mirror of
https://github.com/submariner-io/submariner-charts.git
synced 2026-09-20 22:40:34 +00:00
Remove the standalone Submariner chart
This was deprecated in favour of the operator-based chart. This only removes the Submariner chart, the broker chart will be addressed separately. Signed-off-by: Stephen Kitt <skitt@redhat.com>
This commit is contained in:
Stephen Kitt
committed by
Daniel Farrell
Daniel Farrell
parent
50570be17c
commit
74b4a9d0bb
@@ -62,5 +62,5 @@ jobs:
|
||||
- name: Run yamllint
|
||||
uses: ibiqlik/action-yamllint@v1
|
||||
with:
|
||||
file_or_dir: submariner/Chart.yaml submariner/values.yaml submariner-k8s-broker/Chart.yaml submariner-k8s-broker/values.yaml submariner-operator/Chart.yaml submariner-operator/values.yaml
|
||||
file_or_dir: submariner-k8s-broker/Chart.yaml submariner-k8s-broker/values.yaml submariner-operator/Chart.yaml submariner-operator/values.yaml
|
||||
config_file: .yamllint.yml
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
.git
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
name: submariner
|
||||
version: 0.6.0
|
||||
appVersion: 0.6.0
|
||||
description: Submariner enables direct networking between Pods and Services in different Kubernetes clusters
|
||||
keywords:
|
||||
home: https://submariner-io.github.io/
|
||||
sources:
|
||||
- https://submariner-io.github.io/submariner-charts/charts
|
||||
maintainers:
|
||||
- name: Submariner Developers
|
||||
email: submariner-dev@googlegroups.com
|
||||
@@ -1,5 +0,0 @@
|
||||
# Submariner
|
||||
|
||||
[Submariner](https://submariner.io) is a cross-cluster networking tool.
|
||||
|
||||
This chart creates the required components in this cluster to enable cross cluster networking.
|
||||
@@ -1,324 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: clusters.submariner.io
|
||||
spec:
|
||||
group: submariner.io
|
||||
version: v1
|
||||
names:
|
||||
kind: Cluster
|
||||
plural: clusters
|
||||
scope: Namespaced
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: endpoints.submariner.io
|
||||
spec:
|
||||
group: submariner.io
|
||||
version: v1
|
||||
names:
|
||||
kind: Endpoint
|
||||
plural: endpoints
|
||||
scope: Namespaced
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: gateways.submariner.io
|
||||
spec:
|
||||
group: submariner.io
|
||||
version: v1
|
||||
names:
|
||||
kind: Gateway
|
||||
plural: gateways
|
||||
scope: Namespaced
|
||||
additionalPrinterColumns:
|
||||
- name: ha-status
|
||||
type: string
|
||||
description: High Availability Status of the Gateway
|
||||
JSONPath: .status.haStatus
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: multiclusterservices.lighthouse.submariner.io
|
||||
spec:
|
||||
group: lighthouse.submariner.io
|
||||
version: v1
|
||||
names:
|
||||
kind: MultiClusterService
|
||||
plural: multiclusterservices
|
||||
singular: multiclusterservice
|
||||
scope: Namespaced
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
properties:
|
||||
clusterServiceInfo:
|
||||
properties:
|
||||
clusterID:
|
||||
type: "string"
|
||||
clusterDomain:
|
||||
type: "string"
|
||||
serviceIP:
|
||||
type: "string"
|
||||
port:
|
||||
type: "integer"
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: serviceexports.lighthouse.submariner.io
|
||||
spec:
|
||||
group: lighthouse.submariner.io
|
||||
version: v2alpha1
|
||||
names:
|
||||
kind: ServiceExport
|
||||
plural: serviceexports
|
||||
singular: serviceexport
|
||||
scope: Namespaced
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: serviceimports.lighthouse.submariner.io
|
||||
spec:
|
||||
group: lighthouse.submariner.io
|
||||
version: v2alpha1
|
||||
names:
|
||||
kind: ServiceImport
|
||||
plural: serviceimports
|
||||
singular: serviceimport
|
||||
scope: Namespaced
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: serviceexports.multicluster.x-k8s.io
|
||||
spec:
|
||||
group: multicluster.x-k8s.io
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: serviceexports
|
||||
singular: serviceexport
|
||||
kind: ServiceExport
|
||||
shortNames:
|
||||
- svcex
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
additionalPrinterColumns:
|
||||
- name: Age
|
||||
type: date
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
"schema":
|
||||
"openAPIV3Schema":
|
||||
description: ServiceExport declares that the Service with the same name and
|
||||
namespace as this export should be consumable from other clusters.
