abecadf707
Since Kilo now uses the `kilo.squat.ai/discovered-endpoints` annotation for Peer discovery, Kilo no longer needs to update Peer resources, so we can remove this permission from the ClusterRole. Note, the RBAC in the manifests is not used today, but we eventually want to migrate to this. Signed-off-by: Lucas Servén Marín <lserven@gmail.com>
121 lines
2.6 KiB
YAML
121 lines
2.6 KiB
YAML
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: kilo
|
|
namespace: kube-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kilo
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- nodes
|
|
verbs:
|
|
- list
|
|
- patch
|
|
- watch
|
|
- apiGroups:
|
|
- kilo.squat.ai
|
|
resources:
|
|
- peers
|
|
verbs:
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- apiextensions.k8s.io
|
|
resources:
|
|
- customresourcedefinitions
|
|
verbs:
|
|
- get
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: kilo
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kilo
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kilo
|
|
namespace: kube-system
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: kilo
|
|
namespace: kube-system
|
|
labels:
|
|
app.kubernetes.io/name: kilo
|
|
app.kubernetes.io/part-of: kilo
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: kilo
|
|
app.kubernetes.io/part-of: kilo
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: kilo
|
|
app.kubernetes.io/part-of: kilo
|
|
spec:
|
|
serviceAccountName: kilo
|
|
hostNetwork: true
|
|
containers:
|
|
- name: kilo
|
|
image: squat/kilo
|
|
args:
|
|
- --kubeconfig=/etc/kubernetes/kubeconfig
|
|
- --hostname=$(NODE_NAME)
|
|
- --cni=false
|
|
- --compatibility=flannel
|
|
- --local=false
|
|
env:
|
|
- name: NODE_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
ports:
|
|
- containerPort: 1107
|
|
name: metrics
|
|
securityContext:
|
|
privileged: true
|
|
volumeMounts:
|
|
- name: kilo-dir
|
|
mountPath: /var/lib/kilo
|
|
- name: kubeconfig
|
|
mountPath: /etc/kubernetes/kubeconfig
|
|
readOnly: true
|
|
- name: lib-modules
|
|
mountPath: /lib/modules
|
|
readOnly: true
|
|
- name: xtables-lock
|
|
mountPath: /run/xtables.lock
|
|
readOnly: false
|
|
tolerations:
|
|
- effect: NoSchedule
|
|
operator: Exists
|
|
- effect: NoExecute
|
|
operator: Exists
|
|
volumes:
|
|
- name: kilo-dir
|
|
hostPath:
|
|
path: /var/lib/kilo
|
|
- name: kubeconfig
|
|
hostPath:
|
|
# Since kilo runs as a daemonset, it is recommended that you copy the
|
|
# k3s.yaml kubeconfig file from the master node to all worker nodes
|
|
# with the same path structure.
|
|
path: /etc/rancher/k3s/k3s.yaml
|
|
- name: lib-modules
|
|
hostPath:
|
|
path: /lib/modules
|
|
- name: xtables-lock
|
|
hostPath:
|
|
path: /run/xtables.lock
|
|
type: FileOrCreate
|