deploy Synology CSI

cluster/applications-AoA.yaml

@@ -4,6 +4,8 @@ kind: Application
 metadata:
   name: applications
   namespace: openshift-gitops
+  annotations:
+    argocd.argoproj.io/sync-wave: "5"
 spec:
   destination:
     name: in-cluster

cluster/synology-storageclass-appset.yaml

@@ -0,0 +1,42 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: synology-csi
+  namespace: openshift-gitops
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
+  generators:
+  - clusters: {} # Variable is .name
+  template:
+    metadata:
+      name: '{{.name}}-synology-csi'
+      annotations:
+        argocd.argoproj.io/sync-wave: "2"
+      spec:
+        destination:
+          name: in-cluster
+          namespace: synology-csi
+        project: default
+        source:
+          path: cluster/synology-storageclass
+          repoURL: https://github.com/rblundon/homelab.git
+          targetRevision: HEAD
+        syncPolicy:
+          automated:
+            prune: false
+            selfHeal: true
+          syncOptions:
+          - RespectIgnoreDifferences=true
+          - CreateNamespace=true
+          managedNamespaceMetadata:
+            labels:
+              argocd.argoproj.io/managed-by: openshift-gitops
+        ignoreDifferences:
+        - group: apps
+          kind: Deployment
+          jsonPointers:
+          - /spec/replicas

cluster/synology-storageclass/controller.yaml

@@ -92,7 +92,7 @@ spec:
             capabilities:
               add: ["SYS_ADMIN"]
             allowPrivilegeEscalation: true
-          image: registry.k8s.io/sig-storage/csi-provisioner:v3.0.0
+          image: registry.k8s.io/sig-storage/csi-provisioner:v5.2.0
           args:
             - --timeout=60s
             - --csi-address=$(ADDRESS)
@@ -111,7 +111,7 @@ spec:
             capabilities:
               add: ["SYS_ADMIN"]
             allowPrivilegeEscalation: true
-          image: registry.k8s.io/sig-storage/csi-attacher:v3.3.0
+          image: registry.k8s.io/sig-storage/csi-attacher:v4.2.0
           args:
             - --v=5
             - --csi-address=$(ADDRESS)
@@ -128,7 +128,7 @@ spec:
             capabilities:
               add: ["SYS_ADMIN"]
             allowPrivilegeEscalation: true
-          image: registry.k8s.io/sig-storage/csi-resizer:v1.3.0
+          image: registry.k8s.io/sig-storage/csi-resizer:v1.13.2
           args:
             - --v=5
             - --csi-address=$(ADDRESS)
@@ -145,7 +145,7 @@ spec:
             capabilities:
               add: ["SYS_ADMIN"]
             allowPrivilegeEscalation: true
-          image: synology/synology-csi:v1.2.0 #v1.1.3
+          image: ghcr.io/xphyr/synology-csi:1.4.0
           args:
             - --nodeid=NotUsed
             - --endpoint=$(CSI_ENDPOINT)

cluster/synology-storageclass/kustomization.yaml

@@ -12,4 +12,3 @@ resources:
 - storage-class.yaml
 - snapshotter.yaml
 - volume-snapshot-class.yaml
-- enable-iscsi.yaml

cluster/synology-storageclass/namespace.yaml

@@ -2,10 +2,15 @@
 apiVersion: v1
 kind: Namespace
 metadata:
+  annotations:
+      argocd.argoproj.io/sync-wave: "1"
   labels:
     kubernetes.io/metadata.name: synology-csi
     name: synology-csi
     argocd.argoproj.io/managed-by: openshift-gitops-operator
+    pod-security.kubernetes.io/audit: baseline
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: baseline
   name: synology-csi
 spec:
   finalizers:

cluster/synology-storageclass/node.yaml

@@ -64,7 +64,7 @@ spec:
           securityContext:
             privileged: true
           imagePullPolicy: Always
-          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.3.0
+          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.14.0
           args:
             - --v=5
             - --csi-address=$(ADDRESS)                         # the csi socket path inside the pod
@@ -86,8 +86,12 @@ spec:
         - name: csi-plugin
           securityContext:
             privileged: true
-          imagePullPolicy: Always #IfNotPresent
+            allowPrivilegeEscalation: true
-          image: synology/synology-csi:v1.2.0 #v1.1.3
+            capabilities:
+              add:
+              - SYS_ADMIN
+          imagePullPolicy: IfNotPresent
+          image: ghcr.io/xphyr/synology-csi:1.4.0
           args:
             - --nodeid=$(KUBE_NODE_NAME)
             - --endpoint=$(CSI_ENDPOINT)

