initial commit, adding v0.0.1 helm charts

submariner-k8s-broker/.helmignore

@@ -0,0 +1 @@
+.git

submariner-k8s-broker/Chart.yaml

@@ -0,0 +1,11 @@
+name: submariner-k8s-broker
+version: 0.0.1
+appVersion: 0.0.1
+description: Submariner Kubernetes Broker
+keywords:
+home: https://submariner.io/
+sources:
+- https://github.com/rancher/submariner-charts
+maintainers:
+- name: Chris Kim
+  email: chris.kim@rancher.com

submariner-k8s-broker/app-readme.md

@@ -0,0 +1,5 @@
+# Submariner Kubernetes Broker
+
+[Submariner](https://submariner.io) is a cross-cluster networking tool.
+
+This chart creates a service account and role/role binding for use by Submariner to share cluster/endpoint information between clusters.

submariner-k8s-broker/questions.yml

@@ -0,0 +1,19 @@
+questions:
+- variable: submariner-k8s-broker.rbac.create
+  type: boolean
+  default: true
+  group: "Role Based Access Control"
+  description: "Create the role/rolebinding for the Submariner client"
+  label: "RBAC Creation Enabled"
+- variable: submariner-k8s-broker.crd.create
+  type: boolean
+  default: true
+  group: "Submariner CRD"
+  description: "Create the submariner CRDs for the Submariner client"
+  label: "Submariner CRD Creation Enabled"
+- variable: submariner-k8s-broker.serviceAccounts.client.create
+  type: boolean
+  default: true
+  group: "Service Account"
+  description: "Create the service account for the Submariner client"
+  label: "Submariner Service Account Creation Enabled"

submariner-k8s-broker/templates/NOTES.txt

@@ -0,0 +1,9 @@
+The Submariner Kubernetes Broker is now setup.
+
+You can retrieve the server URL by running
+
+  $ SUBMARINER_BROKER_URL=$(kubectl -n default get endpoints kubernetes -o jsonpath="{.subsets[0].addresses[0].ip}:{.subsets[0].ports[0].port}")
+
+The broker client token can be retrieved by running
+
+  $ SUBMARINER_BROKER_TOKEN=$(kubectl -n {{ .Release.Namespace }} get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='{{ template "submariner-k8s-broker.clientServiceAccountName" . }}')].data.token}"|base64 --decode)

submariner-k8s-broker/templates/_helpers.tpl

@@ -0,0 +1,43 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "submariner-k8s-broker.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "submariner-k8s-broker.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "submariner-k8s-broker.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-client service account to use
+*/}}
+{{- define "submariner-k8s-broker.clientServiceAccountName" -}}
+{{- if .Values.serviceAccounts.client.create -}}
+    {{ default (printf "%s-client" (include "submariner-k8s-broker.fullname" .)) .Values.serviceAccounts.client.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.client.name }}
+{{- end -}}
+{{- end -}}

submariner-k8s-broker/templates/crd.yaml

@@ -0,0 +1,29 @@
+{{- if .Values.crd.create -}}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: clusters.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Cluster
+    plural: clusters
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: endpoints.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Endpoint
+    plural: endpoints
+  scope: Namespaced
+{{- end -}}

submariner-k8s-broker/templates/rbac.yaml

@@ -0,0 +1,28 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner-k8s-broker.fullname" . }}:client
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner-k8s-broker.chart" . }}
+    app: {{ template "submariner-k8s-broker.name" . }}
+rules:
+- apiGroups: ["submariner.io"]
+  resources: ["clusters", "endpoints"]
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner-k8s-broker.fullname" . }}:client
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner-k8s-broker.fullname" . }}:client
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner-k8s-broker.clientServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end -}}

submariner-k8s-broker/templates/svc-acct.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.serviceAccounts.client.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner-k8s-broker.clientServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner-k8s-broker.chart" . }}
+    app: {{ template "submariner-k8s-broker.name" . }}
+{{- end }}

submariner-k8s-broker/values.yaml

@@ -0,0 +1,8 @@
+rbac:
+  create: true
+crd:
+  create: true
+serviceAccounts:
+  client:
+    create: true
+    name: ""

submariner/.helmignore

@@ -0,0 +1 @@
+.git

submariner/Chart.yaml

@@ -0,0 +1,11 @@
+name: submariner
+version: 0.0.1
+appVersion: 0.0.1
+description: Submariner
+keywords:
+home: https://submariner.io/
+sources:
+- https://github.com/rancher/submariner-charts
+maintainers:
+- name: Chris Kim
+  email: chris.kim@rancher.com

submariner/app-readme.md

@@ -0,0 +1,5 @@
+# Submariner
+
+[Submariner](https://submariner.io) is a cross-cluster networking tool.
+
+This chart creates the required components in this cluster to enable cross cluster networking.

