feat(multus-cni): Move multus-cni to stable (#44892)
**Description** <!-- Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change. --> ⚒️ Fixes # <!--(issue)--> **⚙️ Type of change** - [X] ⚙️ Feature/App addition - [ ] 🪛 Bugfix - [ ] ⚠️ Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 🔃 Refactor of current code - [ ] 📜 Documentation Changes **🧪 How Has This Been Tested?** <!-- Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration --> CI **📃 Notes:** <!-- Please enter any other relevant information here --> **✔️ Checklist:** - [ ] ⚖️ My code follows the style guidelines of this project - [X] 👀 I have performed a self-review of my own code - [ ] #️⃣ I have commented my code, particularly in hard-to-understand areas - [ ] 📄 I have made changes to the documentation - [ ] 🧪 I have added tests to this description that prove my fix is effective or that my feature works - [X] ⬆️ I increased versions for any altered app according to semantic versioning - [X] I made sure the title starts with `feat(chart-name):`, `fix(chart-name):`, `chore(chart-name):`, `docs(chart-name):` or `fix(docs):` **➕ App addition** If this PR is an app addition please make sure you have done the following. - [ ] 🖼️ I have added an icon in the Chart's root directory called `icon.png` --- _Please don't blindly check all the boxes. Read them and only check those that apply. Those checkboxes are there for the reviewer to see what is this all about and the status of this PR with a quick glance._
This commit is contained in:
astro-stan
@@ -1,32 +0,0 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
# OWNERS file for Kubernetes
|
||||
OWNERS
|
||||
# helm-docs templates
|
||||
*.gotmpl
|
||||
# docs folder
|
||||
/docs
|
||||
# icon
|
||||
icon.png
|
||||
icon.webp
|
||||
icon-small.webp
|
||||
@@ -1,48 +0,0 @@
|
||||
annotations:
|
||||
artifacthub.io/links: |-
|
||||
- name: support
|
||||
url: https://discord.com/invite/tVsPTHWTtr
|
||||
truecharts.org/category: unsorted
|
||||
truecharts.org/max_helm_version: "3.17"
|
||||
truecharts.org/max_kubernetes_version: 1.32.0
|
||||
truecharts.org/min_helm_version: "3.14"
|
||||
truecharts.org/min_kubernetes_version: 1.24.0
|
||||
truecharts.org/train: incubator
|
||||
trueforge.org/category: network
|
||||
trueforge.org/max_helm_version: "4.1"
|
||||
trueforge.org/max_kubernetes_version: 1.35.0
|
||||
trueforge.org/min_helm_version: "3.14"
|
||||
trueforge.org/train: incubator
|
||||
apiVersion: v2
|
||||
appVersion: 4.2.3
|
||||
dependencies:
|
||||
- name: common
|
||||
version: 28.29.49
|
||||
repository: oci://oci.trueforge.org/truecharts
|
||||
condition: ""
|
||||
alias: ""
|
||||
tags: []
|
||||
import-values: []
|
||||
deprecated: false
|
||||
description: |
|
||||
A CNI meta-plugin for multi-homed pods in Kubernetes
|
||||
home: https://trueforge.org/truetech/truecharts/charts/incubator/multus-cni
|
||||
icon: https://trueforge.org/img/hotlink-ok/chart-icons/multus-cni.webp
|
||||
keywords:
|
||||
- cni
|
||||
- networking
|
||||
kubeVersion: '>=1.27.0-0'
|
||||
maintainers:
|
||||
- name: TrueCharts
|
||||
email: info@trueforge.org
|
||||
url: https://trueforge.org
|
||||
name: multus-cni
|
||||
sources:
|
||||
- https://ghcr.io/k8snetworkplumbingwg/multus-cni
|
||||
- https://ghcr.io/siderolabs/cni
|
||||
- https://github.com/k8snetworkplumbingwg/multus-cni
|
||||
- https://github.com/trueforge-org/truecharts/tree/master/charts/incubator/multus-cni
|
||||
- https://hub.docker.com/r/alpine/crane
|
||||
type: application
|
||||
version: 0.3.0
|
||||
|
||||
@@ -1,50 +0,0 @@
|
||||
---
|
||||
title: README
|
||||
---
|
||||
|
||||
## General Info
|
||||
|
||||
For more information about this Chart, please check the docs on the TrueCharts [website](https://trueforge.org/truecharts/charts/incubator/multus-cni)
|
||||
|
||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/trueforge-org/truecharts/issues/new/choose)**
|
||||
|
||||
## Installation
|
||||
|
||||
### Helm-Chart installation
|
||||
|
||||
To install TrueCharts Helm charts using Helm, you can use our OCI Repository.
|
||||
|
||||
`helm install mychart oci://oci.trueforge.org/truecharts/multus-cni`
|
||||
|
||||
For more information on how to install TrueCharts Helm charts, checkout the [instructions on the website](https://trueforge.org/truecharts/guides/)
|
||||
|
||||
## Chart Specific Guides and information
|
||||
|
||||
All our charts have dedicated documentation pages.
|
||||
The documentation for this chart can be found here:
|
||||
https://trueforge.org/truecharts/incubator/multus-cni
|
||||
|
||||
## Configuration Options
|
||||
|
||||
To view the chart specific options, please view Values.yaml included in the chart.
