Install gateway CRD on broker

If crd.create is set to false when installing submariner on same cluster
as broker, gateways CRD never gets installed because it is missing from
broker charts. This change is to install the CRD even on broker, as a
cleaner alternative to adding more flags.

Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>

.github/workflows/dco-check.yml

@@ -0,0 +1,17 @@
+name: DCO Check
+on: pull_request
+
+jobs:
+  dco:
+    runs-on: ubuntu-latest
+    name: DCO Check
+    steps:
+    - name: Get PR Commits
+      id: 'get-pr-commits'
+      uses: tim-actions/get-pr-commits@master
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+    - name: DCO Check
+      uses: tim-actions/dco@master
+      with:
+        commits: ${{ steps.get-pr-commits.outputs.commits }}

.gitignore

@@ -0,0 +1,2 @@
+.idea
+*.tgz

.travis.yml

@@ -0,0 +1,47 @@
+language: python
+
+env:
+  global:
+    - HELM_URL=https://storage.googleapis.com/kubernetes-helm
+    - HELM_TGZ=helm-v2.14.3-linux-amd64.tar.gz
+    - TARGET_BR=gh-pages
+    - GH_URL=https://submariner-io.github.io/submariner-charts/charts
+    - CHARTS_DIR=charts
+    - YAMLLINT_VERSION=1.17.0
+    - HELM_FLAGS='--set submariner.serviceDiscovery=true,serviceAccounts.globalnet.create=true,globalCidr="169.254.0.0/16"'
+
+install:
+  - wget -q ${HELM_URL}/${HELM_TGZ}
+  - tar xzfv ${HELM_TGZ}
+  - PATH=`pwd`/linux-amd64/:$PATH
+  - helm init --client-only
+  - sudo pip install yamllint=="${YAMLLINT_VERSION}"
+
+script:
+  - for dir in submariner submariner-k8s-broker; do helm lint $dir $HELM_FLAGS; done
+  - yamllint -c .yamllint.yml -s $(find . -type f -name "Chart.yaml")
+  - yamllint -c .yamllint.yml -s $(find . -type f -name "values.yaml")
+
+after_success:
+  - >
+    if [ $TRAVIS_BRANCH = 'master' ] && [ $TRAVIS_PULL_REQUEST = 'false' ]; then
+      set -e
+      for dir in submariner submariner-k8s-broker; do
+        helm dep update $dir
+        helm package $dir
+      done
+      REPO_URL=`git config remote.origin.url`
+      git clone ${REPO_URL} out && cd out && git checkout gh-pages && mkdir -p ${CHARTS_DIR}
+      cp -f ../submariner-*.tgz ${CHARTS_DIR}/
+      if [ -f charts/index.yaml ]; then
+        helm repo index ${CHARTS_DIR} --url ${GH_URL} --merge index.yaml
+      else
+        helm repo index ${CHARTS_DIR} --url ${GH_URL}
+      fi
+      git config user.name "Travis CI"
+      git config user.email "travis@travis-ci.org"
+      git add -f ${CHARTS_DIR}/*
+      git commit -m "Travis build: $TRAVIS_BUILD_NUMBER"
+      git remote add origin-pages https://${GH_TOKEN}@github.com/submariner-io/submariner-charts.git > /dev/null 2>&1
+      git push --quiet -f -u origin-pages gh-pages
+    fi

.yamllint.yml

@@ -0,0 +1,15 @@
+---
+extends: default
+rules:
+  comments: disable
+  comments-indentation: disable
+  line-length:
+    max: 150
+  braces:
+    min-spaces-inside: 0
+    max-spaces-inside: 0
+  brackets:
+    min-spaces-inside: 0
+    max-spaces-inside: 0
+  indentation:
+    indent-sequences: consistent

