641c79c902
Adds "helm-toolkit.utils.merge" which is a replacement for the upstream sprig "merge" function which didn't quite do what we wanted, specifically it didn't merge slices, it just overrode one with the other. This PS also updates existing callsites of the sprig merge with "helm-toolkit.utils.merge". Change-Id: I456349558d4cf941d1bcb07fc76d0688b0a10782
312 lines
12 KiB
YAML
312 lines
12 KiB
YAML
{{/*
|
|
Copyright 2017 The Openstack-Helm Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/}}
|
|
|
|
{{- if .Values.manifests.daemonset_calico_node }}
|
|
{{- $envAll := . }}
|
|
|
|
{{- if empty .Values.conf.node.CALICO_IPV4POOL_CIDR -}}
|
|
{{- set .Values.conf.node "CALICO_IPV4POOL_CIDR" .Values.networking.podSubnet | quote | trunc 0 -}}
|
|
{{- end -}}
|
|
|
|
{{- if empty .Values.conf.node.FELIX_IPINIPMTU -}}
|
|
{{/*
|
|
#NOTE(portdirect): to err on the side of caution we subtract 20 from the physical
|
|
# MTU to account for IPIP overhead unless explicty turned off.
|
|
*/}}
|
|
{{- if eq .Values.conf.node.CALICO_IPV4POOL_IPIP "off" -}}
|
|
{{- set .Values.conf.node "FELIX_IPINIPMTU" .Values.networking.mtu | quote | trunc 0 -}}
|
|
{{- else -}}
|
|
{{- set .Values.conf.node "FELIX_IPINIPMTU" (sub .Values.networking.mtu 20) | quote | trunc 0 -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{- if .Values.images.local_registry.active -}}
|
|
{{- $_ := set .Values "pod_dependency" dict -}}
|
|
{{- $_ := include "helm-toolkit.utils.merge" (tuple .Values.pod_dependency .Values.dependencies.calico_node .Values.conditional_dependencies.local_image_registry) -}}
|
|
{{- else -}}
|
|
{{- $_ := set .Values "pod_dependency" .Values.dependencies.calico_node -}}
|
|
{{- end -}}
|
|
|
|
{{- $prometheus_annotations := $envAll.Values.monitoring.prometheus.calico_node }}
|
|
|
|
{{- $serviceAccountName := "calico-cni-plugin"}}
|
|
{{ tuple $envAll $envAll.Values.pod_dependency $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: calico-cni-plugin
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: {{ $serviceAccountName }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ $serviceAccountName }}
|
|
namespace: {{ .Release.Namespace }}
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
metadata:
|
|
name: {{ $serviceAccountName }}
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources:
|
|
- pods
|
|
- nodes
|
|
verbs:
|
|
- get
|
|
---
|
|
# This manifest installs the calico/node container, as well
|
|
# as the Calico CNI plugins and network config on
|
|
# each master and worker node in a Kubernetes cluster.
|
|
kind: DaemonSet
|
|
apiVersion: extensions/v1beta1
|
|
metadata:
|
|
name: calico-node
|
|
namespace: kube-system
|
|
labels:
|
|
k8s-app: calico-node
|
|
{{ tuple $envAll "calico" "node" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
k8s-app: calico-node
|
|
{{ tuple $envAll "calico" "node" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
k8s-app: calico-node
|
|
{{ tuple $envAll "calico" "node" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
|
annotations:
|
|
# Mark this pod as a critical add-on; when enabled, the critical add-on scheduler
|
|
# reserves resources for critical add-on pods so that they can be rescheduled after
|
|
# a failure. This annotation works in tandem with the toleration below.
|
|
scheduler.alpha.kubernetes.io/critical-pod: ''
|
|
{{- if .Values.monitoring.prometheus.enabled }}
|
|
{{ tuple $prometheus_annotations | include "helm-toolkit.snippets.prometheus_pod_annotations" | indent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