|
||||
The most recent version of which, is available here: https://github.com/trueforge-org/truecharts/blob/master/charts/incubator/multus-cni/values.yaml
|
||||
|
||||
All our Charts use a shared "common" library chart that contains most of the templating and options.
|
||||
For the complete overview of all available options, please checkout the documentation for them on the [common docs on our website](https://trueforge.org/truecharts-common/)
|
||||
|
||||
For information about the common chart and all defaults included with it, please review its values.yaml file available here: https://github.com/trueforge-org/truecharts/blob/master/charts/library/common/values.yaml
|
||||
|
||||
## Support
|
||||
|
||||
- See the [Website](https://truecharts.org)
|
||||
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||
- Open a [issue](https://github.com/trueforge-org/truecharts/issues/new/choose)
|
||||
|
||||
---
|
||||
|
||||
## Sponsor TrueCharts
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://trueforge.org/general/sponsor/) or contributing back to the project any way you can!
|
||||
|
||||
_All Rights Reserved - The TrueCharts Project_
|
||||
@@ -1,43 +0,0 @@
|
||||
workload:
|
||||
main:
|
||||
# This is a workaround for CI and should be removed once
|
||||
# https://github.com/trueforge-org/truecharts/issues/43512
|
||||
# is fixed
|
||||
type: Deployment
|
||||
|
||||
configmap:
|
||||
dummy:
|
||||
enabled: true
|
||||
data:
|
||||
123-dummy.conf: |
|
||||
{
|
||||
"cniVersion": "0.3.1",
|
||||
"name": "my-dummy-network",
|
||||
"type": "dummy",
|
||||
"ipam": {
|
||||
"type": "host-local",
|
||||
"ranges": [
|
||||
[
|
||||
{
|
||||
"subnet": "10.10.0.0/24",
|
||||
"gateway": "10.10.0.1"
|
||||
}
|
||||
]
|
||||
],
|
||||
"routes": [
|
||||
{ "dst": "0.0.0.0/0" }
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
persistence:
|
||||
dummy:
|
||||
enabled: true
|
||||
type: configmap
|
||||
# NOTE:
|
||||
# Must match the mount path specified in the `multus-cni` chart
|
||||
# under `persistence.cniconf.mountPath`
|
||||
mountPath: "/host/etc/cni/net.d/123-dummy.conf"
|
||||
objectName: dummy
|
||||
subPath: 123-dummy.conf
|
||||
readOnly: true
|
||||
@@ -1,275 +0,0 @@
|
||||
---
|
||||
title: Multus
|
||||
---
|
||||
|
||||
It is strongly recommended to check out the Multus [project documentation](https://github.com/k8snetworkplumbingwg/multus-cni/tree/master/docs) before
|
||||
you start configuring this chart.
|
||||
|
||||
## Integrations
|
||||
|
||||
### Cilium
|
||||
|
||||
Cilium is an exclusive CNI by default and needs to be configured to allow interoperation with other CNIs.
|
||||
|
||||
To do this, the following value needs to be added to the Cilium chart:
|
||||
|
||||
```yaml
|
||||
cni:
|
||||
exclusive: false
|
||||
```
|
||||
|
||||
### Talos
|
||||
|
||||
Talos does not ship all reference CNI plugins by default. You can check which
|
||||
CNI plugins are available in your talos install using the following command:
|
||||
|
||||
```bash
|
||||
$ talosctl list /opt/cni/bin
|
||||
NODE NAME
|
||||
192.168.1.10 .
|
||||
192.168.1.10 bridge
|
||||
192.168.1.10 cilium-cni
|
||||
192.168.1.10 firewall
|
||||
192.168.1.10 flannel
|
||||
192.168.1.10 host-local
|
||||
192.168.1.10 ipvlan
|
||||
192.168.1.10 loopback
|
||||
192.168.1.10 macvlan
|
||||
192.168.1.10 multus-shim
|
||||
192.168.1.10 passthru
|
||||
192.168.1.10 portmap
|
||||
```
|
||||
|
||||
If you find that the plugins you require are missing, you can use this chart to
|
||||
install them. To do so, you must enable the Talos integration and specify
|
||||
which CNI binaries you would like to have installed. For example:
|
||||
|
||||
```yaml
|
||||
multus:
|
||||
integrations:
|
||||
talos:
|
||||
enabled: true
|
||||
installCni:
|
||||
macvlan: true
|
||||
ipvlan: true
|
||||
```
|
||||
|
||||
The above configuration will install the `macvlan` and `ipvlan` CNI plugins. This
|
||||
is the default behaviour (as long as the talos integration is enabled), however,
|
||||
it can be disabled by setting the value of any of corresponding keys to `false`.
|
||||
On the other hand, more CNI plugins can be specified for installation by adding
|
||||
their names under the `installCni` map in the form of `<binary_name>: true`.
|
||||
|
||||
:::danger
|
||||
If the Talos integration is enabled, this chart assumes it has full control
|
||||
over all CNIs listed in `integrations.talos.installCni`(and set to `true`).