CODEOWNERS

@@ -0,0 +1 @@
+* @mangelajo @tpantelis @Oats87

README.md

@@ -1,3 +1,116 @@
 # submariner-charts
 
-Please see https://github.com/rancher/submariner for more information. This is only a supporting repository for Submariner
+Please see https://github.com/submariner-io/submariner for more information. This is only a supporting repository for Submariner
+
+# Dev workflow.
+
+### Prerequisites
+
+- [helm]
+- [docker] or [podman]
+
+### Create a fork and checkout.
+
+[Create a fork] of the original repository, clone it locally and checkout a new branch from master. 
+
+Example:
+
+```bash
+git clone https://github.com/myuser/submariner-charts.git
+cd submariner-charts
+git checkout -b new-feature
+```
+
+Now you can modify the helm charts according to your needs.
+
+### Serve the modified charts
+
+Before serving the modified charts, the charts must be packaged for local usage.
+
+```bash
+helm package ./submariner
+helm package ./submariner-k8s-broker
+```
+Note: if you just installed helm, you have to init the helm, by running
+```bash
+helm init --client-only
+```
+ 
+
+
+Serve the packaged charts through a local helm repository:
+
+```bash
+docker run -d --rm --name helm-repo -p 8080:8080 -v $PWD:/charts -e DEBUG=true -e STORAGE=local -e STORAGE_LOCAL_ROOTDIR=/charts chartmuseum/chartmuseum
+```
+
+or 
+ 
+```bash
+sudo podman run -d --rm --name helm-repo -p 8080:8080 -v $PWD:/charts -e DEBUG=true -e STORAGE=local -e STORAGE_LOCAL_ROOTDIR=/charts chartmuseum/chartmuseum
+```
+
+Get the container internal ip:
+
+```bash
+docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo
+```
+
+The local container will serve the charts locally on port 8080.
+
+Get logs for the container:
+
+```bash
+docker logs -f helm-repo
+```
+
+### Use the modified charts
+
+Init helm
+
+```bash
+helm init --client-only
+```
+
+Add your local repository to helm
+
+```bash
+internal_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo)
+helm repo add test-repo http://$internal_ip:8080
+```
+
+List the repos:
+
+```bash
+helm repo list
+```
+
+You should be able to see test-repo in the list
+
+Search the new repo for submariner charts:
+
+```bash
+helm search -l test-repo
+```
+
+### Modify submariner e2e tests helm deployment script to use your local test-repo.
+
+You can test your helm-charts with e2e tests from the [shipyard](https://github.com/submariner-io/shipyard) repository.
+In the file `scripts/shared/lib/deploy_helm` change the line from:
+
+```bash
+helm repo add submariner-latest https://submariner-io.github.io/submariner-charts/charts
+```
+
+to 
+
+```bash
+internal_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo)
+helm repo add submariner-latest http://$internal_ip:8080
+```
+
+<!--links-->
+[helm]: https://helm.sh/docs/using_helm/#installing-helm
+[docker]: https://docs.docker.com/install/
+[podman]: https://podman.io/getting-started/installation
+[Create a fork]: https://help.github.com/en/articles/fork-a-repo

submariner-k8s-broker/Chart.yaml

@@ -1,11 +1,12 @@
+---
 name: submariner-k8s-broker
-version: 0.0.1
-appVersion: v0.0.1
+version: 0.4.1
+appVersion: 0.4.1
 description: Submariner Kubernetes Broker
 keywords:
-home: https://submariner.io/
+home: https://submariner-io.github.io/
 sources:
-- https://github.com/rancher/submariner-charts
+- https://submariner-io.github.io/submariner-charts/charts
 maintainers:
-- name: Rancher Labs
-  email: charts@rancher.com
+- name: Submariner Developers
+  email: submariner-dev@googlegroups.com

submariner-k8s-broker/templates/crd.yaml

@@ -26,4 +26,85 @@ spec:
     kind: Endpoint
     plural: endpoints
   scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: gateways.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Gateway
+    plural: gateways
+  scope: Namespaced
+  additionalPrinterColumns:
+    - name: ha-status
+      type: string
+      description: High Availability Status of the Gateway
+      JSONPath: .status.haStatus
+---
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: multiclusterservices.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v1
+  names:
+    kind: MultiClusterService
+    plural: multiclusterservices
+    singular: multiclusterservice
+  scope: Namespaced
+  validation:
+    openAPIV3Schema:
+      properties:
+        spec:
+          properties:
+            clusterServiceInfo:
+              properties:
+                clusterID:
+                  type: "string"
+                clusterDomain:
+                  type: "string"
+                serviceIP:
+                  type: "string"
+                port:
+                  type: "integer"
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceExport
+    plural: serviceexports
+    singular: serviceexport
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceImport
+    plural: serviceimports
+    singular: serviceimport
+  scope: Namespaced
+{{- end -}}
 {{- end -}}

submariner-k8s-broker/templates/rbac.yaml

@@ -12,6 +12,9 @@ rules:
 - apiGroups: ["submariner.io"]
   resources: ["clusters", "endpoints"]
   verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+- apiGroups: ["lighthouse.submariner.io"]
+  resources: ["*"]
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

