Merge pull request #14186 from hakman/hetzner_csi-driver_latest

Update CSI driver to latest for Hetzner

tests/integration/update_cluster/minimal_hetzner/data/aws_s3_object_minimal.k8s.local-addons-bootstrap_content

@@ -55,7 +55,7 @@ spec:
     version: 9.99.0
   - id: k8s-1.22
     manifest: hcloud-csi-driver.addons.k8s.io/k8s-1.22.yaml
-    manifestHash: ab12002aa9a1c17f7568acc659dd38f73f14c2547ce75dafef0d95a15cb0b189
+    manifestHash: 4c3eaaab2359e91bbd50ca60a3f84de376ecbd2e1bab32de4bce758e2184deed
     name: hcloud-csi-driver.addons.k8s.io
     selector:
       k8s-addon: hcloud-csi-driver.addons.k8s.io

tests/integration/update_cluster/minimal_hetzner/data/aws_s3_object_minimal.k8s.local-addons-hcloud-csi-driver.addons.k8s.io-k8s-1.22_content

@@ -13,23 +13,6 @@ stringData:
 
 ---
 
-apiVersion: storage.k8s.io/v1
-kind: CSIDriver
-metadata:
-  creationTimestamp: null
-  labels:
-    addon.kops.k8s.io/name: hcloud-csi-driver.addons.k8s.io
-    app.kubernetes.io/managed-by: kops
-    k8s-addon: hcloud-csi-driver.addons.k8s.io
-  name: csi.hetzner.cloud
-spec:
-  attachRequired: true
-  podInfoOnMount: true
-  volumeLifecycleModes:
-  - Persistent
-
----
-
 allowVolumeExpansion: true
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
@@ -56,7 +39,7 @@ metadata:
     addon.kops.k8s.io/name: hcloud-csi-driver.addons.k8s.io
     app.kubernetes.io/managed-by: kops
     k8s-addon: hcloud-csi-driver.addons.k8s.io
-  name: hcloud-csi
+  name: hcloud-csi-controller
   namespace: kube-system
 
 ---
@@ -69,7 +52,7 @@ metadata:
     addon.kops.k8s.io/name: hcloud-csi-driver.addons.k8s.io
     app.kubernetes.io/managed-by: kops
     k8s-addon: hcloud-csi-driver.addons.k8s.io
-  name: hcloud-csi
+  name: hcloud-csi-controller
 rules:
 - apiGroups:
   - ""
@@ -212,256 +195,15 @@ metadata:
     addon.kops.k8s.io/name: hcloud-csi-driver.addons.k8s.io
     app.kubernetes.io/managed-by: kops
     k8s-addon: hcloud-csi-driver.addons.k8s.io
-  name: hcloud-csi
+  name: hcloud-csi-controller
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: hcloud-csi
+  name: hcloud-csi-controller
 subjects:
 - kind: ServiceAccount
-  name: hcloud-csi
-  namespace: kube-system
-
----
-
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  creationTimestamp: null
-  labels:
-    addon.kops.k8s.io/name: hcloud-csi-driver.addons.k8s.io
-    app.kubernetes.io/managed-by: kops
-    k8s-addon: hcloud-csi-driver.addons.k8s.io
   name: hcloud-csi-controller
   namespace: kube-system
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hcloud-csi-controller
-  serviceName: hcloud-csi-controller
-  template:
-    metadata:
-      labels:
-        app: hcloud-csi-controller
-    spec:
-      containers:
-      - image: k8s.gcr.io/sig-storage/csi-attacher:v3.2.1
-        name: csi-attacher
-        securityContext:
-          allowPrivilegeEscalation: true
-          capabilities:
-            add:
-            - SYS_ADMIN
-          privileged: true
-        volumeMounts:
-        - mountPath: /run/csi
-          name: socket-dir
-      - image: k8s.gcr.io/sig-storage/csi-resizer:v1.2.0
-        name: csi-resizer
-        securityContext:
-          allowPrivilegeEscalation: true
-          capabilities:
-            add:
-            - SYS_ADMIN
-          privileged: true
-        volumeMounts:
-        - mountPath: /run/csi
-          name: socket-dir
-      - args:
-        - --feature-gates=Topology=true
-        - --default-fstype=ext4
-        image: k8s.gcr.io/sig-storage/csi-provisioner:v2.2.2
-        name: csi-provisioner
-        securityContext:
-          allowPrivilegeEscalation: true
-          capabilities:
-            add:
-            - SYS_ADMIN
-          privileged: true
-        volumeMounts:
-        - mountPath: /run/csi
-          name: socket-dir
-      - env:
-        - name: CSI_ENDPOINT
-          value: unix:///run/csi/socket
-        - name: METRICS_ENDPOINT
-          value: 0.0.0.0:9189
