kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

aws: Update EBS CSI driver to v1.47.0

This commit is contained in:
Ciprian Hacman 2025-08-11 08:44:46 +03:00
parent 93c7490597
commit e54132c827
2 changed files with 551 additions and 540 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/model/components/awsebscsidriver.go
View File

@ -43,8 +43,7 @@ func (b *AWSEBSCSIDriverOptionsBuilder) BuildOptions(o *kops.Cluster) error {
c := aws.EBSCSIDriver c := aws.EBSCSIDriver
if c.Version == nil { if c.Version == nil {
version := "v1.38.1" c.Version = fi.PtrTo("v1.47.0")
c.Version = &version
} }
return nil return nil

162
upup/models/cloudup/resources/addons/aws-ebs-csi-driver.addons.k8s.io/k8s-1.17.yaml.template
View File

@ -1,4 +1,4 @@
# helm template aws-ebs-csi-driver . -n kube-system \ #helm template aws-ebs-csi-driver aws-ebs-csi-driver/aws-ebs-csi-driver -n kube-system \
# --set controller.volumeModificationFeature.enabled=true \ # --set controller.volumeModificationFeature.enabled=true \
# --set sidecars.snapshotter.forceEnable=true \ # --set sidecars.snapshotter.forceEnable=true \
# --set controller.enableMetrics=true \ # --set controller.enableMetrics=true \
@ -64,16 +64,16 @@ metadata:
# Do not modify the rules below manually, see `make update-sidecar-dependencies` # Do not modify the rules below manually, see `make update-sidecar-dependencies`
# BEGIN AUTOGENERATED RULES # BEGIN AUTOGENERATED RULES
rules: rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["persistentvolumes"] resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "patch"] verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"] - apiGroups: ["storage.k8s.io"]
resources: ["csinodes"] resources: ["csinodes"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"] - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"] resources: ["volumeattachments"]
verbs: ["get", "list", "watch", "patch"] verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["storage.k8s.io"] - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments/status"] resources: ["volumeattachments/status"]
verbs: ["patch"] verbs: ["patch"]
# END AUTOGENERATED RULES # END AUTOGENERATED RULES
@ -89,13 +89,13 @@ metadata:
app.kubernetes.io/version: {{ .Version }} app.kubernetes.io/version: {{ .Version }}
app.kubernetes.io/component: csi-driver app.kubernetes.io/component: csi-driver
rules: rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["nodes"] resources: ["nodes"]
verbs: ["get", "patch"] verbs: ["get", "patch", "list", "watch"]
- apiGroups: ["storage.k8s.io"] - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"] resources: ["volumeattachments"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"] - apiGroups: ["storage.k8s.io"]
resources: ["csinodes"] resources: ["csinodes"]
verbs: ["get"] verbs: ["get"]
--- ---
@ -112,45 +112,45 @@ metadata:
# Do not modify the rules below manually, see `make update-sidecar-dependencies` # Do not modify the rules below manually, see `make update-sidecar-dependencies`
# BEGIN AUTOGENERATED RULES # BEGIN AUTOGENERATED RULES
rules: rules:
# The following rule should be uncommented for plugins that require secrets # The following rule should be uncommented for plugins that require secrets
# for provisioning. # for provisioning.
# - apiGroups: [""] # - apiGroups: [""]
# resources: ["secrets"] # resources: ["secrets"]
# verbs: ["get", "list"] # verbs: ["get", "list"]
- apiGroups: [""] - apiGroups: [""]
resources: ["persistentvolumes"] resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "create", "patch", "delete"] verbs: ["get", "list", "watch", "create", "patch", "delete"]
- apiGroups: [""] - apiGroups: [""]
resources: ["persistentvolumeclaims"] resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch", "update"] verbs: ["get", "list", "watch", "update"]
- apiGroups: ["storage.k8s.io"] - apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"] resources: ["storageclasses"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
- apiGroups: [""] - apiGroups: [""]
resources: ["events"] resources: ["events"]
verbs: ["list", "watch", "create", "update", "patch"] verbs: ["list", "watch", "create", "update", "patch"]
- apiGroups: ["snapshot.storage.k8s.io"] - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"] resources: ["volumesnapshots"]
verbs: ["get", "list"] verbs: ["get", "list"]
- apiGroups: ["snapshot.storage.k8s.io"] - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotcontents"] resources: ["volumesnapshotcontents"]
verbs: ["get", "list"] verbs: ["get", "list"]
- apiGroups: ["storage.k8s.io"] - apiGroups: ["storage.k8s.io"]
resources: ["csinodes"] resources: ["csinodes"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
- apiGroups: [""] - apiGroups: [""]
resources: ["nodes"] resources: ["nodes"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
# Access to volumeattachments is only needed when the CSI driver # Access to volumeattachments is only needed when the CSI driver
