c12s-kubespray/roles/network_plugin/kube-ovn/templates/cni-ovn.yml.j2

414 lines
9.7 KiB
Text
Raw Normal View History

2020-11-26 17:34:19 +00:00
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: kube-ovn
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
spec:
privileged: true
allowPrivilegeEscalation: true
allowedCapabilities:
- '*'
volumes:
- '*'
hostNetwork: true
hostPorts:
- min: 0
max: 65535
hostIPC: true
hostPID: true
runAsUser:
rule: 'RunAsAny'
seLinux:
rule: 'RunAsAny'
supplementalGroups:
rule: 'RunAsAny'
fsGroup:
rule: 'RunAsAny'
2019-07-31 03:10:20 +00:00
---
apiVersion: v1
kind: ConfigMap
metadata:
name: ovn-config
2020-05-06 18:05:09 +00:00
namespace: kube-system
2019-07-31 03:10:20 +00:00
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: ovn
2020-05-06 18:05:09 +00:00
namespace: kube-system
2019-07-31 03:10:20 +00:00
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
rbac.authorization.k8s.io/system-only: "true"
name: system:ovn
rules:
2021-02-10 10:25:01 +00:00
- apiGroups:
- policy
resources:
- podsecuritypolicies
verbs:
- use
resourceNames:
- kube-ovn
2019-07-31 03:10:20 +00:00
- apiGroups:
- "kubeovn.io"
resources:
- subnets
- subnets/status
2021-02-10 10:25:01 +00:00
- vpcs
- vpcs/status
2019-07-31 03:10:20 +00:00
- ips
2020-05-06 18:05:09 +00:00
- vlans
2020-11-26 17:34:19 +00:00
- networks
2019-07-31 03:10:20 +00:00
verbs:
- "*"
- apiGroups:
- ""
resources:
- pods
- namespaces
- nodes
- configmaps
verbs:
- create
- get
- list
- watch
- patch
- update
- apiGroups:
- ""
- networking.k8s.io
- apps
2020-05-06 18:05:09 +00:00
- extensions
2019-07-31 03:10:20 +00:00
resources:
- networkpolicies
- services
- endpoints
- statefulsets
- daemonsets
2020-05-06 18:05:09 +00:00
- deployments
2019-07-31 03:10:20 +00:00
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: ovn
roleRef:
name: system:ovn
kind: ClusterRole
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: ovn
2020-05-06 18:05:09 +00:00
namespace: kube-system
2019-07-31 03:10:20 +00:00
---
kind: Service
apiVersion: v1
metadata:
name: ovn-nb
2020-05-06 18:05:09 +00:00
namespace: kube-system
2019-07-31 03:10:20 +00:00
spec:
ports:
- name: ovn-nb
protocol: TCP
port: 6641
targetPort: 6641
type: ClusterIP
selector:
app: ovn-central
ovn-nb-leader: "true"
2019-07-31 03:10:20 +00:00
sessionAffinity: None
---
kind: Service
apiVersion: v1
metadata:
name: ovn-sb
2020-05-06 18:05:09 +00:00
namespace: kube-system
2019-07-31 03:10:20 +00:00
spec:
ports:
- name: ovn-sb
protocol: TCP
port: 6642
targetPort: 6642
type: ClusterIP
selector:
app: ovn-central
ovn-sb-leader: "true"
2019-07-31 03:10:20 +00:00
sessionAffinity: None
---
kind: Deployment
apiVersion: apps/v1
metadata:
name: ovn-central
2020-05-06 18:05:09 +00:00
namespace: kube-system
2019-07-31 03:10:20 +00:00
annotations:
kubernetes.io/description: |
OVN components: northd, nb and sb.
