[ { "path": ".github/PULL_REQUEST_TEMPLATE.md", "content": "*Issue #, if available:*\n\n*Description of changes:*\n\n\nBy submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.\n" }, { "path": ".gitignore", "content": ".DS_Store\nchina/.DS_Store\nglobal/.DS_Store\nresource/china/ecsdemo-crystal\nresource/china/ecsdemo-frontend\nresource/china/ecsdemo-nodejs\nresource/china/s3-echoer\nresource/china/hpa/metrics-server-v0.3.6.tar.gz\nresource/china/hpa/metrics-server-v0.3.6/*" }, { "path": "CODE_OF_CONDUCT.md", "content": "## Code of Conduct\nThis project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct).\nFor more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact\nopensource-codeofconduct@amazon.com with any additional questions or comments.\n" }, { "path": "CONTRIBUTING.md", "content": "# Contributing Guidelines\n\nThank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional\ndocumentation, we greatly value feedback and contributions from our community.\n\nPlease read through this document before submitting any issues or pull requests to ensure we have all the necessary\ninformation to effectively respond to your bug report or contribution.\n\n\n## Reporting Bugs/Feature Requests\n\nWe welcome you to use the GitHub issue tracker to report bugs or suggest features.\n\nWhen filing an issue, please check [existing open](https://github.com/aws-samples/eks-workshop-greater-china/issues), or [recently closed](https://github.com/aws-samples/eks-workshop-greater-china/issues?utf8=%E2%9C%93&q=is%3Aissue%20is%3Aclosed%20), issues to make sure somebody else hasn't already\nreported the issue. Please try to include as much information as you can. Details like these are incredibly useful:\n\n* A reproducible test case or series of steps\n* The version of our code being used\n* Any modifications you've made relevant to the bug\n* Anything unusual about your environment or deployment\n\n\n## Contributing via Pull Requests\nContributions via pull requests are much appreciated. Before sending us a pull request, please ensure that:\n\n1. You are working against the latest source on the *master* branch.\n2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already.\n3. You open an issue to discuss any significant work - we would hate for your time to be wasted.\n\nTo send us a pull request, please:\n\n1. Fork the repository.\n2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change.\n3. Ensure local tests pass.\n4. Commit to your fork using clear commit messages.\n5. Send us a pull request, answering any default questions in the pull request interface.\n6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation.\n\nGitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and\n[creating a pull request](https://help.github.com/articles/creating-a-pull-request/).\n\n\n## Finding contributions to work on\nLooking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any ['help wanted'](https://github.com/aws-samples/eks-workshop-greater-china/labels/help%20wanted) issues is a great place to start.\n\n\n## Code of Conduct\nThis project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct).\nFor more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact\nopensource-codeofconduct@amazon.com with any additional questions or comments.\n\n\n## Security issue notifications\nIf you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue.\n\n\n## Licensing\n\nSee the [LICENSE](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution.\n\nWe may ask you to sign a [Contributor License Agreement (CLA)](http://en.wikipedia.org/wiki/Contributor_License_Agreement) for larger changes.\n" }, { "path": "LICENSE", "content": "Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n" }, { "path": "README.md", "content": "## AWS GCR EKS Resource \n\n\n\n[AWS EKS集群使用Karpenter实现EC2工作节点弹性伸缩](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/karpenter_handson/%E4%BD%BF%E7%94%A8Karpenter%E5%AE%9E%E7%8E%B0EKS%E5%B7%A5%E4%BD%9C%E8%8A%82%E7%82%B9%E5%BC%B9%E6%80%A7%E4%BC%B8%E7%BC%A9.md)\n\n[Kubernetes 节点弹性伸缩开源组件 Karpenter 实践：部署GPU推理应用](https://aws.amazon.com/cn/blogs/china/kubernetes-node-elastic-scaling-open-source-component-karpenter-practice-deploying-gpu-inference-applications/)\n\n[Kubernetes 节点弹性伸缩开源组件 Karpenter 实践：使用 Spot 实例进行成本优化](https://aws.amazon.com/cn/blogs/china/kubernetes-node-elastic-scaling-open-source-component-karpenter-practice-cost-optimization-using-spot-instance/)\n\n[Unreal Engine 像素流送在g4dn上实现容器化部署实践(二)](https://aws.amazon.com/cn/blogs/china/practice-of-container-deployment-of-unreal-engine-pixel-streaming-on-g4dn-ii/)\n\n\n\n\n\n#### China Region Workshop Resource\n\n***\n#### Tech Day 资料:\n\n[AWS GCR 2020 EKS Launch Hands-on Workshop](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/README.md)\n\n\n1. [步骤1-准备实验环境](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤1-准备实验环境.md)\n2. [步骤2-创建EKS集群](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤2-创建EKS集群.md)\n3. [步骤3-部署官方的KubernetesDashboard](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤3-部署官方的KubernetesDashboard.md)\n4. [步骤4-部署微服务以及配置ALBIngressController](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤4-部署微服务以及配置ALBIngressController.md) \n5. [步骤5-配置使用EBS](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤5-配置使用EBS.md)\n6. [步骤6-配置使用EFS](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤6-配置使用EFS.md)\n7. [步骤7-在EKS中使用IAMRole进行权限管理](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤7-在EKS中使用IAMRole进行权限管理.md)\n8. [步骤8-对应用Pod和集群进行自动扩展](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤8-对应用Pod和集群进行自动扩展.md)\n9. [步骤9-使用Helm部署应用](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤9-使用Helm部署应用.md)\n10. [步骤10-可用性-健康检查](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤10-可用性-健康检查.md)\n11. [步骤11-使用Calio加固EKS集群安全](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤11-使用Calio加固EKS集群安全.md)\n12. [步骤12 使用EFK收集、处理日志](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤12-EFK日志收集.md)\n13. [步骤13 部署Prometheus & Grafana监控](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤13-Prometheus&Grafana监控.md)\n14. [步骤14 在EKS集群上部署Istio 服务网格](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_EKS_Launch_Workshop/步骤14-在EKS集群上部署Istio服务网格.md)\n\n\n\n[2020_GCR_Kuberflow_Workshop](https://github.com/aws-samples/eks-workshop-greater-china/tree/master/china/2020_GCR_Kubeflow_Workshop)\n\n1. [安装kubeflow](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_GCR_Kubeflow_Workshop/%E5%AE%89%E8%A3%85Kubeflow.md)\n2. [创建和使用jupter笔记本.md](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_GCR_Kubeflow_Workshop/%E5%88%9B%E5%BB%BA%E5%92%8C%E4%BD%BF%E7%94%A8jupter%E7%AC%94%E8%AE%B0%E6%9C%AC.md)\n3. [使用Kubeflow fairing](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_GCR_Kubeflow_Workshop/Kubeflow_fairing.md)\n4. [使用Kubeflow pipeline](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/china/2020_GCR_Kubeflow_Workshop/Kubeflow_Pipelines.md)\n\n\n\n#### Global Region Workshop Resource \n***\n\n\n\n#### Tech Day 资料:\n\n[AWS 2021 Modern Application Development(MAD) Day](https://github.com/aws-samples/eks-workshop-greater-china/tree/master/global/2021_GCR_MAD_Day)\n\n[通过Cloud9搭建准备实验环境](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2021_GCR_MAD_Day/%E9%80%9A%E8%BF%87AWS%20Cloud9%E6%90%AD%E5%BB%BA%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83.md)\n\nLab1 Serverless\n\n1. [步骤1-从头开始写一个 serverless API](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2021_GCR_MAD_Day/lab2-eks/%E6%AD%A5%E9%AA%A41-%E8%AE%BE%E7%BD%AE%E9%BB%98%E8%AE%A4region%2C%20%E5%AE%89%E8%A3%85eksctl%2C%20kubectl%E5%B7%A5%E5%85%B7.md)\n2. [步骤2-使用serverless 快速构建Express应用](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2021_GCR_MAD_Day/lab1-serverless/%E6%AD%A5%E9%AA%A41-%E4%BD%BF%E7%94%A8serverless%20%E5%BF%AB%E9%80%9F%E6%9E%84%E5%BB%BAExpress%E5%BA%94%E7%94%A8.md)\n\nLab2 EKS 动手训练营\n\n1. [步骤1-设置默认region, 安装eksctl, kubectl工具](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2021_GCR_MAD_Day/lab2-eks/%E6%AD%A5%E9%AA%A41-%E8%AE%BE%E7%BD%AE%E9%BB%98%E8%AE%A4region%2C%20%E5%AE%89%E8%A3%85eksctl%2C%20kubectl%E5%B7%A5%E5%85%B7.md)\n2. [步骤2, 创建EKS集群](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2021_GCR_MAD_Day/lab2-eks/%E6%AD%A5%E9%AA%A42-%E5%88%9B%E5%BB%BAEKS%E9%9B%86%E7%BE%A4.md)\n3. [步骤3, 配置aws-load-balancer-controller&部署2048游戏](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2021_GCR_MAD_Day/lab2-eks/%E6%AD%A5%E9%AA%A43-%E9%83%A8%E7%BD%B2%E9%85%8D%E7%BD%AEaws-load-balancer-controller%262048%E6%B8%B8%E6%88%8F.md)\n4. [步骤4-可观测性-日志收集](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2021_GCR_MAD_Day/lab2-eks/%E6%AD%A5%E9%AA%A44-%E5%8F%AF%E8%A7%82%E6%B5%8B%E6%80%A7-%E6%97%A5%E5%BF%97%E6%94%B6%E9%9B%86.md)\n5. [步骤5-可观测性-prometheus-grafana.md](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2021_GCR_MAD_Day/lab2-eks/%E6%AD%A5%E9%AA%A45-%E5%8F%AF%E8%A7%82%E6%B5%8B%E6%80%A7-prometheus-grafana.md)\n6. [步骤6-使用CodePipeline 实现EKS环境CICD.md](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2021_GCR_MAD_Day/lab2-eks/%E6%AD%A5%E9%AA%A46-%E4%BD%BF%E7%94%A8CodePipeline%20%E5%AE%9E%E7%8E%B0EKS%E7%8E%AF%E5%A2%83CICD.md)\n7. [步骤7 使用Karpenter实现EKS工作节点弹性伸缩](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2021_GCR_MAD_Day/lab2-eks/%E6%AD%A5%E9%AA%A47-%E4%BD%BF%E7%94%A8Karpenter%E5%AE%9E%E7%8E%B0EKS%E5%B7%A5%E4%BD%9C%E8%8A%82%E7%82%B9%E5%BC%B9%E6%80%A7%E4%BC%B8%E7%BC%A9.md)\n\n\n\n[AWS GCR 2020 Container Day](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2020_GCR_SZ_ContainerDay/README.md)\n\n1. [步骤1 , 通过Cloud9搭建准备实验环境](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2020_GCR_SZ_ContainerDay/%E6%AD%A5%E9%AA%A41-%E9%80%9A%E8%BF%87AWS%20Cloud9%E6%90%AD%E5%BB%BA%E6%9C%8D%E5%8A%A1%E5%99%A8%E7%8E%AF%E5%A2%83.md)\n\n2. [步骤2, 安装eksctl, kubectl , jq等工具](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2020_GCR_SZ_ContainerDay/%E6%AD%A5%E9%AA%A42-%E8%AE%BE%E7%BD%AE%E9%BB%98%E8%AE%A4region%2C%20%E5%AE%89%E8%A3%85eksctl%2C%20kubectl%E5%B7%A5%E5%85%B7.md)\n\n3. [步骤3, 创建EKS集群](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2020_GCR_SZ_ContainerDay/%E6%AD%A5%E9%AA%A43-%E5%88%9B%E5%BB%BAEKS%E9%9B%86%E7%BE%A4.md)\n\n4. [步骤4, 使用ALB Ingress](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2020_GCR_SZ_ContainerDay/%E6%AD%A5%E9%AA%A44-%E9%85%8D%E7%BD%AEALBIngressController.md)\n\n5. [步骤5,使用Kubernetes Dashboard](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2020_GCR_SZ_ContainerDay/%E6%AD%A5%E9%AA%A45-%E9%83%A8%E7%BD%B2%E5%AE%98%E6%96%B9%E7%9A%84KubernetesDashboard.md)\n\n6. [步骤6,使用EBS存储](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2020_GCR_SZ_ContainerDay/%E6%AD%A5%E9%AA%A46-%E4%BD%BF%E7%94%A8EBS%E5%AD%98%E5%82%A8.md)\n\n7. [步骤7, IRSA(可选)](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2020_GCR_SZ_ContainerDay/%E6%AD%A5%E9%AA%A47-%E5%9C%A8EKS%E4%B8%AD%E4%BD%BF%E7%94%A8IAMRole%E8%BF%9B%E8%A1%8C%E6%9D%83%E9%99%90%E7%AE%A1%E7%90%86.md)\n\n8. [步骤8, 实现应用Pod和集群进行自动扩展（可选)](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2020_GCR_SZ_ContainerDay/%E6%AD%A5%E9%AA%A48-%E5%AE%9E%E7%8E%B0%E5%BA%94%E7%94%A8Pod%E5%92%8C%E9%9B%86%E7%BE%A4%E8%BF%9B%E8%A1%8C%E8%87%AA%E5%8A%A8%E6%89%A9%E5%B1%95.md)\n\n \n\n[AWS GCR 2019 EKS New Feature Workshop](https://github.com/aws-samples/eks-workshop-greater-china/tree/master/global/2019_GCR_EKS_Workshop)\n\n1. [步骤1: 通过AWSCloud9搭建服务器环境](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2019_GCR_EKS_Workshop/%E6%AD%A5%E9%AA%A41-%E9%80%9A%E8%BF%87AWS%20Cloud9%E6%90%AD%E5%BB%BA%E6%9C%8D%E5%8A%A1%E5%99%A8%E7%8E%AF%E5%A2%83.md)\n2. [步骤2: 设置默认region, 安装eksctl,kubectl工具](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2019_GCR_EKS_Workshop/%E6%AD%A5%E9%AA%A42-%E8%AE%BE%E7%BD%AE%E9%BB%98%E8%AE%A4region%2C%20%E5%AE%89%E8%A3%85eksctl%2C%20kubectl%E5%B7%A5%E5%85%B7.md)\n3. [步骤3: 创建EKS集群(启用按需实例和Fargate)](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2019_GCR_EKS_Workshop/%E6%AD%A5%E9%AA%A43-%E5%88%9B%E5%BB%BAEKS%E9%9B%86%E7%BE%A4(%E5%90%AF%E7%94%A8%E6%8C%89%E9%9C%80%E5%AE%9E%E4%BE%8B%E5%92%8CFargate).md)\n4. [步骤4: 部署示例应用，通过HPA测试Fargate弹性伸缩功能](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2019_GCR_EKS_Workshop/%E6%AD%A5%E9%AA%A44-%E9%83%A8%E7%BD%B2%E7%A4%BA%E4%BE%8B%E5%BA%94%E7%94%A8%EF%BC%8C%E9%80%9A%E8%BF%87HPA%E6%B5%8B%E8%AF%95Fargate%E5%BC%B9%E6%80%A7%E4%BC%B8%E7%BC%A9%E5%8A%9F%E8%83%BD.md)\n5. [步骤5: 在EKS中使用IAM Role进行权限管理](https://github.com/aws-samples/eks-workshop-greater-china/blob/master/global/2019_GCR_EKS_Workshop/%E6%AD%A5%E9%AA%A45-%E5%9C%A8EKS%E4%B8%AD%E4%BD%BF%E7%94%A8IAM%20Role%E8%BF%9B%E8%A1%8C%E6%9D%83%E9%99%90%E7%AE%A1%E7%90%86(%E5%8F%AF%E9%80%89).md)\n\n## Other Resource\n- [Amazon EKS 入门](https://docs.aws.amazon.com/zh_cn/eks/latest/userguide/getting-started.html)\n- [eksworkshop.com](https://eksworkshop.com/)\n- [eksctl doc](https://eksctl.io/)\n\n## License Summary\n\nThis sample code is made available under the MIT-0 license. See the LICENSE file.\n" }, { "path": "china/2020_EKS_Launch_Workshop/README.md", "content": "# AWS EKS China Region Launch Hands-on Workshop \n* 概要\n 在本练习中，您将学习如何使用创建、管理AWS EKS平台，并学会如何在EKS中创建集群并使用使用托管节点组/非托管节点组，在实验中我们还会学习到如何Kubernets 如何与Amazon IAM一起进行权限管理, 如何使用Horizental Pod Autoscaler (HPA)进行Pod的自动扩展，等等常见EKS操作。\n \n\n 在此教程中，您将完成以下实验：\n * [步骤1-准备实验环境](步骤1-准备实验环境.md)\n\n * [步骤2-创建EKS集群](步骤2-创建EKS集群.md)\n\n * [步骤3-部署官方的KubernetesDashboard](步骤3-部署官方的KubernetesDashboard.md)\n\n * [步骤4-部署微服务以及配置ALBIngressController](步骤4-部署微服务以及配置ALBIngressController.md) \n\n * [步骤5-配置使用EBS](步骤5-配置使用EBS.md)\n\n * [步骤6-配置使用EFS](步骤6-配置使用EFS.md)\n\n * [步骤7-在EKS中使用IAMRole进行权限管理](步骤7-在EKS中使用IAMRole进行权限管理.md)\n\n * [步骤8-对应用Pod和集群进行自动扩展](步骤8-对应用Pod和集群进行自动扩展.md)\n\n * [步骤9-使用Helm部署应用](步骤9-使用Helm部署应用.md)\n\n * [步骤10-可用性-健康检查](步骤10-可用性-健康检查.md)\n\n * [步骤11-使用Calio加固EKS集群安全](步骤11-使用Calio加固EKS集群安全.md)\n \n * [步骤12 使用EFK收集、处理日志](步骤12-EFK日志收集.md)\n \n * [步骤13 部署Prometheus & Grafana监控](步骤13-Prometheus&Grafana监控.md) \n \n * [步骤14 在EKS集群上部署Istio 服务网格](步骤14-在EKS集群上部署Istio服务网格.md)\n \n \n \n 本实验使用宁夏ZHY(cn-northwest-1)Region\n \n 本文所需要的资源均在 china/2020_EKS_Lanuch_Workshop/resource/目录\n >请下载本git repository\n \n ```bash\n git clone https://github.com/aws-samples/eks-workshop-greater-china.git\n ```\n \n **重要说明:** 本实验中使用到的gcr.io/k8s.gcr.io, quay.io镜像如果国内无法直接访问,请使用第三方image镜像或者个人dockerhub仓库,(可参考2.4 中国区镜像处理章节配置自动修改模式或者在实验中自行编辑对应的yaml文件).\n\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/IRSA/iam-pod.yaml", "content": "apiVersion: v1\nkind: Pod\nmetadata:\n name: s3-echoer\nspec:\n serviceAccountName: s3-echoer\n containers:\n - name: main\n image: atlassian/pipelines-awscli\n command: ['sh', '-c', 'echo Hello Kubernetes! && sleep 3600']\n env:\n - name: AWS_DEFAULT_REGION\n value: \"cn-northwest-1\"\n - name: ENABLE_IRP\n value: \"true\"\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/alb-ingress-controller/alb-ingress-controller.yaml", "content": "# Application Load Balancer (ALB) Ingress Controller Deployment Manifest.\n# This manifest details sensible defaults for deploying an ALB Ingress Controller.\n# GitHub: https://github.com/kubernetes-sigs/aws-alb-ingress-controller\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n labels:\n app.kubernetes.io/name: alb-ingress-controller\n name: alb-ingress-controller\n # Namespace the ALB Ingress Controller should run in. Does not impact which\n # namespaces it's able to resolve ingress resource for. For limiting ingress\n # namespace scope, see --watch-namespace.