blob: e2b0f36c53c8089ccb1b82f47ca2b010019ac2f5 [file] [log] [blame]
Richard Jankowskifefff3f2019-01-22 13:36:33 -05001# Copyright 2019-present Open Networking Foundation
2#
3# Licensed under the Apache License, Version 2.0 (the "License");
4# you may not use this file except in compliance with the License.
5# You may obtain a copy of the License at
6#
7# http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS,
11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12# See the License for the specific language governing permissions and
13# limitations under the License.
14---
15kind: ClusterRole
16apiVersion: rbac.authorization.k8s.io/v1beta1
17metadata:
18 name: genie-plugin
19rules:
20 - apiGroups:
21 - ""
22 resources:
23 - pods
24 verbs:
25 - get
26 - update
27 - patch
28 - apiGroups:
29 - "alpha.network.k8s.io"
30 resources:
31 - logicalnetworks
32 verbs:
33 - get
34 - update
35 - patch
36 - apiGroups:
37 - "alpha.network.k8s.io"
38 resources:
39 - physicalnetworks
40 verbs:
41 - get
42 - update
43 - patch
44 - apiGroups:
45 - ""
46 resources:
47 - configmaps
48 verbs:
49 - get
50 - apiGroups:
51 - "admissionregistration.k8s.io"
52 resources:
53 - validatingwebhookconfigurations
54 verbs:
55 - get
56 - update
57 - create
58 - delete
59
60---
61kind: ClusterRoleBinding
62apiVersion: rbac.authorization.k8s.io/v1beta1
63metadata:
64 name: genie-plugin
65roleRef:
66 apiGroup: rbac.authorization.k8s.io
67 kind: ClusterRole
68 name: genie-plugin
69subjects:
70- kind: ServiceAccount
71 name: genie-plugin
72 namespace: kube-system
73- kind: Group
74 name: system:authenticated
75 apiGroup: rbac.authorization.k8s.io
76
77---
78apiVersion: v1
79kind: ServiceAccount
80metadata:
81 name: genie-plugin
82 namespace: kube-system
83
84---
85# This ConfigMap can be used to configure a self-hosted CNI-Genie installation.
86kind: ConfigMap
87apiVersion: v1
88metadata:
89 name: genie-config
90 namespace: kube-system
91data:
92 # The CNI network configuration to install on each node.
93 cni_genie_network_config: |-
94 {
95 "name": "k8s-pod-network",
96 "type": "genie",
97 "log_level": "info",
98 "datastore_type": "kubernetes",
99 "hostname": "__KUBERNETES_NODE_NAME__",
100 "policy": {
101 "type": "k8s",
102 "k8s_auth_token": "__SERVICEACCOUNT_TOKEN__"
103 },
104 "kubernetes": {
105 "k8s_api_root": "https://__KUBERNETES_SERVICE_HOST__:__KUBERNETES_SERVICE_PORT__",
106 "kubeconfig": "/etc/cni/net.d/genie-kubeconfig"
107 },
108 "romana_root": "http://__ROMANA_SERVICE_HOST__:__ROMANA_SERVICE_PORT__",
109 "segment_label_name": "romanaSegment"
110 }
111
112---
113# Install CNI-Genie plugin on each slave node.
114kind: DaemonSet
115apiVersion: extensions/v1beta1
116metadata:
117 name: genie-plugin
118 namespace: kube-system
119 labels:
120 k8s-app: genie
121spec:
122 selector:
123 matchLabels:
124 k8s-app: genie
125 template:
126 metadata:
127 labels:
128 k8s-app: genie
129 annotations:
130 scheduler.alpha.kubernetes.io/critical-pod: ''
131 scheduler.alpha.kubernetes.io/tolerations: |
132 [
133 {
134 "key": "dedicated",
135 "value": "master",
136 "effect": "NoSchedule"
137 },
138 {
139 "key": "CriticalAddonsOnly",
140 "operator": "Exists"
141 }
142 ]
143 spec:
144 hostNetwork: true
145 hostPID: true
146 serviceAccountName: genie-plugin
147 containers:
148 # Create a container with install.sh that
149 # Installs required 00-genie.conf and genie binary
150 # on slave node.
151 - name: install-cni
152 image: quay.io/huawei-cni-genie/genie-plugin:latest
153 imagePullPolicy: Always
154 command: ["/launch.sh"]
155 env:
156 - name: CNI_NETWORK_CONFIG
157 valueFrom:
158 configMapKeyRef:
159 name: genie-config
160 key: cni_genie_network_config
161 - name: KUBERNETES_NODE_NAME
162 valueFrom:
163 fieldRef:
164 fieldPath: spec.nodeName
165 volumeMounts:
166 - mountPath: /host/opt/cni/bin
167 name: cni-bin-dir
168 - mountPath: /host/etc/cni/net.d
169 name: cni-net-dir
170 volumes:
171 - name: cni-bin-dir
172 hostPath:
173 path: /opt/cni/bin
174 - name: cni-net-dir
175 hostPath:
176 path: /etc/cni/net.d
177
178---
179# Genie network admission controller daemonset configuration
180# Genie network admission controller pods will run only in master nodes
181apiVersion: extensions/v1beta1
182kind: DaemonSet
183metadata:
184 name: genie-network-admission-controller
185 namespace: kube-system
186spec:
187 template:
188 metadata:
189 labels:
190 role: genie-network-admission-controller
191 annotations:
192 scheduler.alpha.kubernetes.io/critical-pod: ''
193 spec:
194 tolerations:
195 - key: node-role.kubernetes.io/master
196 effect: NoSchedule
197 - key: CriticalAddonsOnly
198 operator: Exists
199 nodeSelector:
200 node-role.kubernetes.io/master: ""
201 hostNetwork: true
202 serviceAccountName: genie-plugin
203 containers:
204 - name: genie-network-admission-controller
205 image: quay.io/huawei-cni-genie/genie-admission-controller:latest
206 imagePullPolicy: Always
207 ports:
208 - containerPort: 8000
209---
210# Genie network admission controller service
211apiVersion: v1
212kind: Service
213metadata:
214 labels:
215 role: genie-network-admission-controller
216 name: genie-network-admission-controller
217 namespace: kube-system
218spec:
219 ports:
220 - port: 443
221 targetPort: 8000
222 selector:
223 role: genie-network-admission-controller