spec:
replicas: 1
strategy:
rollingUpdate:
2021-02-10 10:25:01 +00:00
maxSurge: 0
maxUnavailable: 1
2019-07-31 03:10:20 +00:00
type: RollingUpdate
selector:
matchLabels:
app: ovn-central
template:
metadata:
labels:
app: ovn-central
component: network
type: infra
spec:
tolerations:
- operator: Exists
effect: NoSchedule
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
app: ovn-central
topologyKey: kubernetes.io/hostname
priorityClassName: system-cluster-critical
2019-07-31 03:10:20 +00:00
serviceAccountName: ovn
hostNetwork: true
containers:
- name: ovn-central
image: {{ kube_ovn_container_image_repo }}:{{ kube_ovn_container_image_tag }}
2019-07-31 03:10:20 +00:00
imagePullPolicy: {{ k8s_image_pull_policy }}
command: ["/kube-ovn/start-db.sh"]
securityContext:
capabilities:
add: ["SYS_NICE"]
2019-07-31 03:10:20 +00:00
env:
2020-11-26 17:34:19 +00:00
- name: ENABLE_SSL
value: "false"
2019-07-31 03:10:20 +00:00
- name: POD_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
2019-07-31 03:10:20 +00:00
resources:
requests:
cpu: {{ kube_ovn_db_cpu_request }}
memory: {{ kube_ovn_db_memory_request }}
limits:
cpu: {{ kube_ovn_db_cpu_limit }}
memory: {{ kube_ovn_db_memory_limit }}
volumeMounts:
- mountPath: /var/run/openvswitch
name: host-run-ovs
- mountPath: /var/run/ovn
name: host-run-ovn
2019-07-31 03:10:20 +00:00
- mountPath: /sys
name: host-sys
readOnly: true
- mountPath: /etc/openvswitch
name: host-config-openvswitch
2020-05-06 18:05:09 +00:00
- mountPath: /etc/ovn
name: host-config-ovn
2019-07-31 03:10:20 +00:00
- mountPath: /var/log/openvswitch
name: host-log-ovs
- mountPath: /var/log/ovn
name: host-log-ovn
2020-11-26 17:34:19 +00:00
- mountPath: /var/run/tls
name: kube-ovn-tls
2019-07-31 03:10:20 +00:00
readinessProbe:
exec:
command:
2021-02-10 10:25:01 +00:00
- bash
- /kube-ovn/ovn-is-leader.sh
2019-07-31 03:10:20 +00:00
periodSeconds: 3
2020-11-26 17:34:19 +00:00
timeoutSeconds: 45
2019-07-31 03:10:20 +00:00
livenessProbe:
exec:
command:
2021-02-10 10:25:01 +00:00
- bash
- /kube-ovn/ovn-healthcheck.sh
2019-07-31 03:10:20 +00:00
initialDelaySeconds: 30
periodSeconds: 7
failureThreshold: 5
2020-11-26 17:34:19 +00:00
timeoutSeconds: 45
2019-07-31 03:10:20 +00:00
nodeSelector:
kubernetes.io/os: "linux"
2019-07-31 03:10:20 +00:00
kube-ovn/role: "master"
volumes:
- name: host-run-ovs
hostPath:
path: /run/openvswitch
- name: host-run-ovn
hostPath:
path: /run/ovn
2019-07-31 03:10:20 +00:00
- name: host-sys
hostPath:
path: /sys
- name: host-config-openvswitch
hostPath:
path: /etc/origin/openvswitch
2020-05-06 18:05:09 +00:00
- name: host-config-ovn
hostPath:
path: /etc/origin/ovn
- name: host-log-ovs
2019-07-31 03:10:20 +00:00
hostPath:
path: /var/log/openvswitch
- name: host-log-ovn
hostPath:
path: /var/log/ovn
2020-11-26 17:34:19 +00:00
- name: kube-ovn-tls
secret:
optional: true
secretName: kube-ovn-tls
2019-07-31 03:10:20 +00:00
---
kind: DaemonSet
apiVersion: apps/v1
metadata:
name: ovs-ovn
2020-05-06 18:05:09 +00:00
namespace: kube-system
2019-07-31 03:10:20 +00:00
annotations:
kubernetes.io/description: |
This daemon set launches the openvswitch daemon.