-        - name: ENABLE_METRICS
-          value: "true"
-        - name: KUBE_NODE_NAME
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: spec.nodeName
-        - name: HCLOUD_TOKEN
-          valueFrom:
-            secretKeyRef:
-              key: token
-              name: hcloud-csi
-        image: hetznercloud/hcloud-csi-driver:1.6.0
-        imagePullPolicy: Always
-        livenessProbe:
-          failureThreshold: 5
-          httpGet:
-            path: /healthz
-            port: healthz
-          initialDelaySeconds: 10
-          periodSeconds: 2
-          timeoutSeconds: 3
-        name: hcloud-csi-driver
-        ports:
-        - containerPort: 9189
-          name: metrics
-        - containerPort: 9808
-          name: healthz
-          protocol: TCP
-        securityContext:
-          allowPrivilegeEscalation: true
-          capabilities:
-            add:
-            - SYS_ADMIN
-          privileged: true
-        volumeMounts:
-        - mountPath: /run/csi
-          name: socket-dir
-      - image: k8s.gcr.io/sig-storage/livenessprobe:v2.3.0
-        imagePullPolicy: Always
-        name: liveness-probe
-        volumeMounts:
-        - mountPath: /run/csi
-          name: socket-dir
-      serviceAccount: hcloud-csi
-      volumes:
-      - emptyDir: {}
-        name: socket-dir
-
----
-
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  creationTimestamp: null
-  labels:
-    addon.kops.k8s.io/name: hcloud-csi-driver.addons.k8s.io
-    app: hcloud-csi
-    app.kubernetes.io/managed-by: kops
-    k8s-addon: hcloud-csi-driver.addons.k8s.io
-  name: hcloud-csi-node
-  namespace: kube-system
-spec:
-  selector:
-    matchLabels:
-      app: hcloud-csi
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        app: hcloud-csi
-        kops.k8s.io/managed-by: kops
-    spec:
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: instance.hetzner.cloud/is-root-server
-                operator: NotIn
-                values:
-                - "true"
-      containers:
-      - args:
-        - --kubelet-registration-path=/var/lib/kubelet/plugins/csi.hetzner.cloud/socket
-        env:
-        - name: KUBE_NODE_NAME
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: spec.nodeName
-        image: k8s.gcr.io/sig-storage/csi-node-driver-registrar:v2.2.0
-        name: csi-node-driver-registrar
-        securityContext:
-          privileged: true
-        volumeMounts:
-        - mountPath: /run/csi
-          name: plugin-dir
-        - mountPath: /registration
-          name: registration-dir
-      - env:
-        - name: CSI_ENDPOINT
-          value: unix:///run/csi/socket
-        - name: METRICS_ENDPOINT
-          value: 0.0.0.0:9189
-        - name: ENABLE_METRICS
-          value: "true"
-        - name: HCLOUD_TOKEN
-          valueFrom:
-            secretKeyRef:
-              key: token
-              name: hcloud-csi
-        - name: KUBE_NODE_NAME
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: spec.nodeName
-        image: hetznercloud/hcloud-csi-driver:1.6.0
-        imagePullPolicy: Always
-        livenessProbe:
-          failureThreshold: 5
-          httpGet:
-            path: /healthz
-            port: healthz
-          initialDelaySeconds: 10
-          periodSeconds: 2
-          timeoutSeconds: 3
-        name: hcloud-csi-driver
-        ports:
-        - containerPort: 9189
-          name: metrics
-        - containerPort: 9808
-          name: healthz
-          protocol: TCP
-        securityContext:
-          privileged: true
-        volumeMounts:
-        - mountPath: /var/lib/kubelet
-          mountPropagation: Bidirectional
-          name: kubelet-dir
-        - mountPath: /run/csi
-          name: plugin-dir
-        - mountPath: /dev
-          name: device-dir
-      - image: k8s.gcr.io/sig-storage/livenessprobe:v2.3.0
-        imagePullPolicy: Always
-        name: liveness-probe
-        volumeMounts:
