:00
parent d9e29cb7b5
commit 0107f557ff
13 changed files with 500 additions and 0 deletions

View File

@ -0,0 +1,21 @@
annotations:
catalog.cattle.io/rancher-version: '>= 2.5.0-0 <= 2.5.99-0'
catalog.cattle.io/certified: rancher
catalog.cattle.io/display-name: vSphere CPI
catalog.cattle.io/namespace: kube-system
catalog.cattle.io/os: linux
catalog.cattle.io/release-name: vsphere-cpi
apiVersion: v1
appVersion: 1.21.0
description: vSphere Cloud Provider Interface (CPI)
icon: https://charts.rancher.io/assets/logos/vsphere-cpi.svg
keywords:
- infrastructure
kubeVersion: 1.18 - 1.21
maintainers:
- email: caleb@rancher.com
name: Rancher
name: rancher-vsphere-cpi
sources:
- https://github.com/kubernetes/cloud-provider-vsphere
version: 1.0.100

View File

@ -0,0 +1,57 @@
# vSphere Cloud Provider Interface (CPI)
[vSphere Cloud Provider Interface (CPI)](https://github.com/kubernetes/cloud-provider-vsphere) is responsible for running all the platform specific control loops that were previously run in core Kubernetes components like the KCM and the kubelet, but have been moved out-of-tree to allow cloud and infrastructure providers to implement integrations that can be developed, built and released independent of Kubernetes core. The official documentation and tutorials can be found [here](https://vsphere-csi-driver.sigs.k8s.io/driver-deployment/prerequisites.html).
## Prerequisites
- vSphere 6.7 U3+
- Kubernetes v1.14+
- A Secret on your Kubernetes cluster that contains vSphere credentials (Refer to `README` or `Detailed Descriptions`)
## Installation
This chart requires a Secret in your Kubernetes cluster that contains the server URL and credentials to connect to the vCenter. You can have the chart generate it for you, or create it yourself and provide the name of the Secret during installation.
<span style="color:orange">Warning</span>: When the option to generate the Secret is enabled, the credentials are visible in the API to authorized users. If you create the Secret yourself they will not be visible.
You can create a Secret in one of the following ways:
### <B>Option 1</b>: Create a Secret using the Rancher UI
Go to your cluster's project (Same project you will be installing the chart) > Resources > Secrets > Add Secret.
```yaml
# Example of data required in the Secret
<host-1>.username: <username>
<host-1>.password: <password>
```
### <B>Option 2</b>: Create a Secret using kubectl
Replace placeholders with actual values, and execute the following:
```bash
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: <secret-name>
namespace: <charts-namespace>
data:
<host-1>.username: <base64encoded-username>
<host-1>.password: <base64encoded-password>
EOF
```
More information on managing Secrets using kubectl [here](https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/).
## Migration
If using this chart to migrate volumes provisioned by the in-tree provider to the out-of-tree CPI + CSI, you need to taint all nodes with the following:
```
node.cloudprovider.kubernetes.io/uninitialized=true:NoSchedule
```
To perform this operation on all nodes in your cluster, the following script has been provided for your convenience:
```bash
# Note: Since this script uses kubectl, ensure that you run `export KUBECONFIG=<path-to-kubeconfig-for-cluster>` before running this script
for node in $(kubectl get nodes | awk '{print $1}' | tail -n +2); do
kubectl taint node $node node.cloudprovider.kubernetes.io/uninitialized=true:NoSchedule
done
```

