kops/upup/models/cloudup/resources/addons/networking.amazon-vpc-routed-eni/k8s-1.8.yaml.template

# Vendored from https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.3.3/config/v1.3/aws-k8s-cni.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: aws-node
rules:
- apiGroups:
  - crd.k8s.amazonaws.com
  resources:
  - "*"
  - namespaces
  verbs:
  - "*"
- apiGroups: [""]
  resources:
  - pods
  - nodes
  - namespaces
  verbs: ["list", "watch", "get"]
- apiGroups: ["extensions"]
  resources:
  - daemonsets
  verbs: ["list", "watch"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: aws-node
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: aws-node
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: aws-node
subjects:
- kind: ServiceAccount
  name: aws-node
  namespace: kube-system
---
kind: DaemonSet
apiVersion: extensions/v1beta1
metadata:
  name: aws-node
  namespace: kube-system
  labels:
    k8s-app: aws-node
spec:
  updateStrategy:
    type: RollingUpdate
  selector:
    matchLabels:
      k8s-app: aws-node
  template:
    metadata:
      labels:
        k8s-app: aws-node
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
      serviceAccountName: aws-node
      hostNetwork: true
      tolerations:
      - operator: Exists
      containers:
      - image: "{{- or .Networking.AmazonVPC.ImageName "602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:1.3.3" }}"
        ports:
        - containerPort: 61678
          name: metrics
        name: aws-node
        env:
          - name: CLUSTER_NAME
            value: {{ ClusterName }}
          - name: AWS_VPC_K8S_CNI_LOGLEVEL
            value: DEBUG
          - name: MY_NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: WATCH_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          {{- range .Networking.AmazonVPC.Env }}
          - name: {{ .Name }}
            value: "{{ .Value }}"
          {{- end }}
        resources:
          requests:
            cpu: 10m
        securityContext:
          privileged: true
        volumeMounts:
        - mountPath: /host/opt/cni/bin
          name: cni-bin-dir
        - mountPath: /host/etc/cni/net.d
          name: cni-net-dir
        - mountPath: /host/var/log
          name: log-dir
        - mountPath: /var/run/docker.sock
          name: dockersock
      volumes:
      - name: cni-bin-dir
        hostPath:
          path: /opt/cni/bin
      - name: cni-net-dir
        hostPath:
          path: /etc/cni/net.d
      - name: log-dir
        hostPath:
          path: /var/log
      - name: dockersock
        hostPath:
          path: /var/run/docker.sock
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: eniconfigs.crd.k8s.amazonaws.com
spec:
  scope: Cluster
  group: crd.k8s.amazonaws.com
  version: v1alpha1
  names:
    plural: eniconfigs
    singular: eniconfig
    kind: ENIConfig

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: k8s-ec2-srcdst
  labels:
    role.kubernetes.io/networking: "1"
rules:
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - get
  - list
  - watch
  - update
  - patch

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8s-ec2-srcdst
  namespace: kube-system
  labels:
    role.kubernetes.io/networking: "1"
---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: k8s-ec2-srcdst
  labels:
    role.kubernetes.io/networking: "1"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8s-ec2-srcdst
subjects:
- kind: ServiceAccount
  name: k8s-ec2-srcdst
  namespace: kube-system

---

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: k8s-ec2-srcdst
  namespace: kube-system
  labels:
    k8s-app: k8s-ec2-srcdst
    role.kubernetes.io/networking: "1"
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: k8s-ec2-srcdst
  template:
    metadata:
      labels:
        k8s-app: k8s-ec2-srcdst
        role.kubernetes.io/networking: "1"
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
      hostNetwork: true
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      - key: CriticalAddonsOnly
        operator: Exists
      serviceAccountName: k8s-ec2-srcdst
      containers:
        - image: ottoyiu/k8s-ec2-srcdst:v0.2.0-3-gc0c26eca
          name: k8s-ec2-srcdst
          resources:
            requests:
              cpu: 10m
              memory: 64Mi
          env:
            - name: AWS_REGION
              value: {{ Region }}
          volumeMounts:
            - name: ssl-certs
              mountPath: "/etc/ssl/certs/ca-certificates.crt"
              readOnly: true
          imagePullPolicy: "Always"
      volumes:
        - name: ssl-certs
          hostPath:
            path: "/etc/ssl/certs/ca-certificates.crt"
      nodeSelector:
        node-role.kubernetes.io/master: ""