submariner/questions.yml

@@ -0,0 +1,132 @@
+questions:
+- variable: defaultEngineImage
+  default: true
+  description: "Use default Submariner Engine image or specify a custom one"
+  label: Use default submariner engine image
+  type: boolean
+  show_subquestion_if: false
+  group: "Container Images"
+  subquestions:
+  - variable: engine.image.repository
+    default: "oats87/submariner-engine"
+    description: "Submariner Engine Image Repository"
+    type: string
+    label: Submariner Engine Image Repository
+  - variable: engine.image.tag
+    default: "dev"
+    description: "Submariner Engine Image Tag"
+    type: string
+    label: Submariner Engine Image Tag
+- variable: defaultRouteAgentImage
+  default: true
+  description: "Use default Submariner Route Agent image or specify a custom one"
+  label: Use default submariner route agent image
+  type: boolean
+  show_subquestion_if: false
+  group: "Container Images"
+  subquestions:
+  - variable: routeAgent.image.repository
+    default: "oats87/submariner-route-agent"
+    description: "Submariner Route Agent Image Repository"
+    type: string
+    label: Submariner Route Agent Image Repository
+  - variable: routeAgent.image.tag
+    default: "dev"
+    description: "Submariner Route Agent Image Tag"
+    type: string
+    label: Submariner Route Agent Image Tag
+- variable: engine.nodeSelectorEnabled
+  default: true
+  description: "Restrict submariner to nodes labeled with submariner.io/gateway=true"
+  label: Restrict gateway deployments to specific nodes
+  type: boolean
+  group: "Gateway Configuration"
+- variable: submariner.clusterId
+  default: ""
+  description: "Enter a unique cluster ID to identify this cluster"
+  type: string
+  label: "Cluster ID"
+  group: "Configuration"
+  required: true
+- variable: ipsec.psk
+  default: ""
+  description: "Enter the pre-shared key for the IPsec Cable Engine"
+  type: string
+  label: "IPsec Pre-Shared Key"
+  group: "Configuration"
+  required: true
+- variable: broker.type
+  type: enum
+  default: k8s
+  options:
+    - k8s
+  group: "Broker Configuration"
+  label: "Broker Type"
+  description: "Type of Broker to use"
+- variable: broker.server
+  type: string
+  default: ""
+  group: "Broker Configuration"
+  label: "Broker Server"
+  description: "Broker server to use (without the https://)"
+- variable: broker.insecure
+  type: bool
+  default: false
+  show_subquestion_if: false
+  group: "Broker Configuration"
+  label: "Insecure Broker"
+  description: "Connect to K8s broker without validating CA"
+  subquestions:
+  - variable: broker.ca
+    type: string
+    description: "Base64 encoded broker ca.crt"
+    label: "Broker CA encoded in base64"
+    default: ""
+- variable: broker.token
+  type: string
+  group: "Broker Configuration"
+  label: "Broker Token"
+  description: "Bearer token for broker"
+- variable: broker.namespace
+  type: string
+  group: "Broker Configuration"
+  label: "Broker Namespace"
+  description: "Enter namespace to use on central broker"
+- variable: submariner.clusterCidr
+  default: ""
+  description: "Enter the cluster CIDR (i.e. 10.42.0.0/16) for this cluster"
+  type: string
+  label: "Cluster CIDR"
+  group: "CIDR Configuration"
+  required: true
+- variable: submariner.serviceCidr
+  default: ""
+  description: "Enter the service CIDR (i.e. 10.43.0.0/16) for this cluster"
+  type: string
+  label: "Service CIDR"
+  group: "CIDR Configuration"
+  required: true
+- variable: submariner.natEnabled
+  type: boolean
+  default: false
+  group: "Advanced Configuration"
+  description: "If the gateway nodes for this cluster are behind 1:1 NAT, you should enable NAT"
+  label: "NAT Enabled"
+- variable: crd.create
+  type: boolean
+  default: true
+  group: "Advanced Configuration"
+  description: "Create the Submariner CRDs, if deploying Submariner into the same cluster as the submariner-k8s-broker, you probably shouldn't create CRDs"
+  label: "CRD Creation Enabled"
+- variable: submariner.debug
+  type: boolean
+  default: false
+  group: "Advanced Configuration"
+  description: "Enable submariner debug mode"
+  label: "Submariner Debug Enabled"
+- variable: ipsec.debug
+  type: boolean
+  default: false
+  group: "Advanced Configuration"
+  description: "Enable Charon debug mode"
+  label: "Charon Enabled"

