blob: e93e9da256fe7cb6319023d774eb2cca3af0250d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
|
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "firewall.fullname" . }}
labels:
release: {{ .Release.Name }}
app: {{ include "firewall.name" . }}
chart: {{ .Chart.Name }}
spec:
replicas: {{ .Values.replicaCount }}
selector:
matchLabels:
app: {{ include "firewall.name" . }}
release: {{ .Release.Name }}
template:
metadata:
labels:
app: {{ include "firewall.name" . }}
release: {{ .Release.Name }}
annotations:
k8s.v1.cni.cncf.io/networks: '[
{ "name": "host-device-{{ .Values.global.unprotectedNetPortVfw }}",
"interface": "veth12" },
{ "name": "host-device-{{ .Values.global.protectedNetPortVfw }}",
"interface": "veth21" }
]'
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
{{- range .Values.global.nodeAffinity }}
- key: {{ .label.labelkey }}
operator: {{ .label.op }}
values:
{{- range .label.labelvalues }}
- {{ . }}
{{- end }}
{{- end }}
containers:
- name: {{ .Chart.Name }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
tty: true
stdin: true
env:
- name: unprotectedNetCidr
value: "{{.Values.global.unprotectedNetCidr}}"
- name: unprotectedNetGwIp
value: "{{.Values.global.unprotectedNetGwIp}}"
- name: protectedNetCidr
value: "{{.Values.global.protectedNetCidr}}"
- name: protectedNetGwIp
value: "{{.Values.global.protectedNetGwIp}}"
- name: dcaeCollectorIp
value: "{{.Values.global.dcaeCollectorIp}}"
- name: dcaeCollectorPort
value: "{{.Values.global.dcaeCollectorPort}}"
command: ["/bin/bash", "/opt/vfw_start.sh"]
securityContext:
privileged: true
capabilities:
add:
- CAP_SYS_ADMIN
volumeMounts:
- mountPath: /hugepages
name: hugepage
- name: lib-modules
mountPath: /lib/modules
- name: src
mountPath: /usr/src
- name: scripts
mountPath: /opt
resources:
requests:
cpu: {{ .Values.resources.cpu }}
memory: {{ .Values.resources.memory }}
hugepages-2Mi: {{ .Values.resources.hugepage }}
limits:
cpu: {{ .Values.resources.cpu }}
memory: {{ .Values.resources.memory }}
hugepages-2Mi: {{ .Values.resources.hugepage }}
volumes:
- name: hugepage
emptyDir:
medium: HugePages
- name: lib-modules
hostPath:
path: /lib/modules
- name: src
hostPath:
path: /usr/src
- name: scripts
configMap:
name: {{ .Chart.Name }}-scripts-configmap
imagePullSecrets:
- name: admin-registry-secret
|
