mirror of
https://github.com/submariner-io/submariner-charts.git
synced 2026-09-21 17:20:35 +00:00
Sridhar GaddamandStephen Kitt
8f2bed6191
In an OCP Cluster, openshift-dns namespace has dns-default service and this is controlled by its operator. When Globalnet is deployed on OCP, it was seen that globalip annotation added to it is periodically getting deleted by the operator, so Globalnet tries to re-add the annotation and this goes on forever. This will cause Globalnet to consume CPU unnecessarily and could affect user-experience with Submariner Globalnet. We have plans to enhance Globalnet to improve its scalability, but until then we can exclude annotating services in openshift-dns namespace. Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>
60 lines
2.0 KiB
YAML
60 lines
2.0 KiB
YAML
{{- if ne .Values.submariner.globalCidr "" }}
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}-globalnet
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.fullname" . }}-globalnet
|
|
component: globalnet
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: {{ template "submariner.fullname" . }}-globalnet
|
|
updateStrategy:
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ template "submariner.fullname" . }}-globalnet
|
|
spec:
|
|
hostNetwork: true
|
|
serviceAccountName: submariner-globalnet
|
|
serviceAccount: submariner-globalnet
|
|
terminationGracePeriodSeconds: 2
|
|
nodeSelector:
|
|
submariner.io/gateway: 'true'
|
|
containers:
|
|
- name: {{ template "submariner.fullname" . }}-globalnet
|
|
image: {{ .Values.globalnet.image.repository }}:{{ default .Chart.AppVersion .Values.globalnet.image.tag }}
|
|
imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
|
|
env:
|
|
- name: SUBMARINER_CLUSTERID
|
|
value: '{{ .Values.submariner.clusterId }}'
|
|
- name: SUBMARINER_EXCLUDENS
|
|
value: 'submariner-operator,kube-system,operators,openshift-monitoring,openshift-dns'
|
|
- name: SUBMARINER_NAMESPACE
|
|
value: '{{ .Release.Namespace }}'
|
|
securityContext:
|
|
allowPrivilegeEscalation: true
|
|
capabilities:
|
|
add:
|
|
- ALL
|
|
privileged: true
|
|
readOnlyRootFilesystem: false
|
|
runAsNonRoot: false
|
|
volumeMounts:
|
|
# Because we don't actually run iptables locally, but chroot in to the host
|
|
- mountPath: /host
|
|
name: host-slash
|
|
readOnly: true
|
|
volumes:
|
|
- name: host-slash
|
|
hostPath:
|
|
path: /
|
|
{{- end }}
|