|
||||
type: object
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
status:
|
||||
description: status describes the current state of an exported service.
|
||||
Service configuration comes from the Service that had the same name
|
||||
and namespace as this ServiceExport. Populated by the multi-cluster
|
||||
service implementation's controller.
|
||||
type: object
|
||||
properties:
|
||||
conditions:
|
||||
type: array
|
||||
items:
|
||||
description: "ServiceExportCondition contains details for the current
|
||||
condition of this service export. \n Once [KEP-1623](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1623-standardize-conditions)
|
||||
is implemented, this will be replaced by metav1.Condition."
|
||||
type: object
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
type: string
|
||||
format: date-time
|
||||
message:
|
||||
type: string
|
||||
reason:
|
||||
type: string
|
||||
status:
|
||||
description: Status is one of {"True", "False", "Unknown"}
|
||||
type: string
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type:
|
||||
description: ServiceExportConditionType identifies a specific
|
||||
condition.
|
||||
type: string
|
||||
x-kubernetes-list-map-keys:
|
||||
- type
|
||||
x-kubernetes-list-type: map
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: serviceimports.multicluster.x-k8s.io
|
||||
spec:
|
||||
group: multicluster.x-k8s.io
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: serviceimports
|
||||
singular: serviceimport
|
||||
kind: ServiceImport
|
||||
shortNames:
|
||||
- svcim
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
additionalPrinterColumns:
|
||||
- name: Type
|
||||
type: string
|
||||
description: The type of this ServiceImport
|
||||
jsonPath: .spec.type
|
||||
- name: IP
|
||||
type: string
|
||||
description: The VIP for this ServiceImport
|
||||
jsonPath: .spec.ips
|
||||
- name: Age
|
||||
type: date
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
"schema":
|
||||
"openAPIV3Schema":
|
||||
description: ServiceImport describes a service imported from clusters in a
|
||||
ClusterSet.
|
||||
type: object
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: spec defines the behavior of a ServiceImport.
|
||||
type: object
|
||||
required:
|
||||
- ports
|
||||
- type
|
||||
properties:
|
||||
ips:
|
||||
description: ip will be used as the VIP for this service when type
|
||||
is ClusterSetIP.
|
||||
type: array
|
||||
maxItems: 1
|
||||
items:
|
||||
type: string
|
||||
ports:
|
||||
type: array
|
||||
items:
|
||||
description: ServicePort represents the port on which the service
|
||||
is exposed
|
||||
type: object
|
||||
required:
|
||||
- port
|
||||
properties:
|
||||
appProtocol:
|
||||
description: The application protocol for this port. This field
|
||||
follows standard Kubernetes label syntax. Un-prefixed names
|
||||
are reserved for IANA standard service names (as per RFC-6335
|
||||
and http://www.iana.org/assignments/service-names). Non-standard
|
||||
protocols should use prefixed names such as mycompany.com/my-custom-protocol.
|
||||
Field can be enabled with ServiceAppProtocol feature gate.
|
||||
type: string
|
||||
name:
|
||||
description: The name of this port within the service. This
|
||||
must be a DNS_LABEL. All ports within a ServiceSpec must have
|
||||
unique names. When considering the endpoints for a Service,
|
||||
this must match the 'name' field in the EndpointPort. Optional
|
||||
if only one ServicePort is defined on this service.
|
||||
type: string
|
||||
port:
|
||||
description: The port that will be exposed by this service.
|
||||
type: integer
|
||||
format: int32
|
||||
protocol:
|
||||
description: The IP protocol for this port. Supports "TCP",
|
||||
"UDP", and "SCTP". Default is TCP.
|
||||
type: string
|
||||
x-kubernetes-list-type: atomic
|
||||
sessionAffinity:
|
||||
description: 'Supports "ClientIP" and "None". Used to maintain session
|
||||
affinity. Enable client IP based session affinity. Must be ClientIP
|
||||
or None. Defaults to None. Ignored when type is Headless More info:
|
||||
https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies'
|
||||
type: string
|
||||
sessionAffinityConfig:
|
||||
description: sessionAffinityConfig contains session affinity configuration.
|
||||
type: object
|
||||
properties:
|
||||
clientIP:
|
||||
description: clientIP contains the configurations of Client IP
|
||||
based session affinity.
|
||||
type: object
|
||||
properties:
|
||||
timeoutSeconds:
|
||||
description: timeoutSeconds specifies the seconds of ClientIP
|
||||
type session sticky time. The value must be >0 && <=86400(for
|
||||
1 day) if ServiceAffinity == "ClientIP". Default value is
|
||||
10800(for 3 hours).