\n namespace: kube-system\nspec:\n selector:\n matchLabels:\n app.kubernetes.io/name: alb-ingress-controller\n template:\n metadata:\n labels:\n app.kubernetes.io/name: alb-ingress-controller\n spec:\n containers:\n - name: alb-ingress-controller\n args:\n # Limit the namespace where this ALB Ingress Controller deployment will\n # resolve ingress resources. If left commented, all namespaces are used.\n # - --watch-namespace=your-k8s-namespace\n\n # Setting the ingress-class flag below ensures that only ingress resources with the\n # annotation kubernetes.io/ingress.class: \"alb\" are respected by the controller. You may\n # choose any class you'd like for this controller to respect.\n - --ingress-class=alb\n\n # REQUIRED\n # Name of your cluster. Used when naming resources created\n # by the ALB Ingress Controller, providing distinction between\n # clusters.\n - --cluster-name=eksworkshop\n\n # AWS VPC ID this ingress controller will use to create AWS resources.\n # If unspecified, it will be discovered from ec2metadata.\n # - --aws-vpc-id=vpc-xxxxxx\n - --aws-vpc-id=<你的vpc-id>\n\n # AWS region this ingress controller will operate in.\n # If unspecified, it will be discovered from ec2metadata.\n # List of regions: http://docs.aws.amazon.com/general/latest/gr/rande.html#vpc_region\n - --aws-region=cn-northwest-1\n\n # Enables logging on all outbound requests sent to the AWS API.\n # If logging is desired, set to true.\n # - --aws-api-debug\n # Maximum number of times to retry the aws calls.\n # defaults to 10.\n # - --aws-max-retries=10\n # 如果你在中国区使用alb-ingress-controller 1.1.7以及以上版本 需要禁用\n #- --feature-gates=waf=false,wafv2=false \n env:\n - name: AWS_REGION\n value: cn-northwest-1\n # AWS key id for authenticating with the AWS API.\n # This is only here for examples. It's recommended you instead use\n # a project like kube2iam for granting access.\n #- name: AWS_ACCESS_KEY_ID\n # value: KEYVALUE\n\n # AWS key secret for authenticating with the AWS API.\n # This is only here for examples. It's recommended you instead use\n # a project like kube2iam for granting access.\n #- name: AWS_SECRET_ACCESS_KEY\n # value: SECRETVALUE\n # Repository location of the ALB Ingress Controller.\n image: docker.io/amazon/aws-alb-ingress-controller:v1.1.5\n serviceAccountName: alb-ingress-controller\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/alb-ingress-controller/ingress-iam-policy.json", "content": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"acm:DescribeCertificate\",\n \"acm:ListCertificates\",\n \"acm:GetCertificate\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"ec2:AuthorizeSecurityGroupIngress\",\n \"ec2:CreateSecurityGroup\",\n \"ec2:CreateTags\",\n \"ec2:DeleteTags\",\n \"ec2:DeleteSecurityGroup\",\n \"ec2:DescribeAccountAttributes\",\n \"ec2:DescribeAddresses\",\n \"ec2:DescribeInstances\",\n \"ec2:DescribeInstanceStatus\",\n \"ec2:DescribeInternetGateways\",\n \"ec2:DescribeNetworkInterfaces\",\n \"ec2:DescribeSecurityGroups\",\n \"ec2:DescribeSubnets\",\n \"ec2:DescribeTags\",\n \"ec2:DescribeVpcs\",\n \"ec2:ModifyInstanceAttribute\",\n \"ec2:ModifyNetworkInterfaceAttribute\",\n \"ec2:RevokeSecurityGroupIngress\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"elasticloadbalancing:AddListenerCertificates\",\n \"elasticloadbalancing:AddTags\",\n \"elasticloadbalancing:CreateListener\",\n \"elasticloadbalancing:CreateLoadBalancer\",\n \"elasticloadbalancing:CreateRule\",\n \"elasticloadbalancing:CreateTargetGroup\",\n \"elasticloadbalancing:DeleteListener\",\n \"elasticloadbalancing:DeleteLoadBalancer\",\n \"elasticloadbalancing:DeleteRule\",\n \"elasticloadbalancing:DeleteTargetGroup\",\n \"elasticloadbalancing:DeregisterTargets\",\n \"elasticloadbalancing:DescribeListenerCertificates\",\n \"elasticloadbalancing:DescribeListeners\",\n \"elasticloadbalancing:DescribeLoadBalancers\",\n \"elasticloadbalancing:DescribeLoadBalancerAttributes\",\n \"elasticloadbalancing:DescribeRules\",\n \"elasticloadbalancing:DescribeSSLPolicies\",\n \"elasticloadbalancing:DescribeTags\",\n \"elasticloadbalancing:DescribeTargetGroups\",\n \"elasticloadbalancing:DescribeTargetGroupAttributes\",\n \"elasticloadbalancing:DescribeTargetHealth\",\n \"elasticloadbalancing:ModifyListener\",\n \"elasticloadbalancing:ModifyLoadBalancerAttributes\",\n \"elasticloadbalancing:ModifyRule\",\n \"elasticloadbalancing:ModifyTargetGroup\",\n \"elasticloadbalancing:ModifyTargetGroupAttributes\",\n \"elasticloadbalancing:RegisterTargets\",\n \"elasticloadbalancing:RemoveListenerCertificates\",\n \"elasticloadbalancing:RemoveTags\",\n \"elasticloadbalancing:SetIpAddressType\",\n \"elasticloadbalancing:SetSecurityGroups\",\n \"elasticloadbalancing:SetSubnets\",\n \"elasticloadbalancing:SetWebACL\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"iam:CreateServiceLinkedRole\",\n \"iam:GetServerCertificate\",\n \"iam:ListServerCertificates\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"cognito-idp:DescribeUserPoolClient\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"tag:GetResources\",\n \"tag:TagResources\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/alb-ingress-controller/nginx-alb-ingress.yaml", "content": "---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: nginx-deployment-ingress\n labels:\n app: nginx\nspec:\n replicas: 1\n selector:\n matchLabels:\n app: nginx\n template:\n metadata:\n labels:\n app: nginx\n spec:\n containers:\n - name: nginx\n image: nginx\n ports:\n - containerPort: 80\n---\napiVersion: v1\nkind: Service\nmetadata:\n name: \"service-nginx-clusterip\"\nspec:\n selector:\n app: nginx\n #type: ClusterIP\n type: NodePort\n ports:\n - protocol: TCP\n port: 80\n targetPort: 80\n---\napiVersion: extensions/v1beta1\nkind: Ingress\nmetadata:\n name: \"alb-ingress\"\n namespace: \"default\"\n annotations:\n kubernetes.io/ingress.class: alb\n alb.ingress.kubernetes.io/scheme: internet-facing\n #alb.ingress.kubernetes.io/target-type: ip\n alb.ingress.kubernetes.io/target-type: instance\n labels:\n app: nginx\nspec:\n rules:\n - http:\n paths:\n - path: /*\n backend:\n serviceName: \"service-nginx-clusterip\"\n servicePort: 80\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/alb-ingress-controller/rbac-role.yaml", "content": "---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n labels:\n app.kubernetes.io/name: alb-ingress-controller\n name: alb-ingress-controller\nrules:\n - apiGroups:\n - \"\"\n - extensions\n resources:\n - configmaps\n - endpoints\n - events\n - ingresses\n - ingresses/status\n - services\n verbs:\n - create\n - get\n - list\n - update\n - watch\n - patch\n - apiGroups:\n - \"\"\n - extensions\n resources:\n - nodes\n - pods\n - secrets\n - services\n - namespaces\n verbs:\n - get\n - list\n - watch\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n labels:\n app.kubernetes.io/name: alb-ingress-controller\n name: alb-ingress-controller\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: alb-ingress-controller\nsubjects:\n - kind: ServiceAccount\n name: alb-ingress-controller\n namespace: kube-system\n---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n labels:\n app.kubernetes.io/name: alb-ingress-controller\n name: alb-ingress-controller\n namespace: kube-system\n...\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/aws-ebs-csi-driver/.helmignore", "content": "# Patterns to ignore when building packages.\n# This supports shell glob matching, relative path matching, and\n# negation (prefixed with !). Only one pattern per line.\n.DS_Store\n# Common VCS dirs\n.git/\n.gitignore\n.bzr/\n.bzrignore\n.hg/\n.hgignore\n.svn/\n# Common backup files\n*.swp\n*.bak\n*.tmp\n*~\n# Various IDEs\n.project\n.idea/\n*.tmproj\n.vscode/\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/aws-ebs-csi-driver/Chart.yaml", "content": "apiVersion: v1\nappVersion: \"0.5.0\"\nname: aws-ebs-csi-driver\ndescription: A Helm chart for AWS EBS CSI Driver\nversion: 0.3.0\nkubeVersion: \">=1.13.0-0\"\nhome: https://github.com/kubernetes-sigs/aws-ebs-csi-driver\nsources:\n - https://github.com/kubernetes-sigs/aws-ebs-csi-driver\nkeywords:\n - aws\n - ebs\n - csi\nmaintainers:\n - name: leakingtapan\n email: chengpan@amazon.com\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/aws-ebs-csi-driver/templates/NOTES.txt", "content": "To verify that aws-ebs-csi-driver has started, run:\n\n kubectl get pod -n kube-system -l \"app.kubernetes.io/name={{ include \"aws-ebs-csi-driver.name\" . }},app.kubernetes.io/instance={{ .Release.Name }}\"\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/aws-ebs-csi-driver/templates/_helpers.tpl", "content": "{{/* vim: set filetype=mustache: */}}\n{{/*\nExpand the name of the chart.\n*/}}\n{{- define \"aws-ebs-csi-driver.name\" -}}\n{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix \"-\" -}}\n{{- end -}}\n\n{{/*\nCreate a default fully qualified app name.\nWe truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).\nIf release name contains chart name it will be used as a full name.\n*/}}\n{{- define \"aws-ebs-csi-driver.fullname\" -}}\n{{- if .Values.fullnameOverride -}}\n{{- .Values.fullnameOverride | trunc 63 | trimSuffix \"-\" -}}\n{{- else -}}\n{{- $name := default .Chart.Name .Values.nameOverride -}}\n{{- if contains $name .Release.Name -}}\n{{- .Release.Name | trunc 63 | trimSuffix \"-\" -}}\n{{- else -}}\n{{- printf \"%s-%s\" .Release.Name $name | trunc 63 | trimSuffix \"-\" -}}\n{{- end -}}\n{{- end -}}\n{{- end -}}\n\n{{/*\nCreate chart name and version as used by the chart label.\n*/}}\n{{- define \"aws-ebs-csi-driver.chart\" -}}\n{{- printf \"%s-%s\" .Chart.Name .Chart.Version | replace \"+\" \"_\" | trunc 63 | trimSuffix \"-\" -}}\n{{- end -}}\n\n{{/*\nCommon labels\n*/}}\n{{- define \"aws-ebs-csi-driver.labels\" -}}\napp.kubernetes.io/name: {{ include \"aws-ebs-csi-driver.name\" . }}\nhelm.sh/chart: {{ include \"aws-ebs-csi-driver.chart\" . }}\napp.kubernetes.io/instance: {{ .Release.Name }}\n{{- if .Chart.AppVersion }}\napp.kubernetes.io/version: {{ .Chart.AppVersion | quote }}\n{{- end }}\napp.kubernetes.io/managed-by: {{ .Release.Service }}\n{{- end -}}\n\n{{/*\nConvert the `--extra-volume-tags` command line arg from a map.\n*/}}\n{{- define \"aws-ebs-csi-driver.extra-volume-tags\" -}}\n{{- $result := dict \"pairs\" (list) -}}\n{{- range $key, $value := .Values.extraVolumeTags -}}\n{{- $noop := printf \"%s=%s\" $key $value | append $result.pairs | set $result \"pairs\" -}}\n{{- end -}}\n{{- if gt (len $result.pairs) 0 -}}\n- --extra-volume-tags={{- join \",\" $result.pairs -}}\n{{- end -}}\n{{- end -}}\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/aws-ebs-csi-driver/templates/csidriver.yaml", "content": "apiVersion: storage.k8s.io/v1beta1\nkind: CSIDriver\nmetadata:\n name: ebs.csi.aws.com\nspec:\n attachRequired: true\n podInfoOnMount: false\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/aws-ebs-csi-driver/templates/daemonset.yaml", "content": "# Node Service\nkind: DaemonSet\napiVersion: apps/v1\nmetadata:\n name: ebs-csi-node\n namespace: kube-system\nspec:\n selector:\n matchLabels:\n app: ebs-csi-node\n app.kubernetes.io/name: {{ include \"aws-ebs-csi-driver.name\" . }}\n app.kubernetes.io/instance: {{ .Release.Name }}\n template:\n metadata:\n labels:\n app: ebs-csi-node\n app.kubernetes.io/name: {{ include \"aws-ebs-csi-driver.name\" . }}\n app.kubernetes.io/instance: {{ .Release.Name }}\n {{- if .Values.node.podAnnotations }}\n annotations: {{ toYaml .Values.node.podAnnotations | nindent 8 }}\n {{- end }}\n spec:\n nodeSelector:\n beta.kubernetes.io/os: linux\n hostNetwork: true\n priorityClassName: system-node-critical\n tolerations:\n - operator: Exists\n {{- with .Values.node.tolerations }}\n{{ toYaml . | indent 8 }}\n {{- end }}\n containers:\n - name: ebs-plugin\n securityContext:\n privileged: true\n image: \"{{ .Values.image.repository }}:{{ .Values.image.tag }}\"\n args:\n - node\n - --endpoint=$(CSI_ENDPOINT)\n - --logtostderr\n - --v=5\n env:\n - name: CSI_ENDPOINT\n value: unix:/csi/csi.sock\n volumeMounts:\n - name: kubelet-dir\n mountPath: /var/lib/kubelet\n mountPropagation: \"Bidirectional\"\n - name: plugin-dir\n mountPath: /csi\n - name: device-dir\n mountPath: /dev\n ports:\n - name: healthz\n containerPort: 9808\n protocol: TCP\n livenessProbe:\n httpGet:\n path: /healthz\n port: healthz\n initialDelaySeconds: 10\n timeoutSeconds: 3\n periodSeconds: 10\n failureThreshold: 5\n - name: node-driver-registrar\n image: {{ printf \"%s:%s\" .Values.sidecars.nodeDriverRegistrarImage.repository .Values.sidecars.nodeDriverRegistrarImage.tag }}\n args:\n - --csi-address=$(ADDRESS)\n - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)\n - --v=5\n lifecycle:\n preStop:\n exec:\n command: [\"/bin/sh\", \"-c\", \"rm -rf /registration/ebs.csi.aws.com-reg.sock /csi/csi.sock\"]\n env:\n - name: ADDRESS\n value: /csi/csi.sock\n - name: DRIVER_REG_SOCK_PATH\n value: /var/lib/kubelet/plugins/ebs.csi.aws.com/csi.sock\n volumeMounts:\n - name: plugin-dir\n mountPath: /csi\n - name: registration-dir\n mountPath: /registration\n - name: liveness-probe\n image: {{ printf \"%s:%s\" .Values.sidecars.livenessProbeImage.repository .Values.sidecars.livenessProbeImage.tag }}\n args:\n - --csi-address=/csi/csi.sock\n volumeMounts:\n - name: plugin-dir\n mountPath: /csi\n volumes:\n - name: kubelet-dir\n hostPath:\n path: /var/lib/kubelet\n type: Directory\n - name: plugin-dir\n hostPath:\n path: /var/lib/kubelet/plugins/ebs.csi.aws.com/\n type: DirectoryOrCreate\n - name: registration-dir\n hostPath:\n path: /var/lib/kubelet/plugins_registry/\n type: Directory\n - name: device-dir\n hostPath:\n path: /dev\n type: Directory\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/aws-ebs-csi-driver/templates/deployment.yaml", "content": "# Controller Service\nkind: Deployment\napiVersion: apps/v1\nmetadata:\n name: ebs-csi-controller\n namespace: kube-system\nspec:\n replicas: {{ .Values.replicaCount }}\n selector:\n matchLabels:\n app: ebs-csi-controller\n app.kubernetes.io/name: {{ include \"aws-ebs-csi-driver.name\" . }}\n app.kubernetes.io/instance: {{ .Release.Name }}\n template:\n metadata:\n labels:\n app: ebs-csi-controller\n app.kubernetes.io/name: {{ include \"aws-ebs-csi-driver.name\" . }}\n app.kubernetes.io/instance: {{ .Release.Name }}\n {{- if .Values.podAnnotations }}\n annotations: {{ toYaml .Values.podAnnotations | nindent 8 }}\n {{- end }}\n spec:\n nodeSelector:\n beta.kubernetes.io/os: linux\n {{- with .Values.nodeSelector }}\n{{ toYaml . | indent 8 }}\n {{- end }}\n serviceAccountName: ebs-csi-controller-sa\n priorityClassName: system-cluster-critical\n {{- with .Values.affinity }}\n affinity: {{ toYaml . | nindent 8 }}\n {{- end }}\n tolerations:\n - operator: Exists\n {{- with .Values.tolerations }}\n{{ toYaml . | indent 8 }}\n {{- end }}\n containers:\n - name: ebs-plugin\n image: \"{{ .Values.image.repository }}:{{ .Values.image.tag }}\"\n imagePullPolicy: {{ .Values.image.pullPolicy }}\n args:\n - controller\n - --endpoint=$(CSI_ENDPOINT)\n {{ include \"aws-ebs-csi-driver.extra-volume-tags\" . }}\n - --logtostderr\n - --v=5\n env:\n - name: CSI_ENDPOINT\n value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock\n - name: AWS_ACCESS_KEY_ID\n valueFrom:\n