-        - mountPath: /run/csi
-          name: plugin-dir
-      serviceAccount: hcloud-csi
-      tolerations:
-      - effect: NoExecute
-        operator: Exists
-      - effect: NoSchedule
-        operator: Exists
-      - key: CriticalAddonsOnly
-        operator: Exists
-      volumes:
-      - hostPath:
-          path: /var/lib/kubelet
-          type: Directory
-        name: kubelet-dir
-      - hostPath:
-          path: /var/lib/kubelet/plugins/csi.hetzner.cloud/
-          type: DirectoryOrCreate
-        name: plugin-dir
-      - hostPath:
-          path: /var/lib/kubelet/plugins_registry/
-          type: Directory
-        name: registration-dir
-      - hostPath:
-          path: /dev
-          type: Directory
-        name: device-dir
 
 ---
 
@@ -504,3 +246,224 @@ spec:
     targetPort: metrics
   selector:
     app: hcloud-csi
+
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    addon.kops.k8s.io/name: hcloud-csi-driver.addons.k8s.io
+    app.kubernetes.io/managed-by: kops
+    k8s-addon: hcloud-csi-driver.addons.k8s.io
+  name: hcloud-csi-controller
+  namespace: kube-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: hcloud-csi-controller
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: hcloud-csi-controller
+        kops.k8s.io/managed-by: kops
+    spec:
+      containers:
+      - image: k8s.gcr.io/sig-storage/csi-attacher:v3.2.1
+        name: csi-attacher
+        volumeMounts:
+        - mountPath: /run/csi
+          name: socket-dir
+      - image: k8s.gcr.io/sig-storage/csi-resizer:v1.2.0
+        name: csi-resizer
+        volumeMounts:
+        - mountPath: /run/csi
+          name: socket-dir
+      - args:
+        - --feature-gates=Topology=true
+        - --default-fstype=ext4
+        image: k8s.gcr.io/sig-storage/csi-provisioner:v2.2.2
+        name: csi-provisioner
+        volumeMounts:
+        - mountPath: /run/csi
+          name: socket-dir
+      - command:
+        - /bin/hcloud-csi-driver-controller
+        env:
+        - name: CSI_ENDPOINT
+          value: unix:///run/csi/socket
+        - name: METRICS_ENDPOINT
+          value: 0.0.0.0:9189
+        - name: ENABLE_METRICS
+          value: "true"
+        - name: KUBE_NODE_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: spec.nodeName
+        - name: HCLOUD_TOKEN
+          valueFrom:
+            secretKeyRef:
+              key: token
+              name: hcloud-csi
+        image: hetznercloud/hcloud-csi-driver:latest
+        imagePullPolicy: Always
+        livenessProbe:
+          failureThreshold: 5
+          httpGet:
+            path: /healthz
+            port: healthz
+          initialDelaySeconds: 10
+          periodSeconds: 2
+          timeoutSeconds: 3
+        name: hcloud-csi-driver
+        ports:
+        - containerPort: 9189
+          name: metrics
+        - containerPort: 9808
+          name: healthz
+          protocol: TCP
+        volumeMounts:
+        - mountPath: /run/csi
+          name: socket-dir
+      - image: k8s.gcr.io/sig-storage/livenessprobe:v2.3.0
+        imagePullPolicy: Always
+        name: liveness-probe
+        volumeMounts:
+        - mountPath: /run/csi
+          name: socket-dir
+      serviceAccountName: hcloud-csi-controller
+      volumes:
+      - emptyDir: {}
+        name: socket-dir
+
+---
+
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  creationTimestamp: null
+  labels:
+    addon.kops.k8s.io/name: hcloud-csi-driver.addons.k8s.io
+    app: hcloud-csi
+    app.kubernetes.io/managed-by: kops
+    k8s-addon: hcloud-csi-driver.addons.k8s.io
+  name: hcloud-csi-node
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      app: hcloud-csi
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: hcloud-csi
+        kops.k8s.io/managed-by: kops
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: instance.hetzner.cloud/is-root-server
+                operator: NotIn
