c12s-kubespray/roles/kubernetes/node/templates/manifests/kube-proxy.manifest.j2

100 lines
2.7 KiB
Text
Raw Normal View History

apiVersion: v1
kind: Pod
metadata:
name: kube-proxy
namespace: kube-system
labels:
k8s-app: kube-proxy
annotations:
kubespray.kube-proxy-cert/serial: "{{ kube_proxy_cert_serial }}"
spec:
hostNetwork: true
{% if kube_version | version_compare('v1.6', '>=') %}
dnsPolicy: ClusterFirst
{% endif %}
containers:
- name: kube-proxy
2015-12-14 08:54:58 +00:00
image: {{ hyperkube_image_repo }}:{{ hyperkube_image_tag }}
imagePullPolicy: {{ k8s_image_pull_policy }}
resources:
limits:
cpu: {{ kube_proxy_cpu_limit }}
memory: {{ kube_proxy_memory_limit }}
requests:
cpu: {{ kube_proxy_cpu_requests }}
memory: {{ kube_proxy_memory_requests }}
livenessProbe:
httpGet:
host: 127.0.0.1
path: /healthz
port: 10256
failureThreshold: 8
initialDelaySeconds: 15
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 15
command:
- /hyperkube
- proxy
- --v={{ kube_log_level }}
2017-06-27 04:27:25 +00:00
- --kubeconfig={{kube_config_dir}}/kube-proxy-kubeconfig.yaml
- --bind-address={{ ip | default(ansible_default_ipv4.address) }}
- --cluster-cidr={{ kube_pods_subnet }}
- --proxy-mode={{ kube_proxy_mode }}
- --oom-score-adj=-998
- --healthz-bind-address=127.0.0.1
{% if kube_proxy_masquerade_all and kube_proxy_mode == "iptables" %}
- --masquerade-all
{% elif kube_proxy_mode == 'ipvs' %}
- --masquerade-all
- --feature-gates=SupportIPVSProxyMode=true
- --ipvs-min-sync-period=5s
- --ipvs-sync-period=5s
- --ipvs-scheduler=rr
{% endif %}
securityContext:
privileged: true
volumeMounts:
- mountPath: /etc/ssl/certs
name: ssl-certs-host
readOnly: true
2017-06-27 04:27:25 +00:00
- mountPath: "{{ kube_config_dir }}/ssl"
name: etc-kube-ssl
readOnly: true
2017-06-27 04:27:25 +00:00
- mountPath: "{{ kube_config_dir }}/kube-proxy-kubeconfig.yaml"
name: kubeconfig
readOnly: true
2016-12-05 16:25:27 +00:00
- mountPath: /var/run/dbus
2017-06-27 04:27:25 +00:00
name: var-run-dbus
2016-12-05 16:25:27 +00:00
readOnly: false
- mountPath: /lib/modules
name: lib-modules
readOnly: true
- mountPath: /run/xtables.lock
name: xtables-lock
readOnly: false
volumes:
- name: ssl-certs-host
hostPath:
{% if ansible_os_family == 'RedHat' %}
path: /etc/pki/tls
{% else %}
path: /usr/share/ca-certificates
{% endif %}
2017-06-27 04:27:25 +00:00
- name: etc-kube-ssl
hostPath:
2017-06-27 04:27:25 +00:00
path: "{{ kube_config_dir }}/ssl"
- name: kubeconfig
hostPath:
2017-06-27 04:27:25 +00:00
path: "{{ kube_config_dir }}/kube-proxy-kubeconfig.yaml"
- name: var-run-dbus
2016-12-05 16:25:27 +00:00
hostPath:
2017-06-27 04:27:25 +00:00
path: /var/run/dbus
- hostPath:
path: /lib/modules
name: lib-modules
- hostPath:
path: /run/xtables.lock
type: FileOrCreate
name: xtables-lock