kind: SecurityContextConstraints
apiVersion: v1
metadata:
  name: nfs-scc
allowPrivilegedContainer: true
allowedCapabilities:
- DAC_READ_SEARCH
- SYS_RESOURCE
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: RunAsAny
fsGroup:
  type: RunAsAny
supplementalGroups:
  type: RunAsAny
users:
- system:serviceaccount:cml-nfs:cml-nfs-nfs-server-provisioner
---
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
 name: nfs
 labels:
   app: nfs-server-provisioner
   chart: nfs-server-provisioner-1.0.0
   heritage: Tiller
   release: cml-nfs
provisioner: nfs-server-provisioner
reclaimPolicy: Delete
allowVolumeExpansion: true
mountOptions:
 - vers=3
---
# Source: nfs-server-provisioner/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
 labels:
   app: nfs-server-provisioner
   chart: nfs-server-provisioner-1.0.0
   heritage: Tiller
   release: cml-nfs
 name: cml-nfs-nfs-server-provisioner
---
# Source: nfs-server-provisioner/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name: cml-nfs-nfs-server-provisioner
 labels:
   app: nfs-server-provisioner
   chart: nfs-server-provisioner-1.0.0
   heritage: Tiller
   release: cml-nfs
rules:
 - apiGroups: [""]
   resources: ["persistentvolumes"]
   verbs: ["get", "list", "watch", "create", "delete"]
 - apiGroups: [""]
   resources: ["persistentvolumeclaims"]
   verbs: ["get", "list", "watch", "update"]
 - apiGroups: ["storage.k8s.io"]
   resources: ["storageclasses"]
   verbs: ["get", "list", "watch"]
 - apiGroups: [""]
   resources: ["events"]
   verbs: ["list", "watch", "create", "update", "patch"]
 - apiGroups: [""]
   resources: ["services", "endpoints"]
   verbs: ["get"]
 - apiGroups: ["extensions"]
   resources: ["podsecuritypolicies"]
   resourceNames: ["nfs-provisioner"]
   verbs: ["use"]
 - apiGroups: [""]
   resources: ["endpoints"]
   verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
---
# Source: nfs-server-provisioner/templates/rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
 labels:
   app: nfs-server-provisioner
   chart: nfs-server-provisioner-1.0.0
   heritage: Tiller
   release: cml-nfs
 name: cml-nfs-nfs-server-provisioner
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: ClusterRole
 name: cml-nfs-nfs-server-provisioner
subjects:
 - kind: ServiceAccount
   name: cml-nfs-nfs-server-provisioner
   namespace: cml-nfs
---
# Source: nfs-server-provisioner/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
 name: cml-nfs-nfs-server-provisioner
 namespace: cml-nfs
 labels:
   app: nfs-server-provisioner
   chart: nfs-server-provisioner-1.0.0
   heritage: Tiller
   release: cml-nfs
spec:
 type: ClusterIP
 ports:
   - port: 2049
     targetPort: nfs
     protocol: TCP
     name: nfs
   - port: 2049
     targetPort: nfs-udp
     protocol: UDP
     name: nfs-udp
   - port: 32803
     targetPort: nlockmgr
     protocol: TCP
     name: nlockmgr
   - port: 32803
     targetPort: nlockmgr-udp
     protocol: UDP
     name: nlockmgr-udp
   - port: 20048
     targetPort: mountd
     protocol: TCP
     name: mountd
   - port: 20048
     targetPort: mountd-udp
     protocol: UDP
     name: mountd-udp
   - port: 875
     targetPort: rquotad
     protocol: TCP
     name: rquotad
   - port: 875
     targetPort: rquotad-udp
     protocol: UDP
     name: rquotad-udp
   - port: 111
     targetPort: rpcbind
     protocol: TCP
     name: rpcbind
   - port: 111
     targetPort: rpcbind-udp
     protocol: UDP
     name: rpcbind-udp
   - port: 662
     targetPort: statd
     protocol: TCP
     name: statd
   - port: 662
     targetPort: statd-udp
     protocol: UDP
     name: statd-udp
 selector:
   app: nfs-server-provisioner
   release: cml-nfs
---
# Source: nfs-server-provisioner/templates/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
 name: cml-nfs-nfs-server-provisioner
 namespace: cml-nfs
 labels:
   app: nfs-server-provisioner
   chart: nfs-server-provisioner-1.0.0
   heritage: Tiller
   release: cml-nfs
spec:
 # TODO: Investigate how/if nfs-provisioner can be scaled out beyond 1 replica
 replicas: 1
 selector:
   matchLabels:
     app: nfs-server-provisioner
     release: cml-nfs
 serviceName: cml-nfs-nfs-server-provisioner
 template:
   metadata:
     labels:
       app: nfs-server-provisioner
       chart: nfs-server-provisioner-1.0.0
       heritage: Tiller
       release: cml-nfs
   spec:
     # NOTE: This is 10 seconds longer than the default nfs-provisioner --grace-period value of 90sec
     terminationGracePeriodSeconds: 100
     serviceAccountName: cml-nfs-nfs-server-provisioner
     securityContext:
       fsGroup: 8536
     containers:
       - name: nfs-server-provisioner
         image: "quay.io/kubernetes_incubator/nfs-provisioner:v2.3.0"
         imagePullPolicy: IfNotPresent
         ports:
           - name: nfs
             containerPort: 2049
             protocol: TCP
           - name: nfs-udp
             containerPort: 2049
             protocol: UDP
           - name: nlockmgr
             containerPort: 32803
             protocol: TCP
           - name: nlockmgr-udp
             containerPort: 32803
             protocol: UDP
           - name: mountd
             containerPort: 20048
             protocol: TCP
           - name: mountd-udp
             containerPort: 20048
             protocol: UDP
           - name: rquotad
             containerPort: 875
             protocol: TCP
           - name: rquotad-udp
             containerPort: 875
             protocol: UDP
           - name: rpcbind
             containerPort: 111
             protocol: TCP
           - name: rpcbind-udp
             containerPort: 111
             protocol: UDP
           - name: statd
             containerPort: 662
             protocol: TCP
           - name: statd-udp
             containerPort: 662
             protocol: UDP
         securityContext:
           capabilities:
             add:
               - DAC_READ_SEARCH
               - SYS_RESOURCE
         args:
           - "-provisioner=nfs-server-provisioner"
         env:
           - name: POD_IP
             valueFrom:
               fieldRef:
                 fieldPath: status.podIP
           - name: SERVICE_NAME
             value: cml-nfs-nfs-server-provisioner
           - name: POD_NAMESPACE
             valueFrom:
               fieldRef:
                 fieldPath: metadata.namespace
         volumeMounts:
           - name: data
             mountPath: /export
 volumeClaimTemplates:
   - metadata:
       name: data
     spec:
       storageClassName: rook-ceph-block
       accessModes: [ "ReadWriteOnce" ]
       resources:
         requests:
           storage: "1Ti"