|
||||
type: integer
|
||||
format: int32
|
||||
type:
|
||||
description: type defines the type of this service. Must be ClusterSetIP
|
||||
or Headless.
|
||||
type: string
|
||||
enum:
|
||||
- ClusterSetIP
|
||||
- Headless
|
||||
status:
|
||||
description: status contains information about the exported services that
|
||||
form the multi-cluster service referenced by this ServiceImport.
|
||||
type: object
|
||||
properties:
|
||||
clusters:
|
||||
description: clusters is the list of exporting clusters from which
|
||||
this service was derived.
|
||||
type: array
|
||||
items:
|
||||
description: ClusterStatus contains service configuration mapped
|
||||
to a specific source cluster
|
||||
type: object
|
||||
required:
|
||||
- cluster
|
||||
properties:
|
||||
cluster:
|
||||
description: cluster is the name of the exporting cluster. Must
|
||||
be a valid RFC-1123 DNS label.
|
||||
type: string
|
||||
x-kubernetes-list-map-keys:
|
||||
- cluster
|
||||
x-kubernetes-list-type: map
|
||||
@@ -1,144 +0,0 @@
|
||||
questions:
|
||||
- variable: defaultGatewayImage
|
||||
default: true
|
||||
description: "Use default Submariner Gateway image or specify a custom one"
|
||||
label: Use default submariner gateway image
|
||||
type: boolean
|
||||
show_subquestion_if: false
|
||||
group: "Container Images"
|
||||
subquestions:
|
||||
- variable: gateway.image.repository
|
||||
default: "quay.io/submariner/submariner-gateway"
|
||||
description: "Submariner Gateway Image Repository"
|
||||
type: string
|
||||
label: Submariner Gateway Image Repository
|
||||
- variable: gateway.image.tag
|
||||
default: "0.6.0"
|
||||
description: "Submariner Gateway Image Tag"
|
||||
type: string
|
||||
label: Submariner Gateway Image Tag
|
||||
- variable: defaultRouteAgentImage
|
||||
default: true
|
||||
description: "Use default Submariner Route Agent image or specify a custom one"
|
||||
label: Use default submariner route agent image
|
||||
type: boolean
|
||||
show_subquestion_if: false
|
||||
group: "Container Images"
|
||||
subquestions:
|
||||
- variable: routeAgent.image.repository
|
||||
default: "quay.io/submariner/submariner-route-agent"
|
||||
description: "Submariner Route Agent Image Repository"
|
||||
type: string
|
||||
label: Submariner Route Agent Image Repository
|
||||
- variable: routeAgent.image.tag
|
||||
default: "0.6.0"
|
||||
description: "Submariner Route Agent Image Tag"
|
||||
type: string
|
||||
label: Submariner Route Agent Image Tag
|
||||
- variable: gateway.nodeSelectorEnabled
|
||||
default: true
|
||||
description: "Restrict submariner to nodes labeled with submariner.io/gateway=true"
|
||||
label: Restrict gateway deployments to specific nodes
|
||||
type: boolean
|
||||
group: "Gateway Configuration"
|
||||
- variable: submariner.clusterId
|
||||
default: ""
|
||||
description: "Enter a unique cluster ID to identify this cluster"
|
||||
type: string
|
||||
label: "Cluster ID"
|
||||
group: "Configuration"
|
||||
required: true
|
||||
- variable: ipsec.psk
|
||||
default: ""
|
||||
description: "Enter the pre-shared key for the IPsec Cable Engine"
|
||||
type: string
|
||||
label: "IPsec Pre-Shared Key"
|
||||
group: "Configuration"
|
||||
required: true
|
||||
- variable: broker.type
|
||||
type: enum
|
||||
default: k8s
|
||||
options:
|
||||
- k8s
|
||||
group: "Broker Configuration"
|
||||
label: "Broker Type"
|
||||
description: "Type of Broker to use"
|
||||
- variable: broker.server
|
||||
type: string
|
||||
default: ""
|
||||
group: "Broker Configuration"
|
||||
label: "Broker Server"
|
||||
description: "Broker server to use (without the https://)"
|
||||
- variable: broker.insecure
|
||||
type: boolean
|
||||
default: false
|
||||
show_subquestion_if: false
|
||||
group: "Broker Configuration"
|
||||
label: "Insecure Broker"
|
||||
description: "Connect to K8s broker without validating CA"
|
||||
subquestions:
|
||||
- variable: broker.ca
|
||||
type: string
|
||||
description: "Base64 encoded broker ca.crt"
|
||||
label: "Broker CA encoded in base64"
|
||||
default: ""
|
||||
- variable: broker.token
|
||||
type: string
|
||||
group: "Broker Configuration"
|
||||
label: "Broker Token"
|
||||
description: "Bearer token for broker"
|
||||
- variable: broker.namespace
|
||||
type: string
|
||||
group: "Broker Configuration"
|
||||
label: "Broker Namespace"
|
||||
description: "Enter namespace to use on central broker"
|
||||
- variable: submariner.clusterCidr
|
||||
default: ""
|
||||
description: "Enter the cluster CIDR (i.e. 10.42.0.0/16) for this cluster"
|
||||
type: string
|
||||
label: "Cluster CIDR"
|
||||
