mirror of
https://github.com/submariner-io/submariner-charts.git
synced 2026-09-20 21:30:35 +00:00
Sridhar Gaddam
277d91969b
In an OCP Cluster, openshift-monitoring namespace has couple of services and these are controlled by their respective operators. When Globalnet is deployed on OCP, it was seen that globalip annotation added to such services are periodically getting deleted by the operators, so Globalnet tries to re-add the annotation and this goes on forever. This will cause Globalnet to consume CPU unnecessarily and could affect user-experience with Submariner Globalnet. We have plans to enhance Globalnet to improve its scalability, but until then we can exclude annotating services in openshift-monitoring namespace. Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>
60 lines
2.0 KiB
YAML
60 lines
2.0 KiB
YAML
{{- if ne .Values.submariner.globalCidr "" }}
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}-globalnet
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.fullname" . }}-globalnet
|
|
component: globalnet
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: {{ template "submariner.fullname" . }}-globalnet
|
|
updateStrategy:
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ template "submariner.fullname" . }}-globalnet
|
|
spec:
|
|
hostNetwork: true
|
|
serviceAccountName: submariner-globalnet
|
|
serviceAccount: submariner-globalnet
|
|
terminationGracePeriodSeconds: 2
|
|
nodeSelector:
|
|
submariner.io/gateway: 'true'
|
|
containers:
|
|
- name: {{ template "submariner.fullname" . }}-globalnet
|
|
image: {{ .Values.globalnet.image.repository }}:{{ default .Chart.AppVersion .Values.globalnet.image.tag }}
|
|
imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
|
|
env:
|
|
- name: SUBMARINER_CLUSTERID
|
|
value: '{{ .Values.submariner.clusterId }}'
|
|
- name: SUBMARINER_EXCLUDENS
|
|
value: 'submariner-operator,kube-system,operators,openshift-monitoring'
|
|
- name: SUBMARINER_NAMESPACE
|
|
value: '{{ .Release.Namespace }}'
|
|
securityContext:
|
|
allowPrivilegeEscalation: true
|
|
capabilities:
|
|
add:
|
|
- ALL
|
|
privileged: true
|
|
readOnlyRootFilesystem: false
|
|
runAsNonRoot: false
|
|
volumeMounts:
|
|
# Because we don't actually run iptables locally, but chroot in to the host
|
|
- mountPath: /host
|
|
name: host-slash
|
|
readOnly: true
|
|
volumes:
|
|
- name: host-slash
|
|
hostPath:
|
|
path: /
|
|
{{- end }}
|