Fix coreDNSCustomConfig values

Signed-off-by: Negash <i@negash.ru>
Globalnet include ClusterRole for services
2026-09-20 22:40:34 +00:00 · 2022-01-05 12:47:35 +00:00 · 2022-01-04 07:48:50 -05:00 · 2021-12-16 07:59:53 -05:00 · 2021-12-14 21:44:22 -05:00 · 2021-12-13 07:44:09 -05:00
59 changed files with 1741 additions and 2771 deletions
@@ -23,11 +23,9 @@ Submariner Owners: https://github.com/orgs/submariner-io/teams/submariner-core
 **Anything else we need to know?**:

 **Environment**:
- Submariner version (use `subctl version`):
- Kubernetes version (use `kubectl version`):
+- Diagnose information (use `subctl diagnose all`):
+- Gather information (use `subctl gather`):
 - Cloud provider or hardware configuration:
- OS (e.g: `cat /etc/os-release`):
- Kernel (e.g. `uname -a`):
 - Install tools:
 - Network plugin and version (if this is a network-related bug):
 - Others:
@@ -6,7 +6,7 @@ labels: support
 ---

 <!--
-GitHub may not the right place for support requests.
+GitHub may not be the right place for support requests.

 You can also post your question on the [Submariner
 Slack](https://kubernetes.slack.com/archives/C010RJV694M) or the Submariner
@@ -0,0 +1,13 @@
+<!--  Thanks for sending a pull request!  Here are some tips for you:
+
+1. If this is your first time, please read our developer guide: https://submariner.io/development/
+2. Ensure you have added the appropriate tests for your PR: https://submariner.io/development/code-review/#test-new-functionality
+3. Read the code review guide to ease the review process: https://submariner.io/development/code-review/
+4. If the PR is unfinished, mark it as a draft: https://submariner.io/development/code-review/#mark-work-in-progress-prs-as-drafts
+5. If you are using CI to debug, use your private fork: https://submariner.io/development/code-review/#use-private-forks-for-debugging-prs-by-running-ci
+6. Add labels to the PR as appropriate.
+
+This template is based on the K8s/K8s template:
+
+https://github.com/kubernetes/kubernetes/blob/master/.github/PULL_REQUEST_TEMPLATE.md
+-->
@@ -2,7 +2,7 @@
 # Configuration for probot-stale - https://github.com/probot/stale

 # Number of days of inactivity before an Issue becomes stale (pull request is overridden later)
-daysUntilStale: 60
+daysUntilStale: 120

 # Number of days of inactivity before an Issue or Pull Request with the stale label is closed.
 # Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale.
@@ -0,0 +1,14 @@
+---
+name: Branch Checks
+
+on:
+  pull_request:
+
+jobs:
+  target_branch:
+    name: PR targets branch
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check that the PR targets devel
+        if: ${{ github.base_ref != 'devel' }}
+        run: exit 1
@@ -0,0 +1,39 @@
+---
+name: PR Dependencies
+
+on:
+  issues:
+    types:
+      - opened
+      - edited
+      - closed
+      - reopened
+      - synchronize
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - closed
+      - reopened
+      - synchronize
+  schedule:
+    - cron: '0 0/6 * * *' # every 6 hours
+
+jobs:
+  check:
+    name: Check Dependencies
+    if: github.repository_owner == 'submariner-io'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: z0al/dependent-issues@70a1b2d4ee1cdc743af33498bd0204123953a887
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          # The label to use to mark dependent issues
+          label: dependent
+
+          # Enable checking for dependencies in issues.
+          check_issues: on
+
+          # A comma-separated list of keywords to mark dependency.
+          keywords: depends on, Depends on
@@ -0,0 +1,37 @@
+---
+name: End to End Full
+
+on:
+  pull_request:
+    types: [labeled, opened, synchronize, reopened]
+
+jobs:
+  e2e:
+    name: E2E
+    if: contains(github.event.pull_request.labels.*.name, 'ready-to-test')
+    timeout-minutes: 45
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        cable_driver: ['libreswan', 'wireguard', 'vxlan']
+        globalnet: ['', 'globalnet']
+        k8s_version: ['1.19']
+        lighthouse: ['', 'lighthouse']
+        include:
+          - k8s_version: '1.20'
+          - k8s_version: '1.21'
+          - k8s_version: '1.22'
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
+
+      - name: Run E2E deployment and tests
+        uses: submariner-io/shipyard/gh-actions/e2e@devel
+        with:
+          k8s_version: ${{ matrix.k8s_version }}
+          using: ${{ matrix.cable_driver }} ${{ matrix.globalnet }} ${{ matrix.lighthouse }}
+
+      - name: Post mortem
+        if: failure()
+        uses: submariner-io/shipyard/gh-actions/post-mortem@devel
@@ -1,5 +1,5 @@
 ---
-name: End to End Tests
+name: End to End Default

 on:
  pull_request:
@@ -9,18 +9,12 @@ jobs:
    name: E2E
    timeout-minutes: 30
    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        globalnet: ['', 'globalnet']
    steps:
      - name: Check out the repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f

      - name: Run E2E deployment and tests
        uses: submariner-io/shipyard/gh-actions/e2e@devel
-        with:
-          globalnet: ${{ matrix.globalnet }}

      - name: Post mortem
        if: failure()
@@ -0,0 +1,31 @@
+---
+name: Flake Finder
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+
+jobs:
+  e2e:
+    name: E2E
+    if: github.repository_owner == 'submariner-io'
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        cable_driver: ['libreswan', 'wireguard', 'vxlan']
+        globalnet: ['', 'globalnet']
+        lighthouse: ['', 'lighthouse']
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
+
+      - name: Run E2E deployment and tests
+        uses: submariner-io/shipyard/gh-actions/e2e@devel
+        with:
+          using: ${{ matrix.cable_driver }} ${{ matrix.globalnet }} ${{ matrix.lighthouse }}
+
+      - name: Post mortem
+        if: failure()
+        uses: submariner-io/shipyard/gh-actions/post-mortem@devel
@@ -5,40 +5,77 @@ on:
  pull_request:

 jobs:
-  dco:
-    name: DCO in Commit Message(s)
+  apply-suggestions-commits:
+    name: 'No "Apply suggestions from code review" Commits'
    runs-on: ubuntu-latest
    steps:
      - name: Get PR commits
        id: 'get-pr-commits'
-        uses: tim-actions/get-pr-commits@master
+        uses: tim-actions/get-pr-commits@55b867b9b28954e6f5c1a0fe2f729dc926c306d0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Run DCO check
-        uses: tim-actions/dco@master
+
+      - name: 'Verify no "Apply suggestions from code review" commits'
+        uses: tim-actions/commit-message-checker-with-regex@d6d9770051dd6460679d1cab1dcaa8cffc5c2bbd
        with:
          commits: ${{ steps.get-pr-commits.outputs.commits }}
+          pattern: '^(?!.*(apply suggestions from code review))'
+          flags: 'i'
+          error: 'Commits addressing code review feedback should typically be squashed into the commits under review'
+
+  chart-testing:
+    name: Helm Chart Linting
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
+
+      - name: Set up Helm
+        uses: azure/setup-helm@18bc76811624f360dbd7f18c2d4ecb32c7b87bab
+        with:
+          version: v3.6.0
+
+      - name: Set up Python
+        uses: actions/setup-python@dc73133d4da04e56a135ae2246682783cc7c7cb6
+        with:
+          python-version: '3.x'
+
+      - name: Set up helm/chart-testing
+        uses: helm/chart-testing-action@5f16c27cf7a4fa9c776ff73734df3909b2b65127
+
+      - name: Run helm/chart-testing (lint)
+        run: ct lint --config ct.yaml

  gitlint:
    name: Commit Message(s)
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
        with:
          fetch-depth: 0
      - name: Run gitlint
        run: make gitlint

+  helm-docs:
+    name: Helm Docs Generation
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
+
+      - name: Run helm-docs and verify docs are up-to-date
+        run: make helm-docs
+
  markdown-link-check:
    name: Markdown Links (modified files)
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f

      - name: Run markdown-link-check
-        uses: gaurav-nelson/github-action-markdown-link-check@v1
+        uses: gaurav-nelson/github-action-markdown-link-check@9710f0fec812ce0a3b98bef4c9d842fc1f39d976
        with:
          config-file: ".markdownlinkcheck.json"
          check-modified-files-only: "yes"
@@ -49,7 +86,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
      - name: Run markdownlint
        run: make markdownlint

@@ -58,9 +95,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
      - name: Run yamllint
-        uses: ibiqlik/action-yamllint@v1
+        uses: ibiqlik/action-yamllint@ed2b6e911569708ed121c14b87d513860a7e36a7
        with:
-          file_or_dir: submariner/Chart.yaml submariner/values.yaml submariner-k8s-broker/Chart.yaml submariner-k8s-broker/values.yaml submariner-operator/Chart.yaml submariner-operator/values.yaml
+          file_or_dir: submariner-k8s-broker/Chart.yaml submariner-k8s-broker/values.yaml submariner-operator/Chart.yaml submariner-operator/values.yaml
          config_file: .yamllint.yml
+          strict: true
@@ -8,19 +8,20 @@ on:
 jobs:
  markdown-link-check-periodic:
    name: Markdown Links (all files)
+    if: github.repository_owner == 'submariner-io'
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f

      - name: Run markdown-link-check
-        uses: gaurav-nelson/github-action-markdown-link-check@v1
+        uses: gaurav-nelson/github-action-markdown-link-check@9710f0fec812ce0a3b98bef4c9d842fc1f39d976
        with:
          config-file: ".markdownlinkcheck.json"

      - name: Raise an Issue to report broken links
        if: ${{ failure() }}
-        uses: peter-evans/create-issue-from-file@v2.3.2
+        uses: peter-evans/create-issue-from-file@97e6f902a416aac38834e23fa52e166aad0437d2
        with:
          title: Broken link detected by CI
          content-filepath: .github/ISSUE_TEMPLATE/broken-link.md
@@ -9,10 +9,11 @@ on:
 jobs:
  release:
    name: Release
+    if: github.repository_owner == 'submariner-io'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
        with:
          fetch-depth: 0

@@ -2,3 +2,4 @@
 .idea
 .shflags
 *.tgz
+Makefile.dapper
@@ -1,9 +0,0 @@
-[general]
-# body-is-missing: Allow commit messages with only a title
-# body-min-length: Allow short body lines, like "Relates-to: #issue"
-ignore=body-is-missing,body-min-length
-
-[ignore-by-body]
-# Dependabot doesn't follow our conventions, unfortunately
-regex=^Signed-off-by: dependabot\[bot\](.*)
-ignore=all
@@ -5,6 +5,9 @@
    },
    {
      "pattern": "^http://localhost:"
+    },
+    {
+      "pattern": "^https://submariner-io.github.io/submariner-charts/charts"
    }
  ]
 }
@@ -10,3 +10,7 @@ line-length:
 no-inline-html:
  allowed_elements:
    - span
+
+# Temporary while helm-docs has a bug where maintainer URLs are used raw in MD
+# Waiting on: https://github.com/norwoodj/helm-docs/pull/102
+no-bare-urls: false
@@ -0,0 +1,7 @@
+---
+cni: ovn
+submariner: true
+nodes: control-plane worker worker
+clusters:
+  cluster1:
+  cluster2:
@@ -0,0 +1,7 @@
+---
+cni: weave
+submariner: true
+nodes: control-plane worker
+clusters:
+  cluster1:
+  cluster2:
@@ -0,0 +1,3 @@
+label-approved:
+  approvals: 2
+  label: ready-to-test
@@ -1 +1,3 @@
-* @mangelajo @Oats87 @skitt @tpantelis
+# Auto-generated, do not edit; see CODEOWNERS.in
+* @Oats87 @skitt @sridhargaddam @tpantelis
+*.md @dfarrell07 @Oats87 @skitt @sridhargaddam @tpantelis
@@ -0,0 +1,5 @@
+@dfarrell07 *.md
+@Oats87 *
+@skitt *
+@sridhargaddam *
+@tpantelis *
@@ -1,4 +1,5 @@
-FROM quay.io/submariner/shipyard-dapper-base:devel
+ARG BASE_BRANCH
+FROM quay.io/submariner/shipyard-dapper-base:${BASE_BRANCH}