submariner-k8s-broker/values.yaml

@@ -1,3 +1,4 @@
+---
 rbac:
   create: true
 crd:
@@ -5,4 +6,6 @@ crd:
 serviceAccounts:
   client:
     create: true
-    name: ""
+    name: ""
+submariner:
+  serviceDiscovery: false

submariner/Chart.yaml

@@ -1,11 +1,12 @@
+---
 name: submariner
-version: 0.0.1
-appVersion: v0.0.1
-description: Submariner
+version: 0.4.0
+appVersion: 0.4.0
+description: Submariner enables direct networking between Pods and Services in different Kubernetes clusters
 keywords:
-home: https://submariner.io/
+home: https://submariner-io.github.io/
 sources:
-- https://github.com/rancher/submariner-charts
+  - https://submariner-io.github.io/submariner-charts/charts
 maintainers:
-- name: Rancher Labs
-  email: charts@rancher.com
+  - name: Submariner Developers
+    email: submariner-dev@googlegroups.com

submariner/questions.yml

@@ -13,7 +13,7 @@ questions:
     type: string
     label: Submariner Engine Image Repository
   - variable: engine.image.tag
-    default: "v0.0.1"
+    default: "v0.0.2"
     description: "Submariner Engine Image Tag"
     type: string
     label: Submariner Engine Image Tag
@@ -31,7 +31,7 @@ questions:
     type: string
     label: Submariner Route Agent Image Repository
   - variable: routeAgent.image.tag
-    default: "v0.0.1"
+    default: "v0.0.2"
     description: "Submariner Route Agent Image Tag"
     type: string
     label: Submariner Route Agent Image Tag
@@ -130,3 +130,9 @@ questions:
   group: "Advanced Configuration"
   description: "Enable Charon debug mode"
   label: "Charon Enabled"
+- variable: submariner.cableDriver
+  type: string
+  default: ""
+  group: "Advanced Configuration"
+  description: "Cable driver implementation"
+  label: "Cable Driver"

submariner/templates/_helpers.tpl

@@ -51,4 +51,33 @@ Create the name of the submariner-route-agent service account to use
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.routeAgent.name }}
 {{- end -}}
-{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-globalnet service account to use
+*/}}
+{{- define "submariner.globalnetServiceAccountName" -}}
+{{- if .Values.serviceAccounts.globalnet.create -}}
+    {{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.globalnet.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse service account to use
+*/}}
+{{- define "submariner.lighthouseServiceAccountName" -}}
+{{- if .Values.submariner.serviceDiscovery -}}
+    {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouse.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service name to use
+*/}}
+{{- define "submariner.lighthouseDnsName" -}}
+{{- default (printf "%s-lighthouse-coredns" (include "submariner.fullname" .)) .Values.lighthouseCoredns.name }}
+{{- end -}}

submariner/templates/crd.yaml

@@ -26,4 +26,85 @@ spec:
     kind: Endpoint
     plural: endpoints
   scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: gateways.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Gateway
+    plural: gateways
+  scope: Namespaced
+  additionalPrinterColumns:
+  - name: ha-status
+    type: string
+    description: High Availability Status of the Gateway
+    JSONPath: .status.haStatus
+---
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: multiclusterservices.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v1
+  names:
+    kind: MultiClusterService
+    plural: multiclusterservices
+    singular: multiclusterservice
+  scope: Namespaced
+  validation:
+    openAPIV3Schema:
+      properties:
+        spec:
+          properties:
+            clusterServiceInfo:
+              properties:
+                clusterID:
+                  type: "string"
+                clusterDomain:
+                  type: "string"
+                serviceIP:
+                  type: "string"
+                port:
+                  type: "integer"
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceExport
+    plural: serviceexports
+    singular: serviceexport
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.lighthouse.submariner.io
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceImport
+    plural: serviceimports
+    singular: serviceimport
+  scope: Namespaced
+{{- end }}
 {{- end -}}