group: "CIDR Configuration"
|
||||
required: true
|
||||
- variable: submariner.serviceCidr
|
||||
default: ""
|
||||
description: "Enter the service CIDR (i.e. 10.43.0.0/16) for this cluster"
|
||||
type: string
|
||||
label: "Service CIDR"
|
||||
group: "CIDR Configuration"
|
||||
required: true
|
||||
- variable: submariner.natEnabled
|
||||
type: boolean
|
||||
default: false
|
||||
group: "Advanced Configuration"
|
||||
description: "If the gateway nodes for this cluster are behind 1:1 NAT, you should enable NAT"
|
||||
label: "NAT Enabled"
|
||||
- variable: crd.create
|
||||
type: boolean
|
||||
default: true
|
||||
group: "Advanced Configuration"
|
||||
description: "Create the Submariner CRDs, if deploying Submariner into the same cluster as the submariner-k8s-broker, you probably shouldn't create CRDs"
|
||||
label: "CRD Creation Enabled"
|
||||
- variable: submariner.debug
|
||||
type: boolean
|
||||
default: false
|
||||
group: "Advanced Configuration"
|
||||
description: "Enable submariner debug mode"
|
||||
label: "Submariner Debug Enabled"
|
||||
- variable: ipsec.debug
|
||||
type: boolean
|
||||
default: false
|
||||
group: "Advanced Configuration"
|
||||
description: "Enable Charon debug mode"
|
||||
label: "Charon Enabled"
|
||||
- variable: submariner.cableDriver
|
||||
type: string
|
||||
default: ""
|
||||
group: "Advanced Configuration"
|
||||
description: "Cable driver implementation"
|
||||
label: "Cable Driver"
|
||||
- variable: submariner.serviceDiscovery
|
||||
type: boolean
|
||||
default: false
|
||||
group: "Advanced Configuration"
|
||||
description: "Enable multicluster service discovery"
|
||||
label: "Service Discovery Enabled"
|
||||
@@ -1,7 +0,0 @@
|
||||
Submariner is now installed.
|
||||
|
||||
{{- if .Values.gateway.nodeSelectorEnabled }}
|
||||
If you haven't done so yet, please label a node as `submariner.io/gateway=true` to elect it for running Submariner.
|
||||
{{- end }}
|
||||
|
||||
By default, Submariner runs with 1 replica. If you have more than one Gateway host, you can scale Submariner to N replicas, and the other Submariner pods will simply join the leader election pool.
|
||||
@@ -1,94 +0,0 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "submariner.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "submariner.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "submariner.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-gateway service account to use
|
||||
*/}}
|
||||
{{- define "submariner.gatewayServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.gateway.create -}}
|
||||
{{ default "submariner-gateway" .Values.serviceAccounts.gateway.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.gateway.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-route-agent service account to use
|
||||
*/}}
|
||||
{{- define "submariner.routeAgentServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.routeAgent.create -}}
|
||||
{{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.routeAgent.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-globalnet service account to use
|
||||
*/}}
|
||||
{{- define "submariner.globalnetServiceAccountName" -}}
|
||||
{{- if .Values.serviceAccounts.globalnet.create -}}
|
||||
{{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.globalnet.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-lighthouse-agent service account to use
|
||||
*/}}
|
||||
{{- define "submariner.lighthouseAgentServiceAccountName" -}}
|
||||
{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
|
||||
{{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-lighthouse-coredns service account to use
|
||||
*/}}
|
||||
{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
|
||||
{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
|
||||
{{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the submariner-lighthouse-coredns service name to use
|
||||
*/}}
|
||||
{{- define "submariner.lighthouseDnsName" -}}
|
||||
{{- default (printf "%s-lighthouse-coredns" (include "submariner.fullname" .)) .Values.lighthouseCoredns.name }}
|
||||
{{- end -}}
|
||||
@@ -1,138 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.fullname" . }}-gateway
|
||||
component: gateway
|
||||
name: {{ template "submariner.fullname" . }}-gateway
|
||||
spec:
|
||||
revisionHistoryLimit: 5
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "submariner.fullname" . }}-gateway
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
app: {{ template "submariner.fullname" . }}-gateway
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- {{ template "submariner.fullname" . }}-gateway
|
||||