secretKeyRef:\n name: aws-secret\n key: key_id\n optional: true\n - name: AWS_SECRET_ACCESS_KEY\n valueFrom:\n secretKeyRef:\n name: aws-secret\n key: access_key\n optional: true\n {{- if .Values.region }}\n - name: AWS_REGION\n value: {{ .Values.region }}\n {{- end }}\n volumeMounts:\n - name: socket-dir\n mountPath: /var/lib/csi/sockets/pluginproxy/\n ports:\n - name: healthz\n containerPort: 9808\n protocol: TCP\n livenessProbe:\n httpGet:\n path: /healthz\n port: healthz\n initialDelaySeconds: 10\n timeoutSeconds: 3\n periodSeconds: 10\n failureThreshold: 5\n {{- with .Values.resources }}\n resources: {{ toYaml . | nindent 12 }}\n {{- end }}\n - name: csi-provisioner\n image: {{ printf \"%s:%s\" .Values.sidecars.provisionerImage.repository .Values.sidecars.provisionerImage.tag }}\n args:\n - --csi-address=$(ADDRESS)\n - --v=5\n {{- if .Values.enableVolumeScheduling }}\n - --feature-gates=Topology=true\n {{- end}}\n - --enable-leader-election\n - --leader-election-type=leases\n env:\n - name: ADDRESS\n value: /var/lib/csi/sockets/pluginproxy/csi.sock\n volumeMounts:\n - name: socket-dir\n mountPath: /var/lib/csi/sockets/pluginproxy/\n - name: csi-attacher\n image: {{ printf \"%s:%s\" .Values.sidecars.attacherImage.repository .Values.sidecars.attacherImage.tag }}\n args:\n - --csi-address=$(ADDRESS)\n - --v=5\n - --leader-election=true\n - --leader-election-type=leases\n env:\n - name: ADDRESS\n value: /var/lib/csi/sockets/pluginproxy/csi.sock\n volumeMounts:\n - name: socket-dir\n mountPath: /var/lib/csi/sockets/pluginproxy/\n {{- if .Values.enableVolumeSnapshot }}\n - name: csi-snapshotter\n image: {{ printf \"%s:%s\" .Values.sidecars.snapshotterImage.repository .Values.sidecars.snapshotterImage.tag }}\n args:\n - --csi-address=$(ADDRESS)\n - --leader-election=true\n env:\n - name: ADDRESS\n value: /var/lib/csi/sockets/pluginproxy/csi.sock\n volumeMounts:\n - name: socket-dir\n mountPath: /var/lib/csi/sockets/pluginproxy/\n {{- end }}\n {{- if .Values.enableVolumeResizing }}\n - name: csi-resizer\n image: {{ printf \"%s:%s\" .Values.sidecars.resizerImage.repository .Values.sidecars.resizerImage.tag }}\n imagePullPolicy: Always\n args:\n - --csi-address=$(ADDRESS)\n - --v=5\n env:\n - name: ADDRESS\n value: /var/lib/csi/sockets/pluginproxy/csi.sock\n volumeMounts:\n - name: socket-dir\n mountPath: /var/lib/csi/sockets/pluginproxy/\n {{- end }}\n - name: liveness-probe\n image: {{ printf \"%s:%s\" .Values.sidecars.livenessProbeImage.repository .Values.sidecars.livenessProbeImage.tag }}\n args:\n - --csi-address=/csi/csi.sock\n volumeMounts:\n - name: socket-dir\n mountPath: /csi\n volumes:\n - name: socket-dir\n emptyDir: {}\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/aws-ebs-csi-driver/templates/rbac.yaml", "content": "---\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-external-provisioner-role\nrules:\n - apiGroups: [\"\"]\n resources: [\"persistentvolumes\"]\n verbs: [\"get\", \"list\", \"watch\", \"create\", \"delete\"]\n - apiGroups: [\"\"]\n resources: [\"persistentvolumeclaims\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"storageclasses\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"events\"]\n verbs: [\"list\", \"watch\", \"create\", \"update\", \"patch\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshots\"]\n verbs: [\"get\", \"list\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotcontents\"]\n verbs: [\"get\", \"list\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"csinodes\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"nodes\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"coordination.k8s.io\"]\n resources: [\"leases\"]\n verbs: [\"get\", \"watch\", \"list\", \"delete\", \"update\", \"create\"]\n\n---\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-csi-provisioner-binding\nsubjects:\n - kind: ServiceAccount\n name: ebs-csi-controller-sa\n namespace: kube-system\nroleRef:\n kind: ClusterRole\n name: ebs-external-provisioner-role\n apiGroup: rbac.authorization.k8s.io\n\n---\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-external-attacher-role\nrules:\n - apiGroups: [\"\"]\n resources: [\"persistentvolumes\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\"]\n - apiGroups: [\"\"]\n resources: [\"nodes\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"csi.storage.k8s.io\"]\n resources: [\"csinodeinfos\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"volumeattachments\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\"]\n\n---\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-csi-attacher-binding\nsubjects:\n - kind: ServiceAccount\n name: ebs-csi-controller-sa\n namespace: kube-system\nroleRef:\n kind: ClusterRole\n name: ebs-external-attacher-role\n apiGroup: rbac.authorization.k8s.io\n\n{{- if .Values.enableVolumeSnapshot }}\n---\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-external-snapshotter-role\nrules:\n - apiGroups: [\"\"]\n resources: [\"persistentvolumes\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"persistentvolumeclaims\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"storageclasses\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"events\"]\n verbs: [\"list\", \"watch\", \"create\", \"update\", \"patch\"]\n - apiGroups: [\"\"]\n resources: [\"secrets\"]\n verbs: [\"get\", \"list\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotclasses\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotcontents\"]\n verbs: [\"create\", \"get\", \"list\", \"watch\", \"update\", \"delete\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshots\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotcontents\"]\n verbs: [\"create\", \"get\", \"list\", \"watch\", \"update\", \"delete\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotcontents/status\"]\n verbs: [\"update\"]\n - apiGroups: [\"apiextensions.k8s.io\"]\n resources: [\"customresourcedefinitions\"]\n verbs: [\"create\", \"list\", \"watch\", \"delete\"]\n\n---\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-csi-snapshotter-binding\nsubjects:\n - kind: ServiceAccount\n name: ebs-csi-controller-sa\n namespace: kube-system\nroleRef:\n kind: ClusterRole\n name: ebs-external-snapshotter-role\n apiGroup: rbac.authorization.k8s.io\n\n---\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-snapshot-controller-role\nrules:\n - apiGroups: [\"\"]\n resources: [\"persistentvolumes\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"persistentvolumeclaims\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"storageclasses\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"events\"]\n verbs: [\"list\", \"watch\", \"create\", \"update\", \"patch\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotclasses\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotcontents\"]\n verbs: [\"create\", \"get\", \"list\", \"watch\", \"update\", \"delete\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshots\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshots/status\"]\n verbs: [\"update\"]\n\n---\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-csi-snapshot-controller-binding\nsubjects:\n - kind: ServiceAccount\n name: ebs-snapshot-controller\n namespace: kube-system\nroleRef:\n kind: ClusterRole\n name: ebs-snapshot-controller-role\n apiGroup: rbac.authorization.k8s.io\n\n---\nkind: Role\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-snapshot-controller-leaderelection\n namespace: kube-system \nrules:\n- apiGroups: [\"coordination.k8s.io\"]\n resources: [\"leases\"]\n verbs: [\"get\", \"watch\", \"list\", \"delete\", \"update\", \"create\"]\n\n---\nkind: RoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: snapshot-controller-leaderelection\n namespace: kube-system \nsubjects:\n - kind: ServiceAccount\n name: ebs-snapshot-controller\n namespace: kube-system \nroleRef:\n kind: Role\n name: snapshot-controller-leaderelection\n apiGroup: rbac.authorization.k8s.io\n\n{{- end }}\n\n{{- if .Values.enableVolumeResizing }}\n---\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-external-resizer-role\nrules:\n # The following rule should be uncommented for plugins that require secrets\n # for provisioning.\n # - apiGroups: [\"\"]\n # resources: [\"secrets\"]\n # verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"persistentvolumes\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\", \"patch\"]\n - apiGroups: [\"\"]\n resources: [\"persistentvolumeclaims\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"persistentvolumeclaims/status\"]\n verbs: [\"update\", \"patch\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"storageclasses\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"events\"]\n verbs: [\"list\", \"watch\", \"create\", \"update\", \"patch\"]\n\n---\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-csi-resizer-binding\nsubjects:\n - kind: ServiceAccount\n name: ebs-csi-controller-sa\n namespace: kube-system\nroleRef:\n kind: ClusterRole\n name: ebs-external-resizer-role\n apiGroup: rbac.authorization.k8s.io\n{{- end}}\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/aws-ebs-csi-driver/templates/serviceaccount.yaml", "content": "apiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: ebs-csi-controller-sa\n namespace: kube-system\n {{- with .Values.serviceAccount.controller.annotations }}\n annotations: {{ toYaml . | nindent 4 }}\n {{- end }}\n\n---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: ebs-snapshot-controller\n namespace: kube-system\n {{- with .Values.serviceAccount.snapshot.annotations }}\n annotations: {{ toYaml . | nindent 4 }}\n {{- end }}\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/aws-ebs-csi-driver/templates/statefulset.yaml", "content": "{{- if .Values.enableVolumeSnapshot }}\r\n#Snapshot controller\r\nkind: StatefulSet\r\napiVersion: apps/v1\r\nmetadata:\r\n name: ebs-snapshot-controller\r\n namespace: kube-system\r\nspec:\r\n serviceName: ebs-snapshot-controller\r\n replicas: 1\r\n selector:\r\n matchLabels:\r\n app: ebs-snapshot-controller\r\n template:\r\n metadata:\r\n labels:\r\n app: ebs-snapshot-controller\r\n spec:\r\n serviceAccount: ebs-snapshot-controller\r\n containers:\r\n - name: snapshot-controller\r\n image: quay.io/k8scsi/snapshot-controller:v2.0.1\r\n args:\r\n - --v=5\r\n - --leader-election=false\r\n{{- end }}\r\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/aws-ebs-csi-driver/values.yaml", "content": "# Default values for aws-ebs-csi-driver.\n# This is a YAML-formatted file.\n# Declare variables to be passed into your templates.\n\nreplicaCount: 2\n\nimage:\n repository: amazon/aws-ebs-csi-driver\n tag: \"v0.5.0\"\n pullPolicy: IfNotPresent\n\nsidecars:\n provisionerImage:\n repository: quay.io/k8scsi/csi-provisioner\n tag: \"v1.5.0\"\n attacherImage:\n repository: quay.io/k8scsi/csi-attacher\n tag: \"v1.2.0\"\n snapshotterImage:\n repository: quay.io/k8scsi/csi-snapshotter\n tag: \"v2.0.1\"\n livenessProbeImage:\n repository: quay.io/k8scsi/livenessprobe\n tag: \"v1.1.0\"\n resizerImage:\n repository: quay.io/k8scsi/csi-resizer\n tag: \"v0.3.0\"\n nodeDriverRegistrarImage:\n repository: quay.io/k8scsi/csi-node-driver-registrar\n tag: \"v1.1.0\"\n\nimagePullSecrets: []\nnameOverride: \"\"\nfullnameOverride: \"\"\n\npodAnnotations: {}\n\n# True if enable volume scheduling for dynamic volume provisioning\nenableVolumeScheduling: false\n\n# True if enable volume resizing\nenableVolumeResizing: false\n\n# True if enable volume snapshot\nenableVolumeSnapshot: false\n\nresources: {}\n # We usually recommend not to specify default resources and to leave this as a conscious\n # choice for the user. This also increases chances charts run on environments with little\n # resources, such as Minikube. If you do want to specify resources, uncomment the following\n # lines, adjust them as necessary, and remove the curly braces after 'resources:'.\n # limits:\n # cpu: 100m\n # memory: 128Mi\n # requests:\n # cpu: 100m\n # memory: 128Mi\n\nnodeSelector: {}\n\ntolerations: []\n\naffinity: {}\n\n# Extra volume tags to attach to each dynamically provisioned volume.\n# ---\n# extraVolumeTags:\n# key1: value1\n# key2: value2\nextraVolumeTags: {}\n\n# AWS region to use. If not specified then the region will be looked up via the AWS EC2 metadata\n# service.\n# ---\n# region: us-east-1\nregion: \"\"\n\nnode:\n podAnnotations: {}\n tolerations: []\n\nserviceAccount:\n controller:\n annotations: {}\n snapshot:\n annotations: {}\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/base/controller.yaml", "content": "---\n# Controller Service\nkind: Deployment\napiVersion: apps/v1\nmetadata:\n name: ebs-csi-controller\n namespace: kube-system\nspec:\n replicas: 2\n selector:\n matchLabels:\n app: ebs-csi-controller\n template:\n metadata:\n labels:\n app: ebs-csi-controller\n spec:\n nodeSelector:\n beta.kubernetes.io/os: linux\n serviceAccount: ebs-csi-controller-sa\n priorityClassName: system-cluster-critical\n tolerations:\n - key: CriticalAddonsOnly\n operator: Exists\n containers:\n - name: ebs-plugin\n image: amazon/aws-ebs-csi-driver:latest\n args :\n # - {all,controller,node} # specify the driver mode\n - --endpoint=$(CSI_ENDPOINT)\n - --logtostderr\n - --v=5\n env:\n - name: CSI_ENDPOINT\n value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock\n - name: AWS_ACCESS_KEY_ID\n valueFrom:\n secretKeyRef:\n name: aws-secret\n key: key_id\n optional: true\n - name: AWS_SECRET_ACCESS_KEY\n valueFrom:\n secretKeyRef:\n name: aws-secret\n key: access_key\n optional: true\n # overwrite the AWS region instead of looking it up dynamically via the AWS EC2 metadata svc\n # - name: AWS_REGION\n # value: us-east-1\n volumeMounts:\n - name: socket-dir\n mountPath: /var/lib/csi/sockets/pluginproxy/\n ports:\n - name: healthz\n containerPort: 9808\n protocol: TCP\n livenessProbe:\n httpGet:\n path: /healthz\n port: healthz\n initialDelaySeconds: 10\n timeoutSeconds: 3\n periodSeconds: 10\n failureThreshold: 5\n - name: csi-provisioner\n image: quay.io/k8scsi/csi-provisioner:v1.5.0\n args:\n - --csi-address=$(ADDRESS)\n - --v=5\n - --feature-gates=Topology=true\n - --enable-leader-election\n - --leader-election-type=leases\n env:\n - name: ADDRESS\n value: /var/lib/csi/sockets/pluginproxy/csi.sock\n volumeMounts:\n - name: socket-dir\n mountPath: /var/lib/csi/sockets/pluginproxy/\n - name: csi-attacher\n image: quay.io/k8scsi/csi-attacher:v1.2.0\n args:\n - --csi-address=$(ADDRESS)\n - --v=5\n - --leader-election=true\n - --leader-election-type=leases\n env:\n - name: ADDRESS\n value: /var/lib/csi/sockets/pluginproxy/csi.sock\n volumeMounts:\n - name: socket-dir\n mountPath: /var/lib/csi/sockets/pluginproxy/\n - name: liveness-probe\n image: quay.io/k8scsi/livenessprobe:v1.1.0\n args:\n - --csi-address=/csi/csi.sock\n volumeMounts:\n - name: socket-dir\n mountPath: /csi\n volumes:\n - name: socket-dir\n emptyDir: {}\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/base/csidriver.yaml", "content": "---\n\napiVersion: storage.k8s.io/v1beta1\nkind: CSIDriver\nmetadata:\n name: ebs.csi.aws.com\nspec:\n attachRequired: true\n podInfoOnMount: false\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/base/kustomization.yaml", "content": "apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: kube-system\nresources:\n- controller.yaml\n- node.yaml\n- rbac.yaml\n- csidriver.yaml\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/base/node.yaml", "content": "---\n# Node