kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: ovirt-csi-driver-node
  namespace: openshift-cluster-csi-drivers
  annotations:
    config.openshift.io/inject-proxy: csi-driver
spec:
  selector:
    matchLabels:
      app: ovirt-csi-driver-node
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 10%
  template:
    metadata:
      labels:
        app: ovirt-csi-driver-node
    spec:
      hostNetwork: true
      serviceAccount: ovirt-csi-driver-node-sa
      priorityClassName: system-node-critical
      tolerations:
        - operator: Exists
      initContainers:
        - name: prepare-ovirt-config
          env:
            - name: OVIRT_URL
              valueFrom:
                secretKeyRef:
                  name: ovirt-credentials
                  key: ovirt_url
            - name: OVIRT_USERNAME
              valueFrom:
                secretKeyRef:
                  name: ovirt-credentials
                  key: ovirt_username
            - name: OVIRT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: ovirt-credentials
                  key: ovirt_password
            - name: OVIRT_CAFILE
              value: /tmp/config/ovirt-engine-ca.pem
            - name: OVIRT_INSECURE
              valueFrom:
                secretKeyRef:
                  name: ovirt-credentials
                  key: ovirt_insecure
            - name: OVIRT_CA_BUNDLE
              valueFrom:
                secretKeyRef:
                  name: ovirt-credentials
                  key: ovirt_ca_bundle
          image: ${DRIVER_IMAGE}
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
            - -c
            - |
              #!/bin/sh
              cat << EOF > /tmp/config/ovirt-config.yaml
              ovirt_url: $OVIRT_URL
              ovirt_username: $OVIRT_USERNAME
              ovirt_password: $OVIRT_PASSWORD
              # set a valid path only if ca bundle has content
              ovirt_cafile: ${OVIRT_CA_BUNDLE:+$OVIRT_CAFILE}
              ovirt_insecure: $OVIRT_INSECURE
              EOF
              if [[ -n "$OVIRT_CA_BUNDLE" ]]; then echo "$OVIRT_CA_BUNDLE" > $OVIRT_CAFILE ; fi
          volumeMounts:
            - name: config
              mountPath: /tmp/config
          resources:
            requests:
              memory: 50Mi
              cpu: 10m
      containers:
        - name: csi-driver
          securityContext:
            privileged: true
          image: ${DRIVER_IMAGE}
          imagePullPolicy: IfNotPresent
          args:
            - --endpoint=$(CSI_ENDPOINT)
            - --logtostderr
            - --v=${LOG_LEVEL}
            - --node-name=$(KUBE_NODE_NAME)
          env:
            - name: CSI_ENDPOINT
              value: unix:/csi/csi.sock
            - name: OVIRT_CONFIG
              value: /tmp/config/ovirt-config.yaml
            - name: KUBE_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            - name: kubelet-dir
              mountPath: /var/lib/kubelet
              mountPropagation: "Bidirectional"
            - name: plugin-dir
              mountPath: /csi
            - name: device-dir
              mountPath: /dev
            - name: udev
              mountPath: /run/udev
            - name: config
              mountPath: /tmp/config

          ports:
            - name: healthz
              # Due to hostNetwork, this port is open on a node!
              containerPort: 10300
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /healthz
              port: healthz
            initialDelaySeconds: 10
            timeoutSeconds: 3
            periodSeconds: 30
            failureThreshold: 5
          resources:
            requests:
              memory: 50Mi
              cpu: 10m
        - name: csi-node-driver-registrar
          securityContext:
            privileged: true
          image: ${NODE_DRIVER_REGISTRAR_IMAGE}
          imagePullPolicy: IfNotPresent
          args:
            - --csi-address=$(ADDRESS)
            - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
            - --v=${LOG_LEVEL}
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "rm -rf /registration/csi.ovirt.org-reg.sock /csi/csi.sock"]
          env:
            - name: ADDRESS
              value: /csi/csi.sock
            - name: DRIVER_REG_SOCK_PATH
              value: /var/lib/kubelet/plugins/csi.ovirt.org/csi.sock
          volumeMounts:
            - name: plugin-dir
              mountPath: /csi
            - name: registration-dir
              mountPath: /registration
          resources:
            requests:
              memory: 20Mi
              cpu: 5m
        - name: csi-liveness-probe
          image: ${LIVENESS_PROBE_IMAGE}
          imagePullPolicy: IfNotPresent
          args:
            - --csi-address=/csi/csi.sock
            - --probe-timeout=3s
            - --health-port=10300
          volumeMounts:
            - name: plugin-dir
              mountPath: /csi
          resources:
            requests:
              memory: 20Mi
              cpu: 5m
      volumes:
        - name: kubelet-dir
          hostPath:
            path: /var/lib/kubelet
            type: Directory
        - name: plugin-dir
          hostPath:
            path: /var/lib/kubelet/plugins/csi.ovirt.org/
            type: DirectoryOrCreate
        - name: registration-dir
          hostPath:
            path: /var/lib/kubelet/plugins_registry/
            type: Directory
        - name: device-dir
          hostPath:
            path: /dev
            type: Directory
        - name: udev
          hostPath:
            path: /run/udev
        - name: config
          emptyDir: {}