 ARG DAPPER_HOST_ARCH
 ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH} \
@@ -1,38 +1,62 @@
+BASE_BRANCH ?= devel
+export BASE_BRANCH
+
 ifneq (,$(DAPPER_HOST_ARCH))

 # Running in Dapper

+PRELOAD_IMAGES := submariner-gateway submariner-operator submariner-route-agent lighthouse-agent lighthouse-coredns
+
 include $(SHIPYARD_DIR)/Makefile.inc

-CLUSTER_SETTINGS_FLAG = --cluster_settings $(DAPPER_SOURCE)/cluster_settings
+ifneq (,$(filter ovn,$(_using)))
+CLUSTER_SETTINGS_FLAG = --settings $(DAPPER_SOURCE)/.shipyard.e2e.ovn.yml
+else
+CLUSTER_SETTINGS_FLAG = --settings $(DAPPER_SOURCE)/.shipyard.e2e.yml
+endif
+
 override CLUSTERS_ARGS += $(CLUSTER_SETTINGS_FLAG)
-override DEPLOY_ARGS += $(CLUSTER_SETTINGS_FLAG) --deploytool helm --deploytool_broker_args '--set submariner.serviceDiscovery=true'
+override DEPLOY_ARGS += $(CLUSTER_SETTINGS_FLAG) --deploytool helm
 export DEPLOY_ARGS
 GH_URL=https://submariner-io.github.io/submariner-charts/charts
 CHARTS_DIR=charts
-CHARTS_VERSION=0.7.0
+CHARTS_VERSION=0.10.1
+HELM_DOCS_VERSION=0.15.0
 REPO_URL=$(shell git config remote.origin.url)

+# Process extra flags from the `using=a,b,c` optional flag
+
+ifneq (,$(filter lighthouse,$(_using)))
+override DEPLOY_ARGS += --service_discovery
+endif
+
+ifneq (,$(filter globalnet,$(_using)))
+override DEPLOY_ARGS += --globalnet
+endif
+
 # Targets to make

-deploy: clusters preload-images
-
 e2e: E2E_ARGS=cluster1 cluster2

-preload-images:
-	source $(SCRIPTS_DIR)/lib/debug_functions; \
-	source $(SCRIPTS_DIR)/lib/deploy_funcs; \
-	source $(SCRIPTS_DIR)/lib/version; \
-	set -e; \
-	for image in submariner submariner-route-agent submariner-operator lighthouse-agent submariner-globalnet lighthouse-coredns; do \
-		import_image quay.io/submariner/$${image}; \
-	done
-
 %.tgz:
 	helm dep update $(subst -$(CHARTS_VERSION),,$(basename $(@F)))
 	helm package --version $(CHARTS_VERSION) $(subst -$(CHARTS_VERSION),,$(basename $(@F)))

-release: submariner-$(CHARTS_VERSION).tgz submariner-k8s-broker-$(CHARTS_VERSION).tgz submariner-operator-$(CHARTS_VERSION).tgz
+helm-docs:
+	# Avoid polluting repo with helm-docs' README/LICENSE or other files in the release archive
+	cd /tmp && \
+	curl -sL https://github.com/norwoodj/helm-docs/releases/download/v$(HELM_DOCS_VERSION)/helm-docs_$(HELM_DOCS_VERSION)_Linux_x86_64.tar.gz | tar zx && \
+	cd -
+	/tmp/helm-docs
+	if [ ! -z $(git status --porcelain) ]; then \
+		echo "Helm docs not up-to-date:"; \
+		git status --porcelain; \
+		git diff; \
+		echo "Run make helm-docs locally to generate updated docs, commit the updates."; \
+		exit 1; \
+	fi
+
+release: submariner-k8s-broker-$(CHARTS_VERSION).tgz submariner-operator-$(CHARTS_VERSION).tgz
 	git checkout gh-pages
 	mv *.tgz $(CHARTS_DIR)
 	if [ -f $(CHARTS_DIR)/index.yaml ]; then \
@@ -41,15 +65,19 @@ release: submariner-$(CHARTS_VERSION).tgz submariner-k8s-broker-$(CHARTS_VERSION
 	  helm repo index $(CHARTS_DIR) --url $(GH_URL); \
 	fi

-.PHONY: preload-images release
+.PHONY: release helm-docs

 else

 # Not running in Dapper

+Makefile.dapper:
+	@echo Downloading $@
+	@curl -sfLO https://raw.githubusercontent.com/submariner-io/shipyard/$(BASE_BRANCH)/$@
+
 include Makefile.dapper

 endif

 # Disable rebuilding Makefile
-Makefile Makefile.dapper Makefile.inc: ;
+Makefile Makefile.inc: ;
@@ -1,26 +0,0 @@
-# This Makefile contains the rules required to set up our
-# Dapper-based build environment; it can be copied as-is to
-# other projects (and needs to be copied, it can't be shared
-# via the Dapper image since it's needed to retrieve the image)
-
-.dapper:
-	@echo Downloading dapper
-	@curl -sL https://releases.rancher.com/dapper/latest/dapper-`uname -s`-`uname -m` > .dapper.tmp
-	@@chmod +x .dapper.tmp
-	@./.dapper.tmp -v
-	@mv .dapper.tmp .dapper
-
-invoke_dapper = +./.dapper -m bind make -- $1
-
-%: .dapper
-	@echo Invoking Dapper, MAKEFLAGS=$(MAKEFLAGS)
-	$(call invoke_dapper,$@)
-
-# Ensure that files in the current directory don't hide Dapper targets
-$(wildcard [^M]*): .dapper
-	$(call invoke_dapper,$@)
-
-shell: .dapper
-	./.dapper -m bind -s
-
-.PHONY: shell $(wildcard [^M]*)
@@ -1,5 +1,12 @@
 # submariner-charts

+<!-- markdownlint-disable line-length -->
+[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/4865/badge)](https://bestpractices.coreinfrastructure.org/projects/4865)
+[![Release Charts](https://github.com/submariner-io/submariner-charts/workflows/Release%20Charts/badge.svg)](https://github.com/submariner-io/submariner-charts/actions?query=workflow%3A%22Release+Charts%22)
+[![Periodic](https://github.com/submariner-io/submariner-charts/workflows/Periodic/badge.svg)](https://github.com/submariner-io/submariner-charts/actions?query=workflow%3APeriodic)
+[![Flake Finder](https://github.com/submariner-io/submariner-charts/workflows/Flake%20Finder/badge.svg)](https://github.com/submariner-io/submariner-charts/actions?query=workflow%3A%22Flake+Finder%22)
+<!-- markdownlint-enable line-length -->
+
 Please see the [Helm docs on Submariner's website](https://submariner.io/operations/deployment/helm/).