|
||||
During [uninstall](#uninstalling), it will remove all CNIs that are enabled
|
||||
(`true`). If this is undesired, set the keys of the relevant CNI names to `false`
|
||||
before enabling the [uninstall](#uninstalling) chart mode.
|
||||
:::
|
||||
|
||||
|
||||
## Adding network interfaces to workloads
|
||||
|
||||
Adding a network interface to a workload consists of 2 steps:
|
||||
|
||||
1. Defining the interface template via `NetworkAttachementDefinition` CRD.
|
||||
2. Attaching the interface to a pod via custom annotations
|
||||
|
||||
:::tip
|
||||
More details can be found in the [Multus documentation](https://github.com/k8snetworkplumbingwg/multus-cni/blob/master/docs/how-to-use.md#create-network-attachment-definition).
|
||||
:::
|
||||
|
||||
:::warning
|
||||
If you have a multi-node cluster, you will need to deploy the [Whereabouts](https://github.com/k8snetworkplumbingwg/whereabouts) plugin for IPAM management. The standard `host-local` IPAM plugin does not support multi-node IP assigment and using it may lead to IP conflicts, leaks and/or exhaustion
|
||||
:::
|
||||
|
||||
### Examples
|
||||
|
||||
#### Bridge network
|
||||
|
||||
```yaml
|
||||
apiVersion: k8s.cni.cncf.io/v1
|
||||
kind: NetworkAttachmentDefinition
|
||||
metadata:
|
||||
name: bridge-network-with-gateway
|
||||
spec:
|
||||
config: '{
|
||||
"cniVersion": "0.3.1",
|
||||
"name": "mynet",
|
||||
"type": "bridge",
|
||||
"bridge": "br-192-168-10",
|
||||
"isDefaultGateway": true,
|
||||
"ipMasq": true,
|
||||
"ipam": {
|
||||
"type": "host-local",
|
||||
"subnet": "192.168.10.0/24",
|
||||
"rangeStart": "192.168.10.200",
|
||||
"rangeEnd": "192.168.10.216",
|
||||
"gateway": "192.168.10.1"
|
||||
}
|
||||
}'
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: busybox-bridge-pod
|
||||
annotations:
|
||||
k8s.v1.cni.cncf.io/networks: bridge-network-with-gateway
|
||||
spec:
|
||||
containers:
|
||||
- name: busybox-container
|
||||
image: busybox:1.36
|
||||
command:
|
||||
- "sh"
|
||||
- "-c"
|
||||
- |
|
||||
ip addr
|
||||
echo
|
||||
ip r
|
||||
echo
|
||||
echo '----- Waiting indefinitely -----'
|
||||
sleep infinity
|
||||
```
|
||||
|
||||
#### Macvlan default route network
|
||||
|
||||
```yaml
|
||||
apiVersion: k8s.cni.cncf.io/v1
|
||||
kind: NetworkAttachmentDefinition
|
||||
metadata:
|
||||
name: macvlan-network
|
||||
spec:
|
||||
config: '{
|
||||
"cniVersion": "0.3.1",
|
||||
"name": "mynet",
|
||||
"type": "macvlan",
|
||||
"master": "eth0",
|
||||
"mode": "bridge",
|
||||
"ipam": {
|
||||
"type": "host-local",
|
||||
"subnet": "192.168.1.0/24",
|
||||
"rangeStart": "192.168.1.3",
|
||||
"rangeEnd": "192.168.1.99",
|
||||
"gateway": "192.168.1.1",
|
||||
"routes": [
|
||||
{ "dst": "0.0.0.0/0" }
|
||||
]
|
||||
}
|
||||
}'
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: busybox-macvlan-pod
|
||||
annotations:
|
||||
k8s.v1.cni.cncf.io/networks: |
|
||||
[{
|
||||
"name": "macvlan-network",
|
||||
"mac": "02:aa:bb:cc:dd:ee",
|
||||
"default-route": ["192.168.1.1"]
|
||||
}]
|
||||
spec:
|
||||
containers:
|
||||
- name: busybox-container
|
||||
image: busybox:1.36
|
||||
command:
|
||||
- "sh"
|
||||
- "-c"
|
||||
- |
|
||||
ip addr
|
||||
echo
|
||||
ip r
|
||||
echo
|
||||
echo '----- Waiting indefinitely -----'
|
||||
sleep infinity
|
||||
```
|
||||
|
||||
## Uninstalling
|
||||
|
||||
:::note
|
||||
Before uninstalling this chart, make sure to remove all workloads which make use
|
||||
of network interfaces deployed via Multus. Failing to do so may leave stale
|
||||
network interfaces in your cluster.
|
||||
:::
|
||||
|
||||
This chart makes several changes to the node's root filesystem (via host-path
|
||||
mounts). These changes cannot be reversed by simply uninstalling the chart.
|
||||
|
||||
To combat this, this chart provides an "uninstall" mode, which takes care of
|
||||
cleaning up any host filesystem changes made by this chart.
