astro-stan
956d118e2f
**Description** <!-- Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change. --> Not sure how this wasn't a problem before but I recently upgraded the chart ot a more recent version and started getting: ``` sh: 1: set: Illegal option -o pipefail ``` pipefail is not supprted by `sh`, so it needs to be removed. ⚒️ Fixes # <!--(issue)--> **⚙️ Type of change** - [ ] ⚙️ Feature/App addition - [x] 🪛 Bugfix - [ ] ⚠️ Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 🔃 Refactor of current code - [ ] 📜 Documentation Changes **🧪 How Has This Been Tested?** <!-- Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration --> **📃 Notes:** <!-- Please enter any other relevant information here --> **✔️ Checklist:** - [X] ⚖️ My code follows the style guidelines of this project - [X] 👀 I have performed a self-review of my own code - [ ] #️⃣ I have commented my code, particularly in hard-to-understand areas - [ ] 📄 I have made changes to the documentation - [ ] 🧪 I have added tests to this description that prove my fix is effective or that my feature works - [X] ⬆️ I increased versions for any altered app according to semantic versioning - [X] I made sure the title starts with `feat(chart-name):`, `fix(chart-name):`, `chore(chart-name):`, `docs(chart-name):` or `fix(docs):` **➕ App addition** If this PR is an app addition please make sure you have done the following. - [ ] 🖼️ I have added an icon in the Chart's root directory called `icon.png` --- _Please don't blindly check all the boxes. Read them and only check those that apply. Those checkboxes are there for the reviewer to see what is this all about and the status of this PR with a quick glance._ --------- Signed-off-by: astro-stan <36302090+astro-stan@users.noreply.github.com>
522 lines
18 KiB
YAML
522 lines
18 KiB
YAML
# yaml-language-server: $schema=./values.schema.json
|
|
image:
|
|
pullPolicy: IfNotPresent
|
|
repository: ghcr.io/k8snetworkplumbingwg/multus-cni
|
|
tag: v4.2.4-thick@sha256:3c20900b5381fac7f9cbbdfac8370ea10a2f6ed7fbecc678384a9db57047abb1
|
|
|
|
craneImage:
|
|
pullPolicy: IfNotPresent
|
|
repository: docker.io/alpine/crane
|
|
tag: 0.21.5@sha256:e6b0b5343c2bcdf9b4e02f4cad9d01a9535f0f768e4a6a80739378192f819621
|
|
|
|
talosCniImage:
|
|
pullPolicy: IfNotPresent
|
|
repository: ghcr.io/siderolabs/cni
|
|
tag: v1.12.0@sha256:53c9bafbc4c3d781633fbbc7ee3dc60ed6d0baa39fb1589342a48f6fa868cd96
|
|
|
|
multus:
|
|
# Primary CNI value can be:
|
|
# - "", in which case the aphabetically first file in the CNI JSON
|
|
# configuration directory (pointed to by `persistence.cniconf.mountPath`)
|
|
# will be used
|
|
# - The relative path to a CNI config file inside the CNI JSON configuration
|
|
# directory (pointed to by `persistence.cniconf.mountPath`). For example
|
|
# `05-cilium.conflist`
|
|
primaryCniConfigFile: ""
|
|
# Set to true to make Multus wait for the primary CNI to be ready before
|
|
# it starts attaching extra networks to pods. This can help with pods
|
|
# crash-looping when primary CNI is not ready
|
|
readinessIndicatorEnabled: false
|
|
logLevel: verbose # "debug", "error", "verbose", or "panic"