View File

@ -0,0 +1,17 @@
# vSphere Cloud Provider Interface (CPI)
[vSphere Cloud Provider Interface (CPI)](https://github.com/kubernetes/cloud-provider-vsphere) is responsible for running all the platform specific control loops that were previously run in core Kubernetes components like the KCM and the kubelet, but have been moved out-of-tree to allow cloud and infrastructure providers to implement integrations that can be developed, built and released independent of Kubernetes core. The official documentation and tutorials can be found [here](https://vsphere-csi-driver.sigs.k8s.io/driver-deployment/prerequisites.html).
## Support Matrix
| Rancher vSphere CPI | Minimum Kubernetes Release | Maximum Kubernetes Release |
| ------------------- | -------------------------- | -------------------------- |
| 1.0.100 | 1.18.x | 1.21.x |
| 1.0.1 | | 1.17.x |
| 1.0.000 | | 1.17.x |
## Prerequisites
- vSphere 6.7 U3+
- Kubernetes v1.14+
- A Secret on your Kubernetes cluster that contains vSphere credentials (Refer to `README` or `Detailed Descriptions`)

View File

@ -0,0 +1,42 @@
questions:
- variable: vCenter.host
label: vCenter Host
description: IP address or FQDN of the vCenter
type: string
required: true
group: Configuration
- variable: vCenter.datacenters
description: Comma-separated list of paths to data centers. E.g "<dc1-path>, <dc2-path>, ..."
label: Data Centers
type: string
required: true
group: Configuration
- variable: vCenter.credentialsSecret.generate
label: Generate Credential's Secret
description: Generates a secret with the vSphere credentials (If the option to generate it is enabled, credentials will be visible in the API to authorized users)
type: boolean
default: true
required: true
group: Configuration
show_subquestion_if: true
subquestions:
- variable: vCenter.username
label: Username
description: Username for vCenter
type: string
group: Configuration
- variable: vCenter.password
label: Password
description: Password for vCenter
type: password
group: Configuration
- variable: vCenter.credentialsSecret.name
label: Credential's Secret Name
description: Name of the secret with the vSphere credentials (Will not be visible in the API. More info in the README)
default: "vsphere-cpi-creds"
type: string
group: Configuration
show_if: "vCenter.credentialsSecret.generate=false"

View File

@ -0,0 +1,37 @@
{{- define "system_default_registry" -}}
{{- if .Values.global.cattle.systemDefaultRegistry -}}
{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}}
{{- else -}}
{{- "" -}}
{{- end -}}
{{- end -}}
{{- /* Return the image override if one is defined in the chart values. */ -}}
{{- define "get_image_override" -}}
{{- if hasKey .Values.cloudControllerManager.image "override" -}}
{{- if and (hasKey .Values.cloudControllerManager.image.override "repository") (hasKey .Values.cloudControllerManager.image.override "tag") -}}
{{- printf "%s:%s" .Values.cloudControllerManager.image.override.repository .Values.cloudControllerManager.image.override.tag -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{- /* Return the image's repository and tag corresponding to the cluster's kubernetes version. */ -}}
{{- define "get_image" -}}
{{- $kubeVersion := printf "%s.%s" .Capabilities.KubeVersion.Major .Capabilities.KubeVersion.Minor -}}
{{- if hasKey .Values.cloudControllerManager.image $kubeVersion -}}
{{- $imageForKubeVersion := get .Values.cloudControllerManager.image $kubeVersion -}}
{{- printf "%s:%s" $imageForKubeVersion.repository $imageForKubeVersion.tag -}}
{{- else -}}
{{- $supportedVersions := include "get_supported_k8s_versions" . -}}
{{- required (printf "unsupported Kubernetes version: %s (supported versions: %s)" $kubeVersion $supportedVersions) "" -}}
{{- end -}}
{{- end -}}
{{- /* Return string of a comma separated list of the k8s version lines the chart supports in the `major.minor.x` format. */ -}}
{{- define "get_supported_k8s_versions" -}}
{{- $versions := list -}}
{{- range $k, $v := .Values.cloudControllerManager.image -}}
{{- $versions = append $versions (printf "%s.x" $k) -}}
{{- end -}}
{{- join ", " $versions -}}
{{- end -}}

