updated vsphere-csi to v2.2.1

charts/images.yaml

@@ -2,19 +2,19 @@ images:
 - name: csi-attacher
   sourceRepository: https://github.com/kubernetes-csi/external-attacher
   repository: quay.io/k8scsi/csi-attacher
-  tag: v3.0.0
+  tag: v3.1.0
 - name: csi-resizer
   sourceRepository: github.com/kubernetes-csi/external-resizer
   repository: quay.io/k8scsi/csi-resizer
-  tag: v1.0.0
+  tag: v1.1.0
 - name: csi-node-driver-registrar
   sourceRepository: https://github.com/kubernetes-csi/node-driver-registrar
   repository: quay.io/k8scsi/csi-node-driver-registrar
-  tag: v2.0.1
+  tag: v2.1.0
 - name: csi-provisioner
   sourceRepository: https://github.com/kubernetes-csi/external-provisioner
   repository: quay.io/k8scsi/csi-provisioner
-  tag: v2.0.0
+  tag: v2.1.0
 - name: vsphere-cloud-controller-manager
   sourceRepository: github.com/MartinWeindel/cloud-provider-vsphere
   repository: eu.gcr.io/gardener-project/test/cloud-provider-vsphere-martinweindel
@@ -35,15 +35,15 @@ images:
   #tag: v2.0.1
   sourceRepository: github.com/MartinWeindel/vsphere-csi-driver
   repository: eu.gcr.io/gardener-project/patches/vsphere-csi-driver/driver
-  tag: v2.1.1-gardener1
+  tag: v2.2.1-gardener1
 - name: vsphere-csi-driver-node
   sourceRepository: github.com/kubernetes-sigs/vsphere-csi-driver
   repository: gcr.io/cloud-provider-vsphere/csi/release/driver
-  tag: v2.1.1
+  tag: v2.2.1
 - name: vsphere-csi-driver-syncer
   sourceRepository: github.com/kubernetes-sigs/vsphere-csi-driver
   repository: gcr.io/cloud-provider-vsphere/csi/release/syncer
-  tag: v2.1.1
+  tag: v2.2.1
 - name: liveness-probe
   sourceRepository: github.com/kubernetes-csi/livenessprobe
   repository: k8s.gcr.io/sig-storage/livenessprobe

charts/internal/seed-controlplane/charts/csi-vsphere/templates/vsphere-csi-controller.yaml

@@ -64,7 +64,10 @@ spec:
           args:
             - "--v=4"
             - "--timeout=300s"
+            - "--handle-volume-inuse-error=false"
             - "--csi-address=$(ADDRESS)"
+            - "--kube-api-qps=100"
+            - "--kube-api-burst=100"
             - "--leader-election"
             - --kubeconfig=/var/lib/csi-resizer/kubeconfig
           env:
@@ -119,6 +122,9 @@ spec:
             - name: healthz
               containerPort: 9808
               protocol: TCP
+            - name: prometheus
+              containerPort: 2112
+              protocol: TCP
           livenessProbe:
             httpGet:
               path: /healthz
@@ -177,6 +183,8 @@ spec:
             - "--v=4"
             - "--timeout=300s"
             - "--csi-address=/csi/csi.sock"
+            - "--kube-api-qps=100"
+            - "--kube-api-burst=100"
             - "--feature-gates=Topology=true"
             - "--strict-topology"
             - "--leader-election"

charts/internal/shoot-system-components/charts/csi-vsphere/templates/configmap-internal-featurestate.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+data:
+  "csi-migration": "false"
+  "csi-auth-check": "true"
+  "online-volume-extend": "true"
+kind: ConfigMap
+metadata:
+  name: internal-feature-states.csi.vsphere.vmware.com
+  namespace: {{ .Release.Namespace }}

charts/internal/shoot-system-components/charts/csi-vsphere/templates/daemonset.yaml

@@ -17,7 +17,7 @@ spec:
         app: vsphere-csi-node
         role: vsphere-csi
     spec:
-      automountServiceAccountToken: false
+      automountServiceAccountToken: true
       hostNetwork: true
       priorityClassName: system-node-critical
       serviceAccount: csi-driver-node
@@ -44,8 +44,6 @@ spec:
           value: /csi/csi.sock
         - name: DRIVER_REG_SOCK_PATH
           value: /var/lib/kubelet/plugins_registry/csi.vsphere.vmware.com/csi.sock
-        securityContext:
-          privileged: true
         volumeMounts:
         - name: plugin-dir
           mountPath: /csi
@@ -69,6 +67,12 @@ spec:
         - name: VSPHERE_CSI_CONFIG
           value: "/etc/cloud/csi-vsphere.conf" # here csi-vsphere.conf is the name of the file used for creating secret using "--from-file" flag
 {{- end }}
+        - name: LOGGER_LEVEL
+          value: "PRODUCTION" # Options: DEVELOPMENT, PRODUCTION
+        - name: CSI_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
         securityContext:
           privileged: true
           capabilities:
@@ -87,6 +91,10 @@ spec:
             mountPropagation: "Bidirectional"
           - name: device-dir
             mountPath: /dev
+          - name: blocks-dir
+            mountPath: /sys/block
+          - name: sys-devices-dir
+            mountPath: /sys/devices
         ports:
           - name: healthz
             containerPort: 9808
@@ -127,4 +135,12 @@ spec:
             type: Directory
         - name: device-dir
           hostPath:
-            path: /dev
+            path: /dev
+        - name: blocks-dir
+          hostPath:
+            path: /sys/block
+            type: Directory
+        - name: sys-devices-dir
+          hostPath:
+            path: /sys/devices
+            type: Directory

charts/internal/shoot-system-components/charts/csi-vsphere/templates/serviceaccount.yaml

@@ -4,3 +4,27 @@ kind: ServiceAccount
 metadata:
   name: csi-driver-node
   namespace: {{ .Release.Namespace }}
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: vsphere-csi-node-role
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: vsphere-csi-node-binding
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: csi-driver-node
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: vsphere-csi-node-role
+  apiGroup: rbac.authorization.k8s.io