submariner/templates/NOTES.txt

@@ -0,0 +1,7 @@
+Submariner is now installed.
+
+{{- if .Values.engine.nodeSelectorEnabled }}
+If you haven't done so yet, please label a node as `submariner.io/gateway=true` to elect it for running Submariner.
+{{- end }}
+
+By default, Submariner runs with 1 replica. If you have more than one Gateway host, you can scale Submariner to N replicas, and the other Submariner pods will simply join the leader election pool.

submariner/templates/_helpers.tpl

@@ -0,0 +1,54 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "submariner.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "submariner.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "submariner.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-engine service account to use
+*/}}
+{{- define "submariner.engineServiceAccountName" -}}
+{{- if .Values.serviceAccounts.engine.create -}}
+    {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.engine.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-route-agent service account to use
+*/}}
+{{- define "submariner.routeAgentServiceAccountName" -}}
+{{- if .Values.serviceAccounts.routeAgent.create -}}
+    {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.routeAgent.name }}
+{{- end -}}
+{{- end -}}

submariner/templates/crd.yaml

@@ -0,0 +1,29 @@
+{{- if .Values.crd.create -}}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: clusters.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Cluster
+    plural: clusters
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: endpoints.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Endpoint
+    plural: endpoints
+  scope: Namespaced
+{{- end -}}

submariner/templates/engine-deploy.yaml

@@ -0,0 +1,123 @@
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.fullname" . }}-engine
+    component: engine
+  name: {{ template "submariner.fullname" . }}
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 5
+  selector:
+    matchLabels:
+      app: {{ template "submariner.fullname" . }}-engine
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+    type: RollingUpdate
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: {{ template "submariner.fullname" . }}-engine
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - {{ template "submariner.fullname" . }}-engine
+            topologyKey: "kubernetes.io/hostname"
+{{- with .Values.engine.affinity }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+      nodeSelector:
+{{- if .Values.engine.nodeSelectorEnabled }}
+        submariner.io/gateway: "true"
+{{- end }}
+{{- with .Values.engine.nodeSelector }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- with .Values.engine.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+{{- end }}
+      containers:
+      - command:
+        - submariner.sh
+        env:
+        - name: SUBMARINER_NAMESPACE
+          value: "{{ .Release.Namespace }}"
+        - name: SUBMARINER_CLUSTERCIDR
+          value: "{{ .Values.submariner.clusterCidr }}"
+        - name: SUBMARINER_SERVICECIDR
+          value: "{{ .Values.submariner.serviceCidr }}"
+        - name: SUBMARINER_TOKEN
+          value: "{{ .Values.submariner.apiToken }}"
+        - name: SUBMARINER_CLUSTERID
+          value: "{{ .Values.submariner.clusterId }}"
+        - name: SUBMARINER_COLORCODES
+          value: "{{ .Values.submariner.colorCodes }}"
+        - name: SUBMARINER_DEBUG
+          value: "{{ .Values.submariner.debug }}"
+        - name: SUBMARINER_NATENABLED
+          value: "{{ .Values.submariner.natEnabled }}"
+        - name: SUBMARINER_BROKER
+          value: "{{ .Values.broker.type }}"
+{{- if eq .Values.broker.type "phpapi" }}
+        - name: BROKER_PHPAPI_PROTO
+          value: "{{ .Values.broker.proto }}"
+        - name: BROKER_PHPAPI_SERVER
+          value: "{{ .Values.broker.server }}"
+{{- end }}
+{{- if eq .Values.broker.type "k8s" }}
+        - name: BROKER_K8S_APISERVER
+          value: "{{ .Values.broker.server }}"
+        - name: BROKER_K8S_APISERVERTOKEN
+          value: "{{ .Values.broker.token }}"
+        - name: BROKER_K8S_REMOTENAMESPACE
+          value: "{{ .Values.broker.namespace }}"
+{{- if .Values.broker.insecure }}
+        - name: BROKER_K8S_INSECURE
+          value: "true"
+{{- else }}
+        - name: BROKER_K8S_CA
+          value: "{{ .Values.broker.ca }}"
+{{- end }}
+{{- end }}
+        - name: CE_IPSEC_PSK
+          value: "{{ .Values.ipsec.psk }}"
+        - name: CE_IPSEC_DEBUG
+          value: "{{ .Values.ipsec.debug }}"
+        image: {{ .Values.engine.image.repository }}:{{ .Values.engine.image.tag }}
+        imagePullPolicy: {{ .Values.engine.image.pullPolicy }}
+        name: submariner
+        resources:
+{{ toYaml .Values.engine.resources | indent 10 }}
+        securityContext:
+          allowPrivilegeEscalation: true
+          capabilities:
+            add:
+            - ALL
+          privileged: true
+          readOnlyRootFilesystem: false
+          runAsNonRoot: false
+        stdin: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        tty: true
+      dnsPolicy: ClusterFirst
+      hostNetwork: true
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 0
+      serviceAccountName: {{ template "submariner.engineServiceAccountName" . }}