Service\nkind: DaemonSet\napiVersion: apps/v1\nmetadata:\n name: ebs-csi-node\n namespace: kube-system\nspec:\n selector:\n matchLabels:\n app: ebs-csi-node\n template:\n metadata:\n labels:\n app: ebs-csi-node\n spec:\n nodeSelector:\n beta.kubernetes.io/os: linux\n hostNetwork: true\n priorityClassName: system-node-critical\n tolerations:\n - operator: Exists\n containers:\n - name: ebs-plugin\n securityContext:\n privileged: true\n image: amazon/aws-ebs-csi-driver:latest\n args:\n - --endpoint=$(CSI_ENDPOINT)\n - --logtostderr\n - --v=5\n env:\n - name: CSI_ENDPOINT\n value: unix:/csi/csi.sock\n volumeMounts:\n - name: kubelet-dir\n mountPath: /var/lib/kubelet\n mountPropagation: \"Bidirectional\"\n - name: plugin-dir\n mountPath: /csi\n - name: device-dir\n mountPath: /dev\n ports:\n - name: healthz\n containerPort: 9808\n protocol: TCP\n livenessProbe:\n httpGet:\n path: /healthz\n port: healthz\n initialDelaySeconds: 10\n timeoutSeconds: 3\n periodSeconds: 10\n failureThreshold: 5\n - name: node-driver-registrar\n image: quay.io/k8scsi/csi-node-driver-registrar:v1.1.0\n args:\n - --csi-address=$(ADDRESS)\n - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)\n - --v=5\n lifecycle:\n preStop:\n exec:\n command: [\"/bin/sh\", \"-c\", \"rm -rf /registration/ebs.csi.aws.com-reg.sock /csi/csi.sock\"]\n env:\n - name: ADDRESS\n value: /csi/csi.sock\n - name: DRIVER_REG_SOCK_PATH\n value: /var/lib/kubelet/plugins/ebs.csi.aws.com/csi.sock\n volumeMounts:\n - name: plugin-dir\n mountPath: /csi\n - name: registration-dir\n mountPath: /registration\n - name: liveness-probe\n image: quay.io/k8scsi/livenessprobe:v1.1.0\n args:\n - --csi-address=/csi/csi.sock\n volumeMounts:\n - name: plugin-dir\n mountPath: /csi\n volumes:\n - name: kubelet-dir\n hostPath:\n path: /var/lib/kubelet\n type: Directory\n - name: plugin-dir\n hostPath:\n path: /var/lib/kubelet/plugins/ebs.csi.aws.com/\n type: DirectoryOrCreate\n - name: registration-dir\n hostPath:\n path: /var/lib/kubelet/plugins_registry/\n type: Directory\n - name: device-dir\n hostPath:\n path: /dev\n type: Directory\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/base/rbac.yaml", "content": "apiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: ebs-csi-controller-sa\n namespace: kube-system\n #Enable if EKS IAM for SA is used\n #annotations:\n # eks.amazonaws.com/role-arn: arn:aws:iam::586565787010:role/ebs-csi-role\n\n---\n\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-external-provisioner-role\nrules:\n - apiGroups: [\"\"]\n resources: [\"persistentvolumes\"]\n verbs: [\"get\", \"list\", \"watch\", \"create\", \"delete\"]\n - apiGroups: [\"\"]\n resources: [\"persistentvolumeclaims\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"storageclasses\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"events\"]\n verbs: [\"list\", \"watch\", \"create\", \"update\", \"patch\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshots\"]\n verbs: [\"get\", \"list\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotcontents\"]\n verbs: [\"get\", \"list\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"csinodes\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"nodes\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"coordination.k8s.io\"]\n resources: [\"leases\"]\n verbs: [\"get\", \"watch\", \"list\", \"delete\", \"update\", \"create\"]\n\n---\n\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-csi-provisioner-binding\nsubjects:\n - kind: ServiceAccount\n name: ebs-csi-controller-sa\n namespace: kube-system\nroleRef:\n kind: ClusterRole\n name: ebs-external-provisioner-role\n apiGroup: rbac.authorization.k8s.io\n\n---\n\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-external-attacher-role\nrules:\n - apiGroups: [\"\"]\n resources: [\"persistentvolumes\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\"]\n - apiGroups: [\"\"]\n resources: [\"nodes\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"csi.storage.k8s.io\"]\n resources: [\"csinodeinfos\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"volumeattachments\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\"]\n\n---\n\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-csi-attacher-binding\nsubjects:\n - kind: ServiceAccount\n name: ebs-csi-controller-sa\n namespace: kube-system\nroleRef:\n kind: ClusterRole\n name: ebs-external-attacher-role\n apiGroup: rbac.authorization.k8s.io\n\n\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/cluster/crd_snapshotter.yaml", "content": "---\napiVersion: apiextensions.k8s.io/v1beta1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: (devel)\n api-approved.kubernetes.io: \"https://github.com/kubernetes-csi/external-snapshotter/pull/139\"\n creationTimestamp: null\n name: volumesnapshotclasses.snapshot.storage.k8s.io\nspec:\n group: snapshot.storage.k8s.io\n names:\n kind: VolumeSnapshotClass\n listKind: VolumeSnapshotClassList\n plural: volumesnapshotclasses\n singular: volumesnapshotclass\n scope: Cluster\n preserveUnknownFields: false\n validation:\n openAPIV3Schema:\n description: VolumeSnapshotClass specifies parameters that a underlying storage\n system uses when creating a volume snapshot. A specific VolumeSnapshotClass\n is used by specifying its name in a VolumeSnapshot object. VolumeSnapshotClasses\n are non-namespaced\n properties:\n apiVersion:\n description: 'APIVersion defines the versioned schema of this representation\n of an object. Servers should convert recognized schemas to the latest\n internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'\n type: string\n deletionPolicy:\n description: deletionPolicy determines whether a VolumeSnapshotContent created\n through the VolumeSnapshotClass should be deleted when its bound VolumeSnapshot\n is deleted. Supported values are \"Retain\" and \"Delete\". \"Retain\" means\n that the VolumeSnapshotContent and its physical snapshot on underlying\n storage system are kept. \"Delete\" means that the VolumeSnapshotContent\n and its physical snapshot on underlying storage system are deleted. Required.\n enum:\n - Delete\n - Retain\n type: string\n driver:\n description: driver is the name of the storage driver that handles this\n VolumeSnapshotClass. Required.\n type: string\n kind:\n description: 'Kind is a string value representing the REST resource this\n object represents. Servers may infer this from the endpoint the client\n submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'\n type: string\n parameters:\n additionalProperties:\n type: string\n description: parameters is a key-value map with storage driver specific\n parameters for creating snapshots. These values are opaque to Kubernetes.\n type: object\n required:\n - deletionPolicy\n - driver\n type: object\n version: v1beta1\n versions:\n - name: v1beta1\n served: true\n storage: true\nstatus:\n acceptedNames:\n kind: \"\"\n plural: \"\"\n conditions: []\n storedVersions: []\n\n---\napiVersion: apiextensions.k8s.io/v1beta1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: (devel)\n api-approved.kubernetes.io: \"https://github.com/kubernetes-csi/external-snapshotter/pull/139\"\n creationTimestamp: null\n name: volumesnapshotcontents.snapshot.storage.k8s.io\nspec:\n group: snapshot.storage.k8s.io\n names:\n kind: VolumeSnapshotContent\n listKind: VolumeSnapshotContentList\n plural: volumesnapshotcontents\n singular: volumesnapshotcontent\n scope: Cluster\n subresources:\n status: {}\n preserveUnknownFields: false\n validation:\n openAPIV3Schema:\n description: VolumeSnapshotContent represents the actual \"on-disk\" snapshot\n object in the underlying storage system\n properties:\n apiVersion:\n description: 'APIVersion defines the versioned schema of this representation\n of an object. Servers should convert recognized schemas to the latest\n internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'\n type: string\n kind:\n description: 'Kind is a string value representing the REST resource this\n object represents. Servers may infer this from the endpoint the client\n submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'\n type: string\n spec:\n description: spec defines properties of a VolumeSnapshotContent created\n by the underlying storage system. Required.\n properties:\n deletionPolicy:\n description: deletionPolicy determines whether this VolumeSnapshotContent\n and its physical snapshot on the underlying storage system should\n be deleted when its bound VolumeSnapshot is deleted. Supported values\n are \"Retain\" and \"Delete\". \"Retain\" means that the VolumeSnapshotContent\n and its physical snapshot on underlying storage system are kept. \"Delete\"\n means that the VolumeSnapshotContent and its physical snapshot on\n underlying storage system are deleted. In dynamic snapshot creation\n case, this field will be filled in with the \"DeletionPolicy\" field\n defined in the VolumeSnapshotClass the VolumeSnapshot refers to. For\n pre-existing snapshots, users MUST specify this field when creating\n the VolumeSnapshotContent object. Required.\n enum:\n - Delete\n - Retain\n type: string\n driver:\n description: driver is the name of the CSI driver used to create the\n physical snapshot on the underlying storage system. This MUST be the\n same as the name returned by the CSI GetPluginName() call for that\n driver. Required.\n type: string\n source:\n description: source specifies from where a snapshot will be created.\n This field is immutable after creation. Required.\n properties:\n snapshotHandle:\n description: snapshotHandle specifies the CSI \"snapshot_id\" of a\n pre-existing snapshot on the underlying storage system. This field\n is immutable.\n type: string\n volumeHandle:\n description: volumeHandle specifies the CSI \"volume_id\" of the volume\n from which a snapshot should be dynamically taken from. This field\n is immutable.\n type: string\n type: object\n volumeSnapshotClassName:\n description: name of the VolumeSnapshotClass to which this snapshot\n belongs.\n type: string\n volumeSnapshotRef:\n description: volumeSnapshotRef specifies the VolumeSnapshot object to\n which this VolumeSnapshotContent object is bound. VolumeSnapshot.Spec.VolumeSnapshotContentName\n field must reference to this VolumeSnapshotContent's name for the\n bidirectional binding to be valid. For a pre-existing VolumeSnapshotContent\n object, name and namespace of the VolumeSnapshot object MUST be provided\n for binding to happen. This field is immutable after creation. Required.\n properties:\n apiVersion:\n description: API version of the referent.\n type: string\n fieldPath:\n description: 'If referring to a piece of an object instead of an\n entire object, this string should contain a valid JSON/Go field\n access statement, such as desiredState.manifest.containers[2].\n For example, if the object reference is to a container within\n a pod, this would take on a value like: \"spec.containers{name}\"\n (where \"name\" refers to the name of the container that triggered\n the event) or if no container name is specified \"spec.containers[2]\"\n (container with index 2 in this pod). This syntax is chosen only\n to have some well-defined way of referencing a part of an object.\n TODO: this design is not final and this field is subject to change\n in the future.'\n type: string\n kind:\n description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'\n type: string\n name:\n description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'\n type: string\n namespace:\n description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'\n type: string\n resourceVersion:\n description: 'Specific resourceVersion to which this reference is\n made, if any. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#concurrency-control-and-consistency'\n type: string\n uid:\n description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'\n type: string\n type: object\n required:\n - deletionPolicy\n - driver\n - source\n - volumeSnapshotRef\n type: object\n status:\n description: status represents the current information of a snapshot.\n properties:\n creationTime:\n description: creationTime is the timestamp when the point-in-time snapshot\n is taken by the underlying storage system. In dynamic snapshot creation\n case, this field will be filled in with the \"creation_time\" value\n returned from CSI \"CreateSnapshotRequest\" gRPC call. For a pre-existing\n snapshot, this field will be filled with the \"creation_time\" value\n returned from the CSI \"ListSnapshots\" gRPC call if the driver supports\n it. If not specified, it indicates the creation time is unknown. The\n format of this field is a Unix nanoseconds time encoded as an int64.\n On Unix, the command `date +%s%N` returns the current time in nanoseconds\n since 1970-01-01 00:00:00 UTC.\n format: int64\n type: integer\n error:\n description: error is the latest observed error during snapshot creation,\n if any.\n properties:\n message:\n description: 'message is a string detailing the encountered error\n during snapshot creation if specified. NOTE: message may be logged,\n and it should not contain sensitive information.'\n type: string\n time:\n description: time is the timestamp when the error was encountered.\n format: date-time\n type: string\n type: object\n readyToUse:\n description: readyToUse indicates if a snapshot is ready to be used\n to restore a volume. In dynamic snapshot creation case, this field\n will be filled in with the \"ready_to_use\" value returned from CSI\n \"CreateSnapshotRequest\" gRPC call. For a pre-existing snapshot, this\n field will be filled with the \"ready_to_use\" value returned from the\n CSI \"ListSnapshots\" gRPC call if the driver supports it, otherwise,\n this field will be set to \"True\". If not specified, it means the readiness\n of a snapshot is unknown.\n type: boolean\n restoreSize:\n description: restoreSize represents the complete size of the snapshot\n in bytes. In dynamic snapshot creation case, this field will be filled\n in with the \"size_bytes\" value returned from CSI \"CreateSnapshotRequest\"\n gRPC call. For a pre-existing snapshot, this field will be filled\n with the \"size_bytes\" value returned from the CSI \"ListSnapshots\"\n gRPC call if the driver supports it. When restoring a volume from\n this snapshot, the size of the volume MUST NOT be smaller than the\n restoreSize if it is specified, otherwise the restoration will fail.\n If not specified, it indicates that the size is unknown.\n format: int64\n minimum: 0\n type: integer\n snapshotHandle:\n description: snapshotHandle is the CSI \"snapshot_id\" of a snapshot on\n the underlying storage system. If not specified, it indicates that\n dynamic snapshot creation has either failed or it is still in progress.\n type: string\n type: object\n required:\n - spec\n type: object\n version: v1beta1\n versions:\n - name: v1beta1\n served: true\n storage: true\nstatus:\n acceptedNames:\n kind: \"\"\n plural: \"\"\n conditions: []\n storedVersions: []\n\n---\napiVersion: apiextensions.k8s.io/v1beta1\nkind: CustomResourceDefinition\nmetadata:\n annotations:\n controller-gen.kubebuilder.io/version: (devel)\n api-approved.kubernetes.io: \"https://github.com/kubernetes-csi/external-snapshotter/pull/139\"\n creationTimestamp: null\n name: volumesnapshots.snapshot.storage.k8s.io\nspec:\n group: snapshot.storage.k8s.io\n names:\n kind: VolumeSnapshot\n listKind: VolumeSnapshotList\n plural: volumesnapshots\n singular: volumesnapshot\n scope: Namespaced\n subresources:\n status: {}\n preserveUnknownFields: false\n validation:\n openAPIV3Schema:\n description: VolumeSnapshot is a user's request for either creating a point-in-time\n snapshot of a persistent volume, or binding to a pre-existing snapshot.