submariner/templates/engine-deploy.yaml

@@ -1,5 +1,5 @@
-apiVersion: apps/v1beta2
-kind: Deployment
+apiVersion: apps/v1
+kind: DaemonSet
 metadata:
   labels:
     heritage: {{ .Release.Service | quote }}
@@ -7,18 +7,15 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.fullname" . }}-engine
     component: engine
-  name: {{ template "submariner.fullname" . }}
+  name: {{ template "submariner.fullname" . }}-gateway
 spec:
-  progressDeadlineSeconds: 600
-  replicas: 1
   revisionHistoryLimit: 5
   selector:
     matchLabels:
       app: {{ template "submariner.fullname" . }}-engine
-  strategy:
+  updateStrategy:
     rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
+      maxUnavailable: 1
     type: RollingUpdate
   template:
     metadata:
@@ -60,6 +57,8 @@ spec:
           value: "{{ .Values.submariner.clusterCidr }}"
         - name: SUBMARINER_SERVICECIDR
           value: "{{ .Values.submariner.serviceCidr }}"
+        - name: SUBMARINER_GLOBALCIDR
+          value: "{{ .Values.submariner.globalCidr }}"
         - name: SUBMARINER_TOKEN
           value: "{{ .Values.submariner.apiToken }}"
         - name: SUBMARINER_CLUSTERID
@@ -72,6 +71,8 @@ spec:
           value: "{{ .Values.submariner.natEnabled }}"
         - name: SUBMARINER_BROKER
           value: "{{ .Values.broker.type }}"
+        - name: SUBMARINER_CABLEDRIVER
+          value: "{{ .Values.submariner.cableDriver }}"
 {{- if eq .Values.broker.type "phpapi" }}
         - name: BROKER_PHPAPI_PROTO
           value: "{{ .Values.broker.proto }}"
@@ -97,7 +98,17 @@ spec:
           value: "{{ .Values.ipsec.psk }}"
         - name: CE_IPSEC_DEBUG
           value: "{{ .Values.ipsec.debug }}"
-        image: {{ .Values.engine.image.repository }}:{{ .Values.engine.image.tag }}
+        - name: CE_IPSEC_IKEPORT
+          value: "{{ .Values.ipsec.ikePort }}"
+        - name: CE_IPSEC_NATTPORT
+          value: "{{ .Values.ipsec.natPort }}"
+        - name: LEADERSHIP_LEASEDURATION
+          value: "{{ .Values.leadership.leaseDuration }}"
+        - name: LEADERSHIP_RENEWDEADLINE
+          value: "{{ .Values.leadership.renewDeadline }}"
+        - name: LEADERSHIP_RETRYPERIOD
+          value: "{{ .Values.leadership.retryPeriod }}"
+        image: {{ .Values.engine.image.repository }}:{{ default .Chart.AppVersion .Values.engine.image.tag }}
         imagePullPolicy: {{ .Values.engine.image.pullPolicy }}
         name: submariner
         resources:
@@ -119,5 +130,5 @@ spec:
       restartPolicy: Always
       schedulerName: default-scheduler
       securityContext: {}
-      terminationGracePeriodSeconds: 0
-      serviceAccountName: {{ template "submariner.engineServiceAccountName" . }}
+      terminationGracePeriodSeconds: 1
+      serviceAccountName: {{ template "submariner.engineServiceAccountName" . }}

submariner/templates/globalnet.yaml

@@ -0,0 +1,59 @@
+{{- if ne .Values.submariner.globalCidr "" }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ template "submariner.fullname" . }}-globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.fullname" . }}-globalnet
+    component: globalnet
+spec:
+  selector:
+    matchLabels:
+      app: {{ template "submariner.fullname" . }}-globalnet
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: {{ template "submariner.fullname" . }}-globalnet
+    spec:
+      hostNetwork: true
+      serviceAccountName: submariner-globalnet
+      serviceAccount: submariner-globalnet
+      terminationGracePeriodSeconds: 2
+      nodeSelector:
+        submariner.io/gateway: 'true'
+      containers:
+        - name: {{ template "submariner.fullname" . }}-globalnet
+          image: {{ .Values.globalnet.image.repository }}:{{  default .Chart.AppVersion .Values.globalnet.image.tag }}
+          imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
+          env:
+            - name: SUBMARINER_CLUSTERID
+              value: '{{ .Values.submariner.clusterId }}'
+            - name: SUBMARINER_EXCLUDENS
+              value: 'submariner-operator,kube-system,operators'
+            - name: SUBMARINER_NAMESPACE
+              value: '{{ .Release.Namespace }}'
+          securityContext:
+            allowPrivilegeEscalation: true
+            capabilities:
+              add:
+                - ALL
+            privileged: true
+            readOnlyRootFilesystem: false
+            runAsNonRoot: false
+          volumeMounts:
+            # Because we don't actually run iptables locally, but chroot in to the host
+            - mountPath: /host
+              name: host-slash
+              readOnly: true
+      volumes:
+        - name: host-slash
+          hostPath:
+            path: /
+{{- end }}