topologyKey: "kubernetes.io/hostname"
|
||||
{{- with .Values.gateway.affinity }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
nodeSelector:
|
||||
{{- if .Values.gateway.nodeSelectorEnabled }}
|
||||
submariner.io/gateway: "true"
|
||||
{{- end }}
|
||||
{{- with .Values.gateway.nodeSelector }}
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.gateway.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- command:
|
||||
- submariner.sh
|
||||
env:
|
||||
- name: SUBMARINER_NAMESPACE
|
||||
value: "{{ .Release.Namespace }}"
|
||||
- name: SUBMARINER_CLUSTERCIDR
|
||||
value: "{{ .Values.submariner.clusterCidr }}"
|
||||
- name: SUBMARINER_SERVICECIDR
|
||||
value: "{{ .Values.submariner.serviceCidr }}"
|
||||
- name: SUBMARINER_GLOBALCIDR
|
||||
value: "{{ .Values.submariner.globalCidr }}"
|
||||
- name: SUBMARINER_TOKEN
|
||||
value: "{{ .Values.submariner.apiToken }}"
|
||||
- name: SUBMARINER_CLUSTERID
|
||||
value: "{{ .Values.submariner.clusterId }}"
|
||||
- name: SUBMARINER_COLORCODES
|
||||
value: "{{ .Values.submariner.colorCodes }}"
|
||||
- name: SUBMARINER_DEBUG
|
||||
value: "{{ .Values.submariner.debug }}"
|
||||
- name: SUBMARINER_NATENABLED
|
||||
value: "{{ .Values.submariner.natEnabled }}"
|
||||
- name: SUBMARINER_BROKER
|
||||
value: "{{ .Values.broker.type }}"
|
||||
- name: SUBMARINER_CABLEDRIVER
|
||||
value: "{{ .Values.submariner.cableDriver }}"
|
||||
{{- if eq .Values.broker.type "phpapi" }}
|
||||
- name: BROKER_PHPAPI_PROTO
|
||||
value: "{{ .Values.broker.proto }}"
|
||||
- name: BROKER_PHPAPI_SERVER
|
||||
value: "{{ .Values.broker.server }}"
|
||||
{{- end }}
|
||||
{{- if eq .Values.broker.type "k8s" }}
|
||||
- name: BROKER_K8S_APISERVER
|
||||
value: "{{ .Values.broker.server }}"
|
||||
- name: BROKER_K8S_APISERVERTOKEN
|
||||
value: "{{ .Values.broker.token }}"
|
||||
- name: BROKER_K8S_REMOTENAMESPACE
|
||||
value: "{{ .Values.broker.namespace }}"
|
||||
{{- if .Values.broker.insecure }}
|
||||
- name: BROKER_K8S_INSECURE
|
||||
value: "true"
|
||||
{{- else }}
|
||||
- name: BROKER_K8S_CA
|
||||
value: "{{ .Values.broker.ca }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: CE_IPSEC_PSK
|
||||
value: "{{ .Values.ipsec.psk }}"
|
||||
- name: CE_IPSEC_DEBUG
|
||||
value: "{{ .Values.ipsec.debug }}"
|
||||
- name: CE_IPSEC_IKEPORT
|
||||
value: "{{ .Values.ipsec.ikePort }}"
|
||||
- name: CE_IPSEC_NATTPORT
|
||||
value: "{{ .Values.ipsec.natPort }}"
|
||||
- name: LEADERSHIP_LEASEDURATION
|
||||
value: "{{ .Values.leadership.leaseDuration }}"
|
||||
- name: LEADERSHIP_RENEWDEADLINE
|
||||
value: "{{ .Values.leadership.renewDeadline }}"
|
||||
- name: LEADERSHIP_RETRYPERIOD
|
||||
value: "{{ .Values.leadership.retryPeriod }}"
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: "spec.nodeName"
|
||||
image: {{ .Values.gateway.image.repository }}:{{ default .Chart.AppVersion .Values.gateway.image.tag }}
|
||||
imagePullPolicy: {{ .Values.gateway.image.pullPolicy }}
|
||||
name: submariner
|
||||
resources:
|
||||
{{ toYaml .Values.gateway.resources | indent 10 }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- ALL
|
||||
privileged: true
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: false
|
||||
stdin: true
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
tty: true
|
||||
dnsPolicy: ClusterFirst
|
||||
hostNetwork: true
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
terminationGracePeriodSeconds: 1
|
||||
serviceAccountName: {{ template "submariner.gatewayServiceAccountName" . }}
|
||||
@@ -1,63 +0,0 @@
|
||||
{{- if .Values.broker.globalnet }}
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}-globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.fullname" . }}-globalnet
|
||||
component: globalnet
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "submariner.fullname" . }}-globalnet
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "submariner.fullname" . }}-globalnet
|
||||
spec:
|
||||
hostNetwork: true
|
||||
serviceAccountName: submariner-globalnet
|
||||
serviceAccount: submariner-globalnet
|
||||
terminationGracePeriodSeconds: 2
|
||||
nodeSelector:
|
||||
submariner.io/gateway: 'true'
|
||||
containers:
|
||||
- name: {{ template "submariner.fullname" . }}-globalnet
|
||||
image: {{ .Values.globalnet.image.repository }}:{{ default .Chart.AppVersion .Values.globalnet.image.tag }}
|
||||
imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
|
||||
env:
|
||||
- name: SUBMARINER_CLUSTERID
|
||||
value: '{{ .Values.submariner.clusterId }}'
|
||||
- name: SUBMARINER_EXCLUDENS
|
||||
value: 'submariner-operator,kube-system,operators,openshift-monitoring,openshift-dns'
|