 ## Development workflow
@@ -1,10 +0,0 @@
-. "${SCRIPTS_DIR}"/lib/source_only
-
-# We need a minimal setup to verify the deployment works
-clusters=('cluster1' 'cluster2')
-cluster_nodes['cluster1']="control-plane worker"
-cluster_nodes['cluster2']="control-plane worker"
-
-cluster_cni=( ['cluster1']="weave" ['cluster2']="weave" )
-
-cluster_subm=( ['cluster1']="true" ['cluster2']="true" )
@@ -0,0 +1,6 @@
+charts:
+  - submariner-operator
+  - submariner-k8s-broker
+# Tests that maintainer name is valid GitHub account, which isn't what we want
+# See: https://github.com/helm/chart-testing/issues/192
+validate-maintainers: false
@@ -51,12 +51,16 @@ function helm_install_subm() {
        --set broker.token="${submariner_broker_token}" \
        --set broker.namespace="${SUBMARINER_BROKER_NS}" \
        --set broker.ca="${submariner_broker_ca}" \
+        --set broker.globalnet="${globalnet}" \
+        --set submariner.serviceDiscovery="${service_discovery}" \
        --set submariner.cableDriver="${cable_driver}" \
        --set submariner.clusterId="${cluster}" \
        --set submariner.clusterCidr="${cluster_CIDRs[$cluster]}" \
        --set submariner.serviceCidr="${service_CIDRs[$cluster]}" \
        --set submariner.globalCidr="${global_CIDRs[$cluster]}" \
        --set serviceAccounts.globalnet.create="${globalnet}" \
+        --set serviceAccounts.lighthouseAgent.create="${service_discovery}" \
+        --set serviceAccounts.lighthouseCoreDns.create="${service_discovery}" \
        --set submariner.natEnabled="false" \
        --set operator.image.repository="localhost:5000/submariner-operator" \
        --set operator.image.tag="local" \
@@ -1,12 +1,14 @@
 ---
 name: submariner-k8s-broker
 version: 0.6.0
+apiVersion: v2
 appVersion: 0.6.0
 description: Submariner Kubernetes Broker
 keywords:
 home: https://submariner-io.github.io/
 sources:
- https://submariner-io.github.io/submariner-charts/charts
+  - https://submariner-io.github.io/submariner-charts/charts
 maintainers:
- name: Submariner Developers
-  email: submariner-dev@googlegroups.com
+  - name: Contributors to the Submariner project
+    email: submariner-dev@googlegroups.com
+    url: https://submariner.io/
@@ -0,0 +1,26 @@
+# submariner-k8s-broker
+
+![Version: 0.6.0](https://img.shields.io/badge/Version-0.6.0-informational?style=flat-square) ![AppVersion: 0.6.0](https://img.shields.io/badge/AppVersion-0.6.0-informational?style=flat-square)
+
+Submariner Kubernetes Broker
+
+**Homepage:** <https://submariner-io.github.io/>
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| Contributors to the Submariner project | submariner-dev@googlegroups.com | https://submariner.io/ |
+
+## Source Code
+
+* <https://submariner-io.github.io/submariner-charts/charts>
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| crd.create | bool | `true` |  |
+| rbac.create | bool | `true` |  |
+| serviceAccounts.client.create | bool | `true` |  |
+| serviceAccounts.client.name | string | `""` |  |
@@ -1,97 +1,333 @@
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  name: clusters.submariner.io
 spec:
  group: submariner.io
-  version: v1
  names:
    kind: Cluster
+    listKind: ClusterList
    plural: clusters
+    singular: cluster
  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              cluster_cidr:
+                items:
+                  type: string
+                type: array
+              cluster_id:
+                type: string
+              color_codes:
+                items:
+                  type: string
+                type: array
+              global_cidr:
+                items:
+                  type: string
+                type: array
+              service_cidr:
+                items:
+                  type: string
+                type: array
+            required:
+            - cluster_cidr
+            - cluster_id
+            - color_codes
+            - global_cidr
+            - service_cidr
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
 ---
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  name: endpoints.submariner.io
 spec:
  group: submariner.io
-  version: v1
  names:
    kind: Endpoint
+    listKind: EndpointList
    plural: endpoints
+    singular: endpoint
  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              backend:
+                type: string
+              backend_config:
+                additionalProperties:
+                  type: string
+                type: object
+              cable_name:
+                type: string
+              cluster_id:
+                type: string
+              healthCheckIP:
+                type: string
+              hostname:
+                type: string
+              nat_enabled:
+                type: boolean
+              private_ip:
+                type: string
+              public_ip:
+                type: string
+              subnets:
+                items:
+                  type: string
+                type: array
+            required:
+            - backend
+            - cable_name
+            - cluster_id
+            - hostname
+            - nat_enabled
+            - private_ip
+            - public_ip
+            - subnets
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
 ---
-apiVersion: apiextensions.k8s.io/v1beta1
+apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  name: gateways.submariner.io
 spec:
  group: submariner.io
-  version: v1
  names:
    kind: Gateway
+    listKind: GatewayList
    plural: gateways
+    singular: gateway
  scope: Namespaced
-  additionalPrinterColumns:
-    - name: ha-status
+  versions:
+  - additionalPrinterColumns:
+    - description: High availability status of the Gateway
+      jsonPath: .status.haStatus
+      name: HA Status
      type: string
-      description: High Availability Status of the Gateway
-      JSONPath: .status.haStatus
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: multiclusterservices.lighthouse.submariner.io
-spec:
-  group: lighthouse.submariner.io
-  version: v1
-  names:
-    kind: MultiClusterService
-    plural: multiclusterservices
-    singular: multiclusterservice
-  scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      properties:
-        spec:
-          properties:
-            clusterServiceInfo:
-              properties:
-                clusterID:
-                  type: "string"
-                clusterDomain:
-                  type: "string"
-                serviceIP:
-                  type: "string"
-                port:
-                  type: "integer"
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceexports.lighthouse.submariner.io
-spec:
-  group: lighthouse.submariner.io
-  version: v2alpha1
-  names:
-    kind: ServiceExport
-    plural: serviceexports
-    singular: serviceexport
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceimports.lighthouse.submariner.io
-spec:
-  group: lighthouse.submariner.io
-  version: v2alpha1
-  names:
-    kind: ServiceImport
-    plural: serviceimports
-    singular: serviceimport
-  scope: Namespaced
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          status:
+            properties:
+              connections:
+                items:
+                  properties:
+                    endpoint:
+                      properties:
+                        backend:
+                          type: string
+                        backend_config:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        cable_name:
+                          type: string
+                        cluster_id:
+                          type: string
+                        healthCheckIP:
+                          type: string
+                        hostname:
+                          type: string
+                        nat_enabled:
+                          type: boolean
+                        private_ip:
+                          type: string
+                        public_ip:
+                          type: string
+                        subnets:
+                          items:
+                            type: string
+                          type: array
+                      required:
+                      - backend
+                      - cable_name
+                      - cluster_id
+                      - hostname
+                      - nat_enabled
+                      - private_ip
+                      - public_ip
+                      - subnets
+                      type: object
+                    latency:
+                      description: LatencySpec describes the round trip time information
+                        in nanoseconds for a packet between the gateway pods of two
+                        clusters.
+                      properties:
+                        averageRTT:
+                          format: int64
+                          type: integer
+                        lastRTT:
+                          description: TODO This shall be deleted once the operator
+                            is using the latest. Using Optional to avoid validation
+                            errors when this field is not used.
+                          format: int64
+                          type: integer
+                        maxRTT:
+                          format: int64
+                          type: integer
+                        minRTT:
+                          format: int64
+                          type: integer
+                        stddevRTT:
+                          format: int64
+                          type: integer
+                      type: object
+                    latencyRTT:
+                      description: LatencySpec describes the round trip time information
+                        for a packet between the gateway pods of two clusters.
+                      properties:
+                        average:
+                          type: string
+                        last:
+                          type: string
+                        max:
+                          type: string
+                        min:
+                          type: string
+                        stdDev:
+                          type: string
+                      type: object
+                    status:
+                      type: string
+                    statusMessage:
+                      type: string
+                  required:
+                  - endpoint
+                  - status
+                  - statusMessage
+                  type: object
+                type: array
+              haStatus:
+                type: string
+              localEndpoint:
+                properties:
+                  backend:
+                    type: string
+                  backend_config:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  cable_name:
+                    type: string
+                  cluster_id:
+                    type: string
+                  healthCheckIP:
+                    type: string
+                  hostname:
+                    type: string
+                  nat_enabled:
+                    type: boolean
+                  private_ip:
+                    type: string
+                  public_ip:
+                    type: string
+                  subnets:
+                    items:
+                      type: string
+                    type: array
+                required:
+                - backend
+                - cable_name
+                - cluster_id
+                - hostname
+                - nat_enabled
+                - private_ip
+                - public_ip
+                - subnets
+                type: object
+              statusFailure:
+                type: string
+              version:
+                type: string
+            required:
+            - connections
+            - haStatus
+            - localEndpoint
+            - statusFailure
+            - version
+            type: object
+        required:
+        - status
+        type: object
+    served: true
+    storage: true
+    subresources: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
@@ -2,7 +2,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ template "submariner-k8s-broker.fullname" . }}:client
+  name: {{ template "submariner-k8s-broker.fullname" . }}-cluster
  labels:
    heritage: {{ .Release.Service | quote }}
    release: {{ .Release.Name | quote }}
@@ -16,7 +16,7 @@ rules:
  resources: ["*"]
  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
 - apiGroups: ["discovery.k8s.io"]
-  resources: ["endpointslices"]
+  resources: ["endpointslices", "endpointslices/restricted"]
  verbs: ["create", "get", "list", "watch","patch", "update", "delete"]
 - apiGroups: ["multicluster.x-k8s.io"]
  resources: ["*"]
@@ -25,13 +25,13 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ template "submariner-k8s-broker.fullname" . }}:client
+  name: {{ template "submariner-k8s-broker.fullname" . }}-cluster
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
-  name: {{ template "submariner-k8s-broker.fullname" . }}:client
+  name: {{ template "submariner-k8s-broker.fullname" . }}-cluster
 subjects:
 - kind: ServiceAccount
  name: {{ template "submariner-k8s-broker.clientServiceAccountName" . }}
  namespace: {{ .Release.Namespace }}
-{{- end -}}
+{{- end -}}
@@ -7,5 +7,3 @@ serviceAccounts:
  client:
    create: true
    name: ""
-submariner:
-  serviceDiscovery: false
@@ -1,12 +1,14 @@
 ---
 name: submariner-operator
-version: 0.7.0
-appVersion: 0.7.0
+version: 0.10.1
+apiVersion: v2
+appVersion: 0.10.1
 description: Submariner enables direct networking between Pods and Services in different Kubernetes clusters
 keywords:
 home: https://submariner-io.github.io/
 sources:
  - https://submariner-io.github.io/submariner-charts/charts
 maintainers:
-  - name: Submariner Developers
+  - name: Contributors to the Submariner project
    email: submariner-dev@googlegroups.com
+    url: https://submariner.io/
@@ -0,0 +1,71 @@
+# submariner-operator
+
+![Version: 0.10.1](https://img.shields.io/badge/Version-0.10.1-informational?style=flat-square) ![AppVersion: 0.10.1](https://img.shields.io/badge/AppVersion-0.10.1-informational?style=flat-square)
+
+Submariner enables direct networking between Pods and Services in different Kubernetes clusters
+
+**Homepage:** <https://submariner-io.github.io/>
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| Contributors to the Submariner project | submariner-dev@googlegroups.com | https://submariner.io/ |
+
+## Source Code
+
+* <https://submariner-io.github.io/submariner-charts/charts>
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| broker.ca | string | `""` |  |
+| broker.globalnet | bool | `false` |  |
+| broker.insecure | bool | `false` |  |
+| broker.namespace | string | `"xyz"` |  |
+| broker.server | string | `"example.k8s.apiserver"` |  |
+| broker.token | string | `"test"` |  |
+| gateway.image.repository | string | `"quay.io/submariner/submariner-gateway"` |  |
+| gateway.image.tag | string | `"0.10.1"` |  |
+| ipsec.debug | bool | `false` |  |
+| ipsec.forceUDPEncaps | bool | `false` |  |
+| ipsec.ikePort | int | `500` |  |
+| ipsec.natPort | int | `4500` |  |
+| ipsec.psk | string | `""` |  |
+| leadership.leaseDuration | int | `10` |  |
+| leadership.renewDeadline | int | `5` |  |
+| leadership.retryPeriod | int | `2` |  |
+| operator.affinity | object | `{}` |  |
+| operator.image.pullPolicy | string | `"IfNotPresent"` |  |
+| operator.image.repository | string | `"quay.io/submariner/submariner-operator"` |  |
+| operator.image.tag | string | `"0.10.1"` |  |
+| operator.resources | object | `{}` |  |
+| operator.tolerations | list | `[]` |  |
+| rbac.create | bool | `true` |  |
+| serviceAccounts.gateway.create | bool | `true` |  |
+| serviceAccounts.gateway.name | string | `""` |  |
+| serviceAccounts.globalnet.create | bool | `true` |  |
+| serviceAccounts.globalnet.name | string | `""` |  |
+| serviceAccounts.lighthouseAgent.create | bool | `true` |  |
+| serviceAccounts.lighthouseAgent.name | string | `""` |  |
+| serviceAccounts.lighthouseCoreDns.create | bool | `true` |  |
+| serviceAccounts.lighthouseCoreDns.name | string | `""` |  |
+| serviceAccounts.operator.create | bool | `true` |  |
+| serviceAccounts.operator.name | string | `""` |  |
+| serviceAccounts.routeAgent.create | bool | `true` |  |
+| serviceAccounts.routeAgent.name | string | `""` |  |
+| submariner.cableDriver | string | `"libreswan"` |  |
+| submariner.clusterCidr | string | `""` |  |
+| submariner.clusterId | string | `""` |  |
+| submariner.colorCodes | string | `"blue"` |  |
+| submariner.coreDNSCustomConfig | object | `{}` |  |
+| submariner.debug | bool | `false` |  |
+| submariner.globalCidr | string | `""` |  |
+| submariner.healthcheckEnabled | bool | `true` |  |
+| submariner.images.repository | string | `"quay.io/submariner"` |  |
+| submariner.images.tag | string | `"0.10.1"` |  |
+| submariner.natEnabled | bool | `false` |  |
+| submariner.serviceCidr | string | `""` |  |
+| submariner.serviceDiscovery | bool | `true` |  |
+| submariner.token | string | `""` |  |
@@ -13,7 +13,7 @@ questions:
    type: string
    label: Submariner Operator Image Repository
  - variable: operator.image.tag
-    default: "0.7.0"
+    default: "0.10.1"
    description: "Submariner Operator Image Tag"
    type: string
    label: Submariner Operator Image Tag
@@ -31,7 +31,7 @@ questions:
    type: string
    label: Submariner Repository
  - variable: submariner.images.tag
-    default: "0.7.0"
+    default: "0.10.1"
    description: "Submariner Images Tag (shared for all non-operator images)"
    type: string
    label: Submariner Images Tag
@@ -92,13 +92,26 @@ questions:
  label: "Service CIDR"
  group: "CIDR Configuration"
  required: true
- variable: submariner.globalCidr
-  default: ""
-  description: "Enter the globalnet CIDR (i.e. 169.254.1.0/24) for this cluster if using globalnet"
-  type: string
-  label: "Globalnet CIDR"
-  group: "CIDR Configuration"
-  required: false
+- variable: submariner.serviceDiscovery
+  type: boolean
+  default: false
+  group: "Advanced Configuration"
+  description: "Enable multicluster service discovery"
+  label: "Service Discovery Enabled"
+- variable: broker.globalnet
+  type: boolean
+  default: false
+  group: "Broker Configuration"
+  description: "Enable support for overlapping Cluster/Service CIDRs in connecting clusters"
+  label: "Globalnet Enabled"
+  subquestions:
+  - variable: submariner.globalCidr
+    default: ""
+    description: "Enter the globalnet CIDR (i.e. 169.254.1.0/24) for this cluster if using globalnet"
+    type: string
+    label: "Globalnet CIDR"
+    group: "CIDR Configuration"
+    required: false
 - variable: submariner.natEnabled
  type: boolean
  default: false
@@ -123,3 +136,9 @@ questions:
  group: "Advanced Configuration"
  description: "Cable driver implementation"
  label: "Cable Driver"
+- variable: submariner.healthcheckEnabled
+  type: boolean
+  default: true
+  group: "Advanced Configuration"
+  description: "Disable Healthcheck"
+  label: "Healthcheck Disabled"
@@ -1,6 +1,6 @@
 Submariner is now installed.