spec:
selector:
matchLabels:
app: ovs
updateStrategy:
type: OnDelete
2019-07-31 03:10:20 +00:00
template:
metadata:
labels:
app: ovs
component: network
type: infra
spec:
tolerations:
- operator: Exists
effect: NoSchedule
priorityClassName: system-cluster-critical
2019-07-31 03:10:20 +00:00
serviceAccountName: ovn
hostNetwork: true
hostPID: true
containers:
- name: openvswitch
image: {{ kube_ovn_container_image_repo }}:{{ kube_ovn_container_image_tag }}
2019-07-31 03:10:20 +00:00
imagePullPolicy: {{ k8s_image_pull_policy }}
command: ["/kube-ovn/start-ovs.sh"]
2019-07-31 03:10:20 +00:00
securityContext:
runAsUser: 0
privileged: true
env:
2020-11-26 17:34:19 +00:00
- name: ENABLE_SSL
value: "false"
2019-07-31 03:10:20 +00:00
- name: POD_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
- name: HW_OFFLOAD
value: "false"
2020-11-26 17:34:19 +00:00
- name: KUBE_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
2019-07-31 03:10:20 +00:00
volumeMounts:
- mountPath: /lib/modules
name: host-modules
readOnly: true
- mountPath: /var/run/openvswitch
name: host-run-ovs
- mountPath: /var/run/ovn
name: host-run-ovn
2019-07-31 03:10:20 +00:00
- mountPath: /sys
name: host-sys
readOnly: true
- mountPath: /etc/openvswitch
name: host-config-openvswitch
2020-05-06 18:05:09 +00:00
- mountPath: /etc/ovn
name: host-config-ovn
2019-07-31 03:10:20 +00:00
- mountPath: /var/log/openvswitch
name: host-log-ovs
- mountPath: /var/log/ovn
name: host-log-ovn
2020-11-26 17:34:19 +00:00
- mountPath: /var/run/tls
name: kube-ovn-tls
2019-07-31 03:10:20 +00:00
readinessProbe:
exec:
command:
2021-02-10 10:25:01 +00:00
- bash
- /kube-ovn/ovs-healthcheck.sh
2019-07-31 03:10:20 +00:00
periodSeconds: 5
2020-11-26 17:34:19 +00:00
timeoutSeconds: 45
2019-07-31 03:10:20 +00:00
livenessProbe:
exec:
command:
2021-02-10 10:25:01 +00:00
- bash
- /kube-ovn/ovs-healthcheck.sh
2019-07-31 03:10:20 +00:00
initialDelaySeconds: 10
periodSeconds: 5
failureThreshold: 5
2020-11-26 17:34:19 +00:00
timeoutSeconds: 45
2019-07-31 03:10:20 +00:00
resources:
requests:
cpu: {{ kube_ovn_node_cpu_request }}
memory: {{ kube_ovn_node_memory_request }}
limits:
cpu: {{ kube_ovn_node_cpu_limit }}
memory: {{ kube_ovn_node_memory_limit }}
nodeSelector:
kubernetes.io/os: "linux"
2019-07-31 03:10:20 +00:00
volumes:
- name: host-modules
hostPath:
path: /lib/modules
- name: host-run-ovs
hostPath:
path: /run/openvswitch
- name: host-run-ovn
hostPath:
path: /run/ovn
2019-07-31 03:10:20 +00:00
- name: host-sys
hostPath:
path: /sys
- name: host-config-openvswitch
hostPath:
path: /etc/origin/openvswitch
2020-05-06 18:05:09 +00:00
- name: host-config-ovn
hostPath:
path: /etc/origin/ovn
- name: host-log-ovs
hostPath:
path: /var/log/openvswitch
- name: host-log-ovn
2019-07-31 03:10:20 +00:00
hostPath:
2020-06-29 19:39:59 +00:00
path: /var/log/ovn
2020-11-26 17:34:19 +00:00
- name: kube-ovn-tls
secret:
optional: true
secretName: kube-ovn-tls