kube-cni.yaml

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: cni-terway
rules:
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
      - list
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: cni-terway
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cni-terway
subjects:
- kind: ServiceAccount
  name: cni-terway
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cni-terway
  namespace: kube-system
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: kube-cni-terway-cfg
  namespace: kube-system
  labels:
    tier: node
    app: cni-terway
data:
  cni-conf.json: |
    {
      "name": "mycninet",
      "cniVersion": "0.3.1",
      "type": "cni-terway",
      "server_socket": "/var/run/cniserver.sock",
      "delegate": {
          "cniVersion": "0.3.1",
          "name": "mycninet",
          "type": "bridge",
          "bridge": "mybr0",
          "isGateway": false,
          "ipam": {
            "type": "dhcp"
          }
      }
    }
  
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-cni-terway-ds
  namespace: kube-system
  labels:
    tier: node
    app: cni-terway
spec:
  selector:
    matchLabels:
      app: cni-terway
  template:
    metadata:
      labels:
        tier: node
        app: cni-terway
    spec:
      serviceAccountName: cni-terway
      hostNetwork: true
      hostPID: true
      tolerations:
      - operator: Exists
        effect: NoSchedule
      initContainers:
      - name: cp-cni-config
        image: registry.cn-hangzhou.aliyuncs.com/generals-kuber/cni-terway:0.0.23
        command:
        - cp
        args:
        - -f
        - /etc/kube-cni-terway/cni-conf.json
        - /etc/cni/net.d/10-cni-terway.conf
        ## 挂载源目录和目标目录, 拷贝配置文件.
        volumeMounts:
        - name: cni-terway-cfg
          mountPath: /etc/kube-cni-terway/
        - name: cni-config-dir
          mountPath: /etc/cni/net.d
      - name: cp-cni-bin
        image: registry.cn-hangzhou.aliyuncs.com/generals-kuber/cni-terway:0.0.23
        command:
        - cp
        args:
        - -f
        - /cni-terway
        - /opt/cni/bin/cni-terway
        ## 挂载源目录和目标目录, 拷贝cni-terway可执行文件.
        volumeMounts:
        - name: cni-bin
          mountPath: /opt/cni/bin
      containers:
      - name: kube-cni-terway
        image: registry.cn-hangzhou.aliyuncs.com/generals-kuber/cni-terway:0.0.23
        command:
        - /terway
        ## args:
        ## - --bridge
        ## - mybr0
        ## - --iface
        ## - ens33
        resources:
          requests:
            cpu: "100m"
            memory: "50Mi"
          limits:
            cpu: "100m"
            memory: "50Mi"
        securityContext:
          privileged: false
          capabilities:
            add: ["NET_ADMIN", "SYS_PTRACE", "SYS_ADMIN"]
        volumeMounts:
        - name: dhcp-sock
          mountPath: /run/cni/
        - name: cni-bin
          mountPath: /opt/cni/bin
        - name: cni-config-dir
          mountPath: /etc/cni/net.d
      volumes:
        - name: dhcp-sock
          ## 挂载dhcp目录, 存放dhcp.sock文件
          hostPath:
            path: /run/cni/
        - name: cni-config-dir
          hostPath:
            path: /etc/cni/net.d
        - name: cni-bin
          hostPath:
            path: /opt/cni/bin
        - name: cni-terway-cfg
          ## 这个volume由init container挂载, 用于拷贝其中的配置文件
          configMap:
            name: kube-cni-terway-cfg