-{{- if .Values.engine.nodeSelectorEnabled }}
+{{- if .Values.gateway.nodeSelectorEnabled }}
 If you haven't done so yet, please label a node as `submariner.io/gateway=true` to elect it for running Submariner.
 {{- end }}

@@ -43,13 +43,13 @@ Create the name of the submariner-operator service account to use
 {{- end -}}

 {{/*
-Create the name of the submariner-engine service account to use
+Create the name of the submariner-gateway service account to use
 */}}
-{{- define "submariner.engineServiceAccountName" -}}
-{{- if .Values.serviceAccounts.engine.create -}}
-    {{ default "submariner-engine" .Values.serviceAccounts.engine.name }}
+{{- define "submariner.gatewayServiceAccountName" -}}
+{{- if .Values.serviceAccounts.gateway.create -}}
+    {{ default "submariner-gateway" .Values.serviceAccounts.gateway.name }}
 {{- else -}}
-    {{ default "default" .Values.serviceAccounts.engine.name }}
+    {{ default "default" .Values.serviceAccounts.gateway.name }}
 {{- end -}}
 {{- end -}}

@@ -6,7 +6,7 @@ metadata:
    release: {{ .Release.Name | quote }}
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.fullname" . }}
-    component: engine
+    component: gateway
  name: {{ template "submariner.fullname" . }}
 spec:
  progressDeadlineSeconds: 600
@@ -86,7 +86,7 @@ roleRef:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ template "submariner.fullname" . }}:engine
+  name: {{ template "submariner.fullname" . }}:gateway
  labels:
    heritage: {{ .Release.Service | quote }}
    release: {{ .Release.Name | quote }}
@@ -166,7 +166,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ template "submariner.fullname" . }}:engine
+  name: {{ template "submariner.fullname" . }}:gateway
  labels:
    heritage: {{ .Release.Service | quote }}
    release: {{ .Release.Name | quote }}
@@ -175,10 +175,10 @@ metadata:
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
-  name: {{ template "submariner.fullname" . }}:engine
+  name: {{ template "submariner.fullname" . }}:gateway
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.engineServiceAccountName" . }}
+  name: {{ template "submariner.gatewayServiceAccountName" . }}
  namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -279,7 +279,7 @@ subjects:
  name: {{ template "submariner.routeAgentServiceAccountName" . }}
  namespace: {{ .Release.Namespace }}
 ---
-{{- if ne .Values.submariner.globalCidr "" }}
+{{- if .Values.broker.globalnet }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -397,6 +397,7 @@ rules:
    resources:
      - configmaps
    verbs:
+      - create
      - get
      - list
      - watch
@@ -411,11 +412,13 @@ rules:
      - create
      - update
      - delete
-  - apiGroups:  # pods and services are looked up to figure out network settings
+      - watch
+  - apiGroups:  # pods, services and nodes are looked up to figure out network settings
      - ""
    resources:
      - pods
      - services
+      - nodes
    verbs:
      - get
      - list
@@ -436,6 +439,21 @@ rules:
    verbs:
      - get
      - list
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -456,9 +474,32 @@ roleRef:
  name: {{ template "submariner.fullname" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: submariner-metrics-reader
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "services", "endpoints"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: read-submariner-metrics
+subjects:
+  - kind: ServiceAccount
+    name: prometheus-k8s
+    namespace: openshift-monitoring
+roleRef:
+  kind: Role
+  name: submariner-metrics-reader
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ template "submariner.fullname" . }}:engine
+  name: {{ template "submariner.fullname" . }}:gateway
  labels:
    heritage: {{ .Release.Service | quote }}
    release: {{ .Release.Name | quote }}
@@ -525,7 +566,7 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ template "submariner.fullname" . }}:engine
+  name: {{ template "submariner.fullname" . }}:gateway
  labels:
    heritage: {{ .Release.Service | quote }}
    release: {{ .Release.Name | quote }}
@@ -534,10 +575,10 @@ metadata:
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:engine
+  name: {{ template "submariner.fullname" . }}:gateway
 subjects:
  - kind: ServiceAccount
-    name: {{ template "submariner.engineServiceAccountName" . }}
+    name: {{ template "submariner.gatewayServiceAccountName" . }}
    namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -622,7 +663,7 @@ subjects:
    name: {{ template "submariner.routeAgentServiceAccountName" . }}
    namespace: {{ .Release.Namespace }}
 ---
-{{- if ne .Values.submariner.globalCidr "" }}
+{{- if .Values.broker.globalnet }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -637,14 +678,25 @@ rules:
      - ""
    resources:
      - pods
-      - services
      - namespaces
      - nodes
+      - endpoints
    verbs:
      - get
      - list
      - watch
      - update
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
  - apiGroups:
      - submariner.io
    resources:
@@ -654,6 +706,29 @@ rules:
      - get
      - list
      - watch
+  - apiGroups:
+      - submariner.io
+    resources:
+      - clusterglobalegressips
+      - globalegressips
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - submariner.io
+    resources:
+      - globalingressips
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
  - apiGroups:
      - multicluster.x-k8s.io
    resources:
@@ -708,6 +783,7 @@ rules:
      - discovery.k8s.io
    resources:
      - endpointslices
+      - endpointslices/restricted
    verbs:
      - create
      - get
@@ -720,6 +796,7 @@ rules:
      - submariner.io
    resources:
      - "gateways"
+      - "globalingressips"
    verbs:
      - get
      - list
@@ -9,7 +9,9 @@ spec:
  brokerK8sApiServerToken: {{ .Values.broker.token }}
  brokerK8sCA: {{ .Values.broker.ca }}
  brokerK8sRemoteNamespace: {{ .Values.broker.namespace }}
+  brokerK8sInsecure: {{ .Values.broker.insecure }}
  ceIPSecDebug: {{ .Values.ipsec.debug }}
+  ceIPSecForceUDPEncaps: {{ .Values.ipsec.forceUDPEncaps }}
  ceIPSecIKEPort: {{ .Values.ipsec.ikePort }}
  ceIPSecNATTPort: {{ .Values.ipsec.natPort }}
  ceIPSecPSK: {{ .Values.ipsec.psk }}
@@ -24,3 +26,13 @@ spec:
  serviceCIDR: "{{ .Values.submariner.serviceCidr }}"
  globalCIDR: "{{ .Values.submariner.globalCidr }}"
  serviceDiscoveryEnabled: {{ .Values.submariner.serviceDiscovery }}
+  cableDriver: {{ .Values.submariner.cableDriver }}
+  connectionHealthCheck:
+    enabled: {{ .Values.submariner.healthcheckEnabled }}
+    intervalSeconds: 1
+    maxPacketLossCount: 5
+{{- with .Values.submariner.coreDNSCustomConfig }}
+  coreDNSCustomConfig:
+    configmapName: {{ .configmapName }}
+    namespace: {{ .namespace }}
+{{- end }}
@@ -10,11 +10,11 @@ metadata:
    app: {{ template "submariner.name" . }}
 {{- end }}
 ---
-{{- if .Values.serviceAccounts.engine.create }}
+{{- if .Values.serviceAccounts.gateway.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ template "submariner.engineServiceAccountName" . }}
+  name: {{ template "submariner.gatewayServiceAccountName" . }}
  labels:
    heritage: {{ .Release.Service | quote }}
    release: {{ .Release.Name | quote }}
@@ -9,20 +9,25 @@ submariner:
  colorCodes: blue
  debug: false
  serviceDiscovery: true
+  cableDriver: "libreswan"
+  healthcheckEnabled: true
+  coreDNSCustomConfig: {}
  images:
    repository: quay.io/submariner
-    tag: "0.7.0"
+    tag: "0.10.1"
 broker:
  server: example.k8s.apiserver
  token: test
  namespace: xyz
  insecure: false
  ca: ""
+  globalnet: false
 rbac:
  create: true
 ipsec:
  psk: ""
  debug: false
+  forceUDPEncaps: false
  ikePort: 500
  natPort: 4500
 leadership:
@@ -32,20 +37,20 @@ leadership:
 operator:
  image:
    repository: quay.io/submariner/submariner-operator
-    tag: "0.7.0"
+    tag: "0.10.1"
    pullPolicy: IfNotPresent
  resources: {}
  tolerations: []
  affinity: {}
-engine:
+gateway:
  image:
-    repository: quay.io/submariner/submariner
-    tag: "0.7.0"
+    repository: quay.io/submariner/submariner-gateway
+    tag: "0.10.1"
 serviceAccounts:
  operator:
    create: true
    name: ""
-  engine:
+  gateway:
    create: true
    name: ""
  routeAgent:
@@ -1 +0,0 @@
-.git
@@ -1,12 +0,0 @@
---
-name: submariner
-version: 0.6.0
-appVersion: 0.6.0
-description: Submariner enables direct networking between Pods and Services in different Kubernetes clusters
-keywords:
-home: https://submariner-io.github.io/
-sources:
-  - https://submariner-io.github.io/submariner-charts/charts
-maintainers:
-  - name: Submariner Developers
-    email: submariner-dev@googlegroups.com
@@ -1,5 +0,0 @@
-# Submariner
-
-[Submariner](https://submariner.io) is a cross-cluster networking tool.
-
-This chart creates the required components in this cluster to enable cross cluster networking.
@@ -1,324 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: clusters.submariner.io
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Cluster
-    plural: clusters
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: endpoints.submariner.io
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Endpoint
-    plural: endpoints
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: gateways.submariner.io
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Gateway
-    plural: gateways
-  scope: Namespaced
-  additionalPrinterColumns:
-  - name: ha-status
-    type: string
-    description: High Availability Status of the Gateway
-    JSONPath: .status.haStatus
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: multiclusterservices.lighthouse.submariner.io
-spec:
-  group: lighthouse.submariner.io
-  version: v1
-  names:
-    kind: MultiClusterService
-    plural: multiclusterservices
-    singular: multiclusterservice
-  scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      properties:
-        spec:
-          properties:
-            clusterServiceInfo:
-              properties:
-                clusterID:
-                  type: "string"
-                clusterDomain:
-                  type: "string"
-                serviceIP:
-                  type: "string"
-                port:
-                  type: "integer"
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceexports.lighthouse.submariner.io
-spec:
-  group: lighthouse.submariner.io
-  version: v2alpha1
-  names:
-    kind: ServiceExport
-    plural: serviceexports
-    singular: serviceexport
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceimports.lighthouse.submariner.io
-spec:
-  group: lighthouse.submariner.io
-  version: v2alpha1
-  names:
-    kind: ServiceImport
-    plural: serviceimports
-    singular: serviceimport
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceexports.multicluster.x-k8s.io
-spec:
-  group: multicluster.x-k8s.io
-  scope: Namespaced
-  names:
-    plural: serviceexports
-    singular: serviceexport
-    kind: ServiceExport
-    shortNames:
-      - svcex
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - name: Age
-          type: date
-          jsonPath: .metadata.creationTimestamp
-      "schema":
-        "openAPIV3Schema":
-          description: ServiceExport declares that the Service with the same name and
-            namespace as this export should be consumable from other clusters.
-          type: object
-          properties:
-            apiVersion:
-              description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-              type: string
-            kind:
-              description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-              type: string
-            metadata:
-              type: object
-            status:
-              description: status describes the current state of an exported service.
-                Service configuration comes from the Service that had the same name
-                and namespace as this ServiceExport. Populated by the multi-cluster
-                service implementation's controller.
-              type: object
-              properties:
-                conditions:
-                  type: array
-                  items:
-                    description: "ServiceExportCondition contains details for the current
-                    condition of this service export. \n Once [KEP-1623](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1623-standardize-conditions)
-                    is implemented, this will be replaced by metav1.Condition."
-                    type: object
-                    required:
-                      - status
-                      - type
-                    properties:
-                      lastTransitionTime:
-                        type: string
-                        format: date-time
-                      message:
-                        type: string
-                      reason:
-                        type: string
-                      status:
-                        description: Status is one of {"True", "False", "Unknown"}
-                        type: string
-                        enum:
-                          - "True"
-                          - "False"
-                          - Unknown
-                      type:
-                        description: ServiceExportConditionType identifies a specific
-                          condition.
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - type
-                  x-kubernetes-list-type: map
---
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceimports.multicluster.x-k8s.io
-spec:
-  group: multicluster.x-k8s.io
-  scope: Namespaced
-  names:
-    plural: serviceimports
-    singular: serviceimport
-    kind: ServiceImport
-    shortNames:
-      - svcim
