148 lines
3.8 KiB
YAML
148 lines
3.8 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: << service_account_name >>
|
|
namespace: << namespace >>
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: << service_account_name >>
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- services
|
|
- services/status
|
|
- nodes
|
|
- endpoints
|
|
- pods
|
|
verbs:
|
|
- list
|
|
- get
|
|
- watch
|
|
- update
|
|
- patch
|
|
- apiGroups:
|
|
- discovery.k8s.io
|
|
resources:
|
|
- endpointslices
|
|
verbs:
|
|
- list
|
|
- get
|
|
- watch
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- list
|
|
- get
|
|
- watch
|
|
- update
|
|
- create
|
|
- patch
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: << service_account_name >>
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: << service_account_name >>
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: << service_account_name >>
|
|
namespace: << namespace >>
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: << daemonset_name >>
|
|
namespace: << namespace >>
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: kube-vip
|
|
app.kubernetes.io/instance: << daemonset_name >>
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: kube-vip
|
|
app.kubernetes.io/instance: << daemonset_name >>
|
|
spec:
|
|
hostNetwork: true
|
|
dnsPolicy: ClusterFirstWithHostNet
|
|
serviceAccountName: << service_account_name >>
|
|
<%- if control_plane_only %>
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: node-role.kubernetes.io/master
|
|
operator: Exists
|
|
- matchExpressions:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
<%- endif %>
|
|
tolerations:
|
|
- operator: Exists
|
|
effect: NoSchedule
|
|
- operator: Exists
|
|
effect: NoExecute
|
|
containers:
|
|
- name: kube-vip
|
|
image: << image >>
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- manager
|
|
env:
|
|
- name: vip_arp
|
|
value: "true"
|
|
- name: port
|
|
value: "<< control_plane_port >>"
|
|
- name: vip_interface
|
|
value: "<< interface >>"
|
|
- name: vip_subnet
|
|
value: "<< vip_subnet >>"
|
|
- name: cp_enable
|
|
value: "<< control_plane_enabled | lower >>"
|
|
- name: cp_namespace
|
|
value: "<< namespace >>"
|
|
- name: vip_ddns
|
|
value: "false"
|
|
- name: svc_enable
|
|
value: "<< services_enabled | lower >>"
|
|
- name: svc_election
|
|
value: "<< service_election_enabled | lower >>"
|
|
- name: vip_leaderelection
|
|
value: "<< leader_election_enabled | lower >>"
|
|
- name: vip_leaseduration
|
|
value: "<< lease_duration >>"
|
|
- name: vip_renewdeadline
|
|
value: "<< renew_deadline >>"
|
|
- name: vip_retryperiod
|
|
value: "<< retry_period >>"
|
|
<%- if control_plane_enabled %>
|
|
- name: address
|
|
value: "<< vip_address >>"
|
|
<%- endif %>
|
|
<%- if services_interface_enabled %>
|
|
- name: vip_servicesinterface
|
|
value: "<< services_interface >>"
|
|
<%- endif %>
|
|
<%- if watch_services_namespace_enabled %>
|
|
- name: svc_namespace
|
|
value: "<< watch_services_namespace >>"
|
|
<%- endif %>
|
|
securityContext:
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
- SYS_TIME
|
|
resources: {}
|