# has the PUBLISH_UNPUBLISH_VOLUME controller capability. # has the PUBLISH_UNPUBLISH_VOLUME controller capability.
# In that case, external-provisioner will watch volumeattachments # In that case, external-provisioner will watch volumeattachments
# to determine when it is safe to delete a volume. # to determine when it is safe to delete a volume.
- apiGroups: ["storage.k8s.io"] - apiGroups: ["storage.k8s.io"]
resources: ["volumeattachments"] resources: ["volumeattachments"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
# END AUTOGENERATED RULES # END AUTOGENERATED RULES
# Extra rule: VAC rules not present in upstream example # Extra rule: VAC rules not present in upstream example
- apiGroups: ["storage.k8s.io"] - apiGroups: ["storage.k8s.io"]
resources: ["volumeattributesclasses"] resources: ["volumeattributesclasses"]
verbs: ["get"] verbs: ["get"]
--- ---
@ -167,28 +167,28 @@ metadata:
# Do not modify the rules below manually, see `make update-sidecar-dependencies` # Do not modify the rules below manually, see `make update-sidecar-dependencies`
# BEGIN AUTOGENERATED RULES # BEGIN AUTOGENERATED RULES
rules: rules:
# The following rule should be uncommented for plugins that require secrets # The following rule should be uncommented for plugins that require secrets
# for provisioning. # for provisioning.
# - apiGroups: [""] # - apiGroups: [""]
# resources: ["secrets"] # resources: ["secrets"]
# verbs: ["get", "list", "watch"] # verbs: ["get", "list", "watch"]
- apiGroups: [""] - apiGroups: [""]
resources: ["persistentvolumes"] resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "patch"] verbs: ["get", "list", "watch", "patch"]
- apiGroups: [""] - apiGroups: [""]
resources: ["persistentvolumeclaims"] resources: ["persistentvolumeclaims"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
- apiGroups: [""] - apiGroups: [""]
resources: ["pods"] resources: ["pods"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
- apiGroups: [""] - apiGroups: [""]
resources: ["persistentvolumeclaims/status"] resources: ["persistentvolumeclaims/status"]
verbs: ["patch"] verbs: ["patch"]
- apiGroups: [""] - apiGroups: [""]
resources: ["events"] resources: ["events"]
verbs: ["list", "watch", "create", "update", "patch"] verbs: ["list", "watch", "create", "update", "patch"]
# only required if enabling the alpha volume modify feature # only required if enabling the alpha volume modify feature
- apiGroups: ["storage.k8s.io"] - apiGroups: ["storage.k8s.io"]
resources: ["volumeattributesclasses"] resources: ["volumeattributesclasses"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
# END AUTOGENERATED RULES # END AUTOGENERATED RULES
@ -206,35 +206,35 @@ metadata:
# Do not modify the rules below manually, see `make update-sidecar-dependencies` # Do not modify the rules below manually, see `make update-sidecar-dependencies`
# BEGIN AUTOGENERATED RULES # BEGIN AUTOGENERATED RULES
rules: rules:
- apiGroups: [""] - apiGroups: [""]
resources: ["events"] resources: ["events"]
verbs: ["list", "watch", "create", "update", "patch"] verbs: ["list", "watch", "create", "update", "patch"]
# Secret permission is optional. # Secret permission is optional.
# Enable it if your driver needs secret. # Enable it if your driver needs secret.
# For example, `csi.storage.k8s.io/snapshotter-secret-name` is set in VolumeSnapshotClass. # For example, `csi.storage.k8s.io/snapshotter-secret-name` is set in VolumeSnapshotClass.
# See https://kubernetes-csi.github.io/docs/secrets-and-credentials.html for more details. # See https://kubernetes-csi.github.io/docs/secrets-and-credentials.html for more details.