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-      subresources:
-        status: {}
-      additionalPrinterColumns:
-        - name: Type
-          type: string
-          description: The type of this ServiceImport
-          jsonPath: .spec.type
-        - name: IP
-          type: string
-          description: The VIP for this ServiceImport
-          jsonPath: .spec.ips
-        - name: Age
-          type: date
-          jsonPath: .metadata.creationTimestamp
-      "schema":
-        "openAPIV3Schema":
-          description: ServiceImport describes a service imported from clusters in a
-            ClusterSet.
-          type: object
-          properties:
-            apiVersion:
-              description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-              type: string
-            kind:
-              description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: spec defines the behavior of a ServiceImport.
-              type: object
-              required:
-                - ports
-                - type
-              properties:
-                ips:
-                  description: ip will be used as the VIP for this service when type
-                    is ClusterSetIP.
-                  type: array
-                  maxItems: 1
-                  items:
-                    type: string
-                ports:
-                  type: array
-                  items:
-                    description: ServicePort represents the port on which the service
-                      is exposed
-                    type: object
-                    required:
-                      - port
-                    properties:
-                      appProtocol:
-                        description: The application protocol for this port. This field
-                          follows standard Kubernetes label syntax. Un-prefixed names
-                          are reserved for IANA standard service names (as per RFC-6335
-                          and http://www.iana.org/assignments/service-names). Non-standard
-                          protocols should use prefixed names such as mycompany.com/my-custom-protocol.
-                          Field can be enabled with ServiceAppProtocol feature gate.
-                        type: string
-                      name:
-                        description: The name of this port within the service. This
-                          must be a DNS_LABEL. All ports within a ServiceSpec must have
-                          unique names. When considering the endpoints for a Service,
-                          this must match the 'name' field in the EndpointPort. Optional
-                          if only one ServicePort is defined on this service.
-                        type: string
-                      port:
-                        description: The port that will be exposed by this service.
-                        type: integer
-                        format: int32
-                      protocol:
-                        description: The IP protocol for this port. Supports "TCP",
-                          "UDP", and "SCTP". Default is TCP.
-                        type: string
-                  x-kubernetes-list-type: atomic
-                sessionAffinity:
-                  description: 'Supports "ClientIP" and "None". Used to maintain session
-                  affinity. Enable client IP based session affinity. Must be ClientIP
-                  or None. Defaults to None. Ignored when type is Headless More info:
-                  https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies'
-                  type: string
-                sessionAffinityConfig:
-                  description: sessionAffinityConfig contains session affinity configuration.
-                  type: object
-                  properties:
-                    clientIP:
-                      description: clientIP contains the configurations of Client IP
-                        based session affinity.
-                      type: object
-                      properties:
-                        timeoutSeconds:
-                          description: timeoutSeconds specifies the seconds of ClientIP
-                            type session sticky time. The value must be >0 && <=86400(for
-                            1 day) if ServiceAffinity == "ClientIP". Default value is
-                            10800(for 3 hours).
-                          type: integer
-                          format: int32
-                type:
-                  description: type defines the type of this service. Must be ClusterSetIP
-                    or Headless.
-                  type: string
-                  enum:
-                    - ClusterSetIP
-                    - Headless
-            status:
-              description: status contains information about the exported services that
-                form the multi-cluster service referenced by this ServiceImport.
-              type: object
-              properties:
-                clusters:
-                  description: clusters is the list of exporting clusters from which
-                    this service was derived.
-                  type: array
-                  items:
-                    description: ClusterStatus contains service configuration mapped
-                      to a specific source cluster
-                    type: object
-                    required:
-                      - cluster
-                    properties:
-                      cluster:
-                        description: cluster is the name of the exporting cluster. Must
-                          be a valid RFC-1123 DNS label.
-                        type: string
-                  x-kubernetes-list-map-keys:
-                    - cluster
-                  x-kubernetes-list-type: map
@@ -1,138 +0,0 @@
-questions:
- variable: defaultEngineImage
-  default: true
-  description: "Use default Submariner Engine image or specify a custom one"
-  label: Use default submariner engine image
-  type: boolean
-  show_subquestion_if: false
-  group: "Container Images"
-  subquestions:
-  - variable: engine.image.repository
-    default: "quay.io/submariner/submariner"
-    description: "Submariner Engine Image Repository"
-    type: string
-    label: Submariner Engine Image Repository
-  - variable: engine.image.tag
-    default: "0.6.0"
-    description: "Submariner Engine Image Tag"
-    type: string
-    label: Submariner Engine Image Tag
- variable: defaultRouteAgentImage
-  default: true
-  description: "Use default Submariner Route Agent image or specify a custom one"
-  label: Use default submariner route agent image
-  type: boolean
-  show_subquestion_if: false
-  group: "Container Images"
-  subquestions:
-  - variable: routeAgent.image.repository
-    default: "quay.io/submariner/submariner-route-agent"
-    description: "Submariner Route Agent Image Repository"
-    type: string
-    label: Submariner Route Agent Image Repository
-  - variable: routeAgent.image.tag
-    default: "0.6.0"
-    description: "Submariner Route Agent Image Tag"
-    type: string
-    label: Submariner Route Agent Image Tag
- variable: engine.nodeSelectorEnabled
-  default: true
-  description: "Restrict submariner to nodes labeled with submariner.io/gateway=true"
-  label: Restrict gateway deployments to specific nodes
-  type: boolean
-  group: "Gateway Configuration"
- variable: submariner.clusterId
-  default: ""
-  description: "Enter a unique cluster ID to identify this cluster"
-  type: string
-  label: "Cluster ID"
-  group: "Configuration"
-  required: true
- variable: ipsec.psk
-  default: ""
-  description: "Enter the pre-shared key for the IPsec Cable Engine"
-  type: string
-  label: "IPsec Pre-Shared Key"
-  group: "Configuration"
-  required: true
- variable: broker.type
-  type: enum
-  default: k8s
-  options:
-    - k8s
-  group: "Broker Configuration"
-  label: "Broker Type"
-  description: "Type of Broker to use"
- variable: broker.server
-  type: string
-  default: ""
-  group: "Broker Configuration"
-  label: "Broker Server"
-  description: "Broker server to use (without the https://)"
- variable: broker.insecure
-  type: boolean
-  default: false
-  show_subquestion_if: false
-  group: "Broker Configuration"
-  label: "Insecure Broker"
-  description: "Connect to K8s broker without validating CA"
-  subquestions:
-  - variable: broker.ca
-    type: string
-    description: "Base64 encoded broker ca.crt"
-    label: "Broker CA encoded in base64"
-    default: ""
- variable: broker.token
-  type: string
-  group: "Broker Configuration"
-  label: "Broker Token"
-  description: "Bearer token for broker"
- variable: broker.namespace
-  type: string
-  group: "Broker Configuration"
-  label: "Broker Namespace"
-  description: "Enter namespace to use on central broker"
- variable: submariner.clusterCidr
-  default: ""
-  description: "Enter the cluster CIDR (i.e. 10.42.0.0/16) for this cluster"
-  type: string
-  label: "Cluster CIDR"
-  group: "CIDR Configuration"
-  required: true
- variable: submariner.serviceCidr
-  default: ""
-  description: "Enter the service CIDR (i.e. 10.43.0.0/16) for this cluster"
-  type: string
-  label: "Service CIDR"
-  group: "CIDR Configuration"
-  required: true
- variable: submariner.natEnabled
-  type: boolean
-  default: false
-  group: "Advanced Configuration"
-  description: "If the gateway nodes for this cluster are behind 1:1 NAT, you should enable NAT"
-  label: "NAT Enabled"
- variable: crd.create
-  type: boolean
-  default: true
-  group: "Advanced Configuration"
-  description: "Create the Submariner CRDs, if deploying Submariner into the same cluster as the submariner-k8s-broker, you probably shouldn't create CRDs"
-  label: "CRD Creation Enabled"
- variable: submariner.debug
-  type: boolean
-  default: false
-  group: "Advanced Configuration"
-  description: "Enable submariner debug mode"
-  label: "Submariner Debug Enabled"
- variable: ipsec.debug
-  type: boolean
-  default: false
-  group: "Advanced Configuration"
-  description: "Enable Charon debug mode"
-  label: "Charon Enabled"
- variable: submariner.cableDriver
-  type: string
-  default: ""
-  group: "Advanced Configuration"
-  description: "Cable driver implementation"
-  label: "Cable Driver"
@@ -1,7 +0,0 @@
-Submariner is now installed.
-
-{{- if .Values.engine.nodeSelectorEnabled }}
-If you haven't done so yet, please label a node as `submariner.io/gateway=true` to elect it for running Submariner.
-{{- end }}
-
-By default, Submariner runs with 1 replica. If you have more than one Gateway host, you can scale Submariner to N replicas, and the other Submariner pods will simply join the leader election pool.
@@ -1,94 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "submariner.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "submariner.fullname" -}}
-{{- if .Values.fullnameOverride -}}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if contains $name .Release.Name -}}
-{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "submariner.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Create the name of the submariner-engine service account to use
-*/}}
-{{- define "submariner.engineServiceAccountName" -}}
-{{- if .Values.serviceAccounts.engine.create -}}
-    {{ default "submariner-engine" .Values.serviceAccounts.engine.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccounts.engine.name }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create the name of the submariner-route-agent service account to use
-*/}}
-{{- define "submariner.routeAgentServiceAccountName" -}}
-{{- if .Values.serviceAccounts.routeAgent.create -}}
-    {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccounts.routeAgent.name }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create the name of the submariner-globalnet service account to use
-*/}}
-{{- define "submariner.globalnetServiceAccountName" -}}
-{{- if .Values.serviceAccounts.globalnet.create -}}
-    {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccounts.globalnet.name }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create the name of the submariner-lighthouse-agent service account to use
-*/}}
-{{- define "submariner.lighthouseAgentServiceAccountName" -}}
-{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
-    {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create the name of the submariner-lighthouse-coredns service account to use
-*/}}
-{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
-{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
-    {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create the name of the submariner-lighthouse-coredns service name to use
-*/}}
-{{- define "submariner.lighthouseDnsName" -}}
-{{- default (printf "%s-lighthouse-coredns" (include "submariner.fullname" .)) .Values.lighthouseCoredns.name }}
-{{- end -}}
@@ -1,138 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.fullname" . }}-engine
-    component: engine
-  name: {{ template "submariner.fullname" . }}-gateway
-spec:
-  revisionHistoryLimit: 5
-  selector:
-    matchLabels:
-      app: {{ template "submariner.fullname" . }}-engine
-  updateStrategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        app: {{ template "submariner.fullname" . }}-engine
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-          - labelSelector:
-              matchExpressions:
-              - key: app
-                operator: In
-                values:
-                - {{ template "submariner.fullname" . }}-engine
-            topologyKey: "kubernetes.io/hostname"
-{{- with .Values.engine.affinity }}
-{{ toYaml . | indent 8 }}