View File

@ -0,0 +1,19 @@
# Source: https://github.com/kubernetes/cloud-provider-vsphere
apiVersion: v1
kind: ConfigMap
metadata:
name: vsphere-cloud-config
labels:
vsphere-cpi-infra: config
component: {{ .Chart.Name }}-cloud-controller-manager
namespace: {{ .Release.Namespace }}
data:
vsphere.conf: |
[Global]
secret-name = {{ .Values.vCenter.credentialsSecret.name | quote }}
secret-namespace = {{ .Release.Namespace | quote }}
port = {{ .Values.vCenter.port | quote }}
insecure-flag = {{ .Values.vCenter.insecureFlag | quote }}
[VirtualCenter {{ .Values.vCenter.host | quote }}]
datacenters = {{ .Values.vCenter.datacenters | quote }}

View File

@ -0,0 +1,96 @@
# Source: https://github.com/kubernetes/cloud-provider-vsphere
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: {{ .Chart.Name }}-cloud-controller-manager
labels:
component: {{ .Chart.Name }}-cloud-controller-manager
tier: control-plane
namespace: {{ .Release.Namespace }}
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ""
spec:
selector:
matchLabels:
name: {{ .Chart.Name }}-cloud-controller-manager
updateStrategy:
type: RollingUpdate
template:
metadata:
labels:
name: {{ .Chart.Name }}-cloud-controller-manager
component: {{ .Chart.Name }}-cloud-controller-manager
tier: control-plane
spec:
{{- if .Values.cloudControllerManager.nodeSelector }}
nodeSelector:
{{- with .Values.cloudControllerManager.nodeSelector }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- else }}
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
# RKE node selector label
- key: node-role.kubernetes.io/controlplane
operator: In
values:
- "true"
- matchExpressions:
# RKE2 node selector label
- key: node-role.kubernetes.io/control-plane
operator: In
values:
- "true"
{{- end }}
{{- if .Values.cloudControllerManager.tolerations }}
tolerations:
{{- with .Values.cloudControllerManager.tolerations }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- else }}
tolerations:
- key: node.cloudprovider.kubernetes.io/uninitialized
value: "true"
effect: NoSchedule
- key: node-role.kubernetes.io/master
effect: NoSchedule
operator: Exists
- key: node.kubernetes.io/not-ready
effect: NoSchedule
operator: Exists
# Rancher specific change: These tolerations are added to account for RKE1 and RKE2 taints
- key: node-role.kubernetes.io/controlplane
effect: NoSchedule
value: "true"
- key: node-role.kubernetes.io/control-plane
effect: NoSchedule
value: "true"
- key: node-role.kubernetes.io/etcd
effect: NoSchedule
value: "true"
{{- end }}
securityContext:
runAsUser: 1001
serviceAccountName: {{ .Chart.Name }}-cloud-controller-manager
containers:
- name: {{ .Chart.Name }}-cloud-controller-manager
image: "{{ template "system_default_registry" . }}{{ default (include "get_image" . ) (include "get_image_override" . ) }}"
args:
- --cloud-provider=vsphere
- --v=2
- --cloud-config=/etc/cloud/vsphere.conf
volumeMounts:
- mountPath: /etc/cloud
name: vsphere-config-volume
readOnly: true
resources:
requests:
cpu: 200m
hostNetwork: true
volumes:
- name: vsphere-config-volume
configMap:
name: vsphere-cloud-config

View File

@ -0,0 +1,44 @@
{{- if .Values.cloudControllerManager.rbac.enabled -}}
# Source: https://github.com/kubernetes/cloud-provider-vsphere
apiVersion: v1
kind: List
metadata: {}
items:
- apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: servicecatalog.k8s.io:apiserver-authentication-reader
labels:
vsphere-cpi-infra: role-binding
component: {{ .Chart.Name }}-cloud-controller-manager
namespace: {{ .Release.Namespace }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: extension-apiserver-authentication-reader
subjects:
- apiGroup: ""
kind: ServiceAccount
name: {{ .Chart.Name }}-cloud-controller-manager
namespace: {{ .Release.Namespace }}
- apiGroup: ""
kind: User
name: {{ .Chart.Name }}-cloud-controller-manager
- apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: system:{{ .Chart.Name }}-cloud-controller-manager
labels:
vsphere-cpi-infra: cluster-role-binding
component: {{ .Chart.Name }}-cloud-controller-manager
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:{{ .Chart.Name }}-cloud-controller-manager
subjects:
- kind: ServiceAccount
name: {{ .Chart.Name }}-cloud-controller-manager
namespace: {{ .Release.Namespace }}
- kind: User
name: {{ .Chart.Name }}-cloud-controller-manager
{{- end -}}

