131 lines
2.8 KiB
YAML
131 lines
2.8 KiB
YAML
|
{{ if eq "knet-wg" .vars.cni_provider }}
|
|||
|
|
---
|
|||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|||
|
|
kind: ClusterRole
|
|||
|
|
metadata:
|
|||
|
|
name: knet-wg
|
|||
|
|
rules:
|
|||
|
|
- apiGroups:
|
|||
|
|
- ""
|
|||
|
|
resources:
|
|||
|
|
- nodes
|
|||
|
|
verbs:
|
|||
|
|
- get
|
|||
|
|
- list
|
|||
|
|
- watch
|
|||
|
|
- patch
|
|||
|
|
- update
|
|||
|
|
---
|
|||
|
|
apiVersion: v1
|
|||
|
|
kind: ServiceAccount
|
|||
|
|
metadata:
|
|||
|
|
namespace: kube-system
|
|||
|
|
name: knet-wg
|
|||
|
|
---
|
|||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|||
|
|
kind: ClusterRoleBinding
|
|||
|
|
metadata:
|
|||
|
|
creationTimestamp: null
|
|||
|
|
name: knet-wg
|
|||
|
|
roleRef:
|
|||
|
|
apiGroup: rbac.authorization.k8s.io
|
|||
|
|
kind: ClusterRole
|
|||
|
|
name: knet-wg
|
|||
|
|
subjects:
|
|||
|
|
- kind: ServiceAccount
|
|||
|
|
name: knet-wg
|
|||
|
|
namespace: kube-system
|
|||
|
|
---
|
|||
|
|
apiVersion: v1
|
|||
|
|
kind: ConfigMap
|
|||
|
|
metadata:
|
|||
|
|
name: kubeconfig
|
|||
|
|
namespace: kube-system
|
|||
|
|
data:
|
|||
|
|
kubeconfig.conf: |
|
|||
|
|
apiVersion: v1
|
|||
|
|
kind: Config
|
|||
|
|
clusters:
|
|||
|
|
- cluster:
|
|||
|
|
certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
|||
|
|
server: https://[::1]:6444
|
|||
|
|
name: default
|
|||
|
|
users:
|
|||
|
|
- name: default
|
|||
|
|
user:
|
|||
|
|
tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
|||
|
|
contexts:
|
|||
|
|
- context:
|
|||
|
|
cluster: default
|
|||
|
|
namespace: default
|
|||
|
|
user: default
|
|||
|
|
name: default
|
|||
|
|
current-context: default
|
|||
|
|
---
|
|||
|
|
apiVersion: apps/v1
|
|||
|
|
kind: DaemonSet
|
|||
|
|
metadata:
|
|||
|
|
namespace: kube-system
|
|||
|
|
name: knet-wg
|
|||
|
|
spec:
|
|||
|
|
selector:
|
|||
|
|
matchLabels: { app: knet-wg }
|
|||
|
|
template:
|
|||
|
|
metadata:
|
|||
|
|
labels: { app: knet-wg }
|
|||
|
|
spec:
|
|||
|
|
tolerations:
|
|||
|
|
- operator: "Exists"
|
|||
|
|
effect: "NoSchedule"
|
|||
|
|
serviceAccountName: knet-wg
|
|||
|
|
hostNetwork: true
|
|||
|
|
priorityClassName: system-node-critical
|
|||
|
|
containers:
|
|||
|
|
- name: knet-wg
|
|||
|
|
image: mcluseau/knet-wg:0.9.0
|
|||
|
|
args:
|
|||
|
|
- --key-path=/etc/knet-wg/wg.key
|
|||
|
|
- --kubeconfig=/run/k8s/kubeconfig.conf # to work without kube-proxy, be sure to define the kubernetes host
|
|||
|
|
- --nft
|
|||
|
|
- --nft-masq-oif=!=kwg
|
|||
|
|
- --node-name=$(NODE_NAME)
|
|||
|
|
env:
|
|||
|
|
- name: NODE_NAME
|
|||
|
|
valueFrom:
|
|||
|
|
fieldRef:
|
|||
|
|
apiVersion: v1
|
|||
|
|
fieldPath: spec.nodeName
|
|||
|
|
securityContext:
|
|||
|
|
capabilities:
|
|||
|
|
add:
|
|||
|
|
- NET_ADMIN
|
|||
|
|
volumeMounts:
|
|||
|
|
- name: cni
|
|||
|
|
mountPath: /etc/cni
|
|||
|
|
- name: wg
|
|||
|
|
mountPath: /etc/wireguard
|
|||
|
|
- name: modules
|
|||
|
|
mountPath: /lib/modules
|
|||
|
|
- name: knet-wg
|
|||
|
|
mountPath: /etc/knet-wg
|
|||
|
|
- name: k8s
|
|||
|
|
mountPath: /run/k8s
|
|||
|
|
volumes:
|
|||
|
|
- name: cni
|
|||
|
|
hostPath:
|
|||
|
|
path: /etc/cni
|
|||
|
|
- name: wg
|
|||
|
|
hostPath:
|
|||
|
|
path: /etc/wireguard
|
|||
|
|
- name: modules
|
|||
|
|
hostPath:
|
|||
|
|
path: /lib/modules
|
|||
|
|
- name: knet-wg
|
|||
|
|
hostPath:
|
|||
|
|
path: /var/lib/kubelet/knet-wg
|
|||
|
|
# enable to work with a custom kubeconfig
|
|||
|
|
- name: k8s
|
|||
|
|
configMap:
|
|||
|
|
name: kubeconfig
|
|||
|
|
{{ end }}
|