submariner-charts/submariner/templates/globalnet.yaml

{{- if .Values.broker.globalnet }}
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: {{ template "submariner.fullname" . }}-globalnet
  labels:
    heritage: {{ .Release.Service | quote }}
    release: {{ .Release.Name | quote }}
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.fullname" . }}-globalnet
    component: globalnet
spec:
  selector:
    matchLabels:
      app: {{ template "submariner.fullname" . }}-globalnet
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: {{ template "submariner.fullname" . }}-globalnet
    spec:
      hostNetwork: true
      serviceAccountName: submariner-globalnet
      serviceAccount: submariner-globalnet
      terminationGracePeriodSeconds: 2
      nodeSelector:
        submariner.io/gateway: 'true'
      containers:
      - name: {{ template "submariner.fullname" . }}-globalnet
        image: {{ .Values.globalnet.image.repository }}:{{  default .Chart.AppVersion .Values.globalnet.image.tag }}
        imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
        env:
          - name: SUBMARINER_CLUSTERID
            value: '{{ .Values.submariner.clusterId }}'
          - name: SUBMARINER_EXCLUDENS
            value: 'submariner-operator,kube-system,operators,openshift-monitoring,openshift-dns'
          - name: SUBMARINER_NAMESPACE
            value: '{{ .Release.Namespace }}'
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: "spec.nodeName"
        securityContext:
          allowPrivilegeEscalation: true
          capabilities:
            add:
              - ALL
          privileged: true
          readOnlyRootFilesystem: false
          runAsNonRoot: false
        volumeMounts:
          # Because we don't actually run iptables locally, but chroot in to the host
          - mountPath: /host
            name: host-slash
            readOnly: true
      volumes:
        - name: host-slash
          hostPath:
            path: /
{{- end }}