# SOURCE: https://install.portworx.com/?comp=pvc-controller&kbver= --- apiVersion: v1 kind: ServiceAccount metadata: name: portworx-pvc-controller-account namespace: kube-system --- apiVersion: apps/v1 kind: Deployment metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" labels: tier: control-plane name: portworx-pvc-controller namespace: kube-system spec: selector: matchLabels: name: portworx-pvc-controller replicas: 3 strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 1 type: RollingUpdate template: metadata: annotations: scheduler.alpha.kubernetes.io/critical-pod: "" labels: name: portworx-pvc-controller tier: control-plane spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: "name" operator: In values: - portworx-pvc-controller topologyKey: "kubernetes.io/hostname" hostNetwork: true containers: - command: - kube-controller-manager - --leader-elect=true - --controllers=persistentvolume-binder,persistentvolume-expander - --use-service-account-credentials=true - --leader-elect-resource-name=portworx-pvc-controller image: registry.k8s.io/kube-controller-manager-amd64:v1.23.12 imagePullPolicy: Always livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 10257 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: portworx-pvc-controller-manager resources: requests: cpu: 200m serviceAccountName: portworx-pvc-controller-account --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: portworx-pvc-controller-role rules: - apiGroups: [""] resources: ["persistentvolumes"] verbs: ["create","delete","get","list","update","watch"] - apiGroups: [""] resources: ["persistentvolumes/status"] verbs: ["update"] - apiGroups: [""] resources: ["persistentvolumeclaims"] verbs: ["get", "list", "update", "watch"] - apiGroups: [""] resources: ["persistentvolumeclaims/status"] verbs: ["update"] - apiGroups: [""] resources: ["pods"] verbs: ["create", "delete", "get", "list", "watch"] - apiGroups: ["storage.k8s.io"] resources: ["storageclasses"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["endpoints", "services"] verbs: ["create", "delete", "get", "update"] - apiGroups: [""] resources: ["secrets"] verbs: ["get", "list"] - apiGroups: [""] resources: ["nodes"] verbs: ["get", "list", "watch"] - apiGroups: ["", "events.k8s.io"] resources: ["events"] verbs: ["get", "list", "watch", "create", "update", "patch"] - apiGroups: [""] resources: ["serviceaccounts"] verbs: ["get", "create"] - apiGroups: [""] resources: ["serviceaccounts/token"] verbs: ["create"] - apiGroups: [""] resources: ["configmaps"] verbs: ["get", "create", "update", "list", "watch"] - apiGroups: ["coordination.k8s.io"] resources: ["leases"] verbs: ["create", "update", "get", "list", "watch"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: portworx-pvc-controller-role-binding subjects: - kind: ServiceAccount name: portworx-pvc-controller-account namespace: kube-system roleRef: kind: ClusterRole name: portworx-pvc-controller-role apiGroup: rbac.authorization.k8s.io