submariner/templates/rbac.yaml

@@ -0,0 +1,61 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create", "get", "list", "watch", "patch", "update"]
+- apiGroups: ["submariner.io"]
+  resources: ["clusters", "endpoints"]
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["create", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+- apiGroups: ["submariner.io"]
+  resources: ["clusters", "endpoints"]
+  verbs: ["create", "get", "list", "watch", "patch", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:engine
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.engineServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:routeagent
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end -}}

submariner/templates/route-agent-ds.yaml

@@ -0,0 +1,61 @@
+apiVersion: apps/v1beta2
+kind: DaemonSet
+metadata:
+  name: {{ template "submariner.fullname" . }}-routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.fullname" . }}-routeagent
+    component: routeagent
+spec:
+  selector:
+    matchLabels:
+      app: {{ template "submariner.fullname" . }}-routeagent
+  template:
+    metadata:
+      labels:
+        heritage: {{ .Release.Service | quote }}
+        release: {{ .Release.Name | quote }}
+        chart: {{ template "submariner.chart" . }}
+        app: {{ template "submariner.fullname" . }}-routeagent
+        component: routeagent
+    spec:
+      serviceAccountName: {{ template "submariner.routeAgentServiceAccountName" . }}
+      terminationGracePeriodSeconds: 0
+      hostNetwork: true
+      containers:
+      - name: routeagent
+        command:
+        - submariner-route-agent.sh
+        image: {{ .Values.routeAgent.image.repository }}:{{ .Values.routeAgent.image.tag }}
+        imagePullPolicy: {{ .Values.routeAgent.image.pullPolicy }}
+        env:
+        - name: SUBMARINER_NAMESPACE
+          value: "{{ .Release.Namespace }}"
+        - name: SUBMARINER_CLUSTERID
+          value: "{{ .Values.submariner.clusterId }}"
+        - name: SUBMARINER_DEBUG
+          value: "{{ .Values.submariner.debug }}"
+        resources:
+{{ toYaml .Values.routeAgent.resources | indent 10 }}
+        securityContext:
+          allowPrivilegeEscalation: true
+          capabilities:
+            add:
+            - ALL
+          privileged: true
+          readOnlyRootFilesystem: false
+          runAsNonRoot: false
+{{- with .Values.routeAgent.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- with .Values.routeAgent.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- with .Values.routeAgent.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+{{- end }}

submariner/templates/svc-acct.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.serviceAccounts.engine.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.engineServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+{{- end }}
+---
+{{- if .Values.serviceAccounts.routeAgent.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+{{- end }}

submariner/values.yaml

@@ -0,0 +1,54 @@
+submariner:
+  clusterId: ""
+  token: ""
+  clusterCidr: "10.42.0.0/16"
+  serviceCidr: "10.43.0.0/16"
+  natEnabled: false
+  colorCodes: blue
+  debug: false
+crd:
+  create: true
+broker:
+  type: k8s
+  server: example.k8s.apiserver
+  token: test
+  namespace: xyz
+  insecure: false
+  ca: ""
+rbac:
+  create: true
+ipsec:
+  psk: ""
+  debug: false
+engine:
+  image:
+    repository: rancher/submariner
+    tag: v0.0.1
+    pullPolicy: Always
+  resources: {}
+    # limits:
+    # cpu: 100m
+  # memory: 100Mi
+  nodeSelectorEnabled: true
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+routeAgent:
+  image:
+    repository: rancher/submariner-route-agent
+    tag: v0.0.1
+    pullPolicy: Always
+  resources: {}
+    # limits:
+  # cpu: 100m
+  # memory: 100Mi
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+serviceAccounts:
+  engine:
+    create: true
+    name: ""
+  routeAgent:
+    create: true
+    name: ""