131 lines
2.8 KiB
YAML
131 lines
2.8 KiB
YAML
{{ if eq "knet-wg" .vars.cni_provider }}
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: ClusterRole
|
||
metadata:
|
||
name: knet-wg
|
||
rules:
|
||
- apiGroups:
|
||
- ""
|
||
resources:
|
||
- nodes
|
||
verbs:
|
||
- get
|
||
- list
|
||
- watch
|
||
- patch
|
||
- update
|
||
---
|
||
apiVersion: v1
|
||
kind: ServiceAccount
|
||
metadata:
|
||
namespace: kube-system
|
||
name: knet-wg
|
||
---
|
||
apiVersion: rbac.authorization.k8s.io/v1
|
||
kind: ClusterRoleBinding
|
||
metadata:
|
||
creationTimestamp: null
|
||
name: knet-wg
|
||
roleRef:
|
||
apiGroup: rbac.authorization.k8s.io
|
||
kind: ClusterRole
|
||
name: knet-wg
|
||
subjects:
|
||
- kind: ServiceAccount
|
||
name: knet-wg
|
||
namespace: kube-system
|
||
---
|
||
apiVersion: v1
|
||
kind: ConfigMap
|
||
metadata:
|
||
name: kubeconfig
|
||
namespace: kube-system
|
||
data:
|
||
kubeconfig.conf: |
|
||
apiVersion: v1
|
||
kind: Config
|
||
clusters:
|
||
- cluster:
|
||
certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||
server: https://[::1]:6444
|
||
name: default
|
||
users:
|
||
- name: default
|
||
user:
|
||
tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||
contexts:
|
||
- context:
|
||
cluster: default
|
||
namespace: default
|
||
user: default
|
||
name: default
|
||
current-context: default
|
||
---
|
||
apiVersion: apps/v1
|
||
kind: DaemonSet
|
||
metadata:
|
||
namespace: kube-system
|
||
name: knet-wg
|
||
spec:
|
||
selector:
|
||
matchLabels: { app: knet-wg }
|
||
template:
|
||
metadata:
|
||
labels: { app: knet-wg }
|
||
spec:
|
||
tolerations:
|
||
- operator: "Exists"
|
||
effect: "NoSchedule"
|
||
serviceAccountName: knet-wg
|
||
hostNetwork: true
|
||
priorityClassName: system-node-critical
|
||
containers:
|
||
- name: knet-wg
|
||
image: mcluseau/knet-wg:0.9.0
|
||
args:
|
||
- --key-path=/etc/knet-wg/wg.key
|
||
- --kubeconfig=/run/k8s/kubeconfig.conf # to work without kube-proxy, be sure to define the kubernetes host
|
||
- --nft
|
||
- --nft-masq-oif=!=kwg
|
||
- --node-name=$(NODE_NAME)
|
||
env:
|
||
- name: NODE_NAME
|
||
valueFrom:
|
||
fieldRef:
|
||
apiVersion: v1
|
||
fieldPath: spec.nodeName
|
||
securityContext:
|
||
capabilities:
|
||
add:
|
||
- NET_ADMIN
|
||
volumeMounts:
|
||
- name: cni
|
||
mountPath: /etc/cni
|
||
- name: wg
|
||
mountPath: /etc/wireguard
|
||
- name: modules
|
||
mountPath: /lib/modules
|
||
- name: knet-wg
|
||
mountPath: /etc/knet-wg
|
||
- name: k8s
|
||
mountPath: /run/k8s
|
||
volumes:
|
||
- name: cni
|
||
hostPath:
|
||
path: /etc/cni
|
||
- name: wg
|
||
hostPath:
|
||
path: /etc/wireguard
|
||
- name: modules
|
||
hostPath:
|
||
path: /lib/modules
|
||
- name: knet-wg
|
||
hostPath:
|
||
path: /var/lib/kubelet/knet-wg
|
||
# enable to work with a custom kubeconfig
|
||
- name: k8s
|
||
configMap:
|
||
name: kubeconfig
|
||
{{ end }}
|