csr rewrite

deploy/pve-cloud-controller-manager.yaml

@@ -28,6 +28,14 @@ rules:
   - patch
   - update
   - watch
+- apiGroups: [""]
+  resources: ["endpoints"]
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
 - apiGroups: ["coordination.k8s.io"]
   resources: ["leases"]
   verbs:
@@ -62,67 +70,61 @@ subjects:
   name: cloud-controller-manager
   namespace: kube-system
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: v1
+kind: Pod
 metadata:
   name: pve-cloud-controller-manager
   namespace: kube-system
   labels:
     app: pve-cloud-controller-manager
 spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pve-cloud-controller-manager
-  template:
-    metadata:
-      labels:
-        app: pve-cloud-controller-manager
-    spec:
-      priorityClassName: system-node-critical
-      containers:
-      - args:
-        - --cloud-provider=pve
-        - --leader-elect=false
-        env:
-        - name: PVE_API
-          valueFrom:
-            secretKeyRef:
-              key: api
-              name: pvecloud
-        - name: PVE_USER
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: pvecloud
-        - name: PVE_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: pvecloud
-        image: reg.k8s.giftfish.de/library/pve-cloud-controller-manager-amd64:dev
-        imagePullPolicy: Always
-        livenessProbe:
-          httpGet:
-            path: /healthz
-            port: 10258
-            scheme: HTTPS
-          initialDelaySeconds: 3
-          periodSeconds: 3
-        name: manager
-        resources:
-          requests:
-            cpu: 100m
-            memory: 50Mi
-      dnsPolicy: Default
-      serviceAccountName: cloud-controller-manager
-      tolerations:
-      - effect: NoSchedule
-        key: node.cloudprovider.kubernetes.io/uninitialized
-        value: "true"
-      - key: CriticalAddonsOnly
-        operator: Exists
-      - effect: NoSchedule
-        key: node-role.kubernetes.io/master
-      - effect: NoSchedule
-        key: node.kubernetes.io/not-ready
+  priorityClassName: system-node-critical
+  #hostNetwork: true
+  containers:
+  - args:
+    - --cloud-config=/etc/kubernetes/pve.json
+    - --tls-min-version=VersionTLS12
+    - --tls-cipher-suites="TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+    - --cloud-provider=pve
+    - --leader-elect=true
+    image: reg.k8s.giftfish.de/library/pve-cloud-controller-manager-amd64:dev
+    imagePullPolicy: Always
+    livenessProbe:
+      httpGet:
+        path: /healthz
+        port: 10258
+        scheme: HTTPS
+      initialDelaySeconds: 3
+      periodSeconds: 3
+    name: manager
+    resources:
+      requests:
+        cpu: 100m
+        memory: 50Mi
+    volumeMounts:
+    - name: etc-kubernetes
+      mountPath: /etc/kubernetes
+      readOnly: true
+    - name: etc-ssl
+      mountPath: /etc/ssl
+      readOnly: true
+  volumes:
+  - name: etc-kubernetes
+    hostPath:
+      path: /etc/kubernetes
+  - name: etc-ssl
+    hostPath:
+      path: /etc/ssl
+  dnsPolicy: Default
+  serviceAccountName: cloud-controller-manager
+  tolerations:
+  - effect: NoSchedule
+    key: node.cloudprovider.kubernetes.io/uninitialized
+    value: "true"
+  - key: CriticalAddonsOnly
+    operator: Exists
+  - effect: NoSchedule
+    key: node-role.kubernetes.io/master
+  - effect: NoSchedule
+    key: node.kubernetes.io/not-ready
+

deploy/pve-csr-approver-manager.yaml

@@ -26,6 +26,12 @@ rules:
   verbs:
   - create
   - update
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs:
+  - get
+  - create
+  - update
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -40,57 +46,56 @@ subjects:
   namespace: kube-system
   name: pve-csr-approver
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: v1
+kind: Pod
 metadata:
   name: pve-csr-approver-manager
   namespace: kube-system
   labels:
     app: pve-csr-approver-manager
 spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pve-csr-approver-manager
-  template:
-    metadata:
-      labels:
-        app: pve-csr-approver-manager
-    spec:
-      priorityClassName: system-node-critical
-      containers:
-      - name: manager
-        env:
-        - name: PVE_API
-          valueFrom:
-            secretKeyRef:
-              key: api
-              name: pvecloud
-        - name: PVE_USER
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: pvecloud
-        - name: PVE_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: pvecloud
-        image: reg.k8s.giftfish.de/library/pve-csr-approver-manager-amd64:dev
-        imagePullPolicy: Always
-        resources:
-          requests:
-            cpu: 100m
-            memory: 50Mi
-      dnsPolicy: Default
-      serviceAccountName: pve-csr-approver
-      tolerations:
-      - effect: NoSchedule
-        key: node.cloudprovider.kubernetes.io/uninitialized
-        value: "true"
-      - key: CriticalAddonsOnly
-        operator: Exists
-      - effect: NoSchedule
-        key: node-role.kubernetes.io/master
-      - effect: NoSchedule
-        key: node.kubernetes.io/not-ready
+  priorityClassName: system-node-critical
+  #hostNetwork: true
+  containers:
+  - args:
+    - --cloud-config=/etc/kubernetes/pve.json
+    - --leader-elect=true
+    name: manager
+    image: reg.k8s.giftfish.de/library/pve-csr-approver-manager-amd64:dev
+    imagePullPolicy: Always
+    livenessProbe:
+      httpGet:
+        path: /healthz
+        port: 9449
+      initialDelaySeconds: 3
+      periodSeconds: 3
+    resources:
+      requests:
+        cpu: 100m
+        memory: 50Mi
+    volumeMounts:
+    - name: etc-kubernetes
+      mountPath: /etc/kubernetes
+      readOnly: true
+    - name: etc-ssl
+      mountPath: /etc/ssl
+      readOnly: true
+  volumes:
+  - name: etc-kubernetes
+    hostPath:
+      path: /etc/kubernetes
+  - name: etc-ssl
+    hostPath:
+      path: /etc/ssl
+  dnsPolicy: Default
+  serviceAccountName: pve-csr-approver
+  tolerations:
+  - effect: NoSchedule
+    key: node.cloudprovider.kubernetes.io/uninitialized
+    value: "true"
+  - key: CriticalAddonsOnly
+    operator: Exists
+  - effect: NoSchedule
+    key: node-role.kubernetes.io/master
+  - effect: NoSchedule
+    key: node.kubernetes.io/not-ready