\n properties:\n apiVersion:\n description: 'APIVersion defines the versioned schema of this representation\n of an object. Servers should convert recognized schemas to the latest\n internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'\n type: string\n kind:\n description: 'Kind is a string value representing the REST resource this\n object represents. Servers may infer this from the endpoint the client\n submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'\n type: string\n spec:\n description: 'spec defines the desired characteristics of a snapshot requested\n by a user. More info: https://kubernetes.io/docs/concepts/storage/volume-snapshots#volumesnapshots\n Required.'\n properties:\n source:\n description: source specifies where a snapshot will be created from.\n This field is immutable after creation. Required.\n properties:\n persistentVolumeClaimName:\n description: persistentVolumeClaimName specifies the name of the\n PersistentVolumeClaim object in the same namespace as the VolumeSnapshot\n object where the snapshot should be dynamically taken from. This\n field is immutable.\n type: string\n volumeSnapshotContentName:\n description: volumeSnapshotContentName specifies the name of a pre-existing\n VolumeSnapshotContent object. This field is immutable.\n type: string\n type: object\n volumeSnapshotClassName:\n description: 'volumeSnapshotClassName is the name of the VolumeSnapshotClass\n requested by the VolumeSnapshot. If not specified, the default snapshot\n class will be used if one exists. If not specified, and there is no\n default snapshot class, dynamic snapshot creation will fail. Empty\n string is not allowed for this field. TODO(xiangqian): a webhook validation\n on empty string. More info: https://kubernetes.io/docs/concepts/storage/volume-snapshot-classes'\n type: string\n required:\n - source\n type: object\n status:\n description: 'status represents the current information of a snapshot. NOTE:\n status can be modified by sources other than system controllers, and must\n not be depended upon for accuracy. Controllers should only use information\n from the VolumeSnapshotContent object after verifying that the binding\n is accurate and complete.'\n properties:\n boundVolumeSnapshotContentName:\n description: 'boundVolumeSnapshotContentName represents the name of\n the VolumeSnapshotContent object to which the VolumeSnapshot object\n is bound. If not specified, it indicates that the VolumeSnapshot object\n has not been successfully bound to a VolumeSnapshotContent object\n yet. NOTE: Specified boundVolumeSnapshotContentName alone does not\n mean binding is valid. Controllers MUST always verify bidirectional\n binding between VolumeSnapshot and VolumeSnapshotContent to\n avoid possible security issues.'\n type: string\n creationTime:\n description: creationTime is the timestamp when the point-in-time snapshot\n is taken by the underlying storage system. In dynamic snapshot creation\n case, this field will be filled in with the \"creation_time\" value\n returned from CSI \"CreateSnapshotRequest\" gRPC call. For a pre-existing\n snapshot, this field will be filled with the \"creation_time\" value\n returned from the CSI \"ListSnapshots\" gRPC call if the driver supports\n it. If not specified, it indicates that the creation time of the snapshot\n is unknown.\n format: date-time\n type: string\n error:\n description: error is the last observed error during snapshot creation,\n if any. This field could be helpful to upper level controllers(i.e.,\n application controller) to decide whether they should continue on\n waiting for the snapshot to be created based on the type of error\n reported.\n properties:\n message:\n description: 'message is a string detailing the encountered error\n during snapshot creation if specified. NOTE: message may be logged,\n and it should not contain sensitive information.'\n type: string\n time:\n description: time is the timestamp when the error was encountered.\n format: date-time\n type: string\n type: object\n readyToUse:\n description: readyToUse indicates if a snapshot is ready to be used\n to restore a volume. In dynamic snapshot creation case, this field\n will be filled in with the \"ready_to_use\" value returned from CSI\n \"CreateSnapshotRequest\" gRPC call. For a pre-existing snapshot, this\n field will be filled with the \"ready_to_use\" value returned from the\n CSI \"ListSnapshots\" gRPC call if the driver supports it, otherwise,\n this field will be set to \"True\". If not specified, it means the readiness\n of a snapshot is unknown.\n type: boolean\n restoreSize:\n description: restoreSize represents the complete size of the snapshot\n in bytes. In dynamic snapshot creation case, this field will be filled\n in with the \"size_bytes\" value returned from CSI \"CreateSnapshotRequest\"\n gRPC call. For a pre-existing snapshot, this field will be filled\n with the \"size_bytes\" value returned from the CSI \"ListSnapshots\"\n gRPC call if the driver supports it. When restoring a volume from\n this snapshot, the size of the volume MUST NOT be smaller than the\n restoreSize if it is specified, otherwise the restoration will fail.\n If not specified, it indicates that the size is unknown.\n type: string\n type: object\n required:\n - spec\n type: object\n version: v1beta1\n versions:\n - name: v1beta1\n served: true\n storage: true\nstatus:\n acceptedNames:\n kind: \"\"\n plural: \"\"\n conditions: []\n storedVersions: []\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/overlays/alpha/controller_add_resizer.yaml", "content": "kind: Deployment\napiVersion: apps/v1\nmetadata:\n name: ebs-csi-controller\n namespace: kube-system\nspec:\n template:\n spec:\n containers:\n - name: csi-resizer\n image: quay.io/k8scsi/csi-resizer:v0.3.0\n args:\n - --csi-address=$(ADDRESS)\n - --v=5\n env:\n - name: ADDRESS\n value: /var/lib/csi/sockets/pluginproxy/csi.sock\n volumeMounts:\n - name: socket-dir\n mountPath: /var/lib/csi/sockets/pluginproxy/\n\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/overlays/alpha/controller_add_snapshotter.yaml", "content": "kind: Deployment\napiVersion: apps/v1\nmetadata:\n name: ebs-csi-controller\n namespace: kube-system\nspec:\n template:\n spec:\n containers:\n - name: csi-snapshotter\n image: quay.io/k8scsi/csi-snapshotter:v2.0.1\n args:\n - --csi-address=$(ADDRESS)\n - --leader-election=true\n env:\n - name: ADDRESS\n value: /var/lib/csi/sockets/pluginproxy/csi.sock\n volumeMounts:\n - name: socket-dir\n mountPath: /var/lib/csi/sockets/pluginproxy/\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/overlays/alpha/kustomization.yaml", "content": "apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nbases:\n- ../../base\nimages:\n- name: amazon/aws-ebs-csi-driver\n newName: 961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/eks/aws-ebs-csi-driver\n newTag: v0.4.0\n- name: quay.io/k8scsi/csi-provisioner\n newName: 961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/eks/csi-provisioner\n newTag: v1.3.0\n- name: quay.io/k8scsi/csi-attacher\n newName: 961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/eks/csi-attacher\n newTag: v1.2.0\n- name: quay.io/k8scsi/livenessprobe\n newName: 961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/eks/csi-liveness-probe\n newTag: v1.1.0\n- name: quay.io/k8scsi/csi-node-driver-registrar\n newName: 961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/eks/csi-node-driver-registrar\n newTag: v1.1.0\npatches:\n- controller_add_snapshotter.yaml\n- controller_add_resizer.yaml\nresources:\n- rbac_add_snapshotter.yaml\n- rbac_add_resizer.yaml\n- rbac_add_snapshot_controller.yaml\n- snapshot_controller.yaml\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/overlays/alpha/rbac_add_resizer.yaml", "content": "---\n\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-external-resizer-role\nrules:\n # The following rule should be uncommented for plugins that require secrets\n # for provisioning.\n # - apiGroups: [\"\"]\n # resources: [\"secrets\"]\n # verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"persistentvolumes\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\", \"patch\"]\n - apiGroups: [\"\"]\n resources: [\"persistentvolumeclaims\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"persistentvolumeclaims/status\"]\n verbs: [\"update\", \"patch\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"storageclasses\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"events\"]\n verbs: [\"list\", \"watch\", \"create\", \"update\", \"patch\"]\n\n---\n\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-csi-resizer-binding\nsubjects:\n - kind: ServiceAccount\n name: ebs-csi-controller-sa\n namespace: kube-system\nroleRef:\n kind: ClusterRole\n name: ebs-external-resizer-role\n apiGroup: rbac.authorization.k8s.io\n\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/overlays/alpha/rbac_add_snapshot_controller.yaml", "content": "# RBAC file for the snapshot controller.\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: ebs-snapshot-controller\n namespace: kube-system\n\n---\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-snapshot-controller-role\nrules:\n - apiGroups: [\"\"]\n resources: [\"persistentvolumes\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"persistentvolumeclaims\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"storageclasses\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"events\"]\n verbs: [\"list\", \"watch\", \"create\", \"update\", \"patch\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotclasses\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotcontents\"]\n verbs: [\"create\", \"get\", \"list\", \"watch\", \"update\", \"delete\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshots\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshots/status\"]\n verbs: [\"update\"]\n\n---\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-csi-snapshot-controller-binding\nsubjects:\n - kind: ServiceAccount\n name: ebs-snapshot-controller\n namespace: kube-system\nroleRef:\n kind: ClusterRole\n name: ebs-snapshot-controller-role\n apiGroup: rbac.authorization.k8s.io\n\n---\nkind: Role\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-snapshot-controller-leaderelection\n namespace: kube-system \nrules:\n- apiGroups: [\"coordination.k8s.io\"]\n resources: [\"leases\"]\n verbs: [\"get\", \"watch\", \"list\", \"delete\", \"update\", \"create\"]\n\n---\nkind: RoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: snapshot-controller-leaderelection\n namespace: kube-system \nsubjects:\n - kind: ServiceAccount\n name: ebs-snapshot-controller\n namespace: kube-system \nroleRef:\n kind: Role\n name: snapshot-controller-leaderelection\n apiGroup: rbac.authorization.k8s.io\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/overlays/alpha/rbac_add_snapshotter.yaml", "content": "---\n\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-external-snapshotter-role\nrules:\n - apiGroups: [\"\"]\n resources: [\"persistentvolumes\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"persistentvolumeclaims\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"storageclasses\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"\"]\n resources: [\"events\"]\n verbs: [\"list\", \"watch\", \"create\", \"update\", \"patch\"]\n - apiGroups: [\"\"]\n resources: [\"secrets\"]\n verbs: [\"get\", \"list\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotclasses\"]\n verbs: [\"get\", \"list\", \"watch\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotcontents\"]\n verbs: [\"create\", \"get\", \"list\", \"watch\", \"update\", \"delete\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshots\"]\n verbs: [\"get\", \"list\", \"watch\", \"update\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotcontents\"]\n verbs: [\"create\", \"get\", \"list\", \"watch\", \"update\", \"delete\"]\n - apiGroups: [\"snapshot.storage.k8s.io\"]\n resources: [\"volumesnapshotcontents/status\"]\n verbs: [\"update\"]\n - apiGroups: [\"apiextensions.k8s.io\"]\n resources: [\"customresourcedefinitions\"]\n verbs: [\"create\", \"list\", \"watch\", \"delete\"]\n---\n\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: ebs-csi-snapshotter-binding\nsubjects:\n - kind: ServiceAccount\n name: ebs-csi-controller-sa\n namespace: kube-system\nroleRef:\n kind: ClusterRole\n name: ebs-external-snapshotter-role\n apiGroup: rbac.authorization.k8s.io\n\n\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/overlays/alpha/snapshot_controller.yaml", "content": "---\nkind: StatefulSet\napiVersion: apps/v1\nmetadata:\n name: ebs-snapshot-controller\n namespace: kube-system\nspec:\n serviceName: ebs-snapshot-controller\n replicas: 1\n selector:\n matchLabels:\n app: ebs-snapshot-controller\n template:\n metadata:\n labels:\n app: ebs-snapshot-controller\n spec:\n serviceAccount: ebs-snapshot-controller\n containers:\n - name: snapshot-controller\n image: quay.io/k8scsi/snapshot-controller:v2.0.1\n args:\n - --v=5\n - --leader-election=false\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/overlays/dev/kustomization.yaml", "content": "apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nbases:\n- ../../base\nimages:\n- name: amazon/aws-ebs-csi-driver\n newTag: latest\n newName: chengpan/aws-ebs-csi-driver\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/overlays/stable/kustomization.yaml", "content": "apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nbases:\n- ../../base\nimages:\n- name: amazon/aws-ebs-csi-driver\n newName: 961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/eks/aws-ebs-csi-driver\n newTag: v0.4.0\n- name: quay.io/k8scsi/csi-provisioner\n newName: 961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/eks/csi-provisioner\n newTag: v1.3.0\n- name: quay.io/k8scsi/csi-attacher\n newName: 961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/eks/csi-attacher\n newTag: v1.2.0\n- name: quay.io/k8scsi/livenessprobe\n newName: 961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/eks/csi-liveness-probe\n newTag: v1.1.0\n- name: quay.io/k8scsi/csi-node-driver-registrar\n newName: 961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/eks/csi-node-driver-registrar\n newTag: v1.1.0\n\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/deploy/kubernetes/secret.yaml", "content": "apiVersion: v1\nkind: Secret\nmetadata:\n name: aws-secret\n namespace: kube-system\nstringData:\n key_id: \"\"\n access_key: \"\"\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/ebs-csi-iam-policy.json", "content": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"ec2:AttachVolume\",\n \"ec2:CreateSnapshot\",\n \"ec2:CreateTags\",\n \"ec2:CreateVolume\",\n \"ec2:DeleteSnapshot\",\n \"ec2:DeleteTags\",\n \"ec2:DeleteVolume\",\n \"ec2:DescribeInstances\",\n \"ec2:DescribeSnapshots\",\n \"ec2:DescribeTags\",\n \"ec2:DescribeVolumes\",\n \"ec2:DetachVolume\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/block-volume/README.md", "content": "## Raw Block Volume\nThis example shows how to consume a dynamically-provisioned EBS volume as a raw block device.