submariner/templates/lighthouse-coredns.yaml

@@ -0,0 +1,74 @@
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "submariner.lighthouseDnsName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.lighthouseDnsName" . }}
+    component: lighthouse-coredns
+spec:
+  selector:
+    matchLabels:
+      app: {{ template "submariner.lighthouseDnsName" . }}
+  replicas: 2
+  template:
+    metadata:
+      labels:
+        app: {{ template "submariner.lighthouseDnsName" . }}
+    spec:
+      containers:
+        - args:
+            - -conf
+            - /etc/coredns/Corefile
+          image: {{ .Values.lighthouseCoredns.image.repository }}:{{  default .Chart.AppVersion .Values.lighthouseCoredns.image.tag }}
+          imagePullPolicy: {{ .Values.lighthouseCoredns.image.pullPolicy }}
+          name: {{ template "submariner.lighthouseDnsName" . }}
+          volumeMounts:
+            - mountPath: /etc/coredns
+              name: config-volume
+              readOnly: true
+      serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
+      volumes:
+        - configMap:
+            defaultMode: 420
+            items:
+              - key: Corefile
+                path: Corefile
+            name: {{ template "submariner.lighthouseDnsName" . }}
+          name: config-volume
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "submariner.lighthouseDnsName" . }}
+  labels:
+    app: {{ template "submariner.lighthouseDnsName" . }}
+spec:
+  ports:
+    - name: udp
+      port: 53
+      protocol: UDP
+      targetPort: 53
+  selector:
+    app: {{ template "submariner.lighthouseDnsName" . }}
+  type: ClusterIP
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "submariner.lighthouseDnsName" . }}
+data:
+  Corefile: |
+    supercluster.local:53 {
+{{- if .Values.submariner.debug }}
+        log
+{{- end }}
+        lighthouse
+        errors
+        health
+        ready
+    }
+{{- end }}

submariner/templates/lighthouse.yaml

@@ -0,0 +1,55 @@
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "submariner.fullname" . }}-lighthouse-agent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.fullname" . }}-lighthouse-agent
+    component: lighthouse
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ template "submariner.fullname" . }}-lighthouse-agent
+  template:
+    metadata:
+      labels:
+        app: {{ template "submariner.fullname" . }}-lighthouse-agent
+    spec:
+      serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
+      containers:
+      - command:
+        - lighthouse-agent.sh
+        env:
+        - name: SUBMARINER_NAMESPACE
+          value: "{{ .Release.Namespace }}"
+        - name: SUBMARINER_CLUSTERID
+          value: "{{ .Values.submariner.clusterId }}"
+        - name: SUBMARINER_DEBUG
+          value: "{{ .Values.submariner.debug }}"
+{{- if ne .Values.submariner.globalCidr "" }}
+        - name: SUBMARINER_GLOBALNET_ENABLED
+          value: "true"
+{{- end }}
+        - name: BROKER_K8S_APISERVER
+          value: "{{ .Values.broker.server }}"
+        - name: BROKER_K8S_APISERVERTOKEN
+          value: "{{ .Values.broker.token }}"
+        - name: BROKER_K8S_REMOTENAMESPACE
+          value: "{{ .Values.broker.namespace }}"
+{{- if .Values.broker.insecure }}
+        - name: BROKER_K8S_INSECURE
+          value: "true"
+{{- else }}
+        - name: BROKER_K8S_CA
+          value: "{{ .Values.broker.ca }}"
+{{- end }}
+        name: {{ template "submariner.fullname" . }}-lighthouse-agent
+        image: {{ .Values.lighthouse.image.repository }}:{{  default .Chart.AppVersion  .Values.lighthouse.image.tag }}
+        imagePullPolicy: {{ .Values.lighthouse.image.pullPolicy }}
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 0
+{{- end }}