||||
- name: SUBMARINER_NAMESPACE
|
||||
value: '{{ .Release.Namespace }}'
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: "spec.nodeName"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- ALL
|
||||
privileged: true
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: false
|
||||
volumeMounts:
|
||||
# Because we don't actually run iptables locally, but chroot in to the host
|
||||
- mountPath: /host
|
||||
name: host-slash
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: host-slash
|
||||
hostPath:
|
||||
path: /
|
||||
{{- end }}
|
||||
@@ -1,74 +0,0 @@
|
||||
{{- if .Values.submariner.serviceDiscovery }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "submariner.lighthouseDnsName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.lighthouseDnsName" . }}
|
||||
component: lighthouse-coredns
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "submariner.lighthouseDnsName" . }}
|
||||
replicas: 2
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "submariner.lighthouseDnsName" . }}
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- -conf
|
||||
- /etc/coredns/Corefile
|
||||
image: {{ .Values.lighthouseCoredns.image.repository }}:{{ default .Chart.AppVersion .Values.lighthouseCoredns.image.tag }}
|
||||
imagePullPolicy: {{ .Values.lighthouseCoredns.image.pullPolicy }}
|
||||
name: {{ template "submariner.lighthouseDnsName" . }}
|
||||
volumeMounts:
|
||||
- mountPath: /etc/coredns
|
||||
name: config-volume
|
||||
readOnly: true
|
||||
serviceAccountName: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
|
||||
volumes:
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: Corefile
|
||||
path: Corefile
|
||||
name: {{ template "submariner.lighthouseDnsName" . }}
|
||||
name: config-volume
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "submariner.lighthouseDnsName" . }}
|
||||
labels:
|
||||
app: {{ template "submariner.lighthouseDnsName" . }}
|
||||
spec:
|
||||
ports:
|
||||
- name: udp
|
||||
port: 53
|
||||
protocol: UDP
|
||||
targetPort: 53
|
||||
selector:
|
||||
app: {{ template "submariner.lighthouseDnsName" . }}
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "submariner.lighthouseDnsName" . }}
|
||||
data:
|
||||
Corefile: |
|
||||
clusterset.local:53 {
|
||||
{{- if .Values.submariner.debug }}
|
||||
log
|
||||
{{- end }}
|
||||
lighthouse
|
||||
errors
|
||||
health
|
||||
ready
|
||||
}
|
||||
{{- end }}
|
||||
@@ -1,55 +0,0 @@
|
||||
{{- if .Values.submariner.serviceDiscovery }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}-lighthouse-agent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.fullname" . }}-lighthouse-agent
|
||||
component: lighthouse
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "submariner.fullname" . }}-lighthouse-agent
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "submariner.fullname" . }}-lighthouse-agent
|
||||
spec:
|
||||
serviceAccountName: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
|
||||
containers:
|
||||
- command:
|
||||
- lighthouse-agent.sh
|
||||
env:
|
||||
- name: SUBMARINER_NAMESPACE
|
||||
value: "{{ .Release.Namespace }}"
|
||||
- name: SUBMARINER_CLUSTERID
|
||||
value: "{{ .Values.submariner.clusterId }}"
|
||||
- name: SUBMARINER_DEBUG
|
||||
value: "{{ .Values.submariner.debug }}"
|
||||
{{- if .Values.broker.globalnet }}
|
||||
- name: SUBMARINER_GLOBALNET_ENABLED
|
||||
value: "true"
|
||||
{{- end }}
|
||||
- name: BROKER_K8S_APISERVER
|
||||
value: "{{ .Values.broker.server }}"
|
||||
- name: BROKER_K8S_APISERVERTOKEN
|
||||
value: "{{ .Values.broker.token }}"
|
||||
- name: BROKER_K8S_REMOTENAMESPACE
|
||||
value: "{{ .Values.broker.namespace }}"
|
||||
{{- if .Values.broker.insecure }}
|
||||
- name: BROKER_K8S_INSECURE
|
||||
value: "true"
|
||||
{{- else }}
|
||||
- name: BROKER_K8S_CA
|
||||
value: "{{ .Values.broker.ca }}"
|
||||
{{- end }}
|
||||
name: {{ template "submariner.fullname" . }}-lighthouse-agent
|
||||
image: {{ .Values.lighthouse.image.repository }}:{{ default .Chart.AppVersion .Values.lighthouse.image.tag }}
|
||||
imagePullPolicy: {{ .Values.lighthouse.image.pullPolicy }}
|
||||
restartPolicy: Always
|
||||
terminationGracePeriodSeconds: 0
|
||||
{{- end }}
|
||||
@@ -1,670 +0,0 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- services/finalizers
|
||||
- endpoints
|
||||
- persistentvolumeclaims
|
||||
- events
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- replicasets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resourceNames:
|
||||
- submariner-operator
|
||||
resources:
|
||||
- deployments/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- servicediscoveries