+                values:
+                - "true"
+      containers:
+      - args:
+        - --kubelet-registration-path=/var/lib/kubelet/plugins/csi.hetzner.cloud/socket
+        image: k8s.gcr.io/sig-storage/csi-node-driver-registrar:v2.2.0
+        name: csi-node-driver-registrar
+        volumeMounts:
+        - mountPath: /run/csi
+          name: plugin-dir
+        - mountPath: /registration
+          name: registration-dir
+      - command:
+        - /bin/hcloud-csi-driver-node
+        env:
+        - name: CSI_ENDPOINT
+          value: unix:///run/csi/socket
+        - name: METRICS_ENDPOINT
+          value: 0.0.0.0:9189
+        - name: ENABLE_METRICS
+          value: "true"
+        image: hetznercloud/hcloud-csi-driver:latest
+        imagePullPolicy: Always
+        livenessProbe:
+          failureThreshold: 5
+          httpGet:
+            path: /healthz
+            port: healthz
+          initialDelaySeconds: 10
+          periodSeconds: 2
+          timeoutSeconds: 3
+        name: hcloud-csi-driver
+        ports:
+        - containerPort: 9189
+          name: metrics
+        - containerPort: 9808
+          name: healthz
+          protocol: TCP
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - mountPath: /var/lib/kubelet
+          mountPropagation: Bidirectional
+          name: kubelet-dir
+        - mountPath: /run/csi
+          name: plugin-dir
+        - mountPath: /dev
+          name: device-dir
+      - image: k8s.gcr.io/sig-storage/livenessprobe:v2.3.0
+        imagePullPolicy: Always
+        name: liveness-probe
+        volumeMounts:
+        - mountPath: /run/csi
+          name: plugin-dir
+      tolerations:
+      - effect: NoExecute
+        operator: Exists
+      - effect: NoSchedule
+        operator: Exists
+      - key: CriticalAddonsOnly
+        operator: Exists
+      volumes:
+      - hostPath:
+          path: /var/lib/kubelet
+          type: Directory
+        name: kubelet-dir
+      - hostPath:
+          path: /var/lib/kubelet/plugins/csi.hetzner.cloud/
+          type: DirectoryOrCreate
+        name: plugin-dir
+      - hostPath:
+          path: /var/lib/kubelet/plugins_registry/
+          type: Directory
+        name: registration-dir
+      - hostPath:
+          path: /dev
+          type: Directory
+        name: device-dir
+
+---
+
+apiVersion: storage.k8s.io/v1
+kind: CSIDriver
+metadata:
+  creationTimestamp: null
+  labels:
+    addon.kops.k8s.io/name: hcloud-csi-driver.addons.k8s.io
+    app.kubernetes.io/managed-by: kops
+    k8s-addon: hcloud-csi-driver.addons.k8s.io
+  name: csi.hetzner.cloud
+spec:
+  attachRequired: true
+  fsGroupPolicy: File
+  podInfoOnMount: true
+  volumeLifecycleModes:
+  - Persistent

upup/models/cloudup/resources/addons/hcloud-csi-driver.addons.k8s.io/k8s-1.22.yaml.template

@@ -1,4 +1,4 @@
-# Pulled and modified from: https://raw.githubusercontent.com/hetznercloud/csi-driver/v1.6.0/deploy/kubernetes/hcloud-csi.yml
+# Pulled and modified from: https://raw.githubusercontent.com/hetznercloud/csi-driver/main/deploy/kubernetes/hcloud-csi.yml
 ---
 apiVersion: v1
 kind: Secret
@@ -6,213 +6,295 @@ metadata:
   name: hcloud-csi
   namespace: kube-system
 stringData:
-  token: {{ HCLOUD_TOKEN }}
+  token: '{{ HCLOUD_TOKEN }}'
 ---
+allowVolumeExpansion: true
 apiVersion: storage.k8s.io/v1
-kind: CSIDriver
-metadata:
-  name: csi.hetzner.cloud
-spec:
-  attachRequired: true
-  podInfoOnMount: true
-  volumeLifecycleModes:
-    - Persistent
----
 kind: StorageClass
-apiVersion: storage.k8s.io/v1
 metadata:
-  namespace: kube-system
-  name: hcloud-volumes
   annotations:
     storageclass.kubernetes.io/is-default-class: "true"
+  name: hcloud-volumes
+  namespace: kube-system
 provisioner: csi.hetzner.cloud
 volumeBindingMode: WaitForFirstConsumer
-allowVolumeExpansion: true
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: hcloud-csi
+  name: hcloud-csi-controller
   namespace: kube-system