cluster/synology-storageclass/snapshotter.yaml

@@ -19,7 +19,7 @@ rules:
     verbs: ["get", "list", "watch"]
   - apiGroups: ["snapshot.storage.k8s.io"]
     resources: ["volumesnapshotcontents"]
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+    verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
   - apiGroups: ["snapshot.storage.k8s.io"]
     resources: ["volumesnapshotcontents/status"]
     verbs: ["update"]
@@ -65,7 +65,7 @@ spec:
             capabilities:
               add: ["SYS_ADMIN"]
             allowPrivilegeEscalation: true
-          image: registry.k8s.io/sig-storage/csi-snapshotter:v4.2.1
+          image: registry.k8s.io/sig-storage/csi-snapshotter:v8.2.1
           args:
             - --v=5
             - --csi-address=$(ADDRESS)
@@ -82,7 +82,7 @@ spec:
             capabilities:
               add: ["SYS_ADMIN"]
             allowPrivilegeEscalation: true
-          image: synology/synology-csi:v1.1.3
+          image: ghcr.io/xphyr/synology-csi:1.4.0
           args:
             - --nodeid=NotUsed
             - --endpoint=$(CSI_ENDPOINT)

cluster/synology-storageclass/storage-class.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:
@@ -9,7 +10,23 @@ provisioner: csi.san.synology.com
 parameters:
   dsm: '10.10.121.35'
   protocol: 'iscsi'
-  location: '/volume1'
+  location: '/volume1/openshift-iscsi'
   csi.storage.k8s.io/fstype: 'ext4'
 reclaimPolicy: Delete #Retain
 allowVolumeExpansion: true
+
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: synology-nfs-storage
+provisioner: csi.san.synology.com
+parameters:
+  protocol: "nfs"
+  dsm: '10.10.121.35'
+  location: '/volume1/openshift-nfs'
+  mountPermissions: '0755'
+mountOptions:
+  - nfsvers=4.1
+reclaimPolicy: Delete
+allowVolumeExpansion: true

cluster/synology-storageclass/synology-csi-scc.yaml

@@ -1,29 +1,35 @@
 ---
-kind: SecurityContextConstraints
 apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+allowHostPorts: false
+priority: null
+requiredDropCapabilities: []
+allowPrivilegedContainer: true
+runAsUser:
+  type: RunAsAny
+users:
+  - 'system:serviceaccount:synology-csi:csi-controller-sa'
+  - 'system:serviceaccount:synology-csi:csi-node-sa'
+  - 'system:serviceaccount:synology-csi:csi-snapshotter-sa'
+allowHostDirVolumePlugin: true
+allowHostIPC: false
+seLinuxContext:
+  type: RunAsAny
+readOnlyRootFilesystem: false
 metadata:
   name: synology-csi-scc
-allowHostDirVolumePlugin: true
+  annotations:
-allowHostNetwork: true
+      argocd.argoproj.io/sync-wave: "3"
-allowPrivilegedContainer: true
-allowedCapabilities:
-- 'SYS_ADMIN'
-defaultAddCapabilities: []
 fsGroup:
   type: RunAsAny
 groups: []
-priority:
+defaultAddCapabilities: []
-readOnlyRootFilesystem: false
-requiredDropCapabilities: []
-runAsUser:
-  type: RunAsAny
-seLinuxContext:
-  type: RunAsAny
 supplementalGroups:
   type: RunAsAny
-users:
-- system:serviceaccount:synology-csi:csi-controller-sa
-- system:serviceaccount:synology-csi:csi-node-sa
-- system:serviceaccount:synology-csi:csi-snapshotter-sa
 volumes:
   - '*'
+allowHostPID: false
+allowHostNetwork: true
+allowPrivilegeEscalation: true
+allowedCapabilities:
+  - SYS_ADMIN

cluster/synology-storageclass/synology-secret-eso.yaml

@@ -2,6 +2,8 @@
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
   name: client-info-secret
   namespace: synology-csi
 spec:

cluster/temp/synology-storageclass.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: synology-storageclass
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-  annotations:
-    argocd.argoproj.io/sync-wave: "4"
-spec:
-  destination:
-    name: in-cluster
-    namespace: synology-csi
-  project: default
-  source:
-    path: cluster/synology-storageclass
-    repoURL: https://github.com/rblundon/homelab.git
-    targetRevision: HEAD
-  syncPolicy:
-    automated:
-      prune: false
-      selfHeal: true
-    syncOptions:
-    - RespectIgnoreDifferences=true
-    - CreateNamespace=true
-    managedNamespaceMetadata:
-      labels:
-        argocd.argoproj.io/managed-by: openshift-gitops
-  ignoreDifferences:
-  - group: apps
-    kind: Deployment
-    jsonPointers:
-    - /spec/replicas