View File

@ -0,0 +1,93 @@
{{- if .Values.cloudControllerManager.rbac.enabled -}}
# Source: https://github.com/kubernetes/cloud-provider-vsphere
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: system:{{ .Chart.Name }}-cloud-controller-manager
labels:
vsphere-cpi-infra: role
component: {{ .Chart.Name }}-cloud-controller-manager
rules:
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
- update
- apiGroups:
- ""
resources:
- nodes
verbs:
- "*"
- apiGroups:
- ""
resources:
- nodes/status
verbs:
- patch
- apiGroups:
- ""
resources:
- services
verbs:
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- services/status
verbs:
- patch
- apiGroups:
- ""
resources:
- serviceaccounts
verbs:
- create
- get
- list
- watch
- update
- apiGroups:
- ""
resources:
- persistentvolumes
verbs:
- get
- list
- update
- watch
- apiGroups:
- ""
resources:
- endpoints
verbs:
- create
- get
- list
- watch
- update
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- "coordination.k8s.io"
resources:
- leases
verbs:
- create
- get
- list
- watch
- update
{{- end -}}

View File

@ -0,0 +1,14 @@
{{- if .Values.vCenter.credentialsSecret.generate -}}
# Source: https://github.com/kubernetes/cloud-provider-vsphere
apiVersion: v1
kind: Secret
metadata:
name: {{ .Values.vCenter.credentialsSecret.name }}
labels:
vsphere-cpi-infra: secret
component: {{ .Chart.Name }}-cloud-controller-manager
namespace: {{ .Release.Namespace }}
data:
{{ .Values.vCenter.host }}.username: {{ .Values.vCenter.username | b64enc | quote }}
{{ .Values.vCenter.host }}.password: {{ .Values.vCenter.password | b64enc | quote }}
{{- end -}}

View File

@ -0,0 +1,11 @@
{{- if .Values.cloudControllerManager.rbac.enabled -}}
# Source: https://github.com/kubernetes/cloud-provider-vsphere
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ .Chart.Name }}-cloud-controller-manager
labels:
vsphere-cpi-infra: service-account
component: {{ .Chart.Name }}-cloud-controller-manager
namespace: {{ .Release.Namespace }}
{{- end -}}

View File

@ -0,0 +1,16 @@
# Source: https://github.com/kubernetes/cloud-provider-vsphere
apiVersion: v1
kind: Service
metadata:
labels:
component: {{ .Chart.Name }}-cloud-controller-manager
name: {{ .Chart.Name }}-cloud-controller-manager
namespace: {{ .Release.Namespace }}
spec:
type: NodePort
ports:
- port: 43001
protocol: TCP
targetPort: 43001
selector:
component: {{ .Chart.Name }}-cloud-controller-manager

View File

@ -0,0 +1,33 @@
vCenter:
host: ""
port: 443
insecureFlag: "1"
datacenters: ""
username: ""
password: ""
credentialsSecret:
name: "vsphere-cpi-creds"
generate: true
cloudControllerManager:
image:
"1.21":
repository: rancher/mirrored-cloud-provider-vsphere-cpi-release-manager
tag: v1.21.0
"1.20":
repository: rancher/mirrored-cloud-provider-vsphere-cpi-release-manager
tag: v1.20.0
"1.19":
repository: rancher/mirrored-cloud-provider-vsphere-cpi-release-manager
tag: v1.19.0
"1.18":
repository: rancher/mirrored-cloud-provider-vsphere-cpi-release-manager
tag: v1.18.0
nodeSelector: {}
tolerations: {}
rbac:
enabled: true
global:
cattle:
systemDefaultRegistry: ""