|
|
# Whether to isolate `NetworkAttachmentDefinition`s by namespace.
|
|
# Setting this to `true` will prevent sharing NAD resources across namespaces
|
|
namespaceIsolation: false
|
|
# A list of namespaces for which the `namespaceIsolation` (when set to `true`)
|
|
# does not apply. `NetworkAttachmentDefinition`s defined in these namespaces
|
|
# can be used across all namespaces. Note Multus treats the `default` namespace
|
|
# as global by default (when `globalNamespaces` is empty)
|
|
globalNamespaces: []
|
|
# A list of additional networks to attach to every pod
|
|
# The items of this list can be the names of `NetworkAttachmentDefinition`s,
|
|
# names of CNI configuration files, paths to CNI configuation files and more.
|
|
# See Multus documentation for more information
|
|
defaultNetworks: []
|
|
# A list namespaces, which are excluded from attaching networks from the
|
|
# `defaultNetworks` list. By default, this chart's namespace is excluded.
|
|
systemNamespaces: []
|
|
# A map of capabilities, that are supported by at least one of the used CNI
|
|
# plugins. See Multus documentation for more information
|
|
capabilities: {}
|
|
# You should not need to change the Multus CNI config version, however,
|
|
# if you get an error about version incompatibility with the primary CNI it
|
|
# might help to match the multus CNI version to your primary CNI version
|
|
cniVersion: 0.3.1
|
|
integrations:
|
|
talos:
|
|
enabled: false # Must be enabled when installing on a Talos cluster
|
|
# Select extra reference CNIs to be installed
|
|
# Note:
|
|
# - If you are installing any of the reference CNIs, it is strongly
|
|
# recommended to override the `talosCniImage.tag` to match your
|
|
# Talos version
|
|
# - To install CNIs that are present in the `talosCniImage` but not listed
|
|
# below, simply add them below in the form of `<binary_name>: true`
|
|
installCni:
|
|
macvlan: true
|
|
ipvlan: true
|
|
# Enable the chart's uninstall mode. This will clean up leftover chart
|
|
# configuration data and CNI plugins, allowing for a cleaner uninstall.
|
|
#
|
|
# Note:
|
|
# If the Talos integration is enabled, this chart assumes it has full control
|
|
# over all CNIs listed in `integrations.talos.installCni`(and set to `true`).
|
|
# During uninstall, it will remove all CNIs that are enabled (`true`). If this
|
|
# is undesired, set the keys of the relevant CNI names to `false` before
|
|
# enabling the uninstall mode.
|
|
uninstall: false
|
|
|
|
podOptions:
|
|
hostNetwork: true
|
|
hostPID: true
|
|
automountServiceAccountToken: true
|
|
priorityClassName: system-node-critical
|
|
# Add a toleration to always allow scheduling
|
|
# This is used to allow scheduling while there is no working primary CNI (yet),
|
|
# as in such cases the node is usually tainted with "NoSchedule" since it is
|
|
# not ready for regular workloads. However, depending on config, it may be
|
|
# desired (or even enforced) for Multus to start first, to ensure that all
|
|
# pod interface configuration passes through it after a node reboot.
|
|
tolerations:
|
|
- operator: Exists
|
|
|
|
configmap:
|
|
config:
|
|
enabled: true
|
|
data:
|
|
daemon-config.json: |
|
|
{
|
|
"cniVersion": "{{ .Values.multus.cniVersion }}",
|
|
"confDir": "{{ tpl .Values.persistence.cniconf.mountPath $ }}/multus.d",
|
|
"cniDir": "{{ tpl .Values.persistence.cnimultusdata.mountPath $ }}",
|
|
"binDir": "{{ tpl .Values.persistence.cnibin.mountPath $ }}",
|
|
"logToStderr": true,
|
|
"logLevel": "{{ .Values.multus.logLevel }}",
|
|
"namespaceIsolation": {{ .Values.multus.namespaceIsolation }},
|
|
"globalNamespaces": "{{ join "," .Values.multus.globalNamespaces }}",
|
|
{{- if .Values.multus.systemNamespaces }}
|
|
"systemNamespaces": {{ .Values.multus.systemNamespaces | toJson }},
|
|
{{- else }}
|
|
"systemNamespaces": ["{{ .Release.Namespace }}"],
|
|
{{- end }}
|
|
"defaultNetworks": {{ .Values.multus.defaultNetworks | toJson }},
|
|
"capabilities": {{ .Values.multus.capabilities | toJson }},
|
|
"multusMasterCNI": "{{ .Values.multus.primaryCniConfigFile }}",
|
|
"multusNamespace": "{{ .Release.Namespace }}",
|
|
{{- if .Values.multus.readinessIndicatorEnabled }}
|
|
{{- if not .Values.multus.primaryCniConfigFile -}}
|
|
{{- fail "Invalid configuration: When [multus.readinessIndicatorEnabled] is set to [true], [multus.primaryCniConfigFile] must be set to a non-empty value." -}}
|
|
{{- end }}
|
|
"readinessindicatorfile": "{{ tpl .Values.persistence.cniconf.mountPath $ }}/{{ .Values.multus.primaryCniConfigFile }}",
|
|
{{- end }}
|
|
{{- if .Values.metrics.main.enabled }}
|
|
"metricsPort": {{ .Values.service.main.ports.main.port }},
|
|
{{- end }}
|
|
"chrootDir": "{{ tpl .Values.persistence.hostroot.mountPath $ }}",
|
|
"socketDir": "{{ tpl .Values.persistence.hostrun.mountPath $ }}/multus/",
|
|
"cniConfigDir": "{{ tpl .Values.persistence.cniconf.mountPath $ }}",
|
|
"multusAutoconfigDir": "{{ tpl .Values.persistence.cniconf.mountPath $ }}",
|
|
"multusConfigFile": "auto",
|
|
"retryDeleteOnError": true
|
|
}
|
|
|
|
persistence:
|
|
cnibin:
|
|
enabled: true
|
|
type: hostPath
|
|
# NOTE:
|
|
# multus-daemon expects that cnibin path to be identical between pod and host
|
|
mountPath: "{{ tpl .Values.persistence.cnibin.hostPath $ }}"
|
|
hostPath: /opt/cni/bin
|
|
hostPathType: DirectoryOrCreate
|
|
mountPropagation: Bidirectional
|
|
targetSelector:
|
|
main:
|
|
cleanup: {}
|
|
multus-plugin-installer: {}
|
|
talos-plugin-installer: {}
|
|
main: {}
|
|
dhcp-daemon: {}
|
|
cniconf:
|
|
enabled: true
|
|
type: hostPath
|
|
mountPath: /host/etc/cni/net.d
|
|
hostPath: /etc/cni/net.d
|
|
hostPathType: DirectoryOrCreate
|
|
targetSelector:
|
|
main:
|
|
cleanup: {}
|
|
main: {}
|
|
cnimultusdata: # Used for multus cache data
|
|
enabled: true
|
|
type: hostPath
|
|
mountPath: /var/lib/cni/multus
|
|
hostPath: /var/lib/cni/multus
|
|
hostPathType: DirectoryOrCreate
|
|
# Used for cleanup on during chart uninstall
|
|
cnimultusdatacleanup:
|
|
enabled: true
|
|
type: hostPath
|
|
# NOTE:
|
|
# `mountPath` and `hostPath` MUST exactly match `cnimultusdata`'s mount and
|
|
# host path parent directories.
|
|
mountPath: "{{ (tpl .Values.persistence.cnimultusdata.mountPath $) | clean | dir }}"
|
|
hostPath: "{{ (tpl .Values.persistence.cnimultusdata.hostPath $) | clean | dir }}"
|
|
hostPathType: DirectoryOrCreate
|
|
targetSelector:
|
|
main:
|
|
cleanup: {}
|
|
daemonconfig:
|
|
enabled: true
|
|
type: configmap
|
|
mountPath: "{{ tpl .Values.persistence.cniconf.mountPath $ }}/multus.d/daemon-config.json"
|
|
objectName: config
|
|
subPath: daemon-config.json
|
|
readOnly: true
|
|
hostroot:
|
|
enabled: true
|
|
type: hostPath
|
|
mountPath: /hostroot
|
|
hostPath: /
|
|
hostPathType: Directory
|
|
mountPropagation: HostToContainer
|
|
hostrun:
|
|
enabled: true
|
|
type: hostPath
|
|
mountPath: /host/run
|
|
hostPath: /run
|
|
hostPathType: Directory
|
|
targetSelector:
|
|
main:
|
|
cleanup: {}
|
|
main: {}
|
|
dhcp-daemon: {}
|
|
hostrunnetns:
|
|
enabled: true
|
|
type: hostPath
|
|
# NOTE:
|
|
# The Talos/Multus docs state that this the host's `(/var)/run/netns` must
|
|
# be mounted under `/run/netns` in the container.
|
|
#
|
|
# However, TC common library forcefully renders an emptyDir mount under
|
|
# `/var/run` to facilitate common uses cases. This is done AFTER any
|
|
# chart-specific mounts are rendered and since `/var/run` is usually a
|
|
# symlink to `/run`, this host path mount gets overridden by the
|
|
# emptyDir mount
|
|
#
|
|
# To workaround this we instead mount to `/var/run/netns` inside the
|
|
# the container, and since `/var/run` is a symlink to `/run`, the mount
|
|
# also shows under `/run/netns`.
|
|
mountPath: /var/run/netns
|
|
hostPath: "{{- if .Values.multus.integrations.talos.enabled -}}/var{{- end -}}/run/netns"
|
|
hostPathType: DirectoryOrCreate
|
|
mountPropagation: HostToContainer
|
|
targetSelector:
|
|
main:
|
|
main: {}
|
|
dhcp-daemon: {}
|
|
hostrunk8scnicncfio:
|
|
enabled: true
|
|
type: hostPath
|
|
mountPath: /run/k8s.cni.cncf.io
|
|
hostPath: /run/k8s.cni.cncf.io
|
|
hostPathType: DirectoryOrCreate
|
|
hostvarlibkubelet:
|
|
enabled: true
|
|
type: hostPath
|
|
mountPath: /var/lib/kubelet
|
|
hostPath: /var/lib/kubelet
|
|
hostPathType: Directory
|
|
mountPropagation: HostToContainer
|
|
|
|
workload:
|
|
main:
|
|
type: DaemonSet
|
|
podSpec:
|
|
initContainers:
|
|
talos-plugin-installer:
|
|
enabled: "{{- $cnisMustBeInstalled := false -}}
|
|
{{- range $key, $value := .Values.multus.integrations.talos.installCni -}}
|
|
{{- if $value -}}
|
|
{{- $cnisMustBeInstalled = true -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{ and (not .Values.multus.uninstall)
|
|
.Values.multus.integrations.talos.enabled
|
|
$cnisMustBeInstalled }}"
|
|
type: init
|
|
imageSelector: craneImage
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -eu
|
|
cd /tmp
|
|
|
|
echo "Pulling '{{ .Values.talosCniImage.repository }}:{{ .Values.talosCniImage.tag }}' image..."
|
|
crane export {{ .Values.talosCniImage.repository }}:{{ .Values.talosCniImage.tag }} cni.tar
|
|
|
|
echo "Extracting CNI binaries..."
