---
apiVersion: storage.k8s.io/v1
kind: CSIDriver
metadata:
  name: org.democratic-csi.nfs-client
spec:
  attachRequired: false
  podInfoOnMount: true
  volumeLifecycleModes:
    - Persistent
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: {{ taskserv.storage_class_name | default(value="nfs-shared") }}
provisioner: org.democratic-csi.nfs-client
reclaimPolicy: {{ taskserv.reclaim_policy | default(value="Retain") }}
volumeBindingMode: Immediate
allowVolumeExpansion: false
mountOptions:
  - noatime
  - nfsvers=4
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: democratic-csi-controller
  namespace: democratic-csi
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: democratic-csi-node
  namespace: democratic-csi
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: democratic-csi-controller
rules:
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "create", "delete", "patch"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    verbs: ["get", "list", "watch", "patch"]
  - apiGroups: [""]
    resources: ["events"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["csinodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["volumeattachments"]
    verbs: ["get", "list", "watch", "patch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["volumeattachments/status"]
    verbs: ["patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: democratic-csi-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: democratic-csi-controller
subjects:
  - kind: ServiceAccount
    name: democratic-csi-controller
    namespace: democratic-csi
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: democratic-csi-driver-config
  namespace: democratic-csi
data:
  driver-config-file.yaml: |
    driver: nfs-client
    instance_id: ""
    nfs:
      shareHost: "{{ taskserv.nfs_server }}"
      shareBasePath: "{{ taskserv.nfs_share_base_path | default(value="/shared") }}"
      shareAlldirs: false
      shareAllowedHosts: []
      shareAllowedNetworks: []
    sshConnection:
      host: "{{ taskserv.nfs_server }}"
      port: 22
      username: root
      privateKeyFile: /root/.ssh/id_ed25519
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: democratic-csi-controller
  namespace: democratic-csi
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: democratic-csi
      app.kubernetes.io/component: controller
  template:
    metadata:
      labels:
        app.kubernetes.io/name: democratic-csi
        app.kubernetes.io/component: controller
    spec:
      serviceAccountName: democratic-csi-controller
      tolerations:
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule
      containers:
        - name: csi-provisioner
          image: registry.k8s.io/sig-storage/csi-provisioner:v5.2.0
          args:
            - --csi-address=/csi-data/csi.sock
            - --v=5
            - --timeout=90s
            - --worker-threads=10
          volumeMounts:
            - name: socket-dir
              mountPath: /csi-data
        - name: driver
          image: docker.io/democraticcsi/democratic-csi:v1.9.3
          args:
            - --csi-address=/csi-data/csi.sock
            - --csi-mode=controller
            - --driver-config-file=/config/driver-config-file.yaml
            - --log-level=info
            - --csi-name=org.democratic-csi.nfs-client
            - --csi-version=1.5.0
            - --server-socket=/csi-data/csi.sock
          volumeMounts:
            - name: socket-dir
              mountPath: /csi-data
            - name: config
              mountPath: /config
              readOnly: true
      volumes:
        - name: socket-dir
          emptyDir: {}
        - name: config
          configMap:
            name: democratic-csi-driver-config
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: democratic-csi-node
  namespace: democratic-csi
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: democratic-csi
      app.kubernetes.io/component: node
  template:
    metadata:
      labels:
        app.kubernetes.io/name: democratic-csi
        app.kubernetes.io/component: node
    spec:
      serviceAccountName: democratic-csi-node
      hostNetwork: true
      tolerations:
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule
      containers:
        - name: csi-node-driver-registrar
          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0
          args:
            - --csi-address=/csi-data/csi.sock
            - --kubelet-registration-path=/var/lib/kubelet/plugins/org.democratic-csi.nfs-client/csi.sock
          volumeMounts:
            - name: socket-dir
              mountPath: /csi-data
            - name: registration-dir
              mountPath: /registration
        - name: driver
          image: docker.io/democraticcsi/democratic-csi:v1.9.3
          args:
            - --csi-address=/csi-data/csi.sock
            - --csi-mode=node
            - --driver-config-file=/config/driver-config-file.yaml
            - --log-level=info
            - --csi-name=org.democratic-csi.nfs-client
            - --csi-version=1.5.0
            - --server-socket=/csi-data/csi.sock
          securityContext:
            privileged: true
          volumeMounts:
            - name: socket-dir
              mountPath: /csi-data
            - name: kubelet-dir
              mountPath: /var/lib/kubelet
              mountPropagation: Bidirectional
            - name: config
              mountPath: /config
              readOnly: true
      volumes:
        - name: socket-dir
          hostPath:
            path: /var/lib/kubelet/plugins/org.democratic-csi.nfs-client
            type: DirectoryOrCreate
        - name: registration-dir
          hostPath:
            path: /var/lib/kubelet/plugins_registry
            type: Directory
        - name: kubelet-dir
          hostPath:
            path: /var/lib/kubelet
            type: Directory
        - name: config
          configMap:
            name: democratic-csi-driver-config