c12s-kubespray/roles/network_plugin/kube-router/templates/kube-router.yml.j2
2020-10-05 13:46:20 -07:00

194 lines
4.8 KiB
Django/Jinja

apiVersion: apps/v1
kind: DaemonSet
metadata:
labels:
k8s-app: kube-router
tier: node
name: kube-router
namespace: kube-system
spec:
minReadySeconds: 3
updateStrategy:
rollingUpdate:
maxUnavailable: 1
type: RollingUpdate
selector:
matchLabels:
k8s-app: kube-router
tier: node
template:
metadata:
labels:
k8s-app: kube-router
tier: node
annotations:
{% if kube_router_enable_metrics %}
prometheus.io/path: {{ kube_router_metrics_path }}
prometheus.io/port: "{{ kube_router_metrics_port }}"
prometheus.io/scrape: "true"
{% endif %}
spec:
priorityClassName: system-node-critical
serviceAccountName: kube-router
containers:
- name: kube-router
image: {{ kube_router_image_repo }}:{{ kube_router_image_tag }}
imagePullPolicy: {{ k8s_image_pull_policy }}
args:
- --run-router={{ kube_router_run_router | bool }}
- --run-firewall={{ kube_router_run_firewall | bool }}
- --run-service-proxy={{ kube_router_run_service_proxy | bool }}
- --kubeconfig=/var/lib/kube-router/kubeconfig
- --bgp-graceful-restart=true
{% if kube_router_advertise_cluster_ip %}
- --advertise-cluster-ip
{% endif %}
{% if kube_router_advertise_external_ip %}
- --advertise-external-ip
{% endif %}
{% if kube_router_advertise_loadbalancer_ip %}
- --advertise-loadbalancer-ip
{% endif %}
{% if kube_router_peer_router_asns %}
- --peer-router-asns={{ kube_router_peer_router_asns }}
{% endif %}
{% if kube_router_peer_router_ips %}
- --peer-router-ips={{ kube_router_peer_router_ips }}
{% endif %}
{% if kube_router_peer_router_ports %}
- --peer-router-ports={{ kube_router_peer_router_ports }}
{% endif %}
{% if kube_router_enable_metrics %}
- --metrics-path={{ kube_router_metrics_path }}
- --metrics-port={{ kube_router_metrics_port }}
{% endif %}
{% for arg in kube_router_extra_args %}
- "{{ arg }}"
{% endfor %}
env:
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- name: KUBE_ROUTER_CNI_CONF_FILE
value: /etc/cni/net.d/10-kuberouter.conflist
livenessProbe:
httpGet:
path: /healthz
port: 20244
initialDelaySeconds: 10
periodSeconds: 3
resources:
requests:
cpu: 250m
memory: 250Mi
securityContext:
privileged: true
volumeMounts:
{% if kube_router_enable_dsr %}
- name: docker-socket
mountPath: /var/run/docker.sock
readOnly: true
{% endif %}
- name: lib-modules
mountPath: /lib/modules
readOnly: true
- name: cni-conf-dir
mountPath: /etc/cni/net.d
- name: kubeconfig
mountPath: /var/lib/kube-router
readOnly: true
- name: xtables-lock
mountPath: /run/xtables.lock
readOnly: false
{% if kube_router_enable_metrics %}
ports:
- containerPort: {{ kube_router_metrics_port }}
hostPort: {{ kube_router_metrics_port }}
name: metrics
protocol: TCP
{% endif %}
hostNetwork: true
dnsPolicy: {{ kube_router_dns_policy }}
{% if kube_router_enable_dsr %}
hostIPC: true
hostPID: true
{% endif %}
tolerations:
- operator: Exists
volumes:
{% if kube_router_enable_dsr %}
- name: docker-socket
hostPath:
path: /var/run/docker.sock
type: Socket
{% endif %}
- name: lib-modules
hostPath:
path: /lib/modules
- name: cni-conf-dir
hostPath:
path: /etc/cni/net.d
- name: kubeconfig
hostPath:
path: /var/lib/kube-router
- name: xtables-lock
hostPath:
path: /run/xtables.lock
type: FileOrCreate
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: kube-router
namespace: kube-system
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: kube-router
namespace: kube-system
rules:
- apiGroups:
- ""
resources:
- namespaces
- pods
- services
- nodes
- endpoints
verbs:
- list
- get
- watch
- apiGroups:
- "networking.k8s.io"
resources:
- networkpolicies
verbs:
- list
- get
- watch
- apiGroups:
- extensions
resources:
- networkpolicies
verbs:
- get
- list
- watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: kube-router
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: kube-router
subjects:
- kind: ServiceAccount
name: kube-router
namespace: kube-system