 ---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: hcloud-csi
+  name: hcloud-csi-controller
 rules:
-  # attacher
+- apiGroups:
-  - apiGroups: [""]
+  - ""
-    resources: ["persistentvolumes"]
+  resources:
-    verbs: ["get", "list", "watch", "update", "patch"]
+  - persistentvolumes
-  - apiGroups: [""]
+  verbs:
-    resources: ["nodes"]
+  - get
-    verbs: ["get", "list", "watch"]
+  - list
-  - apiGroups: ["csi.storage.k8s.io"]
+  - watch
-    resources: ["csinodeinfos"]
+  - update
-    verbs: ["get", "list", "watch"]
+  - patch
-  - apiGroups: ["storage.k8s.io"]
+- apiGroups:
-    resources: ["csinodes"]
+  - ""
-    verbs: ["get", "list", "watch"]
+  resources:
-  - apiGroups: ["storage.k8s.io"]
+  - nodes
-    resources: ["volumeattachments"]
+  verbs:
-    verbs: ["get", "list", "watch", "update", "patch"]
+  - get
-  - apiGroups: ["storage.k8s.io"]
+  - list
-    resources: ["volumeattachments/status"]
+  - watch
-    verbs: ["patch"]
+- apiGroups:
-  # provisioner
+  - csi.storage.k8s.io
-  - apiGroups: [""]
+  resources:
-    resources: ["secrets"]
+  - csinodeinfos
-    verbs: ["get", "list"]
+  verbs:
-  - apiGroups: [""]
+  - get
-    resources: ["persistentvolumes"]
+  - list
-    verbs: ["get", "list", "watch", "create", "delete", "patch"]
+  - watch
-  - apiGroups: [""]
+- apiGroups:
-    resources: ["persistentvolumeclaims", "persistentvolumeclaims/status"]
+  - storage.k8s.io
-    verbs: ["get", "list", "watch", "update", "patch"]
+  resources:
-  - apiGroups: ["storage.k8s.io"]
+  - csinodes
-    resources: ["storageclasses"]
+  verbs:
-    verbs: ["get", "list", "watch"]
+  - get
-  - apiGroups: [""]
+  - list
-    resources: ["events"]
+  - watch
-    verbs: ["list", "watch", "create", "update", "patch"]
+- apiGroups:
-  - apiGroups: ["snapshot.storage.k8s.io"]
+  - storage.k8s.io
-    resources: ["volumesnapshots"]
+  resources:
-    verbs: ["get", "list"]
+  - volumeattachments
-  - apiGroups: ["snapshot.storage.k8s.io"]
+  verbs:
-    resources: ["volumesnapshotcontents"]
+  - get
-    verbs: ["get", "list"]
+  - list
-  # resizer
+  - watch
-  - apiGroups: [""]
+  - update
-    resources: ["pods"]
+  - patch
-    verbs: ["get", "list", "watch"]
+- apiGroups:
-  # node
+  - storage.k8s.io
-  - apiGroups: [""]
+  resources:
-    resources: ["events"]
+  - volumeattachments/status
-    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  verbs:
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumes
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - persistentvolumeclaims
+  - persistentvolumeclaims/status
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - storage.k8s.io
+  resources:
+  - storageclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - list
+  - watch
+  - create
+  - update
+  - patch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshots
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshotcontents
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
 ---
-kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
 metadata:
-  name: hcloud-csi
+  name: hcloud-csi-controller
-subjects:
-  - kind: ServiceAccount
-    name: hcloud-csi
-    namespace: kube-system
 roleRef:
-  kind: ClusterRole
-  name: hcloud-csi
   apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: hcloud-csi-controller
+subjects:
+- kind: ServiceAccount
+  name: hcloud-csi-controller
+  namespace: kube-system
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: hcloud-csi
+  name: hcloud-csi-controller-metrics
+  namespace: kube-system
+spec:
+  ports:
+  - name: metrics
+    port: 9189
+    targetPort: metrics
+  selector:
+    app: hcloud-csi-controller
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: hcloud-csi
+  name: hcloud-csi-node-metrics
+  namespace: kube-system
+spec:
+  ports:
+  - name: metrics
+    port: 9189
+    targetPort: metrics
+  selector:
+    app: hcloud-csi
 ---
-kind: StatefulSet
 apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: hcloud-csi-controller
   namespace: kube-system
 spec:
+  replicas: 1
   selector:
     matchLabels:
       app: hcloud-csi-controller
-  serviceName: hcloud-csi-controller
-  replicas: 1
   template:
     metadata:
       labels:
         app: hcloud-csi-controller
     spec:
-      serviceAccount: hcloud-csi
       containers:
-        - name: csi-attacher
+      - image: k8s.gcr.io/sig-storage/csi-attacher:v3.2.1
-          image: k8s.gcr.io/sig-storage/csi-attacher:v3.2.1
+        name: csi-attacher
-          volumeMounts:
+        volumeMounts:
-            - name: socket-dir
+        - mountPath: /run/csi
-              mountPath: /run/csi
+          name: socket-dir
-          securityContext:
+      - image: k8s.gcr.io/sig-storage/csi-resizer:v1.2.0
-            privileged: true
+        name: csi-resizer
-            capabilities:
+        volumeMounts:
-              add: ["SYS_ADMIN"]
+        - mountPath: /run/csi
-            allowPrivilegeEscalation: true
+          name: socket-dir
-        - name: csi-resizer
+      - args:
-          image: k8s.gcr.io/sig-storage/csi-resizer:v1.2.0
+        - --feature-gates=Topology=true
-          volumeMounts:
+        - --default-fstype=ext4
-            - name: socket-dir
+        image: k8s.gcr.io/sig-storage/csi-provisioner:v2.2.2
-              mountPath: /run/csi
+        name: csi-provisioner
-          securityContext:
+        volumeMounts:
-            privileged: true
+        - mountPath: /run/csi
-            capabilities:
+          name: socket-dir
-              add: ["SYS_ADMIN"]
+      - command:
-            allowPrivilegeEscalation: true
+        - /bin/hcloud-csi-driver-controller
-        - name: csi-provisioner
+        env:
-          image: k8s.gcr.io/sig-storage/csi-provisioner:v2.2.2
+        - name: CSI_ENDPOINT
-          args:
+          value: unix:///run/csi/socket
-            - --feature-gates=Topology=true
+        - name: METRICS_ENDPOINT
-            - --default-fstype=ext4
+          value: 0.0.0.0:9189
-          volumeMounts:
+        - name: ENABLE_METRICS
-            - name: socket-dir
+          value: "true"
-              mountPath: /run/csi
+        - name: KUBE_NODE_NAME
-          securityContext:
+          valueFrom:
-            privileged: true
+            fieldRef:
-            capabilities:
+              apiVersion: v1
-              add: ["SYS_ADMIN"]
+              fieldPath: spec.nodeName
-            allowPrivilegeEscalation: true
+        - name: HCLOUD_TOKEN
-        - name: hcloud-csi-driver
+          valueFrom:
-          image: hetznercloud/hcloud-csi-driver:1.6.0
+            secretKeyRef:
-          imagePullPolicy: Always
+              key: token
-          env:
+              name: hcloud-csi
-            - name: CSI_ENDPOINT
+        image: hetznercloud/hcloud-csi-driver:latest
-              value: unix:///run/csi/socket
+        imagePullPolicy: Always
-            - name: METRICS_ENDPOINT
+        livenessProbe:
-              value: 0.0.0.0:9189
+          failureThreshold: 5
-            - name: ENABLE_METRICS
+          httpGet:
-              value: "true"
+            path: /healthz
-            - name: KUBE_NODE_NAME
+            port: healthz
-              valueFrom:
+          initialDelaySeconds: 10
-                fieldRef:
+          periodSeconds: 2
-                  apiVersion: v1
+          timeoutSeconds: 3
-                  fieldPath: spec.nodeName
+        name: hcloud-csi-driver
-            - name: HCLOUD_TOKEN
+        ports:
-              valueFrom:
+        - containerPort: 9189
-                secretKeyRef:
+          name: metrics
-                  name: hcloud-csi
+        - containerPort: 9808
-                  key: token
+          name: healthz
-          volumeMounts:
+          protocol: TCP
-            - name: socket-dir
+        volumeMounts:
-              mountPath: /run/csi
