controller.yaml

kind: Deployment
apiVersion: apps/v1
metadata:
  name: s3-csi-controller
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "scality-mountpoint-s3-csi-driver.labels" . | nindent 4 }}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: s3-csi-controller
      {{- include "scality-mountpoint-s3-csi-driver.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        app: s3-csi-controller
        {{- include "scality-mountpoint-s3-csi-driver.labels" . | nindent 8 }}
    spec:
      nodeSelector:
        kubernetes.io/os: linux
        {{- with .Values.controller.nodeSelector }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      serviceAccountName: {{ .Values.controller.serviceAccount.name }}
      priorityClassName: system-cluster-critical
      {{- with .Values.controller.affinity }}
      affinity: {{- toYaml . | nindent 8 }}
      {{- end }}
      tolerations:
        # TODO: Should we add some default tolerations for controller?
        {{- with .Values.controller.tolerations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      {{- if .Values.imagePullSecrets }}
      imagePullSecrets:
      {{- range .Values.imagePullSecrets }}
        - name: {{ . }}
      {{- end }}
      {{- end }}
      containers:
        # CSI Controller Service for dynamic provisioning
        - name: s3-csi-controller
          image: {{ printf "%s%s:%s" (default "" .Values.image.containerRegistry) .Values.image.repository (default (printf "v%s" .Chart.AppVersion) (toString .Values.image.tag)) }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          args:
            - "--endpoint=unix:///csi/csi.sock"
            - "--node-id=controller"
          command:
            - "/bin/scality-s3-csi-driver"
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            {{- with .Values.controller.seLinuxOptions }}
            seLinuxOptions:
              user: {{ .user }}
              type: {{ .type }}
              role: {{ .role }}
              level: {{ .level }}
            {{- end }}
          volumeMounts:
            - name: socket-dir
              mountPath: /csi
            {{- if .Values.tls.caCertConfigMap }}
            - name: custom-ca-cert
              mountPath: /etc/ssl/custom-ca
              readOnly: true
            {{- end }}
          {{- with .Values.controller.resources }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          env:
            - name: AWS_ENDPOINT_URL
              value: {{ coalesce .Values.node.s3EndpointUrl .Values.s3.endpointUrl }}
            - name: AWS_REGION
              value: {{ coalesce .Values.node.s3Region .Values.s3.region }}
            - name: CSI_NODE_NAME
              value: "controller"
            - name: CSI_CONTROLLER_ONLY
              value: "true"
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.s3CredentialSecret.name }}
                  key: {{ .Values.s3CredentialSecret.accessKeyId }}
            - name: AWS_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.s3CredentialSecret.name }}
                  key: {{ .Values.s3CredentialSecret.secretAccessKey }}
            {{- if .Values.tls.caCertConfigMap }}
            - name: AWS_CA_BUNDLE
              value: "/etc/ssl/custom-ca/ca-bundle.crt"
            {{- end }}
        # Reconciler for MountpointS3PodAttachment CRDs
        - name: s3-pod-reconciler
          image: {{ printf "%s%s:%s" (default "" .Values.image.containerRegistry) .Values.image.repository (default (printf "v%s" .Chart.AppVersion) (toString .Values.image.tag)) }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command:
            - "/bin/scality-csi-controller"
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
          {{- with .Values.controller.resources }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          env:
            # Environment variables for Mountpoint Pod configuration
            - name: MOUNTPOINT_NAMESPACE
              value: {{ .Values.mountpointPod.namespace | quote }}
            - name: MOUNTPOINT_VERSION
              value: {{ .Values.node.mountpointVersion | quote }}
            - name: MOUNTPOINT_PRIORITY_CLASS_NAME
              value: {{ .Values.mountpointPod.priorityClassName | quote }}
            - name: MOUNTPOINT_PREEMPTING_PRIORITY_CLASS_NAME
              value: {{ .Values.mountpointPod.preemptingPriorityClassName | quote }}
            - name: MOUNTPOINT_HEADROOM_PRIORITY_CLASS_NAME
              value: {{ .Values.mountpointPod.headroomPriorityClassName | quote }}
            - name: MOUNTPOINT_IMAGE
              value: {{ printf "%s%s:%s" (default "" .Values.image.containerRegistry) .Values.image.repository (default (printf "v%s" .Chart.AppVersion) (toString .Values.image.tag)) }}
            - name: MOUNTPOINT_HEADROOM_IMAGE
              value: {{ printf "%s:%s" .Values.mountpointPod.headroomImage.repository .Values.mountpointPod.headroomImage.tag | quote }}
            - name: MOUNTPOINT_IMAGE_PULL_POLICY
              value: {{ .Values.image.pullPolicy | quote }}
            {{- if .Values.tls.caCertConfigMap }}
            - name: TLS_CA_CERT_CONFIGMAP
              value: {{ .Values.tls.caCertConfigMap | quote }}
            - name: TLS_INIT_IMAGE
              value: {{ printf "%s:%s" .Values.tls.initImage.repository .Values.tls.initImage.tag | quote }}
            - name: TLS_INIT_IMAGE_PULL_POLICY
              value: {{ .Values.tls.initImage.pullPolicy | quote }}
            - name: TLS_INIT_RESOURCES_REQUESTS_CPU
              value: {{ .Values.tls.initResources.requests.cpu | quote }}
            - name: TLS_INIT_RESOURCES_REQUESTS_MEMORY
              value: {{ .Values.tls.initResources.requests.memory | quote }}
            - name: TLS_INIT_RESOURCES_LIMITS_MEMORY
              value: {{ .Values.tls.initResources.limits.memory | quote }}
            {{- end }}
        - name: csi-provisioner
          image: {{ .Values.sidecars.csiProvisioner.image.repository }}:{{ .Values.sidecars.csiProvisioner.image.tag }}
          imagePullPolicy: {{ .Values.sidecars.csiProvisioner.image.pullPolicy }}
          args:
            - "--csi-address=/csi/csi.sock"
            - "--v=2"
          volumeMounts:
            - name: socket-dir
              mountPath: /csi
      volumes:
        - name: socket-dir
          emptyDir: {}
        {{- if .Values.tls.caCertConfigMap }}
        # ConfigMap volume is NOT optional — if the ConfigMap doesn't exist, the pod stays in
        # ContainerCreating with a clear event, matching the behavior of the credentials Secret above.
        - name: custom-ca-cert
          configMap:
            name: {{ .Values.tls.caCertConfigMap }}
            items:
              - key: ca-bundle.crt
                path: ca-bundle.crt
        {{- end }}