|  | 
|  | 1 | +--- | 
|  | 2 | +apiVersion: apps/v1 | 
|  | 3 | +kind: Deployment | 
|  | 4 | +metadata: | 
|  | 5 | +  name: digitalocean-cloud-controller-manager | 
|  | 6 | +  namespace: kube-system | 
|  | 7 | +spec: | 
|  | 8 | +  replicas: 1 | 
|  | 9 | +  revisionHistoryLimit: 2 | 
|  | 10 | +  selector: | 
|  | 11 | +    matchLabels: | 
|  | 12 | +      app: digitalocean-cloud-controller-manager | 
|  | 13 | +  template: | 
|  | 14 | +    metadata: | 
|  | 15 | +      labels: | 
|  | 16 | +        app: digitalocean-cloud-controller-manager | 
|  | 17 | +    spec: | 
|  | 18 | +      dnsPolicy: Default | 
|  | 19 | +      hostNetwork: true | 
|  | 20 | +      serviceAccountName: cloud-controller-manager | 
|  | 21 | +      priorityClassName: system-cluster-critical | 
|  | 22 | +      tolerations: | 
|  | 23 | +        # this taint is set by all kubelets running `--cloud-provider=external` | 
|  | 24 | +        # so we should tolerate it to schedule the digitalocean ccm | 
|  | 25 | +        - key: "node.cloudprovider.kubernetes.io/uninitialized" | 
|  | 26 | +          value: "true" | 
|  | 27 | +          effect: "NoSchedule" | 
|  | 28 | +        - key: "CriticalAddonsOnly" | 
|  | 29 | +          operator: "Exists" | 
|  | 30 | +        # cloud controller manages should be able to run on masters | 
|  | 31 | +        # TODO: remove this when ccm is not supported on k8s <= 1.23 | 
|  | 32 | +        - key: "node-role.kubernetes.io/master" | 
|  | 33 | +          effect: NoSchedule | 
|  | 34 | +        # k8s clusters 1.24+ uses control-plane name instead of master | 
|  | 35 | +        - key: "node-role.kubernetes.io/control-plane" | 
|  | 36 | +          effect: NoSchedule | 
|  | 37 | +      containers: | 
|  | 38 | +      - image: digitalocean/digitalocean-cloud-controller-manager:v0.1.41 | 
|  | 39 | +        name: digitalocean-cloud-controller-manager | 
|  | 40 | +        command: | 
|  | 41 | +          - "/bin/digitalocean-cloud-controller-manager" | 
|  | 42 | +          - "--leader-elect=false" | 
|  | 43 | +        resources: | 
|  | 44 | +          requests: | 
|  | 45 | +            cpu: 100m | 
|  | 46 | +            memory: 50Mi | 
|  | 47 | +        env: | 
|  | 48 | +          - name: DO_ACCESS_TOKEN | 
|  | 49 | +            valueFrom: | 
|  | 50 | +              secretKeyRef: | 
|  | 51 | +                name: digitalocean | 
|  | 52 | +                key: access-token | 
|  | 53 | + | 
|  | 54 | +--- | 
|  | 55 | +apiVersion: v1 | 
|  | 56 | +kind: ServiceAccount | 
|  | 57 | +metadata: | 
|  | 58 | +  name: cloud-controller-manager | 
|  | 59 | +  namespace: kube-system | 
|  | 60 | +--- | 
|  | 61 | +apiVersion: rbac.authorization.k8s.io/v1 | 
|  | 62 | +kind: ClusterRole | 
|  | 63 | +metadata: | 
|  | 64 | +  annotations: | 
|  | 65 | +    rbac.authorization.kubernetes.io/autoupdate: "true" | 
|  | 66 | +  name: system:cloud-controller-manager | 
|  | 67 | +rules: | 
|  | 68 | +- apiGroups: | 
|  | 69 | +  - coordination.k8s.io | 
|  | 70 | +  resources: | 
|  | 71 | +  - leases | 
|  | 72 | +  verbs: | 
|  | 73 | +  - get | 
|  | 74 | +  - watch | 
|  | 75 | +  - list | 
|  | 76 | +  - create | 
|  | 77 | +  - update | 
|  | 78 | +  - delete | 
|  | 79 | +- apiGroups: | 
|  | 80 | +  - "" | 
|  | 81 | +  resources: | 
|  | 82 | +  - events | 
|  | 83 | +  verbs: | 
|  | 84 | +  - create | 
|  | 85 | +  - patch | 
|  | 86 | +  - update | 
|  | 87 | +- apiGroups: | 
|  | 88 | +  - "" | 
|  | 89 | +  resources: | 
|  | 90 | +  - nodes | 
|  | 91 | +  verbs: | 
|  | 92 | +  - '*' | 
|  | 93 | +- apiGroups: | 
|  | 94 | +  - "" | 
|  | 95 | +  resources: | 
|  | 96 | +  - nodes/status | 
|  | 97 | +  verbs: | 
|  | 98 | +  - patch | 
|  | 99 | +- apiGroups: | 
|  | 100 | +  - "" | 
|  | 101 | +  resources: | 
|  | 102 | +  - services | 
|  | 103 | +  verbs: | 
|  | 104 | +  - list | 
|  | 105 | +  - patch | 
|  | 106 | +  - update | 
|  | 107 | +  - watch | 
|  | 108 | +- apiGroups: | 
|  | 109 | +  - "" | 
|  | 110 | +  resources: | 
|  | 111 | +  - services/status | 
|  | 112 | +  verbs: | 
|  | 113 | +  - list | 
|  | 114 | +  - patch | 
|  | 115 | +  - update | 
|  | 116 | +  - watch | 
|  | 117 | +- apiGroups: | 
|  | 118 | +  - "" | 
|  | 119 | +  resources: | 
|  | 120 | +  - serviceaccounts | 
|  | 121 | +  verbs: | 
|  | 122 | +  - create | 
|  | 123 | +- apiGroups: | 
|  | 124 | +  - "" | 
|  | 125 | +  resources: | 
|  | 126 | +  - persistentvolumes | 
|  | 127 | +  verbs: | 
|  | 128 | +  - get | 
|  | 129 | +  - list | 
|  | 130 | +  - update | 
|  | 131 | +  - watch | 
|  | 132 | +- apiGroups: | 
|  | 133 | +  - "" | 
|  | 134 | +  resources: | 
|  | 135 | +  - endpoints | 
|  | 136 | +  verbs: | 
|  | 137 | +  - create | 
|  | 138 | +  - get | 
|  | 139 | +  - list | 
|  | 140 | +  - watch | 
|  | 141 | +  - update | 
|  | 142 | +--- | 
|  | 143 | +kind: ClusterRoleBinding | 
|  | 144 | +apiVersion: rbac.authorization.k8s.io/v1 | 
|  | 145 | +metadata: | 
|  | 146 | +  name: system:cloud-controller-manager | 
|  | 147 | +roleRef: | 
|  | 148 | +  apiGroup: rbac.authorization.k8s.io | 
|  | 149 | +  kind: ClusterRole | 
|  | 150 | +  name: system:cloud-controller-manager | 
|  | 151 | +subjects: | 
|  | 152 | +- kind: ServiceAccount | 
|  | 153 | +  name: cloud-controller-manager | 
|  | 154 | +  namespace: kube-system | 
0 commit comments