+        - mountPath: /run/csi
-          ports:
+          name: socket-dir
-            - containerPort: 9189
+      - image: k8s.gcr.io/sig-storage/livenessprobe:v2.3.0
-              name: metrics
+        imagePullPolicy: Always
-            - name: healthz
+        name: liveness-probe
-              containerPort: 9808
+        volumeMounts:
-              protocol: TCP
+        - mountPath: /run/csi
-          livenessProbe:
+          name: socket-dir
-            failureThreshold: 5
+      serviceAccountName: hcloud-csi-controller
-            httpGet:
-              path: /healthz
-              port: healthz
-            initialDelaySeconds: 10
-            timeoutSeconds: 3
-            periodSeconds: 2
-          securityContext:
-            privileged: true
-            capabilities:
-              add: ["SYS_ADMIN"]
-            allowPrivilegeEscalation: true
-        - name: liveness-probe
-          imagePullPolicy: Always
-          image: k8s.gcr.io/sig-storage/livenessprobe:v2.3.0
-          volumeMounts:
-            - mountPath: /run/csi
-              name: socket-dir
       volumes:
-        - name: socket-dir
+      - emptyDir: {}
-          emptyDir: {}
+        name: socket-dir
 ---
-kind: DaemonSet
 apiVersion: apps/v1
+kind: DaemonSet
 metadata:
-  name: hcloud-csi-node
-  namespace: kube-system
   labels:
     app: hcloud-csi
+  name: hcloud-csi-node
+  namespace: kube-system
 spec:
   selector:
     matchLabels:
@@ -222,136 +304,99 @@ spec:
       labels:
         app: hcloud-csi
     spec:
-      tolerations:
-        - effect: NoExecute
-          operator: Exists
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
-              - matchExpressions:
+            - matchExpressions:
-                  - key: "instance.hetzner.cloud/is-root-server"
+              - key: instance.hetzner.cloud/is-root-server
-                    operator: NotIn
+                operator: NotIn
-                    values:
+                values:
-                      - "true"
+                - "true"
-      serviceAccount: hcloud-csi
       containers:
-        - name: csi-node-driver-registrar
+      - args:
-          image: k8s.gcr.io/sig-storage/csi-node-driver-registrar:v2.2.0
+        - --kubelet-registration-path=/var/lib/kubelet/plugins/csi.hetzner.cloud/socket
-          args:
+        image: k8s.gcr.io/sig-storage/csi-node-driver-registrar:v2.2.0
-            - --kubelet-registration-path=/var/lib/kubelet/plugins/csi.hetzner.cloud/socket
+        name: csi-node-driver-registrar
-          env:
+        volumeMounts:
-            - name: KUBE_NODE_NAME
+        - mountPath: /run/csi
-              valueFrom:
+          name: plugin-dir
-                fieldRef:
+        - mountPath: /registration
-                  apiVersion: v1
+          name: registration-dir
-                  fieldPath: spec.nodeName
+      - command:
-          volumeMounts:
+        - /bin/hcloud-csi-driver-node
-            - name: plugin-dir
+        env:
-              mountPath: /run/csi
+        - name: CSI_ENDPOINT
-            - name: registration-dir
+          value: unix:///run/csi/socket
-              mountPath: /registration
+        - name: METRICS_ENDPOINT
-          securityContext:
+          value: 0.0.0.0:9189
-            privileged: true
+        - name: ENABLE_METRICS
-        - name: hcloud-csi-driver
+          value: "true"
-          image: hetznercloud/hcloud-csi-driver:1.6.0
+        image: hetznercloud/hcloud-csi-driver:latest
-          imagePullPolicy: Always
+        imagePullPolicy: Always
-          env:
+        livenessProbe:
-            - name: CSI_ENDPOINT
+          failureThreshold: 5
-              value: unix:///run/csi/socket
+          httpGet:
-            - name: METRICS_ENDPOINT
+            path: /healthz
-              value: 0.0.0.0:9189
+            port: healthz
-            - name: ENABLE_METRICS
+          initialDelaySeconds: 10
