You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

90 lines
2.6 KiB

contiv network support (#1914) * Add Contiv support Contiv is a network plugin for Kubernetes and Docker. It supports vlan/vxlan/BGP/Cisco ACI technologies. It support firewall policies, multiple networks and bridging pods onto physical networks. * Update contiv version to 1.1.4 Update contiv version to 1.1.4 and added SVC_SUBNET in contiv-config. * Load openvswitch module to workaround on CentOS7.4 * Set contiv cni version to 0.1.0 Correct contiv CNI version to 0.1.0. * Use kube_apiserver_endpoint for K8S_API_SERVER Use kube_apiserver_endpoint as K8S_API_SERVER to make contiv talks to a available endpoint no matter if there's a loadbalancer or not. * Make contiv use its own etcd Before this commit, contiv is using a etcd proxy mode to k8s etcd, this work fine when the etcd hosts are co-located with contiv etcd proxy, however the k8s peering certs are only in etcd group, as a result the etcd-proxy is not able to peering with the k8s etcd on etcd group, plus the netplugin is always trying to find the etcd endpoint on localhost, this will cause problem for all netplugins not runnign on etcd group nodes. This commit make contiv uses its own etcd, separate from k8s one. on kube-master nodes (where net-master runs), it will run as leader mode and on all rest nodes it will run as proxy mode. * Use cp instead of rsync to copy cni binaries Since rsync has been removed from hyperkube, this commit changes it to use cp instead. * Make contiv-etcd able to run on master nodes * Add rbac_enabled flag for contiv pods * Add contiv into CNI network plugin lists * migrate contiv test to tests/files Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com> * Add required rules for contiv netplugin * Better handling json return of fwdMode * Make contiv etcd port configurable * Use default var instead of templating * roles/download/defaults/main.yml: use contiv 1.1.7 Signed-off-by: Cristian Staretu <cristian.staretu@gmail.com>
7 years ago
  1. # This manifest deploys the Contiv API Server on Kubernetes.
  2. kind: DaemonSet
  3. apiVersion: extensions/v1beta1
  4. metadata:
  5. name: contiv-netmaster
  6. namespace: {{ system_namespace }}
  7. labels:
  8. k8s-app: contiv-netmaster
  9. spec:
  10. updateStrategy:
  11. type: RollingUpdate
  12. template:
  13. metadata:
  14. name: contiv-netmaster
  15. namespace: {{ system_namespace }}
  16. labels:
  17. k8s-app: contiv-netmaster
  18. annotations:
  19. scheduler.alpha.kubernetes.io/critical-pod: ''
  20. spec:
  21. # The netmaster must run in the host network namespace so that
  22. # it isn't governed by policy that would prevent it from working.
  23. hostNetwork: true
  24. hostPID: true
  25. nodeSelector:
  26. node-role.kubernetes.io/master: "true"
  27. tolerations:
  28. - key: node-role.kubernetes.io/master
  29. effect: NoSchedule
  30. {% if rbac_enabled %}
  31. serviceAccountName: contiv-netmaster
  32. {% endif %}
  33. containers:
  34. - name: contiv-netmaster
  35. image: {{ contiv_image_repo }}:{{ contiv_image_tag }}
  36. args:
  37. - -m
  38. - -pkubernetes
  39. env:
  40. - name: CONTIV_ETCD
  41. valueFrom:
  42. configMapKeyRef:
  43. name: contiv-config
  44. key: cluster_store
  45. - name: CONTIV_CONFIG
  46. valueFrom:
  47. configMapKeyRef:
  48. name: contiv-config
  49. key: config
  50. securityContext:
  51. privileged: true
  52. volumeMounts:
  53. - mountPath: /etc/openvswitch
  54. name: etc-openvswitch
  55. readOnly: false
  56. - mountPath: /lib/modules
  57. name: lib-modules
  58. readOnly: false
  59. - mountPath: /var/run
  60. name: var-run
  61. readOnly: false
  62. - mountPath: /var/contiv
  63. name: var-contiv
  64. readOnly: false
  65. - mountPath: /etc/kubernetes/ssl
  66. name: etc-kubernetes-ssl
  67. readOnly: false
  68. - mountPath: /opt/cni/bin
  69. name: cni-bin-dir
  70. readOnly: false
  71. volumes:
  72. # Used by contiv-netmaster
  73. - name: etc-openvswitch
  74. hostPath:
  75. path: /etc/openvswitch
  76. - name: lib-modules
  77. hostPath:
  78. path: /lib/modules
  79. - name: var-run
  80. hostPath:
  81. path: /var/run
  82. - name: var-contiv
  83. hostPath:
  84. path: /var/contiv
  85. - name: etc-kubernetes-ssl
  86. hostPath:
  87. path: /etc/kubernetes/ssl
  88. - name: cni-bin-dir
  89. hostPath:
  90. path: /opt/cni/bin