|
||||
|
||||
Therefore, when uninstalling, it is recommended to first configure the chart in
|
||||
"uninstall" mode like so:
|
||||
|
||||
```yaml
|
||||
multus:
|
||||
uninstall: true
|
||||
```
|
||||
|
||||
Once applied, a cleanup container will run (you can check the logs for progress)
|
||||
and when it is done, the chart can be safely uninstalled.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Missing networks after a node reboot
|
||||
|
||||
This is a common issue with Multus and is caused by a race condition, where the
|
||||
primary CNI starts before Multus after a node reboot. This causes workloads to
|
||||
start scheduling before Multus has started, using only the primary CNI to configure
|
||||
the pods networks, resulting in missing network interfaces.
|
||||
|
||||
The easiest way to fix this is to change the directory where your primary CNI
|
||||
places its config file. For example, with `Cilium` this can be achieved like so:
|
||||
|
||||
```yaml
|
||||
cni:
|
||||
confPath: /etc/cni/net.d/cilium # Note the cilium subdir
|
||||
```
|
||||
|
||||
Once done, Multus needs to be pointed to where the primary CNI config is located.
|
||||
If using `Cilium`, this will look something like this:
|
||||
|
||||
```yaml
|
||||
multus:
|
||||
primaryCniConfigFile: "cilium/05-cilium.conflist"
|
||||
```
|
||||
|
||||
:::note
|
||||
Due to Multus configuration limitations only subdirectories of the path specified
|
||||
under `persistence.cniconf.mountPath` are supported when configuring `multus.primaryCniConfigFile`
|
||||
```
|
||||
|
||||
:::warning
|
||||
If you do not configure the location of the primary CNI config correctly, your
|
||||
cluster will become unschedulable. Already deployed workloads will continue working,
|
||||
however, new workloads will not be able to be scheduled.
|
||||
:::
|
||||
|
||||
:::tip
|
||||
If you already had your primary CNI deployed using the standard CNI directory,
|
||||
a stale config file may be left behind when you change the primary CNI config
|
||||
location.
|
||||
|
||||
You can try to prevent this from happening by first scaling down primary CNI to
|
||||
0 replicas, and checking its config file has been removed from the host file
|
||||
system.
|
||||
|
||||
If a stale file is left after changing the config file location, you must manually
|
||||
remove it from the filesystem of **all** nodes. Otherwise, after a node reboot the cluster will see the stale primary CNI file and immediately try to use it instead of waiting for Multus to start.
|
||||
|
||||
An easy way to access a node's filesystem is using the `kubectl debug` command like
|
||||
so:
|
||||
|
||||
```bash
|
||||
kubectl debug node/<NODE_NAME> --profile=sysadmin exec -it --image ubuntu -n kube-system -- sh
|
||||
```
|
||||
|
||||
Once inside the pod, the host's filesystem will be mounted under `/host`.
|
||||
|
||||
When done clean up the completed node debug pod(s) using the following command:
|
||||
|
||||
```bash
|
||||
kubectl get pods -n kube-system -o name | grep "node-debugger" | xargs kubectl delete -n kube-system
|
||||
```
|
||||
:::
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 778 B |
Binary file not shown.
|
Before Width: | Height: | Size: 8.0 KiB |
@@ -1 +0,0 @@
|
||||
{{- include "tc.v1.common.lib.chart.notes" $ -}}
|
||||
@@ -1,5 +0,0 @@
|
||||
{{/* Make sure all variables are set properly */}}
|
||||
{{- include "tc.v1.common.loader.init" . }}
|
||||
|
||||
{{/* Render the templates */}}
|
||||
{{ include "tc.v1.common.loader.apply" . }}
|
||||
@@ -1,44 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: network-attachment-definitions.k8s.cni.cncf.io
|
||||
spec:
|
||||
group: k8s.cni.cncf.io
|
||||
scope: Namespaced
|
||||
names:
|
||||
plural: network-attachment-definitions
|
||||
singular: network-attachment-definition
|
||||
kind: NetworkAttachmentDefinition
|
||||
shortNames:
|
||||
- net-attach-def
|
||||
versions:
|
||||
- name: v1
|
||||
served: true
|
||||
storage: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: 'NetworkAttachmentDefinition is a CRD schema specified by the Network Plumbing
|
||||
Working Group to express the intent for attaching pods to one or more logical or physical
|
||||
networks. More information available at: https://github.com/k8snetworkplumbingwg/multi-net-spec'
|
||||
type: object
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this represen
|
||||
tation of an object. Servers should convert recognized schemas to the
|
||||
latest internal value, and may reject unrecognized values. More info:
|
||||
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: 'NetworkAttachmentDefinition spec defines the desired state of a network attachment'
|
||||
type: object
|
||||
properties:
|
||||
config:
|
||||
description: 'NetworkAttachmentDefinition config is a JSON-formatted CNI configuration'
|
||||
type: string
|
||||
@@ -1,520 +0,0 @@
|
||||
image:
|
||||
pullPolicy: IfNotPresent
|
||||
repository: ghcr.io/k8snetworkplumbingwg/multus-cni
|
||||
tag: v4.2.3-thick@sha256:e93af9e533cc16ca7847aeec3b516c9b1e8891c2b95c727991e94c9b59c4970e
|
||||
|
||||
craneImage:
|
||||
pullPolicy: IfNotPresent
|
||||
repository: docker.io/alpine/crane
|
||||
tag: 0.20.7@sha256:68bc6aee55d435fc76af636f0cc02ffba3f59f8acfbb2c0c0afce0b67202c5c8
|
||||
|
||||
talosCniImage:
|
||||
pullPolicy: IfNotPresent
|
||||
repository: ghcr.io/siderolabs/cni
|
||||
tag: v1.12.0@sha256:53c9bafbc4c3d781633fbbc7ee3dc60ed6d0baa39fb1589342a48f6fa868cd96
|
||||
|
||||
multus:
|
||||
# Primary CNI value can be:
|
||||
# - "", in which case the aphabetically first file in the CNI JSON
|
||||
# configuration directory (pointed to by `persistence.cniconf.mountPath`)
|
||||
# will be used
|
||||
# - The relative path to a CNI config file inside the CNI JSON configuration
|
||||
# directory (pointed to by `persistence.cniconf.mountPath`). For example
|
||||
# `05-cilium.conflist`
|
||||
primaryCniConfigFile: ""
|
||||
# Set to true to make Multus wait for the primary CNI to be ready before
|
||||
# it starts attaching extra networks to pods. This can help with pods
|
||||
# crash-looping when primary CNI is not ready
|
||||
readinessIndicatorEnabled: false
|
||||
logLevel: verbose # "debug", "error", "verbose", or "panic"