|
|
mkdir -p cniBins
|
|
tar -xvf cni.tar --strip-components=3 -C cniBins opt/cni/bin >/dev/null
|
|
ls cniBins # print available binaries for ease of debugging
|
|
echo
|
|
|
|
{{- $cniBinMountPath := (tpl .Values.persistence.cnibin.mountPath $) -}}
|
|
{{- range $key, $value := .Values.multus.integrations.talos.installCni -}}
|
|
{{- if $value }}
|
|
echo "Copying {{ $key }} to '{{ $cniBinMountPath }}/{{ $key }}'"
|
|
cp cniBins/{{ $key }} "{{ $cniBinMountPath }}/{{ $key }}"
|
|
{{- end }}
|
|
{{- end -}}
|
|
securityContext:
|
|
privileged: true
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: "10m"
|
|
memory: "15Mi"
|
|
multus-plugin-installer:
|
|
enabled: "{{ not .Values.multus.uninstall }}"
|
|
type: init
|
|
imageSelector: image
|
|
command:
|
|
- "/usr/src/multus-cni/bin/install_multus"
|
|
args:
|
|
- "-d"
|
|
- "{{ tpl .Values.persistence.cnibin.mountPath $ }}"
|
|
- "-t"
|
|
- "thick"
|
|
securityContext:
|
|
privileged: true
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: "10m"
|
|
memory: "15Mi"
|
|
termination:
|
|
messagePolicy: FallbackToLogsOnError
|
|
containers:
|
|
cleanup:
|
|
enabled: "{{ .Values.multus.uninstall }}"
|
|
type: init
|
|
imageSelector: ubuntuImage
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
echoRun() {
|
|
echo "$@"
|
|
eval "$@"
|
|
}
|
|
|
|
set -eu
|
|
|
|
echo "Cleaning up Multus CNI config..."
|
|
echoRun rm -rf "{{ tpl .Values.persistence.cniconf.mountPath $ }}"/*multus.*
|
|
echo
|
|
|
|
echo "Cleaning up Multus CNI data..."
|
|
echoRun rm -rf "{{ tpl .Values.persistence.cnimultusdata.mountPath $ }}"
|
|
echo
|
|
|
|
echo "Cleaning up Multus CNI plugins..."
|
|
echoRun rm -f "{{ tpl .Values.persistence.cnibin.mountPath $ }}"/multus*
|
|
echoRun rm -f "{{ tpl .Values.persistence.cnibin.mountPath $ }}"/passthru
|
|
|
|
{{- if .Values.multus.integrations.talos.enabled }}
|
|
{{- $cniBinMountPath := (tpl .Values.persistence.cnibin.mountPath $) -}}
|
|
{{- $hostRunMountPath := (tpl .Values.persistence.hostrun.mountPath $) -}}
|
|
{{- range $key, $value := .Values.multus.integrations.talos.installCni -}}
|
|
{{- if $value }}
|
|
echoRun rm -f "{{ $cniBinMountPath }}/{{ $key }}"
|
|
{{- if eq $key "dhcp" }}
|
|
echoRun rm -f "{{ $hostRunMountPath }}/cni/dhcp.sock"
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
echo "Cleanup completed! You can now safely uninstall this chart."
|
|
sleep infinity
|
|
securityContext:
|
|
privileged: true
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
probes:
|
|
liveness:
|
|
enabled: false
|
|
readiness:
|
|
enabled: false
|
|
startup:
|
|
enabled: false
|
|
main:
|
|
enabled: "{{ not .Values.multus.uninstall }}"
|
|
env:
|
|
MULTUS_NODE_NAME:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
args:
|
|
- --config
|
|
- "{{ tpl .Values.persistence.daemonconfig.mountPath $ }}"
|
|
securityContext:
|
|
privileged: true
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
resources:
|
|
requests:
|
|
cpu: "100m"
|
|
memory: "50Mi"