hostNetwork: true
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/master
|
|
effect: NoSchedule
|
|
# Allow this pod to be rescheduled while the node is in "critical add-ons only" mode.
|
|
# This, along with the annotation above marks this pod as a critical add-on.
|
|
- key: CriticalAddonsOnly
|
|
operator: Exists
|
|
serviceAccountName: {{ $serviceAccountName }}
|
|
terminationGracePeriodSeconds: {{ .Values.pod.lifecycle.termination_grace_period.node.timeout | default "30" }}
|
|
initContainers:
|
|
{{ tuple $envAll .Values.pod_dependency list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
|
|
containers:
|
|
# Runs calico/node container on each Kubernetes node. This
|
|
# container programs network policy and routes on each
|
|
# host.
|
|
- name: calico-node
|
|
{{ tuple $envAll "calico_node" | include "helm-toolkit.snippets.image" | indent 10 }}
|
|
{{ tuple $envAll $envAll.Values.pod.resources.calico_node | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
|
env:
|
|
{{ include "helm-toolkit.utils.to_k8s_env_vars" .Values.conf.node | indent 12 }}
|
|
# The location of the Calico etcd cluster.
|
|
- name: ETCD_ENDPOINTS
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: calico-etc
|
|
key: etcd_endpoints
|
|
# Set noderef for node controller.
|
|
- name: CALICO_K8S_NODE_REF
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
{{ if .Values.endpoints.etcd.auth.client.tls.ca}}
|
|
- name: ETCD_CA_CERT_FILE
|
|
value: {{ .Values.endpoints.etcd.auth.client.path.ca }}
|
|
{{ end }}
|
|
{{ if .Values.endpoints.etcd.auth.client.tls.key}}
|
|
- name: ETCD_KEY_FILE
|
|
value: {{ .Values.endpoints.etcd.auth.client.path.key }}
|
|
{{ end }}
|
|
{{ if .Values.endpoints.etcd.auth.client.tls.crt}}
|
|
- name: ETCD_CERT_FILE
|
|
value: {{ .Values.endpoints.etcd.auth.client.path.crt }}
|
|
{{ end }}
|
|
securityContext:
|
|
privileged: true
|
|
volumeMounts:
|
|
- mountPath: /lib/modules
|
|
name: lib-modules
|
|
readOnly: true
|
|
- mountPath: /var/run/calico
|
|
name: var-run-calico
|
|
readOnly: false
|
|
- mountPath: /etc/calico/confd/templates/bird6.cfg.mesh.template
|
|
name: calico-etc
|
|
subPath: bird6.cfg.mesh.template
|
|
- mountPath: /etc/calico/confd/templates/bird6.cfg.no-mesh.template
|
|
name: calico-etc
|
|
subPath: bird6.cfg.no-mesh.template
|
|
- mountPath: /etc/calico/confd/templates/bird6_ipam.cfg.template
|
|
name: calico-etc
|
|
subPath: bird6_ipam.cfg.template
|
|
- mountPath: /etc/calico/confd/templates/bird_aggr.cfg.template
|
|
name: calico-etc
|
|
subPath: bird_aggr.cfg.template
|
|
- mountPath: /etc/calico/confd/templates/bird.cfg.mesh.template
|
|
name: calico-etc
|
|
subPath: bird.cfg.mesh.template
|
|
- mountPath: /etc/calico/confd/templates/bird.cfg.no-mesh.template
|
|
name: calico-etc
|
|
subPath: bird.cfg.no-mesh.template
|
|
- mountPath: /etc/calico/confd/templates/bird_ipam.cfg.template
|
|
name: calico-etc
|
|
subPath: bird_ipam.cfg.template
|
|
- mountPath: /etc/calico/confd/templates/custom_filters6.cfg.template
|
|
name: calico-etc
|
|
subPath: custom_filters6.cfg.template
|
|
- mountPath: /etc/calico/confd/templates/custom_filters.cfg.template
|
|
name: calico-etc
|
|
subPath: custom_filters.cfg.template
|
|
- mountPath: /etc/calico/confd/templates/tunl-ip.template
|
|
name: calico-etc
|
|
subPath: tunl-ip.template
|
|
- name: calico-certificates
|
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.ca }}
|
|
subPath: tls.ca
|
|
readOnly: true
|
|
- name: calico-certificates
|
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.crt }}
|
|
subPath: tls.crt
|
|
readOnly: true
|
|
- name: calico-certificates
|
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.key }}
|
|
subPath: tls.key
|
|
readOnly: true
|
|
# This container installs the Calico CNI binaries
|
|
# and CNI network config file on each node.
|
|
- name: install-cni
|
|
{{ tuple $envAll "calico_cni" | include "helm-toolkit.snippets.image" | indent 10 }}
|
|
{{ tuple $envAll $envAll.Values.pod.resources.calico_cni | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
|
command: ["/install-cni.sh"]
|
|
env:
|
|
# The location of the Calico etcd cluster.
|
|
- name: ETCD_ENDPOINTS
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: calico-etc
|
|
key: etcd_endpoints
|
|
# The CNI network config to install on each node.
|
|
- name: CNI_NETWORK_CONFIG
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: calico-etc
|
|
key: cni_network_config
|
|
volumeMounts:
|
|
- name: cni-bin-dir
|
|
mountPath: /host/opt/cni/bin
|
|
- name: cni-net-dir
|
|
mountPath: /host/etc/cni/net.d
|
|
{{ if .Values.manifests.daemonset_calico_node_calicoctl }}
|
|
- name: install-calicoctl
|
|
{{ tuple $envAll "calico_ctl" | include "helm-toolkit.snippets.image" | indent 10 }}
|
|
{{ tuple $envAll $envAll.Values.pod.resources.calico_ctl | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
|
command:
|
|
- /tmp/install-calicoctl.sh
|
|
env:
|
|
- name: ETCD_ENDPOINTS
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: calico-etc
|
|
key: etcd_endpoints
|
|
{{ if .Values.endpoints.etcd.auth.client.tls.ca}}
|
|
- name: ETCD_CA_CERT_FILE
|
|
value: {{ .Values.endpoints.etcd.auth.client.path.ca }}
|
|
- name: ETCD_CA_CERT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: calico-certificates
|
|
key: tls.ca
|
|
{{ end }}
|
|
{{ if .Values.endpoints.etcd.auth.client.tls.key}}
|
|
- name: ETCD_KEY_FILE
|
|
value: {{ .Values.endpoints.etcd.auth.client.path.key }}
|
|
- name: ETCD_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: calico-certificates
|
|
key: tls.key
|
|
{{ end }}
|
|
{{ if .Values.endpoints.etcd.auth.client.tls.crt}}
|
|
- name: ETCD_CERT_FILE
|
|
value: {{ .Values.endpoints.etcd.auth.client.path.crt }}
|
|
- name: ETCD_CERT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: calico-certificates
|
|
key: tls.crt
|
|
{{ end }}
|
|
volumeMounts:
|
|
- mountPath: /host/etc/calico
|
|
name: calico-cert-dir
|
|
- mountPath: /host/opt/cni/bin
|
|
name: cni-bin-dir
|
|
- mountPath: /tmp/install-calicoctl.sh
|
|
name: calico-bin
|
|
subPath: install-calicoctl.sh
|
|
- name: calico-certificates
|
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.ca }}
|
|
subPath: tls.ca
|
|
readOnly: true
|
|
- name: calico-certificates
|
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.crt }}
|
|
subPath: tls.crt
|
|
readOnly: true
|
|
- name: calico-certificates
|
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.key }}
|
|
subPath: tls.key
|
|
readOnly: true
|
|
{{ end }}
|
|
volumes:
|
|
# Used by calico/node.
|
|
- name: lib-modules
|
|
hostPath:
|
|
path: /lib/modules
|
|
- name: var-run-calico
|
|
hostPath:
|
|
path: /var/run/calico
|
|
# Used to install CNI.
|
|
- name: cni-bin-dir
|
|
hostPath:
|
|
path: /opt/cni/bin
|
|
- name: cni-net-dir
|
|
hostPath:
|
|
path: /etc/cni/net.d
|
|
- name: calico-cert-dir
|
|
hostPath:
|
|
path: /etc/calico
|
|
- name: calico-etc
|
|
configMap:
|
|
name: calico-etc
|
|
defaultMode: 0444
|
|
- name: calico-bin
|
|
configMap:
|
|
name: calico-bin
|
|
defaultMode: 0555
|
|
- name: calico-certificates
|
|
secret:
|
|
secretName: calico-certificates
|
|
{{- end }}
|