-{{- end }}
-      nodeSelector:
-{{- if .Values.engine.nodeSelectorEnabled }}
-        submariner.io/gateway: "true"
-{{- end }}
-{{- with .Values.engine.nodeSelector }}
-{{ toYaml . | indent 8 }}
-{{- end }}
-{{- with .Values.engine.tolerations }}
-      tolerations:
-{{ toYaml . | indent 8 }}
-{{- end }}
-      containers:
-      - command:
-        - submariner.sh
-        env:
-        - name: SUBMARINER_NAMESPACE
-          value: "{{ .Release.Namespace }}"
-        - name: SUBMARINER_CLUSTERCIDR
-          value: "{{ .Values.submariner.clusterCidr }}"
-        - name: SUBMARINER_SERVICECIDR
-          value: "{{ .Values.submariner.serviceCidr }}"
-        - name: SUBMARINER_GLOBALCIDR
-          value: "{{ .Values.submariner.globalCidr }}"
-        - name: SUBMARINER_TOKEN
-          value: "{{ .Values.submariner.apiToken }}"
-        - name: SUBMARINER_CLUSTERID
-          value: "{{ .Values.submariner.clusterId }}"
-        - name: SUBMARINER_COLORCODES
-          value: "{{ .Values.submariner.colorCodes }}"
-        - name: SUBMARINER_DEBUG
-          value: "{{ .Values.submariner.debug }}"
-        - name: SUBMARINER_NATENABLED
-          value: "{{ .Values.submariner.natEnabled }}"
-        - name: SUBMARINER_BROKER
-          value: "{{ .Values.broker.type }}"
-        - name: SUBMARINER_CABLEDRIVER
-          value: "{{ .Values.submariner.cableDriver }}"
-{{- if eq .Values.broker.type "phpapi" }}
-        - name: BROKER_PHPAPI_PROTO
-          value: "{{ .Values.broker.proto }}"
-        - name: BROKER_PHPAPI_SERVER
-          value: "{{ .Values.broker.server }}"
-{{- end }}
-{{- if eq .Values.broker.type "k8s" }}
-        - name: BROKER_K8S_APISERVER
-          value: "{{ .Values.broker.server }}"
-        - name: BROKER_K8S_APISERVERTOKEN
-          value: "{{ .Values.broker.token }}"
-        - name: BROKER_K8S_REMOTENAMESPACE
-          value: "{{ .Values.broker.namespace }}"
-{{- if .Values.broker.insecure }}
-        - name: BROKER_K8S_INSECURE
-          value: "true"
-{{- else }}
-        - name: BROKER_K8S_CA
-          value: "{{ .Values.broker.ca }}"
-{{- end }}
-{{- end }}
-        - name: CE_IPSEC_PSK
-          value: "{{ .Values.ipsec.psk }}"
-        - name: CE_IPSEC_DEBUG
-          value: "{{ .Values.ipsec.debug }}"
-        - name: CE_IPSEC_IKEPORT
-          value: "{{ .Values.ipsec.ikePort }}"
-        - name: CE_IPSEC_NATTPORT
-          value: "{{ .Values.ipsec.natPort }}"
-        - name: LEADERSHIP_LEASEDURATION
-          value: "{{ .Values.leadership.leaseDuration }}"
-        - name: LEADERSHIP_RENEWDEADLINE
-          value: "{{ .Values.leadership.renewDeadline }}"
-        - name: LEADERSHIP_RETRYPERIOD
-          value: "{{ .Values.leadership.retryPeriod }}"
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: "spec.nodeName"
-        image: {{ .Values.engine.image.repository }}:{{ default .Chart.AppVersion .Values.engine.image.tag }}
-        imagePullPolicy: {{ .Values.engine.image.pullPolicy }}
-        name: submariner
-        resources:
-{{ toYaml .Values.engine.resources | indent 10 }}
-        securityContext:
-          allowPrivilegeEscalation: true
-          capabilities:
-            add:
-            - ALL
-          privileged: true
-          readOnlyRootFilesystem: false
-          runAsNonRoot: false
-        stdin: true
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        tty: true
-      dnsPolicy: ClusterFirst
-      hostNetwork: true
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 1
-      serviceAccountName: {{ template "submariner.engineServiceAccountName" . }}
@@ -1,63 +0,0 @@
-{{- if ne .Values.submariner.globalCidr "" }}
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: {{ template "submariner.fullname" . }}-globalnet
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.fullname" . }}-globalnet
-    component: globalnet
-spec:
-  selector:
-    matchLabels:
-      app: {{ template "submariner.fullname" . }}-globalnet
-  updateStrategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: {{ template "submariner.fullname" . }}-globalnet
-    spec:
-      hostNetwork: true
-      serviceAccountName: submariner-globalnet
-      serviceAccount: submariner-globalnet
-      terminationGracePeriodSeconds: 2
-      nodeSelector:
-        submariner.io/gateway: 'true'
-      containers:
-      - name: {{ template "submariner.fullname" . }}-globalnet
-        image: {{ .Values.globalnet.image.repository }}:{{  default .Chart.AppVersion .Values.globalnet.image.tag }}
-        imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
-        env:
-          - name: SUBMARINER_CLUSTERID
-            value: '{{ .Values.submariner.clusterId }}'
-          - name: SUBMARINER_EXCLUDENS
-            value: 'submariner-operator,kube-system,operators,openshift-monitoring,openshift-dns'
-          - name: SUBMARINER_NAMESPACE
-            value: '{{ .Release.Namespace }}'
-          - name: NODE_NAME
-            valueFrom:
-              fieldRef:
-                fieldPath: "spec.nodeName"
-        securityContext:
-          allowPrivilegeEscalation: true
-          capabilities:
-            add:
-              - ALL
-          privileged: true
-          readOnlyRootFilesystem: false
-          runAsNonRoot: false
-        volumeMounts:
-          # Because we don't actually run iptables locally, but chroot in to the host
-          - mountPath: /host
-            name: host-slash
-            readOnly: true
-      volumes:
-        - name: host-slash
-          hostPath:
-            path: /
-{{- end }}
@@ -1,74 +0,0 @@
-{{- if .Values.submariner.serviceDiscovery }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ template "submariner.lighthouseDnsName" . }}
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.lighthouseDnsName" . }}
-    component: lighthouse-coredns
-spec:
-  selector:
-    matchLabels:
-      app: {{ template "submariner.lighthouseDnsName" . }}
-  replicas: 2
-  template:
-    metadata:
-      labels:
-        app: {{ template "submariner.lighthouseDnsName" . }}
-    spec:
-      containers:
-        - args:
-            - -conf
-            - /etc/coredns/Corefile
-          image: {{ .Values.lighthouseCoredns.image.repository }}:{{  default .Chart.AppVersion .Values.lighthouseCoredns.image.tag }}
-          imagePullPolicy: {{ .Values.lighthouseCoredns.image.pullPolicy }}
-          name: {{ template "submariner.lighthouseDnsName" . }}
-          volumeMounts:
-            - mountPath: /etc/coredns
-              name: config-volume
-              readOnly: true
-      serviceAccountName: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
-      volumes:
-        - configMap:
-            defaultMode: 420
-            items:
-              - key: Corefile
-                path: Corefile
-            name: {{ template "submariner.lighthouseDnsName" . }}
-          name: config-volume
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ template "submariner.lighthouseDnsName" . }}
-  labels:
-    app: {{ template "submariner.lighthouseDnsName" . }}
-spec:
-  ports:
-    - name: udp
-      port: 53
-      protocol: UDP
-      targetPort: 53
-  selector:
-    app: {{ template "submariner.lighthouseDnsName" . }}
-  type: ClusterIP
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ template "submariner.lighthouseDnsName" . }}
-data:
-  Corefile: |
-    clusterset.local:53 {
-{{- if .Values.submariner.debug }}
-        log
-{{- end }}
-        lighthouse
-        errors
-        health
-        ready
-    }
-{{- end }}
@@ -1,55 +0,0 @@
-{{- if .Values.submariner.serviceDiscovery }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ template "submariner.fullname" . }}-lighthouse-agent
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.fullname" . }}-lighthouse-agent
-    component: lighthouse
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: {{ template "submariner.fullname" . }}-lighthouse-agent
-  template:
-    metadata:
-      labels:
-        app: {{ template "submariner.fullname" . }}-lighthouse-agent
-    spec:
-      serviceAccountName: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
-      containers:
-      - command:
-        - lighthouse-agent.sh
-        env:
-        - name: SUBMARINER_NAMESPACE
-          value: "{{ .Release.Namespace }}"
-        - name: SUBMARINER_CLUSTERID
-          value: "{{ .Values.submariner.clusterId }}"
-        - name: SUBMARINER_DEBUG
-          value: "{{ .Values.submariner.debug }}"
-{{- if ne .Values.submariner.globalCidr "" }}
-        - name: SUBMARINER_GLOBALNET_ENABLED
-          value: "true"
-{{- end }}
-        - name: BROKER_K8S_APISERVER
-          value: "{{ .Values.broker.server }}"
-        - name: BROKER_K8S_APISERVERTOKEN
-          value: "{{ .Values.broker.token }}"
-        - name: BROKER_K8S_REMOTENAMESPACE
-          value: "{{ .Values.broker.namespace }}"
-{{- if .Values.broker.insecure }}
-        - name: BROKER_K8S_INSECURE
-          value: "true"
-{{- else }}
-        - name: BROKER_K8S_CA
-          value: "{{ .Values.broker.ca }}"
-{{- end }}
-        name: {{ template "submariner.fullname" . }}-lighthouse-agent
-        image: {{ .Values.lighthouse.image.repository }}:{{  default .Chart.AppVersion  .Values.lighthouse.image.tag }}
-        imagePullPolicy: {{ .Values.lighthouse.image.pullPolicy }}
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 0
-{{- end }}
@@ -1,670 +0,0 @@
-{{- if .Values.rbac.create -}}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ template "submariner.fullname" . }}:engine
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-      - services
-      - services/finalizers
-      - endpoints
-      - persistentvolumeclaims
-      - events
-      - configmaps
-      - secrets
-    verbs:
-      - '*'
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-      - daemonsets
-      - replicasets
-      - statefulsets
-    verbs:
-      - '*'
-  - apiGroups:
-      - monitoring.coreos.com
-    resources:
-      - servicemonitors
-    verbs:
-      - get
-      - create
-  - apiGroups:
-      - apps
-    resourceNames:
-      - submariner-operator
-    resources:
-      - deployments/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - get
-  - apiGroups:
-      - apps
-    resources:
-      - replicasets
-    verbs:
-      - get
-  - apiGroups:
-      - submariner.io
-    resources:
-      - '*'
-      - servicediscoveries
-    verbs:
-      - '*'
-  - apiGroups:
-      - lighthouse.submariner.io
-    resources:
-      - '*'
-      - serviceexports
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:engine
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ template "submariner.fullname" . }}:engine
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.engineServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ template "submariner.fullname" . }}:routeagent
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-      - services
-      - services/finalizers
-      - endpoints
-      - persistentvolumeclaims
-      - events
-      - configmaps
-      - secrets
-    verbs:
-      - '*'
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-      - daemonsets
-      - replicasets
-      - statefulsets
-    verbs:
-      - '*'
-  - apiGroups:
-      - monitoring.coreos.com
-    resources:
-      - servicemonitors
-    verbs:
-      - get
-      - create
-  - apiGroups:
-      - apps
-    resourceNames:
-      - submariner-operator
-    resources:
-      - deployments/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - get
-  - apiGroups:
-      - apps
-    resources:
-      - replicasets
-    verbs:
-      - get
-  - apiGroups:
-      - submariner.io
-    resources:
-      - '*'
-      - servicediscoveries
-    verbs:
-      - '*'
-  - apiGroups:
-      - lighthouse.submariner.io
-    resources:
-      - '*'
-      - serviceexports
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:routeagent
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ template "submariner.fullname" . }}:routeagent
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.routeAgentServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
---
-{{- if ne .Values.submariner.globalCidr "" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ template "submariner.fullname" . }}:globalnet
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-      - services
-      - services/finalizers
-      - endpoints
-      - persistentvolumeclaims
-      - events
-      - configmaps
-      - secrets
-    verbs:
-      - '*'
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-      - daemonsets
-      - replicasets
-      - statefulsets
-    verbs:
-      - '*'
-  - apiGroups:
-      - monitoring.coreos.com
-    resources:
-      - servicemonitors
-    verbs:
-      - get
-      - create
-  - apiGroups:
-      - apps
-    resourceNames:
-      - submariner-operator
-    resources:
-      - deployments/finalizers
-    verbs:
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - get
-  - apiGroups:
-      - apps
-    resources:
-      - replicasets
-    verbs:
-      - get
-  - apiGroups:
-      - submariner.io
-    resources:
-      - '*'
-      - servicediscoveries
-    verbs:
-      - '*'
-  - apiGroups:
-      - lighthouse.submariner.io
-    resources:
-      - '*'
-      - serviceexports
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:globalnet
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ template "submariner.fullname" . }}:globalnet
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.globalnetServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
---
-{{- end -}}
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "submariner.fullname" . }}:engine