|
||||
# Whether to isolate `NetworkAttachmentDefinition`s by namespace.
|
||||
# Setting this to `true` will prevent sharing NAD resources across namespaces
|
||||
namespaceIsolation: false
|
||||
# A list of namespaces for which the `namespaceIsolation` (when set to `true`)
|
||||
# does not apply. `NetworkAttachmentDefinition`s defined in these namespaces
|
||||
# can be used across all namespaces. Note Multus treats the `default` namespace
|
||||
# as global by default (when `globalNamespaces` is empty)
|
||||
globalNamespaces: []
|
||||
# A list of additional networks to attach to every pod
|
||||
# The items of this list can be the names of `NetworkAttachmentDefinition`s,
|
||||
# names of CNI configuration files, paths to CNI configuation files and more.
|
||||
# See Multus documentation for more information
|
||||
defaultNetworks: []
|
||||
# A list namespaces, which are excluded from attaching networks from the
|
||||
# `defaultNetworks` list. By default, this chart's namespace is excluded.
|
||||
systemNamespaces: []
|
||||
# A map of capabilities, that are supported by at least one of the used CNI
|
||||
# plugins. See Multus documentation for more information
|
||||
capabilities: {}
|
||||
# You should not need to change the Multus CNI config version, however,
|
||||
# if you get an error about version incompatibility with the primary CNI it
|
||||
# might help to match the multus CNI version to your primary CNI version
|
||||
cniVersion: 0.3.1
|
||||
integrations:
|
||||
talos:
|
||||
enabled: false # Must be enabled when installing on a Talos cluster
|
||||
# Select extra reference CNIs to be installed
|
||||
# Note:
|
||||
# - If you are installing any of the reference CNIs, it is strongly
|
||||
# recommended to override the `talosCniImage.tag` to match your
|
||||
# Talos version
|
||||
# - To install CNIs that are present in the `talosCniImage` but not listed
|
||||
# below, simply add them below in the form of `<binary_name>: true`
|
||||
installCni:
|
||||
macvlan: true
|
||||
ipvlan: true
|
||||
# Enable the chart's uninstall mode. This will clean up leftover chart
|
||||
# configuration data and CNI plugins, allowing for a cleaner uninstall.
|
||||
#
|
||||
# Note:
|
||||
# If the Talos integration is enabled, this chart assumes it has full control
|
||||
# over all CNIs listed in `integrations.talos.installCni`(and set to `true`).
|
||||
# During uninstall, it will remove all CNIs that are enabled (`true`). If this
|
||||
# is undesired, set the keys of the relevant CNI names to `false` before
|
||||
# enabling the uninstall mode.
|
||||
uninstall: false
|
||||
|
||||
podOptions:
|
||||
hostNetwork: true
|
||||
hostPID: true
|
||||
automountServiceAccountToken: true
|
||||
priorityClassName: system-node-critical
|
||||
# Add a toleration to always allow scheduling
|
||||
# This is used to allow scheduling while there is no working primary CNI (yet),
|
||||
# as in such cases the node is usually tainted with "NoSchedule" since it is
|
||||
# not ready for regular workloads. However, depending on config, it may be
|
||||
# desired (or even enforced) for Multus to start first, to ensure that all
|
||||
# pod interface configuration passes through it after a node reboot.
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
|
||||
configmap:
|
||||
config:
|
||||
enabled: true
|
||||
data:
|
||||
daemon-config.json: |
|
||||
{
|
||||
"cniVersion": "{{ .Values.multus.cniVersion }}",
|
||||
"confDir": "{{ tpl .Values.persistence.cniconf.mountPath $ }}/multus.d",
|
||||
"cniDir": "{{ tpl .Values.persistence.cnimultusdata.mountPath $ }}",
|
||||
"binDir": "{{ tpl .Values.persistence.cnibin.mountPath $ }}",
|
||||
"logToStderr": true,
|
||||
"logLevel": "{{ .Values.multus.logLevel }}",
|
||||
"namespaceIsolation": {{ .Values.multus.namespaceIsolation }},
|
||||
"globalNamespaces": "{{ join "," .Values.multus.globalNamespaces }}",
|
||||
{{- if .Values.multus.systemNamespaces }}
|
||||
"systemNamespaces": {{ .Values.multus.systemNamespaces | toJson }},
|
||||
{{- else }}
|
||||
"systemNamespaces": ["{{ .Release.Namespace }}"],
|
||||
{{- end }}
|
||||
"defaultNetworks": {{ .Values.multus.defaultNetworks | toJson }},
|
||||
"capabilities": {{ .Values.multus.capabilities | toJson }},
|
||||
"multusMasterCNI": "{{ .Values.multus.primaryCniConfigFile }}",
|
||||
"multusNamespace": "{{ .Release.Namespace }}",
|
||||
{{- if .Values.multus.readinessIndicatorEnabled }}
|
||||
{{- if not .Values.multus.primaryCniConfigFile -}}
|
||||
{{- fail "Invalid configuration: When [multus.readinessIndicatorEnabled] is set to [true], [multus.primaryCniConfigFile] must be set to a non-empty value." -}}
|
||||
{{- end }}
|
||||
"readinessindicatorfile": "{{ tpl .Values.persistence.cniconf.mountPath $ }}/{{ .Values.multus.primaryCniConfigFile }}",
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.main.enabled }}
|
||||
"metricsPort": {{ .Values.service.main.ports.main.port }},
|
||||
{{- end }}
|
||||
"chrootDir": "{{ tpl .Values.persistence.hostroot.mountPath $ }}",
|
||||
"socketDir": "{{ tpl .Values.persistence.hostrun.mountPath $ }}/multus/",
|
||||
"cniConfigDir": "{{ tpl .Values.persistence.cniconf.mountPath $ }}",
|
||||
"multusAutoconfigDir": "{{ tpl .Values.persistence.cniconf.mountPath $ }}",
|
||||
"multusConfigFile": "auto",
|
||||
"retryDeleteOnError": true
|
||||
}
|
||||
|
||||
persistence:
|
||||
cnibin:
|
||||
enabled: true
|
||||
type: hostPath
|
||||
# NOTE:
|
||||
# multus-daemon expects that cnibin path to be identical between pod and host
|
||||
mountPath: "{{ tpl .Values.persistence.cnibin.hostPath $ }}"
|
||||
hostPath: /opt/cni/bin
|
||||
hostPathType: DirectoryOrCreate
|
||||
mountPropagation: Bidirectional
|
||||
targetSelector:
|
||||
main:
|
||||
cleanup: {}
|
||||
multus-plugin-installer: {}
|
||||
talos-plugin-installer: {}
|
||||
main: {}
|
||||
dhcp-daemon: {}
|
||||
cniconf:
|
||||
enabled: true
|
||||
type: hostPath
|
||||
mountPath: /host/etc/cni/net.d
|
||||
hostPath: /etc/cni/net.d
|
||||
hostPathType: DirectoryOrCreate
|
||||
targetSelector:
|
||||
main:
|
||||
cleanup: {}
|
||||
main: {}
|
||||
cnimultusdata: # Used for multus cache data
|
||||
enabled: true
|
||||
type: hostPath
|
||||
mountPath: /var/lib/cni/multus
|
||||
hostPath: /var/lib/cni/multus
|
||||
hostPathType: DirectoryOrCreate
|
||||
# Used for cleanup on during chart uninstall
|
||||
cnimultusdatacleanup:
|
||||
enabled: true
|
||||
type: hostPath
|
||||
# NOTE:
|
||||
# `mountPath` and `hostPath` MUST exactly match `cnimultusdata`'s mount and
|
||||
# host path parent directories.
|
||||
mountPath: "{{ (tpl .Values.persistence.cnimultusdata.mountPath $) | clean | dir }}"
|
||||
hostPath: "{{ (tpl .Values.persistence.cnimultusdata.hostPath $) | clean | dir }}"
|
||||
hostPathType: DirectoryOrCreate
|
||||
targetSelector:
|
||||
main:
|
||||
cleanup: {}
|
||||
daemonconfig:
|
||||
enabled: true
|
||||
type: configmap
|
||||
mountPath: "{{ tpl .Values.persistence.cniconf.mountPath $ }}/multus.d/daemon-config.json"
|
||||
objectName: config
|
||||
subPath: daemon-config.json
|
||||
readOnly: true
|
||||
hostroot:
|
||||
enabled: true
|
||||
type: hostPath
|
||||
mountPath: /hostroot
|
||||
hostPath: /
|
||||
hostPathType: Directory
|
||||
mountPropagation: HostToContainer
|
||||
hostrun:
|
||||
enabled: true
|
||||
type: hostPath
|
||||
mountPath: /host/run
|
||||
hostPath: /run
|
||||
hostPathType: Directory
|
||||
targetSelector:
|
||||
main:
|
||||
cleanup: {}
|
||||
main: {}
|
||||
dhcp-daemon: {}
|
||||
hostrunnetns:
|
||||
enabled: true
|
||||
type: hostPath
|
||||
# NOTE:
|
||||
# The Talos/Multus docs state that this the host's `(/var)/run/netns` must
|
||||
# be mounted under `/run/netns` in the container.
|
||||
#
|
||||
# However, TC common library forcefully renders an emptyDir mount under
|
||||
# `/var/run` to facilitate common uses cases. This is done AFTER any
|
||||
# chart-specific mounts are rendered and since `/var/run` is usually a
|
||||
# symlink to `/run`, this host path mount gets overridden by the
|
||||
# emptyDir mount
|
||||
#
|
||||
# To workaround this we instead mount to `/var/run/netns` inside the
|
||||
# the container, and since `/var/run` is a symlink to `/run`, the mount
|
||||
# also shows under `/run/netns`.
|
||||
mountPath: /var/run/netns
|
||||
hostPath: "{{- if .Values.multus.integrations.talos.enabled -}}/var{{- end -}}/run/netns"
|
||||
hostPathType: DirectoryOrCreate
|
||||
mountPropagation: HostToContainer
|
||||
targetSelector:
|
||||
main:
|
||||
main: {}
|
||||
dhcp-daemon: {}
|
||||
hostrunk8scnicncfio:
|
||||
enabled: true
|
||||
type: hostPath
|
||||
mountPath: /run/k8s.cni.cncf.io
|
||||
hostPath: /run/k8s.cni.cncf.io
|
||||
hostPathType: DirectoryOrCreate
|
||||
hostvarlibkubelet:
|
||||
enabled: true
|
||||
type: hostPath
|
||||
mountPath: /var/lib/kubelet
|
||||
hostPath: /var/lib/kubelet
|
||||
hostPathType: Directory
|
||||
mountPropagation: HostToContainer
|
||||
|
||||
workload:
|
||||
main:
|
||||
type: DaemonSet
|
||||
podSpec:
|
||||
initContainers:
|
||||
talos-plugin-installer:
|
||||
enabled: "{{- $cnisMustBeInstalled := false -}}
|
||||
{{- range $key, $value := .Values.multus.integrations.talos.installCni -}}
|
||||
{{- if $value -}}
|
||||
{{- $cnisMustBeInstalled = true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{ and (not .Values.multus.uninstall)
|
||||
.Values.multus.integrations.talos.enabled
|
||||
$cnisMustBeInstalled }}"
|
||||
type: init
|
||||
imageSelector: craneImage
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -euo pipefail
|
||||
cd /tmp
|
||||
|
||||
echo "Pulling '{{ .Values.talosCniImage.repository }}:{{ .Values.talosCniImage.tag }}' image..."
|
||||
crane export {{ .Values.talosCniImage.repository }}:{{ .Values.talosCniImage.tag }} cni.tar
|
||||
|
||||
echo "Extracting CNI binaries..."
|
||||
mkdir -p cniBins
|
||||
tar -xvf cni.tar --strip-components=3 -C cniBins opt/cni/bin >/dev/null
|
||||
ls cniBins # print available binaries for ease of debugging
|
||||
echo
|
||||
|
||||
{{- $cniBinMountPath := (tpl .Values.persistence.cnibin.mountPath $) -}}
|
||||
{{- range $key, $value := .Values.multus.integrations.talos.installCni -}}
|
||||
{{- if $value }}
|
||||
echo "Copying {{ $key }} to '{{ $cniBinMountPath }}/{{ $key }}'"
|
||||
cp cniBins/{{ $key }} "{{ $cniBinMountPath }}/{{ $key }}"
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
securityContext:
|
||||
privileged: true
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
requests:
|
||||
cpu: "10m"
|
||||
memory: "15Mi"
|
||||
multus-plugin-installer:
|
||||
enabled: "{{ not .Values.multus.uninstall }}"
|
||||
type: init
|
||||
imageSelector: image
|
||||
command:
|
||||
- "/usr/src/multus-cni/bin/install_multus"
|
||||
args:
|
||||
- "-d"
|
||||
- "{{ tpl .Values.persistence.cnibin.mountPath $ }}"
|
||||
- "-t"
|
||||
- "thick"
|
||||
securityContext:
|
||||
privileged: true
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
requests:
|
||||
cpu: "10m"
|
||||
memory: "15Mi"
|
||||
termination:
|
||||
messagePolicy: FallbackToLogsOnError
|
||||
containers:
|
||||
cleanup:
|
||||
enabled: "{{ .Values.multus.uninstall }}"
|
||||
type: init
|
||||
imageSelector: ubuntuImage
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
echoRun() {
|
||||
echo "$@"
|
||||
eval "$@"
|
||||
}
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo "Cleaning up Multus CNI config..."
|
||||
echoRun rm -rf "{{ tpl .Values.persistence.cniconf.mountPath $ }}"/*multus.*
|
||||
echo
|
||||
|
||||
echo "Cleaning up Multus CNI data..."
|
||||
echoRun rm -rf "{{ tpl .Values.persistence.cnimultusdata.mountPath $ }}"
|
||||
echo
|
||||
|
||||
echo "Cleaning up Multus CNI plugins..."