# - apiGroups: [""] # - apiGroups: [""]
# resources: ["secrets"] # resources: ["secrets"]
# verbs: ["get", "list"] # verbs: ["get", "list"]
- apiGroups: ["snapshot.storage.k8s.io"] - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotclasses"] resources: ["volumesnapshotclasses"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
- apiGroups: ["snapshot.storage.k8s.io"] - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshots"] resources: ["volumesnapshots"]
verbs: ["get", "list", "watch", "update", "patch", "create"] verbs: ["get", "list", "watch", "update", "patch", "create"]
- apiGroups: ["snapshot.storage.k8s.io"] - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotcontents"] resources: ["volumesnapshotcontents"]
verbs: ["get", "list", "watch", "update", "patch", "create"] verbs: ["get", "list", "watch", "update", "patch"]
- apiGroups: ["snapshot.storage.k8s.io"] - apiGroups: ["snapshot.storage.k8s.io"]
resources: ["volumesnapshotcontents/status"] resources: ["volumesnapshotcontents/status"]
verbs: ["update", "patch"] verbs: ["update", "patch"]
- apiGroups: ["groupsnapshot.storage.k8s.io"] - apiGroups: ["groupsnapshot.storage.k8s.io"]
resources: ["volumegroupsnapshotclasses"] resources: ["volumegroupsnapshotclasses"]
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
- apiGroups: ["groupsnapshot.storage.k8s.io"] - apiGroups: ["groupsnapshot.storage.k8s.io"]
resources: ["volumegroupsnapshotcontents"] resources: ["volumegroupsnapshotcontents"]
verbs: ["get", "list", "watch", "update", "patch"] verbs: ["get", "list", "watch", "update", "patch"]
- apiGroups: ["groupsnapshot.storage.k8s.io"] - apiGroups: ["groupsnapshot.storage.k8s.io"]
resources: ["volumegroupsnapshotcontents/status"] resources: ["volumegroupsnapshotcontents/status"]
verbs: ["update", "patch"] verbs: ["update", "patch"]
# END AUTOGENERATED RULES # END AUTOGENERATED RULES
@ -250,7 +250,7 @@ metadata:
app.kubernetes.io/version: {{ .Version }} app.kubernetes.io/version: {{ .Version }}
app.kubernetes.io/component: csi-driver app.kubernetes.io/component: csi-driver
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: ebs-csi-controller-sa name: ebs-csi-controller-sa
namespace: kube-system namespace: kube-system
roleRef: roleRef:
@ -269,7 +269,7 @@ metadata:
app.kubernetes.io/version: {{ .Version }} app.kubernetes.io/version: {{ .Version }}
app.kubernetes.io/component: csi-driver app.kubernetes.io/component: csi-driver
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: ebs-csi-node-sa name: ebs-csi-node-sa
namespace: kube-system namespace: kube-system
roleRef: roleRef:
@ -288,7 +288,7 @@ metadata:
app.kubernetes.io/version: {{ .Version }} app.kubernetes.io/version: {{ .Version }}
app.kubernetes.io/component: csi-driver app.kubernetes.io/component: csi-driver
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: ebs-csi-controller-sa name: ebs-csi-controller-sa
namespace: kube-system namespace: kube-system
roleRef: roleRef:
@ -307,7 +307,7 @@ metadata:
app.kubernetes.io/version: {{ .Version }} app.kubernetes.io/version: {{ .Version }}
app.kubernetes.io/component: csi-driver app.kubernetes.io/component: csi-driver
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: ebs-csi-controller-sa name: ebs-csi-controller-sa
namespace: kube-system namespace: kube-system
roleRef: roleRef:
@ -326,7 +326,7 @@ metadata:
app.kubernetes.io/version: {{ .Version }} app.kubernetes.io/version: {{ .Version }}
app.kubernetes.io/component: csi-driver app.kubernetes.io/component: csi-driver
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: ebs-csi-controller-sa name: ebs-csi-controller-sa
namespace: kube-system namespace: kube-system
roleRef: roleRef:
@ -460,7 +460,7 @@ spec:
runAsUser: 0 runAsUser: 0
containers: containers:
- name: ebs-plugin - name: ebs-plugin
image: public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:{{ .Version }} image: registry.k8s.io/provider-aws/aws-ebs-csi-driver:{{ .Version }}
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args:
- node - node
@ -470,7 +470,7 @@ spec:
- --volume-attach-limit={{ .VolumeAttachLimit }} - --volume-attach-limit={{ .VolumeAttachLimit }}
{{- end }} {{- end }}
- --logging-format=text - --logging-format=text
- --v=2 - --v=5
env: env:
{{- if IsIPv6Only }} {{- if IsIPv6Only }}
- name: AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE - name: AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE
@ -510,6 +510,13 @@ spec:
timeoutSeconds: 3 timeoutSeconds: 3
periodSeconds: 10 periodSeconds: 10
failureThreshold: 5 failureThreshold: 5
readinessProbe:
httpGet:
path: /healthz
port: healthz
timeoutSeconds: 3
periodSeconds: 5
failureThreshold: 3
resources: resources:
limits: limits:
memory: 256Mi memory: 256Mi
@ -524,12 +531,12 @@ spec:
exec: exec:
command: ["/bin/aws-ebs-csi-driver", "pre-stop-hook"] command: ["/bin/aws-ebs-csi-driver", "pre-stop-hook"]
- name: node-driver-registrar - name: node-driver-registrar
image: public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.12.0-eks-1-32-1 image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.14.0
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args:
- --csi-address=$(ADDRESS) - --csi-address=$(ADDRESS)
- --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH) - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)
- --v=2 - --v=5
env: env:
- name: ADDRESS - name: ADDRESS
value: /csi/csi.sock value: /csi/csi.sock
@ -561,7 +568,7 @@ spec:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
- name: liveness-probe - name: liveness-probe
image: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-1 image: registry.k8s.io/sig-storage/livenessprobe:v2.16.0
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args:
- --csi-address=/csi/csi.sock - --csi-address=/csi/csi.sock
@ -727,7 +734,7 @@ spec:
runAsUser: 1000 runAsUser: 1000
containers: containers:
- name: ebs-plugin - name: ebs-plugin
image: public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:{{ .Version }} image: registry.k8s.io/provider-aws/aws-ebs-csi-driver:{{ .Version }}
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args:
- controller - controller
@ -807,7 +814,7 @@ spec:
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
- name: csi-provisioner - name: csi-provisioner
image: public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v5.1.0-eks-1-32-1 image: registry.k8s.io/sig-storage/csi-provisioner:v5.3.0
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args:
- --timeout=60s - --timeout=60s
@ -839,10 +846,10 @@ spec:
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
- name: csi-attacher - name: csi-attacher
image: public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.7.0-eks-1-32-1 image: registry.k8s.io/sig-storage/csi-attacher:v4.9.0
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args:
- --timeout=60s - --timeout=6m
- --csi-address=$(ADDRESS) - --csi-address=$(ADDRESS)
- --v=5 - --v=5
- --leader-election=true - --leader-election=true
@ -869,7 +876,7 @@ spec:
type: RuntimeDefault type: RuntimeDefault
{{ if HasSnapshotController }} {{ if HasSnapshotController }}
- name: csi-snapshotter - name: csi-snapshotter
image: public.ecr.aws/eks-distro/kubernetes-csi/external-snapshotter/csi-snapshotter:v8.1.0-eks-1-32-1 image: registry.k8s.io/sig-storage/csi-snapshotter:v8.3.0
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args:
- --csi-address=$(ADDRESS) - --csi-address=$(ADDRESS)
@ -898,8 +905,11 @@ spec:
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{ end }} {{ end }}
{{ if IsKubernetesLT "1.31.0" }}
# volume-modifier-for-k8s is no longer needed starting with Kubernetes 1.31.
# https://github.com/awslabs/volume-modifier-for-k8s/issues/46
- name: volumemodifier - name: volumemodifier
image: public.ecr.aws/ebs-csi-driver/volume-modifier-for-k8s:v0.5.0 image: public.ecr.aws/ebs-csi-driver/volume-modifier-for-k8s:v0.7.0
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args:
- --timeout=60s - --timeout=60s
@ -931,11 +941,13 @@ spec:
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
{{ end }}
- name: csi-resizer - name: csi-resizer
image: public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.12.0-eks-1-32-1 image: registry.k8s.io/sig-storage/csi-resizer:v1.14.0
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args:
- --timeout=60s - --timeout=60s
- --extra-modify-metadata
- --csi-address=$(ADDRESS) - --csi-address=$(ADDRESS)
- --v=5 - --v=5
- --handle-volume-inuse-error=false - --handle-volume-inuse-error=false
@ -962,7 +974,7 @@ spec:
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
- name: liveness-probe - name: liveness-probe
image: public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.14.0-eks-1-32-1 image: registry.k8s.io/sig-storage/livenessprobe:v2.16.0
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args:
- --csi-address=/csi/csi.sock - --csi-address=/csi/csi.sock