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-  - apiGroups:
-      - apiextensions.k8s.io
-    resources:
-      - customresourcedefinitions
-    verbs:
-      - get
-      - list
-      - create
-      - update
-      - delete
-  - apiGroups:  # pods and services are looked up to figure out network settings
-      - ""
-    resources:
-      - pods
-      - services
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - operator.openshift.io
-    resources:
-      - dnses
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - config.openshift.io
-    resources:
-      - networks
-    verbs:
-      - get
-      - list
-  - apiGroups:
-      - submariner.io
-    resources:
-      - endpoints
-      - gateways
-      - clusters
-    verbs:
-      - get
-      - list
-      - watch
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:engine
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:engine
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.engineServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "submariner.fullname" . }}:routeagent
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - apiextensions.k8s.io
-    resources:
-      - customresourcedefinitions
-    verbs:
-      - get
-      - list
-      - create
-      - update
-      - delete
-  - apiGroups:  # pods and services are looked up to figure out network settings
-      - ""
-    resources:
-      - pods
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - operator.openshift.io
-    resources:
-      - dnses
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - config.openshift.io
-    resources:
-      - networks
-    verbs:
-      - get
-      - list
-  - apiGroups:
-      - ""
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-    resources:
-      - nodes
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:routeagent
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:routeagent
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.routeAgentServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
---
-{{- if ne .Values.submariner.globalCidr "" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "submariner.fullname" . }}:globalnet
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-      - services
-      - namespaces
-      - nodes
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - submariner.io
-    resources:
-      - endpoints
-      - clusters
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - multicluster.x-k8s.io
-    resources:
-      - "serviceexports"
-    verbs:
-      - get
-      - list
-      - watch
---
-{{- end -}}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:globalnet
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:globalnet
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.globalnetServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
---
-{{- if .Values.submariner.serviceDiscovery }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse-agent
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - services
-      - namespaces
-      - endpoints
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - discovery.k8s.io
-    resources:
-      - endpointslices
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
-      - deletecollection
-  - apiGroups:
-      - submariner.io
-    resources:
-      - "gateways"
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - multicluster.x-k8s.io
-    resources:
-      - "*"
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse-agent
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:lighthouse-agent
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - services
-      - namespaces
-      - endpoints
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - discovery.k8s.io
-    resources:
-      - endpointslices
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
-      - deletecollection
-  - apiGroups:
-      - lighthouse.submariner.io
-    resources:
-      - "*"
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
-  - apiGroups:
-      - submariner.io
-    resources:
-      - "gateways"
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - multicluster.x-k8s.io
-    resources:
-      - "*"
-    verbs:
-      - create
-      - get
-      - list
-      - watch
-      - update
-      - delete
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
-{{- end -}}
-{{- end -}}
@@ -1,82 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: {{ template "submariner.fullname" . }}-routeagent
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.fullname" . }}-routeagent
-    component: routeagent
-spec:
-  selector:
-    matchLabels:
-      app: {{ template "submariner.fullname" . }}-routeagent
-  updateStrategy:
-    rollingUpdate:
-      maxUnavailable: "100%"
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        heritage: {{ .Release.Service | quote }}
-        release: {{ .Release.Name | quote }}
-        chart: {{ template "submariner.chart" . }}
-        app: {{ template "submariner.fullname" . }}-routeagent
-        component: routeagent
-    spec:
-      serviceAccountName: {{ template "submariner.routeAgentServiceAccountName" . }}
-      terminationGracePeriodSeconds: 1
-      hostNetwork: true
-      containers:
-      - name: routeagent
-        command:
-        - submariner-route-agent.sh
-        image: {{ .Values.routeAgent.image.repository }}:{{  default .Chart.AppVersion .Values.routeAgent.image.tag }}
-        imagePullPolicy: {{ .Values.routeAgent.image.pullPolicy }}
-        env:
-        - name: SUBMARINER_NAMESPACE
-          value: "{{ .Release.Namespace }}"
-        - name: SUBMARINER_CLUSTERID
-          value: "{{ .Values.submariner.clusterId }}"
-        - name: SUBMARINER_DEBUG
-          value: "{{ .Values.submariner.debug }}"
-        - name: SUBMARINER_CLUSTERCIDR
-          value: "{{ .Values.submariner.clusterCidr }}"
-        - name: SUBMARINER_SERVICECIDR
-          value: "{{ .Values.submariner.serviceCidr }}"
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: "spec.nodeName"
-        resources:
-{{ toYaml .Values.routeAgent.resources | indent 10 }}
-        securityContext:
-          allowPrivilegeEscalation: true
-          capabilities:
-            add:
-            - ALL
-          privileged: true
-          readOnlyRootFilesystem: false
-          runAsNonRoot: false
-        volumeMounts:
-        # Because we don't actually run iptables locally, but chroot in to the host
-        - mountPath: /host
-          name: host-slash
-          readOnly: true
-{{- with .Values.routeAgent.nodeSelector }}
-      nodeSelector:
-{{ toYaml . | indent 8 }}
-{{- end }}
-{{- with .Values.routeAgent.tolerations }}
-      tolerations:
-{{ toYaml . | indent 8 }}
-{{- end }}
-{{- with .Values.routeAgent.affinity }}
-      affinity:
-{{ toYaml . | indent 8 }}
-{{- end }}
-      volumes:
-      - name: host-slash
-        hostPath:
-          path: /
@@ -1,59 +0,0 @@
-{{- if .Values.serviceAccounts.engine.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ template "submariner.engineServiceAccountName" . }}
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-{{- end }}
---
-{{- if .Values.serviceAccounts.routeAgent.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ template "submariner.routeAgentServiceAccountName" . }}
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-{{- end }}
---
-{{- if .Values.serviceAccounts.globalnet.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ template "submariner.globalnetServiceAccountName" . }}
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-{{- end }}
---
-{{- if .Values.serviceAccounts.lighthouseAgent.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-{{- end }}
---
-{{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: {{ template "submariner.chart" . }}
-    app: {{ template "submariner.name" . }}
-  {{- end }}
@@ -1,82 +0,0 @@
---
-submariner:
-  clusterId: ""
-  token: ""
-  clusterCidr: "10.42.0.0/16"
-  serviceCidr: "10.43.0.0/16"
-  globalCidr: ""
-  natEnabled: false
-  colorCodes: blue
-  debug: false
-  serviceDiscovery: false
-crd:
-  create: true
-broker:
-  type: k8s
-  server: example.k8s.apiserver
-  token: test
-  namespace: xyz
-  insecure: false
-  ca: ""
-rbac:
-  create: true
-ipsec:
-  psk: ""
-  debug: false
-  ikePort: 500
-  natPort: 4500
-leadership:
-  leaseDuration: 10
-  renewDeadline: 5
-  retryPeriod: 2
-engine:
-  image:
-    repository: quay.io/submariner/submariner
-    tag: ""
-    pullPolicy: IfNotPresent
-  resources: {}
-  nodeSelectorEnabled: true
-  nodeSelector: {}
-  tolerations: []
-  affinity: {}
-routeAgent:
-  image:
-    repository: quay.io/submariner/submariner-route-agent
-    tag: ""
-    pullPolicy: IfNotPresent
-  resources: {}
-  nodeSelector: {}
-  tolerations: []
-  affinity: {}
-globalnet:
-  image:
-    repository: quay.io/submariner/submariner-globalnet
-    tag: ""
-    pullPolicy: IfNotPresent
-lighthouse:
-  image:
-    repository: quay.io/submariner/lighthouse-agent
-    tag: ""
-    pullPolicy: IfNotPresent
-lighthouseCoredns:
-  name: ""
-  image:
-    repository: quay.io/submariner/lighthouse-coredns
-    tag: ""
-    pullPolicy: IfNotPresent
-serviceAccounts:
-  engine:
-    create: true
-    name: ""
-  routeAgent:
-    create: true
-    name: ""
-  globalnet:
-    create: true
-    name: ""
-  lighthouseAgent:
-    create: true
-    name: ""
-  lighthouseCoreDns:
-    create: true
-    name: ""
Author	SHA1	Message	Date
NegashandGitHub	9ba0123e72	Fix coreDNSCustomConfig values Signed-off-by: Negash <i@negash.ru>	2022-01-05 12:47:35 +00:00
Sridhar GaddamandThomas Pantelis	b3a5e40a5a	Globalnet include ClusterRole for services As part of Globalnet enhancement where kubeproxy dependency is removed, the Globalnet Pod will now create internal services for every exported service in the respective namespace where the original service resides. This PR adds the necessary clusterRole to allow Globalnet pod to create/delete such internal services. Related to: https://github.com/submariner-io/submariner/issues/1166 Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>	2022-01-04 07:48:50 -05:00
Stephen KittandThomas Pantelis	9358c86eb5	Add roles and privileges required for monitoring This replicates the RBAC changes applied to the operator in https://github.com/submariner-io/submariner-operator/pull/1416 Fixes: #191 Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-12-16 07:59:53 -05:00
Masaki KimuraandDaniel Farrell	5da180d44f	Allow submariner-globalnet role to handle endpoints Signed-off-by: Masaki Kimura <masaki.kimura@hitachivantara.com>	2021-12-14 21:44:22 -05:00
Stephen KittandThomas Pantelis	7068abafc8	Add dfarrell07 as *.md code owner See <https://github.com/submariner-io/submariner/issues/1622>. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-12-13 07:44:09 -05:00
Stephen KittandDaniel Farrell	2cfbd5c394	Update all CRDs to v1 CRDs ... and drop the obsolete Lighthouse CRDs. Fixes: #186 Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-12-08 15:37:07 -05:00
Stephen KittandThomas Pantelis	42a2af008a	Pass the broker.insecure flag to the CR Fixes: #185 Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-12-06 11:07:45 -05:00
Stephen KittandThomas Pantelis	1fbd3da4ae	Remove mangelajo from CODEOWNERS ... with his approval. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-11-18 08:36:24 -05:00
Mike KolesnikandStephen Kitt	8c2c55cc9b	Use YAML settings for shipyard Makes it simple to view and change the deployment settings Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>	2021-11-09 10:49:38 +01:00
Stephen KittandThomas Pantelis	fc77796287	Update K8s versions: drop 1.17/1.18, add 1.21/1.22 1.17 and 1.18 have reached EOL. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-11-08 13:52:07 -05:00
Vishal ThaparandDaniel Farrell	220ccc34f5	Fix connectionHealthCheck connectionHealthCheck in submariner CR is a nested field but is being added as a variable. This means it is ignored and the field isn't set correctly in gateway pods. Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>	2021-10-27 12:36:06 -04:00
Aswin SurayanarayananandThomas Pantelis	c3a885fec9	Add RBAC permission endpointslices/restricted in broker roles Fixes : github.com/submariner-io/lighthouse/issues#627 Signed-off-by: Aswin Surayanarayanan <asuryana@redhat.com>	2021-10-26 08:12:41 -04:00
Víctor Felipe Godoy Hernández Thomas Pantelis Sridhar Gaddam	17f4fecfd9	Update submariner-operator/questions.yml Co-authored-by: Sridhar Gaddam <sgaddam@redhat.com> Signed-off-by: Victor Godoy Hernández <vigohe@gmail.com>	2021-10-25 09:12:47 -04:00
Victor Godoy HernándezandThomas Pantelis	9ee272bec8	Update Readme.md Signed-off-by: Victor Godoy Hernández <vigohe@gmail.com>	2021-10-25 09:12:47 -04:00
Victor Godoy HernándezandThomas Pantelis	9347e8f345	Add ceIPSecForceUDPEncaps & coreDNSCustomConfig variables Signed-off-by: Victor Godoy Hernández <vigohe@gmail.com>	2021-10-25 09:12:47 -04:00
Victor Godoy HernándezandThomas Pantelis	916f255461	Add enable/disable connectionHealthCheck Signed-off-by: Victor Godoy Hernández <vigohe@gmail.com>	2021-10-25 09:12:47 -04:00
Victor Godoy HernándezandThomas Pantelis	756daf344e	Bump up to 0.10.1 Signed-off-by: Victor Godoy Hernández <vigohe@gmail.com>	2021-10-25 09:12:47 -04:00
Mike KolesnikandThomas Pantelis	839d20f972	Rename job so it won't shard on stable branches Right now auto release logic updates `devel` to the stable branch name when creating stable branches. This leads to this job "sharding" into multiple jobs, and messes up branch protections. To keep things simple, the main job name will remain the same so that there's no "PR targets X" and "PR targets Y" jobs, just the one "PR targets branch" job Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>	2021-10-20 11:18:35 -04:00
