summaryrefslogtreecommitdiff
path: root/roles/kubernetes/kubeadm/master/templates/net_kubeguard
diff options
context:
space:
mode:
authorChristian Pointner <equinox@spreadspace.org>2022-05-07 22:45:49 +0200
committerChristian Pointner <equinox@spreadspace.org>2022-05-07 23:53:19 +0200
commitc09b07327b688a6a47f523a15c1a5c29d4f476d0 (patch)
tree6c243d60a3fb142c582761f1baab1c00f7081342 /roles/kubernetes/kubeadm/master/templates/net_kubeguard
parentcosmetic changes (diff)
k8s: rename masters to control-plane nodes
Diffstat (limited to 'roles/kubernetes/kubeadm/master/templates/net_kubeguard')
-rw-r--r--roles/kubernetes/kubeadm/master/templates/net_kubeguard/kube-router.0.4.0.yml.j2170
-rw-r--r--roles/kubernetes/kubeadm/master/templates/net_kubeguard/kube-router.1.1.1.yml.j2170
2 files changed, 0 insertions, 340 deletions
diff --git a/roles/kubernetes/kubeadm/master/templates/net_kubeguard/kube-router.0.4.0.yml.j2 b/roles/kubernetes/kubeadm/master/templates/net_kubeguard/kube-router.0.4.0.yml.j2
deleted file mode 100644
index e343f4a7..00000000
--- a/roles/kubernetes/kubeadm/master/templates/net_kubeguard/kube-router.0.4.0.yml.j2
+++ /dev/null
@@ -1,170 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
- name: kube-router-kubeconfig
- namespace: kube-system
- labels:
- tier: node
- k8s-app: kube-router
-data:
- kubeconfig.conf: |
- apiVersion: v1
- kind: Config
- clusters:
- - cluster:
- certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
- server: https://127.0.0.1:{{ kubernetes_api_lb_port | default('6443') }}
- name: default
- contexts:
- - context:
- cluster: default
- namespace: default
- user: default
- name: default
- current-context: default
- users:
- - name: default
- user:
- tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
- labels:
- k8s-app: kube-router
- tier: node
- name: kube-router
- namespace: kube-system
-spec:
- selector:
- matchLabels:
- k8s-app: kube-router
- tier: node
- template:
- metadata:
- labels:
- k8s-app: kube-router
- tier: node
- annotations:
- prometheus.io/scrape: "true"
- prometheus.io/port: "8080"
- spec:
- priorityClassName: system-node-critical
- serviceAccountName: kube-router
- serviceAccount: kube-router
- containers:
- - name: kube-router
- image: docker.io/cloudnativelabs/kube-router:v{{ kubernetes_network_plugin_version }}
- imagePullPolicy: Always
- args:
- - --cluster-cidr={{ kubernetes.pod_ip_range }}
- - --run-router=false
- - --run-firewall=true
- - --run-service-proxy={{ kubernetes_network_plugin_replaces_kube_proxy | string | lower }}
- - --kubeconfig=/var/lib/kube-router/kubeconfig
- - --hairpin-mode
- - --iptables-sync-period=10s
- - --ipvs-sync-period=10s
- env:
- - name: NODE_NAME
- valueFrom:
- fieldRef:
- fieldPath: spec.nodeName
- livenessProbe:
- httpGet:
- path: /healthz
- port: 20244
- initialDelaySeconds: 10
- periodSeconds: 3
- resources:
- requests:
- cpu: 250m
- memory: 250Mi
- securityContext:
- privileged: true
- volumeMounts:
- - name: lib-modules
- mountPath: /lib/modules
- readOnly: true
- - name: kubeconfig
- mountPath: /var/lib/kube-router
- readOnly: true
- - name: xtables-lock
- mountPath: /run/xtables.lock
- readOnly: false
- hostNetwork: true
- tolerations:
- - effect: NoSchedule
- operator: Exists
- - key: CriticalAddonsOnly
- operator: Exists
- - effect: NoExecute
- operator: Exists
- volumes:
- - name: lib-modules
- hostPath:
- path: /lib/modules
- - name: kubeconfig
- configMap:
- name: kube-router-kubeconfig
- items:
- - key: kubeconfig.conf
- path: kubeconfig
- - name: xtables-lock
- hostPath:
- path: /run/xtables.lock
- type: FileOrCreate
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
- name: kube-router
- namespace: kube-system
----
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: kube-router
- namespace: kube-system
-rules:
- - apiGroups:
- - ""
- resources:
- - namespaces
- - pods
- - services
- - nodes
- - endpoints
- verbs:
- - list
- - get
- - watch