\n\n### Edit [Persistence Volume Claim Spec](./specs/raw-claim.yaml)\nMake sure the `volumeMode` is `Block`.\n\n### Edit [Application Pod](./specs/pod.yaml)\nMake sure the pod is consuming the PVC with the defined name and `volumeDevices` is used instead of `volumeMounts`.\n\n### Deploy the Application\n```sh\nkubectl apply -f examples/kubernetes/block-volume/specs/storageclass.yaml\nkubectl apply -f examples/kubernetes/block-volume/specs/raw-claim.yaml\nkubectl apply -f examples/kubernetes/block-volume/specs/pod.yaml\n```\n\n### Access Block Device\nAfter the objects are created, verify that pod is running:\n\n```sh\n$ kubectl get pods\nNAME READY STATUS RESTARTS AGE\napp 1/1 Running 0 16m\n```\nVerify the device node is mounted inside the container:\n\n```sh\n$ kubectl exec -ti app -- ls -al /dev/xvda\nbrw-rw---- 1 root disk 202, 23296 Mar 12 04:23 /dev/xvda\n```\n\nWrite to the device using:\n\n```sh\ndd if=/dev/zero of=/dev/xvda bs=1024k count=100\n100+0 records in\n100+0 records out\n104857600 bytes (105 MB, 100 MiB) copied, 0.0492386 s, 2.1 GB/s\n```\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/block-volume/specs/pod.yaml", "content": "apiVersion: v1\nkind: Pod\nmetadata:\n name: app \nspec:\n containers:\n - name: app \n image: busybox \n command: [\"/bin/sh\", \"-c\"]\n args: [\"tail -f /dev/null\"]\n volumeDevices:\n - name: data\n devicePath: /dev/xvda\n volumes:\n - name: data\n persistentVolumeClaim:\n claimName: block-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/block-volume/specs/raw-claim.yaml", "content": "apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: block-claim\nspec:\n accessModes:\n - ReadWriteOnce\n volumeMode: Block\n storageClassName: ebs-sc\n resources:\n requests:\n storage: 10Gi\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/block-volume/specs/storageclass.yaml", "content": "kind: StorageClass\napiVersion: storage.k8s.io/v1\nmetadata:\n name: ebs-sc\nprovisioner: ebs.csi.aws.com\nvolumeBindingMode: WaitForFirstConsumer\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/dynamic-provisioning/README.md", "content": "# Dynamic Volume Provisioning\nThis example shows how to create a EBS volume and consume it from container dynamically.\n\n## Prerequisites\n\n1. Kubernetes 1.13+ (CSI 1.0).\n\n1. The [aws-ebs-csi-driver driver](https://github.com/kubernetes-sigs/aws-ebs-csi-driver) is installed.\n\n## Usage\n\n1. Create a sample app along with the StorageClass and the PersistentVolumeClaim:\n```\nkubectl apply -f specs/\n```\n\n2. Validate the volume was created and `volumeHandle` contains an EBS volumeID:\n```\nkubectl describe pv\n```\n\n3. Validate the pod successfully wrote data to the volume:\n```\nkubectl exec -it app cat /data/out.txt\n```\n\n4. Cleanup resources:\n```\nkubectl delete -f specs/\n```\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/dynamic-provisioning/specs/claim.yaml", "content": "apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: ebs-claim\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: ebs-sc\n resources:\n requests:\n storage: 4Gi\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/dynamic-provisioning/specs/pod.yaml", "content": "apiVersion: v1\nkind: Pod\nmetadata:\n name: app\nspec:\n containers:\n - name: app\n image: busybox\n command: [\"/bin/sh\"]\n args: [\"-c\", \"while true; do echo $(date -u) >> /data/out.txt; sleep 5; done\"]\n volumeMounts:\n - name: persistent-storage\n mountPath: /data\n volumes:\n - name: persistent-storage\n persistentVolumeClaim:\n claimName: ebs-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/dynamic-provisioning/specs/storageclass.yaml", "content": "kind: StorageClass\napiVersion: storage.k8s.io/v1\nmetadata:\n name: ebs-sc\nprovisioner: ebs.csi.aws.com\nvolumeBindingMode: WaitForFirstConsumer\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/resizing/README.md", "content": "## Volume Resizing\nThis example shows how to resize EBS persistence volume using volume resizing features.\n\n**Note**\n1. CSI volume resizing is still alpha as of Kubernetes 1.15\n2. EBS has a limit of one volume modification every 6 hours. Refer to [EBS documentation](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVolume.html) for more details.\n\n## Usage\n1. Add `allowVolumeExpansion: true` in the StorageClass spec in [example manifest](./specs/example.yaml) to enable volume expansion. You can only expand a PVC if its storage class’s allowVolumeExpansion field is set to true\n\n2. Deploy the example:\n```sh\nkubectl apply -f specs/\n``` \n\n3. Verify the volume is created and Pod is running:\n```sh\nkubectl get pv\nkubectl get po app\n```\n\n4. Expand the volume size by increasing the capacity in PVC's `spec.resources.requests.storage`:\n```sh\nkubectl edit pvc ebs-claim\n```\nSave the result at the end of the edit.\n\n5. Verify that both the persistence volume and persistence volume claim are resized:\n```sh\nkubectl get pv\nkubectl get pvc\n```\nYou should see that both should have the new value relfected in the capacity fields.\n\n6. Verify that the application is continuously running without any interruption:\n```sh\nkubectl exec -it app cat /data/out.txt\n```\n\n7. Cleanup resources:\n```\nkubectl delete -f specs/\n```\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/resizing/spec/example.yaml", "content": "kind: StorageClass\napiVersion: storage.k8s.io/v1\nmetadata:\n name: resize-sc\nprovisioner: ebs.csi.aws.com\nallowVolumeExpansion: true\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: ebs-claim\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: resize-sc\n resources:\n requests:\n storage: 4Gi\n---\napiVersion: v1\nkind: Pod\nmetadata:\n name: app\nspec:\n containers:\n - name: app\n image: centos\n command: [\"/bin/sh\"]\n args: [\"-c\", \"while true; do echo $(date -u) >> /data/out.txt; sleep 5; done\"]\n volumeMounts:\n - name: persistent-storage\n mountPath: /data\n volumes:\n - name: persistent-storage\n persistentVolumeClaim:\n claimName: ebs-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/snapshot/README.md", "content": "# Volume Snapshots\n\n## Overview\n\nThis driver implements basic volume snapshotting functionality using the [external snapshotter](https://github.com/kubernetes-csi/external-snapshotter) sidecar and creates snapshots of EBS volumes using the `VolumeSnapshot` custom resources.\n\n## Prerequisites\n\n1. Kubernetes 1.13+ (CSI 1.0).\n\n1. The `VolumeSnapshotDataSource` must be set in `--feature-gates=` in the `kube-apiserver`.\n\n1. The [aws-ebs-csi-driver driver](https://github.com/kubernetes-sigs/aws-ebs-csi-driver) is installed.\n\n### Usage\n\n1. Create the `StorageClass` and `VolumeSnapshotClass`:\n```\nkubectl apply -f specs/classes/\n```\n\n2. Create a sample app and the `PersistentVolumeClaim`: \n```\nkubectl apply -f specs/app/\n```\n\n3. Validate the volume was created and `volumeHandle` contains an EBS volumeID: \n```\nkubectl describe pv\n```\n\n4. Validate the pod successfully wrote data to the volume, taking note of the timestamp of the first entry:\n```\nkubectl exec -it app cat /data/out.txt\n```\n\n5. Create a `VolumeSnapshot` referencing the `PersistentVolumeClaim` name:\n```\nkubectl apply -f specs/snapshot/\n```\n\n6. Wait for the `Ready To Use: true` attribute of the `VolumeSnapshot`: \n```\nkubectl describe volumesnapshot.snapshot.storage.k8s.io ebs-volume-snapshot\n```\n\n7. Delete the existing app:\n```\nkubectl delete -f specs/app/\n```\n\n8. Restore a volume from the snapshot with a `PersistentVolumeClaim` referencing the `VolumeSnapshot` in its `dataSource`:\n```\nkubectl apply -f specs/snapshot-restore/\n```\n\n9. Validate the new pod has the restored data by comparing the timestamp of the first entry to that of in step 4:\n```\nkubectl exec -it app cat /data/out.txt\n```\n\n10. Cleanup resources:\n```\nkubectl delete -f specs/snapshot-restore\nkubectl delete -f specs/snapshot\nkubectl delete -f specs/classes\n```\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/snapshot/specs/app/claim.yaml", "content": "apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: ebs-claim\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: ebs-sc\n resources:\n requests:\n storage: 4Gi\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/snapshot/specs/app/pod.yaml", "content": "apiVersion: v1\nkind: Pod\nmetadata:\n name: app\nspec:\n containers:\n - name: app\n image: centos\n command: [\"/bin/sh\"]\n args: [\"-c\", \"while true; do echo $(date -u) >> /data/out.txt; sleep 5; done\"]\n volumeMounts:\n - name: persistent-storage\n mountPath: /data\n volumes:\n - name: persistent-storage\n persistentVolumeClaim:\n claimName: ebs-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/snapshot/specs/classes/snapshotclass.yaml", "content": "apiVersion: snapshot.storage.k8s.io/v1beta1\nkind: VolumeSnapshotClass\nmetadata:\n name: csi-aws-vsc\ndriver: ebs.csi.aws.com\ndeletionPolicy: Delete\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/snapshot/specs/classes/storageclass.yaml", "content": "kind: StorageClass\napiVersion: storage.k8s.io/v1\nmetadata:\n name: ebs-sc\nprovisioner: ebs.csi.aws.com\nvolumeBindingMode: WaitForFirstConsumer\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/snapshot/specs/snapshot/snapshot.yaml", "content": "apiVersion: snapshot.storage.k8s.io/v1beta1\nkind: VolumeSnapshot\nmetadata:\n name: ebs-volume-snapshot\nspec:\n volumeSnapshotClassName: csi-aws-vsc\n source:\n persistentVolumeClaimName: ebs-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/snapshot/specs/snapshot-import/volume-snapshot-content.yaml", "content": "apiVersion: snapshot.storage.k8s.io/v1beta1\nkind: VolumeSnapshotContent\nmetadata:\n name: static-snapshot-content\nspec:\n volumeSnapshotRef:\n kind: VolumeSnapshot\n name: static-snapshot-demo\n namespace: default \n source:\n snapshotHandle: snap-0fba4d7649d765c50\n driver: ebs.csi.aws.com\n volumeSnapshotClassName: csi-aws-vsc\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/snapshot/specs/snapshot-import/volume-snapshot.yaml", "content": "apiVersion: snapshot.storage.k8s.io/v1beta1\nkind: VolumeSnapshot\nmetadata:\n name: static-snapshot-demo\n namespace: default \nspec:\n volumeSnapshotClassName: csi-aws-vsc\n source:\n volumeSnapshotContentName: static-snapshot-content\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/snapshot/specs/snapshot-restore/claim.yaml", "content": "apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: ebs-snapshot-restored-claim\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: ebs-sc\n resources:\n requests:\n storage: 4Gi\n dataSource:\n name: ebs-volume-snapshot\n kind: VolumeSnapshot\n apiGroup: snapshot.storage.k8s.io\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/snapshot/specs/snapshot-restore/pod.yaml", "content": "apiVersion: v1\nkind: Pod\nmetadata:\n name: app\nspec:\n containers:\n - name: app\n image: centos\n command: [\"/bin/sh\"]\n args: [\"-c\", \"while true; do echo $(date -u) >> /data/out.txt; sleep 5; done\"]\n volumeMounts:\n - name: persistent-storage\n mountPath: /data\n volumes:\n - name: persistent-storage\n persistentVolumeClaim:\n claimName: ebs-snapshot-restored-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/static-provisioning/README.md", "content": "# Static Provisioning \nThis example shows how to create and consume persistence volume from exising EBS using static provisioning. \n\n## Usage\n1. Edit the PersistentVolume spec in [example manifest](./specs/example.yaml). Update `volumeHandle` with EBS volume ID that you are going to use, and update the `fsType` with the filesystem type of the volume. In this example, I have a pre-created EBS volume in us-east-1c availability zone and it is formatted with xfs filesystem.\n\n```\napiVersion: v1\nkind: PersistentVolume\nmetadata:\n name: test-pv\nspec:\n capacity:\n storage: 50Gi\n volumeMode: Filesystem\n accessModes:\n - ReadWriteOnce\n storageClassName: ebs-sc\n csi:\n driver: ebs.csi.aws.com\n volumeHandle: {volumeId} \n fsType: xfs\n nodeAffinity:\n required:\n nodeSelectorTerms:\n - matchExpressions:\n - key: topology.ebs.csi.aws.com/zone\n operator: In\n values:\n - us-east-1c \n```\nNote that node affinity is used here since EBS volume is created in us-east-1c, hence only node in the same AZ can consume this persisence volume. \n\n2. Deploy the example:\n```sh\nkubectl apply -f specs/\n```\n\n3. Verify application pod is running:\n```sh\nkubectl describe po app\n```\n\n4. Validate the pod successfully wrote data to the volume:\n```sh\nkubectl exec -it app cat /data/out.txt\n```\n\n5. Cleanup resources:\n```sh\nkubectl delete -f specs/\n```\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/static-provisioning/specs/example.yaml", "content": "kind: StorageClass\napiVersion: storage.k8s.io/v1\nmetadata:\n name: ebs-sc\nprovisioner: ebs.csi.aws.com\nvolumeBindingMode: WaitForFirstConsumer\nreclaimPolicy: Retain\n---\napiVersion: v1\nkind: PersistentVolume\nmetadata:\n name: test-pv\nspec:\n capacity:\n storage: 50Gi\n volumeMode: Filesystem\n accessModes:\n - ReadWriteOnce\n storageClassName: ebs-sc\n csi:\n driver: ebs.csi.aws.com\n volumeHandle: vol-05786ec9ec9526b67\n fsType: xfs\n nodeAffinity:\n required:\n nodeSelectorTerms:\n - matchExpressions:\n - key: topology.ebs.csi.aws.com/zone\n operator: In\n values:\n - us-east-1c \n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: ebs-claim\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: ebs-sc\n resources:\n requests:\n storage: 50Gi\n---\napiVersion: v1\nkind: Pod\nmetadata:\n name: app\nspec:\n containers:\n - name: app\n image: centos\n command: [\"/bin/sh\"]\n args: [\"-c\", \"while true; do echo $(date -u) >> /data/out.txt; sleep 5; done\"]\n volumeMounts:\n - name: persistent-storage\n mountPath: /data\n volumes:\n - name: persistent-storage\n persistentVolumeClaim:\n claimName: ebs-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/storageclass/README.md", "content": "# Configuring StorageClass\nThis example shows how to configure Kubernetes storageclass to provision EBS volumes with various configuration parameters. EBS CSI driver is compatiable with in-tree EBS plugin on StorageClass parameters. For the full list of in-tree EBS plugin parameters, please refer to Kubernetes documentation of [StorageClass Parameter](https://kubernetes.io/docs/concepts/storage/storage-classes/#aws-ebs).\n\n## Usage\n1. Edit the StorageClass spec in [example manifest](./specs/example.yaml) and update storageclass parameters to desired value. In this example, a `io1` EBS volume will be created and formatted to `xfs` filesystem with encryption enabled using the default KMS key.