submariner/templates/rbac.yaml

@@ -13,7 +13,7 @@ rules:
   resources: ["configmaps"]
   verbs: ["create", "get", "list", "watch", "patch", "update"]
 - apiGroups: ["submariner.io"]
-  resources: ["clusters", "endpoints"]
+  resources: ["clusters", "endpoints", "gateways"]
   verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
 - apiGroups: [""]
   resources: ["events"]
@@ -30,7 +30,7 @@ metadata:
     app: {{ template "submariner.name" . }}
 rules:
 - apiGroups: ["submariner.io"]
-  resources: ["clusters", "endpoints"]
+  resources: ["clusters", "endpoints", "gateways"]
   verbs: ["create", "get", "list", "watch", "patch", "update"]
 - apiGroups: [""]
   resources: ["pods"]
@@ -61,4 +61,83 @@ subjects:
 - kind: ServiceAccount
   name: {{ template "submariner.routeAgentServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:routeagent
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.routeAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- if ne .Values.submariner.globalCidr "" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+rules:
+- apiGroups: [""]
+  resources: ["services", "namespaces", "pods", "nodes"]
+  verbs: ["get", "list", "watch", "update"]
+- apiGroups: ["submariner.io"]
+  resources: ["clusters", "endpoints", "gateways"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+{{- end -}}
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse
+rules:
+  - apiGroups: [""]
+    resources: ["services", "namespaces", "configmaps"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: ["lighthouse.submariner.io"]
+    resources: ["*"]
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
+  - apiGroups: ["submariner.io"]
+    resources: ["gateways"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.lighthouseServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
 {{- end -}}

submariner/templates/route-agent-ds.yaml

@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: {{ template "submariner.fullname" . }}-routeagent
@@ -12,6 +12,10 @@ spec:
   selector:
     matchLabels:
       app: {{ template "submariner.fullname" . }}-routeagent
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
   template:
     metadata:
       labels:
@@ -22,13 +26,13 @@ spec:
         component: routeagent
     spec:
       serviceAccountName: {{ template "submariner.routeAgentServiceAccountName" . }}
-      terminationGracePeriodSeconds: 0
+      terminationGracePeriodSeconds: 1
       hostNetwork: true
       containers:
       - name: routeagent
         command:
         - submariner-route-agent.sh
-        image: {{ .Values.routeAgent.image.repository }}:{{ .Values.routeAgent.image.tag }}
+        image: {{ .Values.routeAgent.image.repository }}:{{  default .Chart.AppVersion .Values.routeAgent.image.tag }}
         imagePullPolicy: {{ .Values.routeAgent.image.pullPolicy }}
         env:
         - name: SUBMARINER_NAMESPACE

submariner/templates/svc-acct.yaml

@@ -20,4 +20,28 @@ metadata:
     release: {{ .Release.Name | quote }}
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
-{{- end }}
+{{- end }}
+---
+{{- if .Values.serviceAccounts.globalnet.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+{{- end }}
+---
+{{- if .Values.serviceAccounts.lighthouse.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+{{- end }}

submariner/values.yaml

@@ -1,11 +1,14 @@
+---
 submariner:
   clusterId: ""
   token: ""
   clusterCidr: "10.42.0.0/16"
   serviceCidr: "10.43.0.0/16"
+  globalCidr: ""
   natEnabled: false
   colorCodes: blue
   debug: false
+  serviceDiscovery: false
 crd:
   create: true
 broker:
@@ -20,35 +23,57 @@ rbac:
 ipsec:
   psk: ""
   debug: false
+  ikePort: 500
+  natPort: 4500
+leadership:
+  leaseDuration: 10
+  renewDeadline: 5
+  retryPeriod: 2
 engine:
   image:
-    repository: rancher/submariner
-    tag: v0.0.1
-    pullPolicy: Always
+    repository: quay.io/submariner/submariner
+    tag: ""
+    pullPolicy: IfNotPresent
   resources: {}
-    # limits:
-    # cpu: 100m
-  # memory: 100Mi
   nodeSelectorEnabled: true
   nodeSelector: {}
   tolerations: []
   affinity: {}
 routeAgent:
   image:
-    repository: rancher/submariner-route-agent
-    tag: v0.0.1
-    pullPolicy: Always
+    repository: quay.io/submariner/submariner-route-agent
+    tag: ""
+    pullPolicy: IfNotPresent
   resources: {}
-    # limits:
-  # cpu: 100m
-  # memory: 100Mi
   nodeSelector: {}
   tolerations: []
   affinity: {}
+globalnet:
+  image:
+    repository: quay.io/submariner/submariner-globalnet
+    tag: ""
+    pullPolicy: IfNotPresent
+lighthouse:
+  image:
+    repository: quay.io/submariner/lighthouse-agent
+    tag: ""
+    pullPolicy: IfNotPresent
+lighthouseCoredns:
+  name: ""
+  image:
+    repository: quay.io/submariner/lighthouse-coredns
+    tag: ""
+    pullPolicy: IfNotPresent
 serviceAccounts:
   engine:
     create: true
     name: ""
   routeAgent:
     create: true
-    name: ""
+    name: ""
+  globalnet:
+    create: false
+    name: ""
+  lighthouse:
+    create: false
+    name: ""