- - apiGroups:
- - "networking.k8s.io"
- resources:
- - networkpolicies
- verbs:
- - list
- - get
- - watch
- - apiGroups:
- - extensions
- resources:
- - networkpolicies
- verbs:
- - get
- - list
- - watch
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: kube-router
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: kube-router
-subjects:
-- kind: ServiceAccount
- name: kube-router
- namespace: kube-system
diff --git a/roles/kubernetes/kubeadm/master/templates/net_kubeguard/kube-router.1.1.1.yml.j2 b/roles/kubernetes/kubeadm/master/templates/net_kubeguard/kube-router.1.1.1.yml.j2
deleted file mode 100644
index ec30d670..00000000
--- a/roles/kubernetes/kubeadm/master/templates/net_kubeguard/kube-router.1.1.1.yml.j2
+++ /dev/null
@@ -1,170 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
- name: kube-router-kubeconfig
- namespace: kube-system
- labels:
- tier: node
- k8s-app: kube-router
-data:
- kubeconfig.conf: |
- apiVersion: v1
- kind: Config
- clusters:
- - cluster:
- certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
- server: https://127.0.0.1:{{ kubernetes_api_lb_port | default('6443') }}
- name: default
- contexts:
- - context:
- cluster: default
- namespace: default
- user: default
- name: default
- current-context: default
- users:
- - name: default
- user:
- tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
- labels:
- k8s-app: kube-router
- tier: node
- name: kube-router
- namespace: kube-system
-spec:
- selector:
- matchLabels:
- k8s-app: kube-router
- tier: node
- template:
- metadata:
- labels:
- k8s-app: kube-router
- tier: node
- annotations:
- prometheus.io/scrape: "true"
- prometheus.io/port: "8080"
- spec:
- priorityClassName: system-node-critical
- serviceAccountName: kube-router
- serviceAccount: kube-router
- containers:
- - name: kube-router
- image: docker.io/cloudnativelabs/kube-router:v{{ kubernetes_network_plugin_version }}
- imagePullPolicy: Always
- args:
- - --run-router=false
- - --run-firewall=true
- - --run-service-proxy={{ kubernetes_network_plugin_replaces_kube_proxy | string | lower }}
- - --bgp-graceful-restart=true
- - --kubeconfig=/var/lib/kube-router/kubeconfig
- - --hairpin-mode
- - --iptables-sync-period=10s
- - --ipvs-sync-period=10s
- env:
- - name: NODE_NAME
- valueFrom:
- fieldRef:
- fieldPath: spec.nodeName
- livenessProbe:
- httpGet:
- path: /healthz
- port: 20244
- initialDelaySeconds: 10
- periodSeconds: 3
- resources:
- requests:
- cpu: 250m
- memory: 250Mi
- securityContext:
- privileged: true
- volumeMounts:
- - name: lib-modules
- mountPath: /lib/modules
- readOnly: true
- - name: kubeconfig
- mountPath: /var/lib/kube-router
- readOnly: true
- - name: xtables-lock
- mountPath: /run/xtables.lock
- readOnly: false
- hostNetwork: true
- tolerations:
- - effect: NoSchedule
- operator: Exists
- - key: CriticalAddonsOnly
- operator: Exists
- - effect: NoExecute
- operator: Exists
- volumes:
- - name: lib-modules
- hostPath:
- path: /lib/modules
- - name: kubeconfig
- configMap:
- name: kube-router-kubeconfig
- items:
- - key: kubeconfig.conf
- path: kubeconfig
- - name: xtables-lock
- hostPath:
- path: /run/xtables.lock
- type: FileOrCreate
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
- name: kube-router
- namespace: kube-system
----
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: kube-router
- namespace: kube-system
-rules:
- - apiGroups:
- - ""
- resources:
- - namespaces
- - pods
- - services
- - nodes
- - endpoints
- verbs:
- - list
- - get
- - watch
- - apiGroups:
- - "networking.k8s.io"
- resources:
- - networkpolicies
- verbs:
- - list
- - get
- - watch
- - apiGroups:
- - extensions
- resources:
- - networkpolicies
- verbs:
- - get
- - list
- - watch
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
- name: kube-router
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: kube-router
-subjects:
-- kind: ServiceAccount
- name: kube-router
- namespace: kube-system