\n\n2. Deploy the example:\n```sh\nkubectl apply -f specs/\n```\n\n3. Verify the volume is created:\n```sh\nkubectl describe pv\n```\n\n4. Validate the pod successfully wrote data to the volume:\n```sh\nkubectl exec -it app cat /data/out.txt\n```\n\n5. Cleanup resources:\n```sh\nkubectl delete -f specs/\n```\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/examples/kubernetes/storageclass/specs/example.yaml", "content": "kind: StorageClass\napiVersion: storage.k8s.io/v1\nmetadata:\n name: ebs-sc\nprovisioner: ebs.csi.aws.com\nvolumeBindingMode: WaitForFirstConsumer\nparameters:\n csi.storage.k8s.io/fstype: xfs\n type: io1\n iopsPerGB: \"50\"\n encrypted: \"true\"\nallowedTopologies:\n- matchLabelExpressions:\n - key: topology.ebs.csi.aws.com/zone\n values:\n - us-east-1a\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: ebs-claim\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: ebs-sc\n resources:\n requests:\n storage: 4Gi\n---\napiVersion: v1\nkind: Pod\nmetadata:\n name: app\nspec:\n containers:\n - name: app\n image: centos\n command: [\"/bin/sh\"]\n args: [\"-c\", \"while true; do echo $(date -u) >> /data/out.txt; sleep 5; done\"]\n volumeMounts:\n - name: persistent-storage\n mountPath: /data\n volumes:\n - name: persistent-storage\n persistentVolumeClaim:\n claimName: ebs-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-ebs-csi-driver/updaterole.sh", "content": "\necho \"CSI Policy ARN| $1\"\n\nCSI_ARN=$1\nROLES=$(aws iam list-roles --query 'Roles[?contains(RoleName,`nodegr`)].RoleName' --output text)\n\nfor i in $ROLES\ndo\n echo attach [$CSI_ARN] to [$i]\n aws iam attach-role-policy \\\n --policy-arn $CSI_ARN \\\n --role-name $i \\\n --region cn-northwest-1\n\ndone\n\n\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/.dockerignore", "content": "vendor/\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/.github/ISSUE_TEMPLATE/bug_report.md", "content": "---\nname: Bug report\nabout: Create a report to help us improve EBS CSI Driver\nlabels: \n\n---\n\n/kind bug\n\n**What happened?**\n\n**What you expected to happen?**\n\n**How to reproduce it (as minimally and precisely as possible)?**\n\n**Anything else we need to know?**:\n\n**Environment**\n- Kubernetes version (use `kubectl version`):\n- Driver version:\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/.github/ISSUE_TEMPLATE/enhancement-request.md", "content": "---\nname: Enhancement request\nabout: Suggest an idea for this project\nlabels: \n\n---\n\n**Is your feature request related to a problem?/Why is this needed**\nA clear and concise description of what the problem is. Ex. I'm always frustrated when [...]\n\n/feature\n\n**Describe the solution you'd like in detail**\nA clear and concise description of what you want to happen.\n\n**Describe alternatives you've considered**\nA clear and concise description of any alternative solutions or features you've considered.\n\n**Additional context**\nAdd any other context or screenshots about the feature request here.\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/.github/ISSUE_TEMPLATE/feature_request.md", "content": "---\nname: Feature request\nabout: Suggest an idea for this project\nlabels: \n\n---\n\n**Is your feature request related to a problem? Please describe.**\nA clear and concise description of what the problem is. Ex. I'm always frustrated when [...]\n\n**Describe the solution you'd like in detail**\nA clear and concise description of what you want to happen.\n\n**Describe alternatives you've considered**\nA clear and concise description of any alternative solutions or features you've considered.\n\n**Additional context**\nAdd any other context or screenshots about the feature request here.\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/.github/ISSUE_TEMPLATE/support-request.md", "content": "---\nname: Support request\nabout: Ask questions about the driver\nlabels: \n\n---\n\n\n\n\n\n/triage support\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/.github/PULL_REQUEST_TEMPLATE.md", "content": "**Is this a bug fix or adding new feature?**\n\n**What is this PR about? / Why do we need it?**\n\n**What testing is done?** \n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/.github/workflows/container-image.yaml", "content": "name: Container Images\n\non: push\njobs:\n build:\n # this is to prevent the job to run at forked projects\n if: github.repository == 'kubernetes-sigs/aws-efs-csi-driver'\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v1\n - name: Build container image\n run: |\n docker build -t aws-efs-csi-driver .\n - name: Push to Github registry\n run: |\n USER=$(echo $GITHUB_REPOSITORY | cut -d'/' -f1)\n BRANCH=$(echo $GITHUB_REF | cut -d'/' -f3)\n IMAGE=aws-efs-csi-driver\n if [ \"$BRANCH\" = \"master\" ]; then\n TAG=\"latest\"\n else\n TAG=$BRANCH\n fi\n docker login docker.pkg.github.com -u $USER -p ${{ secrets.REGISTRY_TOKEN }}\n docker tag aws-efs-csi-driver docker.pkg.github.com/$GITHUB_REPOSITORY/$IMAGE:$TAG\n docker push docker.pkg.github.com/$GITHUB_REPOSITORY/$IMAGE:$TAG\n - name: Push to Dockerhub registry\n run: |\n BRANCH=$(echo $GITHUB_REF | cut -d'/' -f3)\n REPO=amazon/aws-efs-csi-driver\n if [ \"$BRANCH\" = \"master\" ]; then\n TAG=\"latest\"\n else\n TAG=$BRANCH\n fi\n docker login -u ${{ secrets.DOCKERHUB_USER }} -p ${{ secrets.DOCKERHUB_TOKEN }}\n docker tag aws-efs-csi-driver $REPO:$TAG\n docker push $REPO:$TAG\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/.gitignore", "content": "*.swp\nbin/\nvendor/\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/.travis.yml", "content": "language: go\ngo_import_path: github.com/kubernetes-sigs/aws-efs-csi-driver\n\nenv:\n global:\n - GO111MODULE=on\n\ngo:\n - \"1.13.4\"\n\nbefore_install:\n - go get github.com/mattn/goveralls\n\nscript:\n - make\n - go test -covermode=count -coverprofile=profile.cov $(go list ./pkg/... | grep -v /driver)\n # TODO stop skipping controller tests when controller is implemented\n - go test -covermode=count -coverprofile=profile.cov ./pkg/driver/... -ginkgo.skip='\\[Controller.Server\\]'\n - $GOPATH/bin/goveralls -coverprofile=profile.cov -service=travis-ci\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/deploy/kubernetes/base/csidriver.yaml", "content": "---\n\napiVersion: storage.k8s.io/v1beta1\nkind: CSIDriver\nmetadata:\n name: efs.csi.aws.com\nspec:\n attachRequired: false\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/deploy/kubernetes/base/kustomization.yaml", "content": "apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nnamespace: kube-system\nresources:\n- node.yaml\n- csidriver.yaml\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/deploy/kubernetes/base/node.yaml", "content": "---\n# Node Service\nkind: DaemonSet\napiVersion: apps/v1\nmetadata:\n name: efs-csi-node\n namespace: kube-system\nspec:\n selector:\n matchLabels:\n app: efs-csi-node\n template:\n metadata:\n labels:\n app: efs-csi-node\n spec:\n nodeSelector:\n beta.kubernetes.io/os: linux\n hostNetwork: true\n priorityClassName: system-node-critical\n tolerations:\n - operator: Exists\n containers:\n - name: efs-plugin\n securityContext:\n privileged: true\n image: amazon/aws-efs-csi-driver:latest\n args:\n - --endpoint=$(CSI_ENDPOINT)\n - --logtostderr\n - --v=5\n env:\n - name: CSI_ENDPOINT\n value: unix:/csi/csi.sock\n volumeMounts:\n - name: kubelet-dir\n mountPath: /var/lib/kubelet\n mountPropagation: \"Bidirectional\"\n - name: plugin-dir\n mountPath: /csi\n - name: efs-state-dir\n mountPath: /var/run/efs\n ports:\n - containerPort: 9809\n name: healthz\n protocol: TCP\n livenessProbe:\n httpGet:\n path: /healthz\n port: healthz\n initialDelaySeconds: 10\n timeoutSeconds: 3\n periodSeconds: 2\n failureThreshold: 5\n - name: csi-driver-registrar\n image: quay.io/k8scsi/csi-node-driver-registrar:v1.1.0\n args:\n - --csi-address=$(ADDRESS)\n - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)\n - --v=5\n env:\n - name: ADDRESS\n value: /csi/csi.sock\n - name: DRIVER_REG_SOCK_PATH\n value: /var/lib/kubelet/plugins/efs.csi.aws.com/csi.sock\n - name: KUBE_NODE_NAME\n valueFrom:\n fieldRef:\n fieldPath: spec.nodeName\n volumeMounts:\n - name: plugin-dir\n mountPath: /csi\n - name: registration-dir\n mountPath: /registration\n - name: liveness-probe\n imagePullPolicy: Always\n image: quay.io/k8scsi/livenessprobe:v1.1.0\n args:\n - --csi-address=/csi/csi.sock\n - --health-port=9809\n volumeMounts:\n - mountPath: /csi\n name: plugin-dir\n volumes:\n - name: kubelet-dir\n hostPath:\n path: /var/lib/kubelet\n type: Directory\n - name: registration-dir\n hostPath:\n path: /var/lib/kubelet/plugins_registry/\n type: Directory\n - name: plugin-dir\n hostPath:\n path: /var/lib/kubelet/plugins/efs.csi.aws.com/\n type: DirectoryOrCreate\n - name: efs-state-dir\n hostPath:\n path: /var/run/efs\n type: DirectoryOrCreate\n\n\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/deploy/kubernetes/overlays/stable/kustomization.yaml", "content": "apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nbases:\n- ../../base\nimages:\n- name: amazon/aws-efs-csi-driver\n newTag: v0.3.0\n newName: amazon/aws-efs-csi-driver\n- name: quay.io/k8scsi/livenessprobe\n newName: 961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/eks/csi-liveness-probe\n newTag: v1.1.0\n- name: quay.io/k8scsi/csi-node-driver-registrar\n newName: 961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/eks/csi-node-driver-registrar\n newTag: v1.1.0\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/encryption_in_transit/README.md", "content": "## Encryption in Transit\nThis example shows how to make a static provisioned EFS persistence volume (PV) mounted inside container with encryption in transit enabled.\n\n**Note**: this example requires Kubernetes v1.13+\n\n### Edit [Persistence Volume Spec](./specs/pv.yaml) \n\n```\napiVersion: v1\nkind: PersistentVolume\nmetadata:\n name: efs-pv\nspec:\n capacity:\n storage: 5Gi\n volumeMode: Filesystem\n accessModes:\n - ReadWriteOnce\n persistentVolumeReclaimPolicy: Retain\n storageClassName: efs-sc\n mountOptions:\n - tls\n csi:\n driver: efs.csi.aws.com\n volumeHandle: [FileSystemId] \n```\nNote that encryption in transit is enabled using mount option `tls`. Replace `VolumeHandle` value with `FileSystemId` of the EFS filesystem that needs to be mounted.\n\nYou can find it using AWS CLI:\n```sh\n>> aws efs describe-file-systems --query \"FileSystems[*].FileSystemId\"\n```\n\n### Deploy the Example\nCreate PV, persistence volume claim (PVC) and storage class:\n```sh\n>> kubectl apply -f examples/kubernetes/encryption_in_transit/specs/storageclass.yaml\n>> kubectl apply -f examples/kubernetes/encryption_in_transit/specs/pv.yaml\n>> kubectl apply -f examples/kubernetes/encryption_in_transit/specs/claim.yaml\n>> kubectl apply -f examples/kubernetes/encryption_in_transit/specs/pod.yaml\n```\n\n### Check EFS filesystem is used\nAfter the objects are created, verify that pod is running:\n\n```sh\n>> kubectl get pods\n```\n\nAlso you can verify that data is written onto EFS filesystem:\n\n```sh\n>> kubectl exec -ti efs-app -- tail -f /data/out.txt\n```\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/encryption_in_transit/specs/claim.yaml", "content": "apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: efs-claim\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: efs-sc\n resources:\n requests:\n storage: 5Gi\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/encryption_in_transit/specs/pod.yaml", "content": "apiVersion: v1\nkind: Pod\nmetadata:\n name: efs-app\nspec:\n containers:\n - name: app\n image: busybox\n command: [\"/bin/sh\"]\n args: [\"-c\", \"while true; do echo $(date -u) >> /data/out.txt; sleep 5; done\"]\n volumeMounts:\n - name: persistent-storage\n mountPath: /data\n volumes:\n - name: persistent-storage\n persistentVolumeClaim:\n claimName: efs-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/encryption_in_transit/specs/pv.yaml", "content": "apiVersion: v1\nkind: PersistentVolume\nmetadata:\n name: efs-pv\nspec:\n capacity:\n storage: 5Gi\n volumeMode: Filesystem\n accessModes:\n - ReadWriteOnce\n persistentVolumeReclaimPolicy: Retain\n storageClassName: efs-sc\n mountOptions:\n - tls\n csi:\n driver: efs.csi.aws.com\n volumeHandle: fs-4af69aab\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/encryption_in_transit/specs/storageclass.yaml", "content": "kind: StorageClass\napiVersion: storage.k8s.io/v1\nmetadata:\n name: efs-sc\nprovisioner: efs.csi.aws.com\nmountOptions:\n - tls\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/multiple_pods/README.md", "content": "## Multiple Pods Read Write Many \nThis example shows how to create a static provisioned EFS persistence volume (PV) and access it from multiple pods with RWX access mode.\n\n### Edit Persistent Volume\nEdit persistent volume using sample [spec](./specs/pv.yaml):\n```\napiVersion: v1\nkind: PersistentVolume\nmetadata:\n name: efs-pv\nspec:\n capacity:\n storage: 5Gi\n volumeMode: Filesystem\n accessModes:\n - ReadWriteMany\n persistentVolumeReclaimPolicy: Retain\n storageClassName: efs-sc\n csi:\n driver: efs.csi.aws.com\n volumeHandle: [FileSystemId] \n```\nReplace `volumeHandle` value with `FileSystemId` of the EFS filesystem that needs to be mounted. Note that the access mode is `RWX` which means the PV can be read and written from multiple pods.\n\nYou can get `FileSystemId` using AWS CLI:\n\n```sh\n>> aws efs describe-file-systems --query \"FileSystems[*].FileSystemId\"\n```\n\n### Deploy the Example Application\nCreate PV, persistence volume claim (PVC), storageclass and the pods that consume the PV:\n```sh\n>> kubectl apply -f examples/kubernetes/multiple_pods/specs/storageclass.yaml\n>> kubectl apply -f examples/kubernetes/multiple_pods/specs/pv.yaml\n>> kubectl apply -f examples/kubernetes/multiple_pods/specs/claim.yaml\n>> kubectl apply -f examples/kubernetes/multiple_pods/specs/pod1.yaml\n>> kubectl apply -f examples/kubernetes/multiple_pods/specs/pod2.yaml\n```\n\nIn the example, both pod1 and pod2 are writing to the same EFS filesystem at the same time.\n\n### Check the Application uses EFS filesystem\nAfter the objects are created, verify that pod is running:\n\n```sh\n>> kubectl get pods\n```\n\nAlso verify that data is written onto EFS filesystem from both pods:\n\n```sh\n>> kubectl exec -ti app1 -- tail -f /data/out1.txt\n>> kubectl exec -ti app2 -- tail -f /data/out2.txt\n```\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/multiple_pods/specs/claim.yaml", "content": "apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: efs-claim\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: efs-sc\n resources:\n requests:\n storage: 5Gi\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/multiple_pods/specs/pod1.yaml", "content": "apiVersion: v1\nkind: Pod\nmetadata:\n name: app1\nspec:\n containers:\n - name: app1\n image: busybox\n command: [\"/bin/sh\"]\n args: [\"-c\", \"while true; do echo $(date -u) >> /data/out1.txt; sleep 5; done\"]\n volumeMounts:\n - name: persistent-storage\n mountPath: /data\n volumes:\n - name: persistent-storage\n persistentVolumeClaim:\n claimName: efs-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/multiple_pods/specs/pod2.yaml", "content": "apiVersion: v1\nkind: Pod\nmetadata:\n name: app2\nspec:\n containers:\n - name: app2\n image: busybox\n command: [\"/bin/sh\"]\n args: [\"-c\", \"while true; do echo $(date -u) >> /data/out2.txt; sleep 5; done\"]\n volumeMounts:\n - name: persistent-storage\n mountPath: /data\n volumes:\n - name: persistent-storage\n persistentVolumeClaim:\n claimName: efs-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/multiple_pods/specs/pv.yaml", "content": "apiVersion: v1\nkind: PersistentVolume\nmetadata:\n name: efs-pv\nspec:\n capacity:\n storage: 5Gi\n volumeMode: Filesystem\n accessModes:\n - ReadWriteMany\n persistentVolumeReclaimPolicy: Retain\n storageClassName: efs-sc\n csi:\n driver: efs.csi.aws.com\n volumeHandle: fs-9c48a679\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/multiple_pods/specs/storageclass.yaml", "content": "kind: StorageClass\napiVersion: storage.k8s.io/v1\nmetadata:\n name: efs-sc\nprovisioner: efs.csi.aws.com\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/statefulset/README.md", "content": "## Use in Stateful Set\nThis example shows how to consume EFS filesystem from StatefulSets using the driver. Before the example, refer to [StatefulSets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) for what it is.