From 409c87571393daff74935ff4d46500acd5c4da51 Mon Sep 17 00:00:00 2001
From: Mike Kolesnik <mkolesni@redhat.com>
Date: Wed, 8 Jan 2020 11:52:24 +0200
Subject: [PATCH] Add support for the Globalnet controller

Added a chart for the globalnet controller which uses the global CIDR.
Also added the global CIDR to the submariner engine pod env so it can
utilize it.
The controller will only be deployed if the CIDR is specified.
---
 submariner/templates/engine-deploy.yaml |  4 +-
 submariner/templates/globalnet.yaml     | 59 +++++++++++++++++++++++++
 submariner/values.yaml                  |  1 +
 3 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 submariner/templates/globalnet.yaml

diff --git a/submariner/templates/engine-deploy.yaml b/submariner/templates/engine-deploy.yaml
index 85e44ff..dd18f80 100644
--- a/submariner/templates/engine-deploy.yaml
+++ b/submariner/templates/engine-deploy.yaml
@@ -60,6 +60,8 @@ spec:
           value: "{{ .Values.submariner.clusterCidr }}"
         - name: SUBMARINER_SERVICECIDR
           value: "{{ .Values.submariner.serviceCidr }}"
+        - name: SUBMARINER_GLOBALCIDR
+          value: "{{ .Values.submariner.globalCidr }}"
         - name: SUBMARINER_TOKEN
           value: "{{ .Values.submariner.apiToken }}"
         - name: SUBMARINER_CLUSTERID
@@ -124,4 +126,4 @@ spec:
       schedulerName: default-scheduler
       securityContext: {}
       terminationGracePeriodSeconds: 0
-      serviceAccountName: {{ template "submariner.engineServiceAccountName" . }}
\ No newline at end of file
+      serviceAccountName: {{ template "submariner.engineServiceAccountName" . }}
diff --git a/submariner/templates/globalnet.yaml b/submariner/templates/globalnet.yaml
new file mode 100644
index 0000000..6efd7aa
--- /dev/null
+++ b/submariner/templates/globalnet.yaml
@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ template "submariner.fullname" . }}-globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.fullname" . }}-globalnet
+    component: globalnet
+spec:
+  selector:
+    matchLabels:
+      app: {{ template "submariner.fullname" . }}-globalnet
+  template:
+    metadata:
+      labels:
+        app: {{ template "submariner.fullname" . }}-globalnet
+    spec:
+      hostNetwork: true
+      serviceAccountName: submariner-globalnet
+      serviceAccount: submariner-globalnet
+      nodeSelector:
+{{- if eq .Values.submariner.globalCidr "" }}
+        nowhere: 'noplace'
+{{- else }}
+        submariner.io/gateway: 'true'
+{{- end }}
+      containers:
+        - name: {{ template "submariner.fullname" . }}-globalnet
+          image: submariner-globalnet:local
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: SUBMARINER_CLUSTERID
+              value: '{{ .Values.submariner.clusterId }}'
+            - name: SUBMARINER_GLOBALCIDR
+              value: '{{ .Values.submariner.globalCidr }}'
+            - name: SUBMARINER_EXCLUDENS
+              value: 'submariner,kube-system,operators'
+            - name: SUBMARINER_NAMESPACE
+              value: '{{ .Release.Namespace }}'
+          securityContext:
+            allowPrivilegeEscalation: true
+            capabilities:
+              add:
+                - ALL
+            privileged: true
+            readOnlyRootFilesystem: false
+            runAsNonRoot: false
+          volumeMounts:
+            # Because we don't actually run iptables locally, but chroot in to the host
+            - mountPath: /host
+              name: host-slash
+              readOnly: true
+      volumes:
+        - name: host-slash
+          hostPath:
+            path: /
+
diff --git a/submariner/values.yaml b/submariner/values.yaml
index c674e94..e0ba61e 100644
--- a/submariner/values.yaml
+++ b/submariner/values.yaml
@@ -4,6 +4,7 @@ submariner:
   token: ""
   clusterCidr: "10.42.0.0/16"
   serviceCidr: "10.43.0.0/16"
+  globalCidr: ""
   natEnabled: false
   colorCodes: blue
   debug: false