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- lighthouse.submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- serviceexports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.gatewayServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- services/finalizers
|
||||
- endpoints
|
||||
- persistentvolumeclaims
|
||||
- events
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- replicasets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resourceNames:
|
||||
- submariner-operator
|
||||
resources:
|
||||
- deployments/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- servicediscoveries
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- lighthouse.submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- serviceexports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.routeAgentServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
{{- if .Values.broker.globalnet }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- services/finalizers
|
||||
- endpoints
|
||||
- persistentvolumeclaims
|
||||
- events
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
- daemonsets
|
||||
- replicasets
|
||||
- statefulsets
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- monitoring.coreos.com
|
||||
resources:
|
||||
- servicemonitors
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- apiGroups:
|
||||
- apps
|
||||
resourceNames:
|
||||
- submariner-operator
|
||||
resources:
|
||||
- deployments/finalizers
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- replicasets
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- servicediscoveries
|
||||
verbs:
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- lighthouse.submariner.io
|
||||
resources:
|
||||
- '*'
|
||||
- serviceexports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.globalnetServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
{{- end -}}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- apiGroups: # pods and services are looked up to figure out network settings
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- operator.openshift.io
|
||||
resources:
|
||||
- dnses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- config.openshift.io
|
||||
resources:
|
||||
- networks
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- endpoints
|
||||
- gateways
|
||||
- clusters
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:gateway
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.gatewayServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- apiGroups: # pods and services are looked up to figure out network settings
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- operator.openshift.io
|
||||
resources:
|
||||
- dnses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- config.openshift.io
|
||||
resources:
|
||||
- networks
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
resources:
|
||||
- nodes
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:routeagent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.routeAgentServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
{{- if .Values.broker.globalnet }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- namespaces
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- endpoints
|
||||
- clusters
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- multicluster.x-k8s.io
|
||||
resources:
|
||||
- "serviceexports"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
{{- end -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:globalnet
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.globalnetServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
{{- if .Values.submariner.serviceDiscovery }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-agent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- namespaces
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- "gateways"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- multicluster.x-k8s.io
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-agent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-agent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- namespaces
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- lighthouse.submariner.io
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- apiGroups:
|
||||
- submariner.io
|
||||
resources:
|
||||
- "gateways"
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- multicluster.x-k8s.io
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -1,82 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ template "submariner.fullname" . }}-routeagent
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.fullname" . }}-routeagent