-              value: "true"
+          periodSeconds: 2
-            - name: HCLOUD_TOKEN
+          timeoutSeconds: 3
-              valueFrom:
+        name: hcloud-csi-driver
-                secretKeyRef:
+        ports:
-                  name: hcloud-csi
+        - containerPort: 9189
-                  key: token
+          name: metrics
-            - name: KUBE_NODE_NAME
+        - containerPort: 9808
-              valueFrom:
+          name: healthz
-                fieldRef:
+          protocol: TCP
-                  apiVersion: v1
+        securityContext:
-                  fieldPath: spec.nodeName
+          privileged: true
-          volumeMounts:
+        volumeMounts:
-            - name: kubelet-dir
+        - mountPath: /var/lib/kubelet
-              mountPath: /var/lib/kubelet
+          mountPropagation: Bidirectional
-              mountPropagation: "Bidirectional"
+          name: kubelet-dir
-            - name: plugin-dir
+        - mountPath: /run/csi
-              mountPath: /run/csi
+          name: plugin-dir
-            - name: device-dir
+        - mountPath: /dev
-              mountPath: /dev
+          name: device-dir
-          securityContext:
+      - image: k8s.gcr.io/sig-storage/livenessprobe:v2.3.0
-            privileged: true
+        imagePullPolicy: Always
-          ports:
+        name: liveness-probe
-            - containerPort: 9189
+        volumeMounts:
-              name: metrics
+        - mountPath: /run/csi
-            - name: healthz
+          name: plugin-dir
-              containerPort: 9808
+      tolerations:
-              protocol: TCP
+      - effect: NoExecute
-          livenessProbe:
+        operator: Exists
-            failureThreshold: 5
+      - effect: NoSchedule
-            httpGet:
+        operator: Exists
-              path: /healthz
+      - key: CriticalAddonsOnly
-              port: healthz
+        operator: Exists
-            initialDelaySeconds: 10
-            timeoutSeconds: 3
-            periodSeconds: 2
-        - name: liveness-probe
-          imagePullPolicy: Always
-          image: k8s.gcr.io/sig-storage/livenessprobe:v2.3.0
-          volumeMounts:
-            - mountPath: /run/csi
-              name: plugin-dir
       volumes:
-        - name: kubelet-dir
+      - hostPath:
-          hostPath:
+          path: /var/lib/kubelet
-            path: /var/lib/kubelet
+          type: Directory
-            type: Directory
+        name: kubelet-dir
-        - name: plugin-dir
+      - hostPath:
-          hostPath:
+          path: /var/lib/kubelet/plugins/csi.hetzner.cloud/
-            path: /var/lib/kubelet/plugins/csi.hetzner.cloud/
+          type: DirectoryOrCreate
-            type: DirectoryOrCreate
+        name: plugin-dir
-        - name: registration-dir
+      - hostPath:
-          hostPath:
+          path: /var/lib/kubelet/plugins_registry/
-            path: /var/lib/kubelet/plugins_registry/
+          type: Directory
-            type: Directory
+        name: registration-dir
-        - name: device-dir
+      - hostPath:
-          hostPath:
+          path: /dev
-            path: /dev
+          type: Directory
-            type: Directory
+        name: device-dir
 ---
-apiVersion: v1
+apiVersion: storage.k8s.io/v1
-kind: Service
+kind: CSIDriver
 metadata:
-  name: hcloud-csi-controller-metrics
+  name: csi.hetzner.cloud
-  namespace: kube-system
-  labels:
-    app: hcloud-csi
 spec:
-  selector:
+  attachRequired: true
-    app: hcloud-csi-controller
+  fsGroupPolicy: File
-  ports:
+  podInfoOnMount: true
-    - port: 9189
+  volumeLifecycleModes:
-      name: metrics
+  - Persistent
-      targetPort: metrics
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: hcloud-csi-node-metrics
-  namespace: kube-system
-  labels:
-    app: hcloud-csi
-spec:
-  selector:
-    app: hcloud-csi
-  ports:
-    - port: 9189
-      name: metrics
-      targetPort: metrics