|
|
limits:
|
|
cpu: "200m"
|
|
memory: "500Mi"
|
|
termination:
|
|
messagePolicy: FallbackToLogsOnError
|
|
probes:
|
|
liveness:
|
|
enabled: true
|
|
type: exec
|
|
command:
|
|
- sh
|
|
- -c
|
|
- cat "{{ tpl .Values.persistence.cniconf.mountPath $ }}"/00-multus.conf*
|
|
readiness:
|
|
enabled: true
|
|
type: exec
|
|
command:
|
|
- sh
|
|
- -c
|
|
- cat "{{ tpl .Values.persistence.cniconf.mountPath $ }}"/00-multus.conf*
|
|
startup:
|
|
enabled: true
|
|
type: exec
|
|
command:
|
|
- sh
|
|
- -c
|
|
- cat "{{ tpl .Values.persistence.cniconf.mountPath $ }}"/00-multus.conf*
|
|
dhcp-daemon:
|
|
enabled: "{{ and (not .Values.multus.uninstall)
|
|
.Values.multus.integrations.talos.enabled
|
|
(.Values.multus.integrations.talos.installCni | dig \"dhcp\" false) }}"
|
|
imageSelector: ubuntuImage
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
set -eu
|
|
|
|
SOCKET_PATH="{{ tpl .Values.persistence.hostrun.mountPath $ }}/cni/dhcp.sock"
|
|
CNI_BIN_DIR="{{ (tpl .Values.persistence.cnibin.mountPath $) }}"
|
|
|
|
# Make sure the unix socket has been removed
|
|
rm -f "$SOCKET_PATH"
|
|
|
|
# Start the daemon
|
|
"$CNI_BIN_DIR/dhcp" daemon -socketpath "$SOCKET_PATH" &
|
|
DAEMON_PID=$!
|
|
|
|
if kill -0 $DAEMON_PID 2>/dev/null; then
|
|
echo "DHCP daemon started successfully"
|
|
else
|
|
echo "DHCP daemon failed to start..."
|
|
exit 1
|
|
fi
|
|
|
|
wait $DAEMON_PID
|
|
securityContext:
|
|
privileged: true
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
resources:
|
|
requests:
|
|
cpu: "10m"
|
|
memory: "50Mi"
|
|
limits:
|
|
cpu: "100m"
|
|
memory: "100Mi"
|
|
termination:
|
|
messagePolicy: FallbackToLogsOnError
|
|
probes:
|
|
liveness:
|
|
enabled: true
|
|
type: exec
|
|
command:
|
|
- sh
|
|
- -c
|
|
- test -S "{{ tpl .Values.persistence.hostrun.mountPath $ }}/cni/dhcp.sock"
|
|
readiness:
|
|
enabled: true
|
|
type: exec
|
|
command:
|
|
- sh
|
|
- -c
|
|
- test -S "{{ tpl .Values.persistence.hostrun.mountPath $ }}/cni/dhcp.sock"
|
|
startup:
|
|
enabled: true
|
|
type: exec
|
|
command:
|
|
- sh
|
|
- -c
|
|
- test -S "{{ tpl .Values.persistence.hostrun.mountPath $ }}/cni/dhcp.sock"
|
|
|
|
metrics:
|
|
main:
|
|
enabled: true
|
|
type: servicemonitor
|
|
endpoints:
|
|
- port: main
|
|
path: /metrics
|
|
targetSelector: main
|
|
|
|
service:
|
|
main:
|
|
enabled: "{{ .Values.metrics.main.enabled }}"
|
|
clusterIP: None # No need for ClusterIP with host networking
|
|
ports:
|
|
main:
|
|
enabled: true
|
|
port: 8080
|
|
protocol: http
|
|
|
|
serviceAccount:
|
|
main:
|
|
enabled: true
|
|
primary: true
|
|
rbac:
|
|
main:
|
|
enabled: true
|
|
primary: true
|
|
clusterWide: true
|
|
serviceAccounts: ["main"]
|
|
rules:
|
|
- apiGroups: ["k8s.cni.cncf.io"]
|
|
resources: ['*']
|
|
verbs: ['*']
|
|
- apiGroups: [""]
|
|
resources: ["pods", "pods/status"]
|
|
verbs: ["get", "list", "update", "watch"]
|
|
- apiGroups: ["", "events.k8s.io"]
|
|
resources: ["events"]
|
|
verbs: ["create", "patch", "update"]
|