|
||||
echoRun rm -f "{{ tpl .Values.persistence.cnibin.mountPath $ }}"/multus*
|
||||
echoRun rm -f "{{ tpl .Values.persistence.cnibin.mountPath $ }}"/passthru
|
||||
|
||||
{{- if .Values.multus.integrations.talos.enabled }}
|
||||
{{- $cniBinMountPath := (tpl .Values.persistence.cnibin.mountPath $) -}}
|
||||
{{- $hostRunMountPath := (tpl .Values.persistence.hostrun.mountPath $) -}}
|
||||
{{- range $key, $value := .Values.multus.integrations.talos.installCni -}}
|
||||
{{- if $value }}
|
||||
echoRun rm -f "{{ $cniBinMountPath }}/{{ $key }}"
|
||||
{{- if eq $key "dhcp" }}
|
||||
echoRun rm -f "{{ $hostRunMountPath }}/cni/dhcp.sock"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
echo "Cleanup completed! You can now safely uninstall this chart."
|
||||
sleep infinity
|
||||
securityContext:
|
||||
privileged: true
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
main:
|
||||
enabled: "{{ not .Values.multus.uninstall }}"
|
||||
env:
|
||||
MULTUS_NODE_NAME:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
args:
|
||||
- --config
|
||||
- "{{ tpl .Values.persistence.daemonconfig.mountPath $ }}"
|
||||
securityContext:
|
||||
privileged: true
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "50Mi"
|
||||
limits:
|
||||
cpu: "200m"
|
||||
memory: "500Mi"
|
||||
termination:
|
||||
messagePolicy: FallbackToLogsOnError
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- cat "{{ tpl .Values.persistence.cniconf.mountPath $ }}"/00-multus.conf*
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- cat "{{ tpl .Values.persistence.cniconf.mountPath $ }}"/00-multus.conf*
|
||||
startup:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- cat "{{ tpl .Values.persistence.cniconf.mountPath $ }}"/00-multus.conf*
|
||||
dhcp-daemon:
|
||||
enabled: "{{ and (not .Values.multus.uninstall)
|
||||
.Values.multus.integrations.talos.enabled
|
||||
(.Values.multus.integrations.talos.installCni | dig \"dhcp\" false) }}"
|
||||
imageSelector: ubuntuImage
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -euo pipefail
|
||||
|
||||
SOCKET_PATH="{{ tpl .Values.persistence.hostrun.mountPath $ }}/cni/dhcp.sock"
|
||||
CNI_BIN_DIR="{{ (tpl .Values.persistence.cnibin.mountPath $) }}"
|
||||
|
||||
# Make sure the unix socket has been removed
|
||||
rm -f "$SOCKET_PATH"
|
||||
|
||||
# Start the daemon
|
||||
"$CNI_BIN_DIR/dhcp" daemon -socketpath "$SOCKET_PATH" &
|
||||
DAEMON_PID=$!
|
||||
|
||||
if kill -0 $DAEMON_PID 2>/dev/null; then
|
||||
echo "DHCP daemon started successfully"
|
||||
else
|
||||
echo "DHCP daemon failed to start..."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
wait $DAEMON_PID
|
||||
securityContext:
|
||||
privileged: true
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
resources:
|
||||
requests:
|
||||
cpu: "10m"
|
||||
memory: "50Mi"
|
||||
limits:
|
||||
cpu: "100m"
|
||||
memory: "100Mi"
|
||||
termination:
|
||||
messagePolicy: FallbackToLogsOnError
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- test -S "{{ tpl .Values.persistence.hostrun.mountPath $ }}/cni/dhcp.sock"
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- test -S "{{ tpl .Values.persistence.hostrun.mountPath $ }}/cni/dhcp.sock"
|
||||
startup:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- test -S "{{ tpl .Values.persistence.hostrun.mountPath $ }}/cni/dhcp.sock"
|
||||
|
||||
metrics:
|
||||
main:
|
||||
enabled: true
|
||||
type: servicemonitor
|
||||
endpoints:
|
||||
- port: main
|
||||
path: /metrics
|
||||
targetSelector: main
|
||||
|
||||
service:
|
||||
main:
|
||||
enabled: "{{ .Values.metrics.main.enabled }}"
|
||||
clusterIP: None # No need for ClusterIP with host networking
|
||||
ports:
|
||||
main:
|
||||
enabled: true
|
||||
port: 8080
|
||||
protocol: http
|
||||
|
||||
serviceAccount:
|
||||
main:
|
||||
enabled: true
|
||||
primary: true
|
||||
rbac:
|
||||
main:
|
||||
enabled: true
|
||||
primary: true
|
||||
clusterWide: true
|
||||
serviceAccounts: ["main"]
|
||||
rules:
|
||||
- apiGroups: ["k8s.cni.cncf.io"]
|
||||
resources: ['*']
|
||||
verbs: ['*']
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "pods/status"]
|
||||
verbs: ["get", "list", "update", "watch"]
|
||||
- apiGroups: ["", "events.k8s.io"]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch", "update"]
|
||||
Reference in New Issue
Block a user