mirror of
https://github.com/submariner-io/submariner-charts.git
synced 2026-09-21 18:30:34 +00:00
Sridhar GaddamandMiguel Angel Ajo Pelayo
c905d9fdca
In K8s the default termination grace period for a Pod is 30 secs. However, for Submariner Pods, we were configuring this as 0 secs, because of which, cleanup was not happening in a consistent manner and we are seeing failures in CI jobs. This PR modifies the terminationGracePeriodSeconds to 10 secs. Along with this change, it also uses the proper namespace of submariner in the excluded namespaces. Fixes issue: https://github.com/submariner-io/submariner-charts/issues/39 Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
56 lines
1.8 KiB
YAML
56 lines
1.8 KiB
YAML
{{- if ne .Values.submariner.globalCidr "" }}
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}-globalnet
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.fullname" . }}-globalnet
|
|
component: globalnet
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: {{ template "submariner.fullname" . }}-globalnet
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ template "submariner.fullname" . }}-globalnet
|
|
spec:
|
|
hostNetwork: true
|
|
serviceAccountName: submariner-globalnet
|
|
serviceAccount: submariner-globalnet
|
|
terminationGracePeriodSeconds: 10
|
|
nodeSelector:
|
|
submariner.io/gateway: 'true'
|
|
containers:
|
|
- name: {{ template "submariner.fullname" . }}-globalnet
|
|
image: {{ .Values.globalnet.image.repository }}:{{ .Values.globalnet.image.tag }}
|
|
imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
|
|
env:
|
|
- name: SUBMARINER_CLUSTERID
|
|
value: '{{ .Values.submariner.clusterId }}'
|
|
- name: SUBMARINER_EXCLUDENS
|
|
value: 'submariner-operator,kube-system,operators'
|
|
- name: SUBMARINER_NAMESPACE
|
|
value: '{{ .Release.Namespace }}'
|
|
securityContext:
|
|
allowPrivilegeEscalation: true
|
|
capabilities:
|
|
add:
|
|
- ALL
|
|
privileged: true
|
|
readOnlyRootFilesystem: false
|
|
runAsNonRoot: false
|
|
volumeMounts:
|
|
# Because we don't actually run iptables locally, but chroot in to the host
|
|
- mountPath: /host
|
|
name: host-slash
|
|
readOnly: true
|
|
volumes:
|
|
- name: host-slash
|
|
hostPath:
|
|
path: /
|
|
{{- end }}
|