Vishal ThaparandStephen Kitt	6b7fed425a	Add endpontslices/restricted to lighthouse-agent Fixes: submariner-io/lighthouse#627 Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>	2021-10-19 16:22:31 +02:00
Stephen KittandThomas Pantelis	ea1df8ed54	Add Sridhar Gaddam as code owner ... since he is now a project administrator, as voted on the mailing list. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-10-01 12:32:51 -04:00
Daniel FarrellandThomas Pantelis	2788692ffc	Update create-issue-from-file GHA 2.3.2 to 3.0.0 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-09-14 08:00:47 -04:00
Daniel FarrellandThomas Pantelis	87390b6e5d	Enable strict YAML linting Fail yamllint on warnings, as we do with other repos. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-09-10 08:32:45 -04:00
Daniel FarrellandThomas Pantelis	47a7aec05d	Update ibiqlik/action-yamllint GHA 1.0.0 to 3.0.4 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-09-09 17:26:16 -04:00
Daniel FarrellandThomas Pantelis	eea398da4e	Use SHAs for GHA versions Per GitHub's security guidelines, GHAs should be pinned using full length commit SHAs instead of tags. The SHAs are of the commits currently resolved by the versions. Even "trusted" GHAs from GitHub developers are pinned because it's possible their repo rights could be compromised and a malicious GHA published. These core repos are not frequently substantially updated. Submariner-internal GHAs are left pinned at devel because we want automatic updates from Shipyard's shared tooling. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-08-24 08:18:22 -04:00
Daniel FarrellandDaniel Farrell	50489802e2	Don't run periodic PR dependency checks on forks As we do with the Flake Finder and other periodic jobs, skip the checks for PR dependencies on forks. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-08-09 16:39:00 -04:00
Janki ChhatbarandGitHub	cb78ab7aaa	Remove duplicated information (#162 ) Submariner, k8s, OS and kernel information are collected as part of `subctl gather`. Don't ask for them explicitly in bug report. Signed-off-by: Janki Chhatbar <jchhatba@redhat.com>	2021-07-27 09:47:20 +00:00
Daniel FarrellandDaniel Farrell	2f9156cf34	Extract helm-docs generation/testing to Makefile Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-07-27 05:00:56 -04:00
Stephen KittandThomas Pantelis	4b48a3d30c	Remove project-specific gitlint configuration We now use Shipyard's gitlint configuration everywhere. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-07-22 22:23:50 -04:00
Janki ChhatbarandDaniel Farrell	78294c1827	Enable PR dependency check jobs This job marks a PR `dependent` whenever a dependent PR is mentioned via `Depends on/ depends on` keyword. The job fails until the dependent PR is not merged. This helps in properly managing merging of dependent PRs. Signed-off-by: Janki Chhatbar <jchhatba@redhat.com>	2021-07-22 10:18:28 -04:00
Stephen KittandThomas Pantelis	29c87078b5	Increase days until stale to 120 This gives us a little over a full release to work on issues. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-07-16 15:04:52 -04:00
Vishal ThaparandThomas Pantelis	f757a66958	Allow lighthouse-agent access to ingressips `lighthouse-agent` `ClusterRole` requires access to `globalingressips` for Globalnetv2 in Lighthouse. Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>	2021-07-07 10:04:32 -04:00
Vishal ThaparandMiguel Angel Ajo Pelayo	ac4910d36b	Fix globalnetv2 ClusterRole Globalnetv2 requires `globalnet` `ClusterRole` for Egress/IngressIPs but those were added as `globalnet` `Role` instead. This change moves the permissions from `Role` to `ClusterRole` Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>	2021-07-07 13:33:54 +02:00
Daniel FarrellandGitHub	6869b47fc3	Add linter to check no "Apply suggestions" commits (#154 ) Add a linting job to verify that no commit message in a PR contains the case insensitive string "Apply suggestions from code review". Commits with exactly this title are generated by GitHub automatically when a batch of proposed changes from code review are accepted from the GitHub UI. A number of such commits have made it into various Submariner/* repos. Commits addressing code review feedback should typically be squashed into the commits under review, or made into well-commented discrete commits. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-06-30 16:26:39 +00:00
Daniel FarrellandGitHub	d3fcdc2c57	Add bot config for labeling when approved (#153 ) Will configure the submariner-bot to add the /ready-to-test label when a PR has two approvals, causing the full E2E workflow to run. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-06-30 13:39:53 +00:00
Daniel FarrellandDaniel Farrell	23968afbef	Add helm-docs generation and linting Generate docs for each chart and verify the committed docs match the generated docs. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-06-29 12:14:34 -05:00
Daniel FarrellandDaniel Farrell	90db64f64d	Add generated docs for both Helm charts Add docs generated by helm-docs for each chart. The docs will be kept up-to-date with CI and the contents of the docs can be improved in future changes to inline commenting. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-06-29 12:14:34 -05:00
Daniel FarrellandDaniel Farrell	4f5b617ae7	Ignore raw URLs in MDlint pending helm-docs bugfix The maintainers table generated by helm-docs includes a raw URL in Markdown, which fails markdownlint. I sent a PR upstream to fix the root of the issue, but for now we have to disable this linter rule. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-06-29 12:14:34 -05:00
Daniel FarrellandDaniel Farrell	06504b84d6	Ignore charts repo URL in MD link checking Somehow the GitHub Pages URL we use to publish and install the charts works to install the charts in CI but also fails with a 404 in CI. The URL is successfully used by Shipyard here: https://github.com/submariner-io/shipyard/blob/ 33dc2ffdadf6e520a2101368f7f7456c031bace0/scripts/shared/lib/ deploy_helm#L14 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-06-29 12:14:34 -05:00
Sridhar GaddamandThomas Pantelis	cff6e76f98	Add roles to access new Globalnet 2.0 objects Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>	2021-06-28 11:55:55 -04:00
Daniel FarrellandStephen Kitt	97782b4bb4	Split E2E into default and full Following the pattern from other repos, split the E2E test job into a default job that runs a single default-only test always on PRs and a full job that runs the full matrix when the ready-to-test label is added. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-06-22 15:10:19 +02:00
Daniel FarrellandDaniel Farrell	2938f26520	Add helm/chart-testing linting Fixes: #68 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-06-21 08:14:04 -05:00
Daniel FarrellandDaniel Farrell	c8b09b5c31	Name RBAC fields to match K8s requirements The colon in these field names isn't allowed by K8s, and fails ct linting. Use the new names from submariner-operator, which have already been renamed to fix this. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-06-21 08:14:04 -05:00
Daniel FarrellandDaniel Farrell	df86353f4b	Add required apiVersion field to Chart.yaml This field is required by standard chart schemas. It should be v2 for Charts that support Helm v3, as we do. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-06-21 08:14:04 -05:00
Daniel FarrellandDaniel Farrell	b0cdd50077	Use CNCF-wording for maintainers Use copyright notice wording required by CNCF for the maintainers field for both Chart.yaml files. Also fix an indentation error in one Chart.yaml file. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-06-21 08:14:04 -05:00
Janki ChhatbarandThomas Pantelis	69ff334c72	Add vxlan cable driver to test matrix Signed-Off-By: Janki Chhatbar <jchhatba@redhat.com>	2021-06-14 09:15:16 -04:00
Stephen KittandThomas Pantelis	df9a462b9b	Use short Kubernetes versions Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-06-01 22:25:17 -04:00
Steve MattarandDaniel Farrell	12c8e9b3ff	fix(rbac): add missing cluster roles to submariner-operator Signed-off-by: Steve Mattar <smattar@redhat.com>	2021-05-24 14:40:13 -05:00
Daniel FarrellandThomas Pantelis	55b0610620	Add pull request template Add a template for PRs with tips and pointers to docs. This completes a recommendation of the CII Best Practices program: > It is SUGGESTED that this policy on adding tests (see test_policy) be documented in the instructions for change proposals. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-05-20 12:34:36 -04:00
Daniel FarrellandMiguel Angel Ajo Pelayo	4b52dc668e	Add CII and merged-CI badges to README Add Submariner's CII Best Practices badge to the README. Add badges for workflows run against merged code. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-05-20 12:50:16 +02:00
Mike KolesnikandThomas Pantelis	6f94f29563	Don't run certain GHA jobs on forks Don't run jobs that aren't triggered on pull request on forks. Forks aren't likely to need these jobs, and theyre more likely to fail there. Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>	2021-05-12 07:35:11 -04:00
nyechielandThomas Pantelis	f0a0ae93bf	Fix a typo in support issue template Signed-off-by: nyechiel <nyechiel@redhat.com>	2021-05-03 09:29:11 -04:00
Stephen KittandThomas Pantelis	2b992c9f04	Disable the DCO GHA We've installed the DCO bot instead, as requested by the CNCF. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-04-28 08:43:32 -04:00
Tom Pantelis	b02dce884f	Fix the release job It's failing b/c the submariner chart was recently removed. Signed-off-by: Tom Pantelis <tompantelis@gmail.com>	2021-04-06 10:23:34 -04:00
Stephen KittandThomas Pantelis	c16442ac29	Add a failing check on PRs not targeting devel Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-04-05 13:26:24 -04:00
Daniel FarrellandThomas Pantelis	e0c75d7db2	Test K8s versions 1.18, 1.19, and 1.20 in E2E Use the new ability of the shared E2E GHA to configure the Kubernetes version. Add jobs that cover the latest available patch versions (limited by kind images) from the three most recent minor versions. Only run one E2E job with all-default configuration per K8s version, for some coverage with minimal overhead. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-04-05 13:07:59 -04:00
Stephen KittandDaniel Farrell	74b4a9d0bb	Remove the standalone Submariner chart This was deprecated in favour of the operator-based chart. This only removes the Submariner chart, the broker chart will be addressed separately. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-03-30 13:01:39 -05:00
Daniel FarrellandMiguel Angel Ajo Pelayo	50570be17c	Add flake finder periodic E2E tests Periodically run E2E tests against the merged (must have passed E2E gating) code to detect breakages due to external changes or flaky failures. Also supports debugging Helm-related failures in other repositories, by verifying (or not) what's passing here. Use the same test matrix as the current E2E job. Mirrors similar tests in other Submariner repositories. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-03-16 09:06:04 +01:00
Mike KolesnikandDaniel Farrell	50a2d3db29	Import Makefile.dapper downloaded from Shipyard Instead of redefining the dapper file here, download it from Shiyard Also use the BASE_BRANCH env variable for the dapper file Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>	2021-03-10 19:43:24 -05:00
Mike KolesnikandDaniel Farrell	51975c6bc7	Use 'preload-images' from Shipyard Now that it's a standard target, use it instead of having specific code here Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>	2021-03-10 19:27:17 -05:00
Mike Kolesnik	8d326e660e	Use the 'using' input for the E2E GHA Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>	2021-03-10 17:41:07 +02:00
Steve MattarandSteve Mattar	c450f75c8e	feat: add lighthouse to e2e matrix Signed-off-by: Steve Mattar <smattar@redhat.com>	2021-03-10 16:41:48 +02:00
Steve MattarandSteve Mattar	d74e4a6fd4	feat: support ovn Signed-off-by: Steve Mattar <smattar@redhat.com>	2021-03-10 16:41:48 +02:00
Steve MattarandSteve Mattar	64d7c11506	refactor: globalnet should be under the broker Signed-off-by: Steve Mattar <smattar@redhat.com>	2021-03-10 16:41:48 +02:00
Daniel FarrellandThomas Pantelis	8d6ca0bd1d	Add cable driver to E2E matrix Run E2E tests for all currently-supported cable drivers. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-03-05 09:47:25 -05:00
Steve MattarandSteve Mattar	86ba2b8857	feat: support cableDriver value default is libreswan Closes #33 Signed-off-by: Steve Mattar <smattar@redhat.com>	2021-03-04 19:46:28 +02:00
Steve MattarandSteve Mattar	8d13ad14fb	refactor: rename the gateway deployment file Rename to maintain consistency and to follow the standards. Signed-off-by: Steve Mattar <smattar@redhat.com>	2021-03-04 15:53:03 +02:00
Steve MattarandGitHub	4a59718a34	refactor: rename submariner-engine to submariner-gateway (#122 ) Signed-off-by: Steve Mattar <smattar@redhat.com>	2021-03-02 08:57:52 -05:00
Mike KolesnikandGitHub	0c0e73c57f	Remove reliance on `version` script (#121 ) The script has been migrated to `Makefile.versions` so we can just rely on the `$VERSION` from there. Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>	2021-03-01 10:57:14 -05:00
Miguel Angel AjoandMiguel Angel Ajo Pelayo	dd6bc283c7	Enable globalnet E2E matrix Signed-off-by: Miguel Angel Ajo <majopela@redhat.com>	2021-02-24 15:01:01 +01:00
Miguel Angel AjoandThomas Pantelis	f3787856f6	Add globalCidr mappings to the submariner template also includes the questions.yaml which is UI. Signed-off-by: Miguel Angel Ajo <majopela@redhat.com>	2021-02-24 08:36:47 -05:00