Use kustomize for csi driver

Signed-off-by: Jirka Kremser <[email protected]>

.gitignore

@@ -1,3 +1,3 @@
 # binary
-/bin/kustomize
+/bin/*
 

Makefile.custom.mk

@@ -4,9 +4,11 @@ OS ?= $(shell go env GOOS 2>/dev/null || echo linux)
 ARCH ?= $(shell go env GOARCH 2>/dev/null || echo amd64)
 KUSTOMIZE := ./bin/kustomize
 KUSTOMIZE_VERSION ?= v4.5.7
+YQ = ./bin/yq
+YQ_VERSION := 4.31.2
 
 .PHONY: all
-all: update-cpi-chart update-csi-chart update-kubevip-chart update-kubevip-cloud-provider-chart
+all: update-cpi-chart update-csi-chart apply-custom-patches-for-csi update-kubevip-chart update-kubevip-cloud-provider-chart
 	@$(call say,Sync has been done ✓)
 
 .PHONY: update-cpi-chart
@@ -15,11 +17,16 @@ update-cpi-chart:
 	./hack/update-cpi-chart.sh
 	./hack/common-labels-injector.sh cloud-provider-for-vsphere
 
+.PHONY: apply-custom-patches-for-csi
+apply-custom-patches-for-csi: $(YQ) ## apply giantswarm specific patches that are not possible via kustomize
+	@$(call say,Custom yq magic for CSI)
+	./hack/custom-patches.sh
+	./hack/common-labels-injector.sh vsphere-csi-driver
+
 .PHONY: update-csi-chart
 update-csi-chart: $(KUSTOMIZE)
 	@$(call say,CSI helm chart)
 	./hack/update-csi-chart.sh $(KUSTOMIZE)
-	./hack/common-labels-injector.sh vsphere-csi-driver
 
 .PHONY: update-kubevip-chart
 update-kubevip-chart:
@@ -40,6 +47,13 @@ $(KUSTOMIZE): ## Download kustomize locally if necessary.
 	chmod +x $@
 	@echo "kustomize downloaded"
 
+$(YQ): ## Download yq locally if necessary.
+	@$(call say,Download yq)
+	curl -sfL https://github.com/mikefarah/yq/releases/download/v$(YQ_VERSION)/yq_$(OS)_$(ARCH) > $@
+	chmod +x $@
+	@echo "yq downloaded"
+
+
 ifndef NO_COLOR
 YELLOW=\033[0;33m
 # no color

config/vsphere-csi-driver/overwrites/values.yaml

@@ -53,3 +53,9 @@ storageClass:
     isDefault: false
     vcdStorageProfileName: "vSAN Default Storage Policy"
     fileSystem: "ext4"
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault

hack/custom-patches.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+YQ="./bin/yq"
+
+f="helm/cloud-provider-vsphere/charts/vsphere-csi-driver/templates/apps_v1_deployment_vsphere-csi-controller.yaml"
+${YQ} e '.spec.template.spec.securityContext.remove-this-key="'"
+{{- with .Values.podSecurityContext }}
+  {{- . | toYaml | nindent 8 }}
+{{- end }}
+"'" | .spec.template.spec.containers[].securityContext.remove-this-key="'"
+{{- with .Values.containerSecurityContext }}
+  {{- . | toYaml | nindent 12 }}
+{{- end }}
+"'"' ${f} > ${f}.tmp
+cat ${f}.tmp | grep -v 'remove-this-key' > ${f}
+rm -rf ${f}.tmp

helm/cloud-provider-vsphere/charts/cloud-provider-for-vsphere/templates/daemonset.yaml

@@ -45,6 +45,9 @@ spec:
       - key: node.cloudprovider.kubernetes.io/uninitialized
         value: "true"
         effect: NoSchedule
+      - key: node.cluster.x-k8s.io/uninitialized
+        effect: NoSchedule
+        operator: Exists
       - key: node-role.kubernetes.io/master
         effect: NoSchedule
         operator: Exists