csr rewrite

deploy/pve-csr-approver-manager.yaml

@@ -26,6 +26,12 @@ rules:
   verbs:
   - create
   - update
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs:
+  - get
+  - create
+  - update
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -40,57 +46,56 @@ subjects:
   namespace: kube-system
   name: pve-csr-approver
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: v1
+kind: Pod
 metadata:
   name: pve-csr-approver-manager
   namespace: kube-system
   labels:
     app: pve-csr-approver-manager
 spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pve-csr-approver-manager
-  template:
-    metadata:
-      labels:
-        app: pve-csr-approver-manager
-    spec:
-      priorityClassName: system-node-critical
-      containers:
-      - name: manager
-        env:
-        - name: PVE_API
-          valueFrom:
-            secretKeyRef:
-              key: api
-              name: pvecloud
-        - name: PVE_USER
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: pvecloud
-        - name: PVE_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: pvecloud
-        image: reg.k8s.giftfish.de/library/pve-csr-approver-manager-amd64:dev
-        imagePullPolicy: Always
-        resources:
-          requests:
-            cpu: 100m
-            memory: 50Mi
-      dnsPolicy: Default
-      serviceAccountName: pve-csr-approver
-      tolerations:
-      - effect: NoSchedule
-        key: node.cloudprovider.kubernetes.io/uninitialized
-        value: "true"
-      - key: CriticalAddonsOnly
-        operator: Exists
-      - effect: NoSchedule
-        key: node-role.kubernetes.io/master
-      - effect: NoSchedule
-        key: node.kubernetes.io/not-ready
+  priorityClassName: system-node-critical
+  #hostNetwork: true
+  containers:
+  - args:
+    - --cloud-config=/etc/kubernetes/pve.json
+    - --leader-elect=true
+    name: manager
+    image: reg.k8s.giftfish.de/library/pve-csr-approver-manager-amd64:dev
+    imagePullPolicy: Always
+    livenessProbe:
+      httpGet:
+        path: /healthz
+        port: 9449
+      initialDelaySeconds: 3
+      periodSeconds: 3
+    resources:
+      requests:
+        cpu: 100m
+        memory: 50Mi
+    volumeMounts:
+    - name: etc-kubernetes
+      mountPath: /etc/kubernetes
+      readOnly: true
+    - name: etc-ssl
+      mountPath: /etc/ssl
+      readOnly: true
+  volumes:
+  - name: etc-kubernetes
+    hostPath:
+      path: /etc/kubernetes
+  - name: etc-ssl
+    hostPath:
+      path: /etc/ssl
+  dnsPolicy: Default
+  serviceAccountName: pve-csr-approver
+  tolerations:
+  - effect: NoSchedule
+    key: node.cloudprovider.kubernetes.io/uninitialized
+    value: "true"
+  - key: CriticalAddonsOnly
+    operator: Exists
+  - effect: NoSchedule
+    key: node-role.kubernetes.io/master
+  - effect: NoSchedule
+    key: node.kubernetes.io/not-ready