cloud-controller.yml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cloud-controller-manager
  namespace: kube-system
---
apiVersion: v1
items:
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: system:cloud-controller-manager
  rules:
  - apiGroups:
    - coordination.k8s.io
    resources:
    - leases
    verbs:
    - get
    - create
    - update
  - apiGroups:
    - ""
    resources:
    - events
    verbs:
    - create
    - patch
    - update
  - apiGroups:
    - ""
    resources:
    - nodes
    verbs:
    - '*'
  - apiGroups:
    - ""
    resources:
    - nodes/status
    verbs:
    - patch
  - apiGroups:
    - ""
    resources:
    - services
    verbs:
    - list
    - patch
    - update
    - watch
  - apiGroups:
    - ""
    resources:
    - serviceaccounts
    verbs:
    - create
    - get
  - apiGroups:
    - ""
    resources:
    - serviceaccounts/token
    verbs:
    - create
  - apiGroups:
    - ""
    resources:
    - persistentvolumes
    verbs:
    - '*'
  - apiGroups:
    - ""
    resources:
    - endpoints
    verbs:
    - create
    - get
    - list
    - watch
    - update
  - apiGroups:
    - ""
    resources:
    - configmaps
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    resources:
    - secrets
    verbs:
    - list
    - get
    - watch
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: system:cloud-node-controller
  rules:
  - apiGroups:
    - ""
    resources:
    - nodes
    verbs:
    - '*'
  - apiGroups:
    - ""
    resources:
    - nodes/status
    verbs:
    - patch
  - apiGroups:
    - ""
    resources:
    - events
    verbs:
    - create
    - patch
    - update
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: system:pvl-controller
  rules:
  - apiGroups:
    - ""
    resources:
    - persistentvolumes
    verbs:
    - '*'
  - apiGroups:
    - ""
    resources:
    - events
    verbs:
    - create
    - patch
    - update
kind: List
metadata: {}
---
apiVersion: v1
items:
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: system:cloud-node-controller
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: system:cloud-node-controller
  subjects:
  - kind: ServiceAccount
    name: cloud-node-controller
    namespace: kube-system
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: system:pvl-controller
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: system:pvl-controller
  subjects:
  - kind: ServiceAccount
    name: pvl-controller
    namespace: kube-system
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: system:cloud-controller-manager
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: system:cloud-controller-manager
  subjects:
  - kind: ServiceAccount
    name: cloud-controller-manager
    namespace: kube-system
kind: List
metadata: {}
---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app: brightbox-cloud-controller-manager
  name: brightbox-cloud-controller-manager
  namespace: kube-system
data:
  cloud-controller.conf: |-
    apiVersion: v1
    kind: Config
    clusters:
    - cluster:
        certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        server: https://[::1]:6443
      name: default
    contexts:
    - context:
        cluster: default
        namespace: default
        user: default
      name: default
    current-context: default
    users:
    - name: default
      user:
        tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    k8s-app: brightbox-cloud-controller-manager
  name: brightbox-cloud-controller-manager
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: brightbox-cloud-controller-manager
  template:
    metadata:
      labels:
        k8s-app: brightbox-cloud-controller-manager
    spec:
      nodeSelector:
        node-role.kubernetes.io/control-plane: ""
      securityContext:
        runAsUser: 1001
      dnsPolicy: Default
      tolerations:
        # this taint is set by all kubelets running '--cloud-provider=external'
        # so we should tolerate it to schedule the brightbox ccm
        - key: "node.cloudprovider.kubernetes.io/uninitialized"
          value: "true"
          effect: "NoSchedule"
        - key: "node-role.kubernetes.io/control-plane"
          effect: NoSchedule
        - key: "node-role.kubernetes.io/master"
          effect: NoSchedule
        - key: "CriticalAddonsOnly"
          operator: "Exists"
        - effect: NoExecute
          key: node.kubernetes.io/not-ready
          operator: Exists
          tolerationSeconds: 300
        - effect: NoExecute
          key: node.kubernetes.io/unreachable
          operator: Exists
          tolerationSeconds: 300
      serviceAccountName: cloud-controller-manager
      containers:
      - name: brightbox-cloud-controller-manager
        # brightbox-cloud-controller-manager image version should match k8s version
        image: cr.brightbox.com/acc-juq13/public/brightbox-cloud-controller-manager:1.30.2
        imagePullPolicy: Always
        args:
          - "--cloud-provider=brightbox"
          - "--bind-address=::1"
          - "--secure-port=10253"
          - "--configure-cloud-routes=false"
          - "--kubeconfig=/etc/kubernetes/cloud-controller.conf"
          - "--cluster-name=brightbox-k8s"
          - "--use-service-account-credentials=true"
        resources:
          requests:
            cpu: 200m
        env:
          - name: BRIGHTBOX_CLIENT
            valueFrom:
              secretKeyRef:
                name: brightbox-credentials
                key: controller-client
          - name: BRIGHTBOX_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: brightbox-credentials
                key: controller-client-secret
          - name: BRIGHTBOX_API_URL
            valueFrom:
              secretKeyRef:
                name: brightbox-credentials
                key: apiurl
        volumeMounts:
        - mountPath: /etc/kubernetes/cloud-controller.conf
          name: cloud-controller-conf
          readOnly: true
          subPath: cloud-controller.conf
      hostNetwork: true
      volumes:
      - configMap:
          defaultMode: 420
          name: brightbox-cloud-controller-manager
        name: cloud-controller-conf