|
||||
component: routeagent
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "submariner.fullname" . }}-routeagent
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: "100%"
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.fullname" . }}-routeagent
|
||||
component: routeagent
|
||||
spec:
|
||||
serviceAccountName: {{ template "submariner.routeAgentServiceAccountName" . }}
|
||||
terminationGracePeriodSeconds: 1
|
||||
hostNetwork: true
|
||||
containers:
|
||||
- name: routeagent
|
||||
command:
|
||||
- submariner-route-agent.sh
|
||||
image: {{ .Values.routeAgent.image.repository }}:{{ default .Chart.AppVersion .Values.routeAgent.image.tag }}
|
||||
imagePullPolicy: {{ .Values.routeAgent.image.pullPolicy }}
|
||||
env:
|
||||
- name: SUBMARINER_NAMESPACE
|
||||
value: "{{ .Release.Namespace }}"
|
||||
- name: SUBMARINER_CLUSTERID
|
||||
value: "{{ .Values.submariner.clusterId }}"
|
||||
- name: SUBMARINER_DEBUG
|
||||
value: "{{ .Values.submariner.debug }}"
|
||||
- name: SUBMARINER_CLUSTERCIDR
|
||||
value: "{{ .Values.submariner.clusterCidr }}"
|
||||
- name: SUBMARINER_SERVICECIDR
|
||||
value: "{{ .Values.submariner.serviceCidr }}"
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: "spec.nodeName"
|
||||
resources:
|
||||
{{ toYaml .Values.routeAgent.resources | indent 10 }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- ALL
|
||||
privileged: true
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: false
|
||||
volumeMounts:
|
||||
# Because we don't actually run iptables locally, but chroot in to the host
|
||||
- mountPath: /host
|
||||
name: host-slash
|
||||
readOnly: true
|
||||
{{- with .Values.routeAgent.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.routeAgent.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.routeAgent.affinity }}
|
||||
affinity:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: host-slash
|
||||
hostPath:
|
||||
path: /
|
||||
@@ -1,59 +0,0 @@
|
||||
{{- if .Values.serviceAccounts.gateway.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.gatewayServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.routeAgent.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.routeAgentServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.globalnet.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.globalnetServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.lighthouseAgent.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
|
||||
labels:
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
release: {{ .Release.Name | quote }}
|
||||
chart: {{ template "submariner.chart" . }}
|
||||
app: {{ template "submariner.name" . }}
|
||||
{{- end }}
|
||||
@@ -1,84 +0,0 @@
|
||||
---
|
||||
submariner:
|
||||
clusterId: ""
|
||||
token: ""
|
||||
clusterCidr: "10.42.0.0/16"
|
||||
serviceCidr: "10.43.0.0/16"
|
||||
globalCidr: ""
|
||||
natEnabled: false
|
||||
colorCodes: blue
|
||||
debug: false
|
||||
serviceDiscovery: false
|
||||
cableDriver: "libreswan"
|
||||
crd:
|
||||
create: true
|
||||
broker:
|
||||
type: k8s
|
||||
server: example.k8s.apiserver
|
||||
token: test
|
||||
namespace: xyz
|
||||
insecure: false
|
||||
ca: ""
|
||||
globalnet: false
|
||||
rbac:
|
||||
create: true
|
||||
ipsec:
|
||||
psk: ""
|
||||
debug: false
|
||||
ikePort: 500
|
||||
natPort: 4500
|
||||
leadership:
|
||||
leaseDuration: 10
|
||||
renewDeadline: 5
|
||||
retryPeriod: 2
|
||||
gateway:
|
||||
image:
|
||||
repository: quay.io/submariner/submariner-gateway
|
||||
tag: ""
|
||||
pullPolicy: IfNotPresent
|
||||
resources: {}
|
||||
nodeSelectorEnabled: true
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
routeAgent:
|
||||
image:
|
||||
repository: quay.io/submariner/submariner-route-agent
|
||||
tag: ""
|
||||
pullPolicy: IfNotPresent
|
||||
resources: {}
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
globalnet:
|
||||
image:
|
||||
repository: quay.io/submariner/submariner-globalnet
|
||||
tag: ""
|
||||
pullPolicy: IfNotPresent
|
||||
lighthouse:
|
||||
image:
|
||||
repository: quay.io/submariner/lighthouse-agent
|
||||
tag: ""
|
||||
pullPolicy: IfNotPresent
|
||||
lighthouseCoredns:
|
||||
name: ""
|
||||
image:
|
||||
repository: quay.io/submariner/lighthouse-coredns
|
||||
tag: ""
|
||||
pullPolicy: IfNotPresent
|
||||
serviceAccounts:
|
||||
gateway:
|
||||
create: true
|
||||
name: ""
|
||||
routeAgent:
|
||||
create: true
|
||||
name: ""
|
||||
globalnet:
|
||||
create: true
|
||||
name: ""
|
||||
lighthouseAgent:
|
||||
create: true
|
||||
name: ""
|
||||
lighthouseCoreDns:
|
||||
create: true
|
||||
name: ""
|
||||
Reference in New Issue
Block a user