\n\n## Deploy the example\n\n```sh\nkubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-efs-csi-driver/master/examples/kubernetes/statefulset/specs/example.yaml\n```\n\n## Check the StatefulSets Application\nCheck StatefulSets is deployed successfully:\n```sh\n$ kubectl get sts\nNAME READY AGE\nefs-app-sts 3/3 70m\n``` \n\nCheck the pods are running:\n```sh\n$ kubectl get po\nNAME READY STATUS RESTARTS AGE\nefs-app-sts-0 1/1 Running 0 71m\nefs-app-sts-1 1/1 Running 0 71m\nefs-app-sts-2 1/1 Running 0 71m\n```\n\nCheck data are written onto EFS filesystem:\n```sh\n$ kubectl exec -ti efs-app-sts-0 -- tail -f /efs-data/out.txt\nMon May 6 00:50:15 UTC 2019\nMon May 6 00:50:18 UTC 2019\nMon May 6 00:50:19 UTC 2019\nMon May 6 00:50:20 UTC 2019\nMon May 6 00:50:23 UTC 2019\nMon May 6 00:50:24 UTC 2019\nMon May 6 00:50:25 UTC 2019\nMon May 6 00:50:28 UTC 2019\nMon May 6 00:50:29 UTC 2019\nMon May 6 00:50:30 UTC 2019\n```\n\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/statefulset/specs/example.yaml", "content": "apiVersion: v1\nkind: PersistentVolume\nmetadata:\n name: efs-pv\nspec:\n capacity:\n storage: 5Gi\n volumeMode: Filesystem\n accessModes:\n - ReadWriteMany\n persistentVolumeReclaimPolicy: Retain\n storageClassName: efs-sc\n csi:\n driver: efs.csi.aws.com\n volumeHandle: fs-4af69aab\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: efs-claim\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: efs-sc\n resources:\n requests:\n storage: 5Gi\n---\napiVersion: apps/v1\nkind: StatefulSet\nmetadata:\n name: efs-app-sts\nspec:\n selector:\n matchLabels:\n app: test-efs\n serviceName: efs-app\n replicas: 3\n template:\n metadata:\n labels:\n app: test-efs\n spec:\n terminationGracePeriodSeconds: 10\n containers:\n - name: linux\n image: amazonlinux:2 \n command: [\"/bin/sh\"]\n args: [\"-c\", \"while true; do echo $(date -u) >> /efs-data/out.txt; sleep 5; done\"]\n volumeMounts:\n - name: efs-storage\n mountPath: /efs-data\n volumes:\n - name: efs-storage\n persistentVolumeClaim:\n claimName: efs-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/static_provisioning/README.md", "content": "## Static Provisioning\nThis example shows how to make a static provisioned EFS persistence volume (PV) mounted inside container.\n\n### Edit [Persistence Volume Spec](./specs/pv.yaml) \n\n```\napiVersion: v1\nkind: PersistentVolume\nmetadata:\n name: efs-pv\nspec:\n capacity:\n storage: 5Gi\n volumeMode: Filesystem\n accessModes:\n - ReadWriteOnce\n persistentVolumeReclaimPolicy: Retain\n storageClassName: efs-sc\n csi:\n driver: efs.csi.aws.com\n volumeHandle: [FileSystemId] \n```\nReplace `VolumeHandle` value with `FileSystemId` of the EFS filesystem that needs to be mounted.\n\nYou can find it using AWS CLI:\n```sh\n>> aws efs describe-file-systems --query \"FileSystems[*].FileSystemId\"\n```\n\n### Deploy the Example Application\nCreate PV, persistence volume claim (PVC) and storage class:\n```sh\n>> kubectl apply -f examples/kubernetes/static_provisioning/specs/storageclass.yaml\n>> kubectl apply -f examples/kubernetes/static_provisioning/specs/pv.yaml\n>> kubectl apply -f examples/kubernetes/static_provisioning/specs/claim.yaml\n>> kubectl apply -f examples/kubernetes/static_provisioning/specs/pod.yaml\n```\n\n### Check EFS filesystem is used\nAfter the objects are created, verify that pod is running:\n\n```sh\n>> kubectl get pods\n```\n\nAlso you can verify that data is written onto EFS filesystem:\n\n```sh\n>> kubectl exec -ti efs-app -- tail -f /data/out.txt\n```\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/static_provisioning/specs/claim.yaml", "content": "apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: efs-claim\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: efs-sc\n resources:\n requests:\n storage: 5Gi\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/static_provisioning/specs/pod.yaml", "content": "apiVersion: v1\nkind: Pod\nmetadata:\n name: efs-app\nspec:\n containers:\n - name: app\n image: busybox\n command: [\"/bin/sh\"]\n args: [\"-c\", \"while true; do echo $(date -u) >> /data/out.txt; sleep 5; done\"]\n volumeMounts:\n - name: persistent-storage\n mountPath: /data\n volumes:\n - name: persistent-storage\n persistentVolumeClaim:\n claimName: efs-claim\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/static_provisioning/specs/pv.yaml", "content": "apiVersion: v1\nkind: PersistentVolume\nmetadata:\n name: efs-pv\nspec:\n capacity:\n storage: 5Gi\n volumeMode: Filesystem\n accessModes:\n - ReadWriteOnce\n persistentVolumeReclaimPolicy: Retain\n storageClassName: efs-sc\n csi:\n driver: efs.csi.aws.com\n volumeHandle: fs-9c48a679\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/static_provisioning/specs/storageclass.yaml", "content": "kind: StorageClass\napiVersion: storage.k8s.io/v1\nmetadata:\n name: efs-sc\nprovisioner: efs.csi.aws.com\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/volume_path/README.md", "content": "## EFS Volume Path\nSimilar to [static provisioning example](../static_provisioning). A sub directory of EFS can be mounted inside container. This gives cluster operator the flexibility to restrict the amount of data being accessed from different containers on EFS.\n\n**Note**: this feature requires the sub directory to mount precreated on EFS before consuming the volume from pod.\n\n### Edit [Persistence Volume Spec](./specs/example.yaml)\n```\napiVersion: v1\nkind: PersistentVolume\nmetadata:\n name: efs-pv1\nspec:\n capacity:\n storage: 5Gi\n volumeMode: Filesystem\n accessModes:\n - ReadWriteOnce\n persistentVolumeReclaimPolicy: Retain\n storageClassName: efs-sc\n csi:\n driver: efs.csi.aws.com\n volumeHandle: [FileSystemId]:[Path]\n```\nReplace `FileSystemId` of the EFS filesystem ID that needs to be mounted. And replace `Path` with a existing path on the filesystem.\n\nYou can find it using AWS CLI:\n```sh\n>> aws efs describe-file-systems --query \"FileSystems[*].FileSystemId\"\n```\n\n### Deploy the Example Application\nCreate PV, persistence volume claim (PVC) and storage class:\n```sh\n>> kubectl apply -f examples/kubernetes/volume_path/specs/example.yaml\n```\n\n### Check EFS filesystem is used\nAfter the objects are created, verify that pod is running:\n\n```sh\n>> kubectl get pods\n```\n\nAlso you can verify that data is written onto EFS filesystem:\n\n```sh\n>> kubectl exec -ti efs-app -- tail -f /data-dir1/out.txt\n>> kubectl exec -ti efs-app -- ls /data-dir2\n```\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/aws-efs-csi-driver/examples/kubernetes/volume_path/specs/example.yaml", "content": "kind: StorageClass\napiVersion: storage.k8s.io/v1\nmetadata:\n name: efs-sc\nprovisioner: efs.csi.aws.com\n---\napiVersion: v1\nkind: PersistentVolume\nmetadata:\n name: efs-pv1\nspec:\n capacity:\n storage: 5Gi\n volumeMode: Filesystem\n accessModes:\n - ReadWriteMany\n persistentVolumeReclaimPolicy: Retain\n storageClassName: efs-sc\n mountOptions:\n - tls\n csi:\n driver: efs.csi.aws.com\n volumeHandle: fs-e8a95a42:/dir1\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: efs-claim1\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: efs-sc\n resources:\n requests:\n storage: 5Gi\n---\napiVersion: v1\nkind: PersistentVolume\nmetadata:\n name: efs-pv2\nspec:\n capacity:\n storage: 5Gi\n volumeMode: Filesystem\n accessModes:\n - ReadWriteMany\n persistentVolumeReclaimPolicy: Retain\n storageClassName: efs-sc\n mountOptions:\n - tls\n csi:\n driver: efs.csi.aws.com\n volumeHandle: fs-e8a95a42:/dir2\n---\napiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: efs-claim2\nspec:\n accessModes:\n - ReadWriteMany\n storageClassName: efs-sc\n resources:\n requests:\n storage: 5Gi\n---\napiVersion: v1\nkind: Pod\nmetadata:\n name: efs-app\nspec:\n containers:\n - name: app\n image: busybox\n command: [\"/bin/sh\"]\n args: [\"-c\", \"while true; do echo $(date -u) >> /data-dir1/out.txt; sleep 5; done\"]\n volumeMounts:\n - name: efs-volume-1\n mountPath: /data-dir1\n - name: efs-volume-2\n mountPath: /data-dir2\n volumes:\n - name: efs-volume-1\n persistentVolumeClaim:\n claimName: efs-claim1\n - name: efs-volume-2\n persistentVolumeClaim:\n claimName: efs-claim2\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/cluster-autoscaler/cluster_autoscaler.yml", "content": "---\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n labels:\n k8s-addon: cluster-autoscaler.addons.k8s.io\n k8s-app: cluster-autoscaler\n name: cluster-autoscaler\n namespace: kube-system\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cluster-autoscaler\n labels:\n k8s-addon: cluster-autoscaler.addons.k8s.io\n k8s-app: cluster-autoscaler\nrules:\n - apiGroups: [\"\"]\n resources: [\"events\", \"endpoints\"]\n verbs: [\"create\", \"patch\"]\n - apiGroups: [\"\"]\n resources: [\"pods/eviction\"]\n verbs: [\"create\"]\n - apiGroups: [\"\"]\n resources: [\"pods/status\"]\n verbs: [\"update\"]\n - apiGroups: [\"\"]\n resources: [\"endpoints\"]\n resourceNames: [\"cluster-autoscaler\"]\n verbs: [\"get\", \"update\"]\n - apiGroups: [\"\"]\n resources: [\"nodes\"]\n verbs: [\"watch\", \"list\", \"get\", \"update\"]\n - apiGroups: [\"\"]\n resources:\n - \"pods\"\n - \"services\"\n - \"replicationcontrollers\"\n - \"persistentvolumeclaims\"\n - \"persistentvolumes\"\n verbs: [\"watch\", \"list\", \"get\"]\n - apiGroups: [\"extensions\"]\n resources: [\"replicasets\", \"daemonsets\"]\n verbs: [\"watch\", \"list\", \"get\"]\n - apiGroups: [\"policy\"]\n resources: [\"poddisruptionbudgets\"]\n verbs: [\"watch\", \"list\"]\n - apiGroups: [\"apps\"]\n resources: [\"statefulsets\", \"replicasets\", \"daemonsets\"]\n verbs: [\"watch\", \"list\", \"get\"]\n - apiGroups: [\"storage.k8s.io\"]\n resources: [\"storageclasses\"]\n verbs: [\"watch\", \"list\", \"get\"]\n - apiGroups: [\"batch\", \"extensions\"]\n resources: [\"jobs\"]\n verbs: [\"get\", \"list\", \"watch\", \"patch\"]\n\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cluster-autoscaler\n namespace: kube-system\n labels:\n k8s-addon: cluster-autoscaler.addons.k8s.io\n k8s-app: cluster-autoscaler\nrules:\n - apiGroups: [\"\"]\n resources: [\"configmaps\"]\n verbs: [\"create\"]\n - apiGroups: [\"\"]\n resources: [\"configmaps\"]\n resourceNames: [\"cluster-autoscaler-status\", \"cluster-autoscaler-priority-expander\"]\n verbs: [\"delete\", \"get\", \"update\", \"watch\"]\n\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cluster-autoscaler\n labels:\n k8s-addon: cluster-autoscaler.addons.k8s.io\n k8s-app: cluster-autoscaler\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cluster-autoscaler\nsubjects:\n - kind: ServiceAccount\n name: cluster-autoscaler\n namespace: kube-system\n\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cluster-autoscaler\n namespace: kube-system\n labels:\n k8s-addon: cluster-autoscaler.addons.k8s.io\n k8s-app: cluster-autoscaler\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cluster-autoscaler\nsubjects:\n - kind: ServiceAccount\n name: cluster-autoscaler\n namespace: kube-system\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: cluster-autoscaler\n namespace: kube-system\n labels:\n app: cluster-autoscaler\nspec:\n replicas: 1\n selector:\n matchLabels:\n app: cluster-autoscaler\n template:\n metadata:\n labels:\n app: cluster-autoscaler\n spec:\n serviceAccountName: cluster-autoscaler\n #nodeSelector:\n # intent: control-apps \n containers:\n - image: k8s.gcr.io/cluster-autoscaler:v1.14.7\n name: cluster-autoscaler\n resources:\n limits:\n cpu: 100m\n memory: 300Mi\n requests:\n cpu: 100m\n memory: 300Mi\n command:\n - ./cluster-autoscaler\n - --v=4\n - --stderrthreshold=info\n - --cloud-provider=aws\n - --skip-nodes-with-local-storage=false\n - --nodes=1:3:eksctl-eksworkshop-nodegroup-ng-6ee72264-NodeGroup-1HV2SGGAPW9U3\n - --expander=random\n - --expendable-pods-priority-cutoff=-10\n - --scale-down-unneeded-time=2m0s\n - --scale-down-unready-time=3m0s\n - --scale-down-delay-after-add=2m0s\n - --scale-down-utilization-threshold=0.7\n - --balance-similar-node-groups\n - --max-total-unready-percentage=75\n - --ok-total-unready-count=20\n - --max-empty-bulk-delete=30\n env:\n - name: AWS_REGION\n value: cn-northwest-1\n volumeMounts:\n - name: ssl-certs\n mountPath: /etc/ssl/certs/ca-certificates.crt\n readOnly: true\n imagePullPolicy: \"Always\"\n volumes:\n - name: ssl-certs\n hostPath:\n path: \"/etc/ssl/certs/ca-bundle.crt\"\n\n\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/cluster-autoscaler/k8s-asg-policy.json", "content": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"autoscaling:DescribeAutoScalingGroups\",\n \"autoscaling:DescribeAutoScalingInstances\",\n \"autoscaling:SetDesiredCapacity\",\n \"autoscaling:TerminateInstanceInAutoScalingGroup\",\n \"autoscaling:DescribeTags\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/cluster-autoscaler/nginx-to-scaleout.yaml", "content": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: nginx-to-scaleout\nspec:\n replicas: 1\n selector:\n matchLabels:\n app: nginx\n template:\n metadata:\n labels:\n service: nginx\n app: nginx\n spec:\n containers:\n - image: nginx\n name: nginx-to-scaleout\n resources:\n limits:\n cpu: 500m\n memory: 512Mi\n requests:\n cpu: 500m\n memory: 512Mi\n" }, { "path": "china/2020_EKS_Launch_Workshop/resource/efk/fluent-bit.yaml", "content": "apiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: fluent-bit\n---\napiVersion: rbac.authorization.k8s.io/v1beta1\nkind: ClusterRole\nmetadata:\n name: pod-log-reader\nrules:\n- apiGroups: [\"\"]\n resources:\n - namespaces\n - pods\n verbs: [\"get\", \"list\", \"watch\"]\n---\napiVersion: rbac.authorization.k8s.io/v1beta1\nkind: ClusterRoleBinding\nmetadata:\n name: pod-log-crb\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: pod-log-reader\nsubjects:\n- kind: ServiceAccount\n name: fluent-bit\n namespace: default\n---\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: fluent-bit-config\n labels:\n app.kubernetes.io/name: fluentbit\ndata:\n fluent-bit.conf: |\n [SERVICE]\n Parsers_File parsers.conf\n [INPUT]\n Name tail\n Tag kube.*\n Path /var/log/containers/*.log\n Parser docker\n DB /var/log/flb_kube.db\n Mem_Buf_Limit 5MB\n Skip_Long_Lines On\n Refresh_Interval 10\n [FILTER]\n Name parser\n Match **\n Parser nginx\n Key_Name log\n [OUTPUT]\n Name cloudwatch\n Match *\n region cn-northwest-1\n log_group_name fluent-bit-cloudwatch\n log_stream_prefix from-fluent-bit-\n auto_create_group true \n parsers.conf: |\n [PARSER]\n Name nginx\n Format regex\n Regex ^(?[^ ]*) (?[^ ]*) (?[^ ]*) \\[(?