commit 2b583f8ea8bee5f65f5ce0b32328ad1126f49ac2
parent 0dfe744c0962b0807e9953d24fde2a600c61a507
Author: MTRNord <mtrnord1@gmail.com>
Date: Mon, 10 Apr 2023 00:57:48 +0200
Disable kube-router and make volume larger for pg
Diffstat:
4 files changed, 82 insertions(+), 51 deletions(-)
diff --git a/infrastructure/configs/postgres-clusters.yaml b/infrastructure/configs/postgres-clusters.yaml
@@ -71,7 +71,7 @@ spec:
signal_bridge: []
instagram_bridge: []
volume:
- size: 10Gi
+ size: 50Gi
patroni:
ttl: 30
loop_wait: 10
diff --git a/infrastructure/controllers/kube-router.yaml b/infrastructure/controllers/kube-router.yaml
@@ -1,17 +1,36 @@
---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: kube-router-cfg
+ namespace: kube-system
+ labels:
+ tier: node
+ k8s-app: kube-router
+data:
+ cni-conf.json: |
+ {
+ "cniVersion":"0.3.0",
+ "name":"mynet",
+ "plugins":[
+ {
+ "name":"kubernetes",
+ "type":"bridge",
+ "bridge":"kube-bridge",
+ "isDefaultGateway":true,
+ "ipam":{
+ "type":"host-local"
+ }
+ }
+ ]
+ }
+---
apiVersion: apps/v1
kind: DaemonSet
metadata:
labels:
k8s-app: kube-router
tier: node
- annotations:
- checkov.io/skip1: CKV_K8S_20=The container needs to modify host network rules.
- checkov.io/skip2: CKV_K8S_19=The container needs to modify host network rules.
- checkov.io/skip3: CKV_K8S_38=The container needs to know values from the node.
- checkov.io/skip4: CKV_K8S_28=The container does bgp.
- prometheus.io/scrape: "true"
- prometheus.io/port: "8081"
name: kube-router
namespace: kube-system
spec:
@@ -27,47 +46,35 @@ spec:
spec:
priorityClassName: system-node-critical
serviceAccountName: kube-router
+ serviceAccount: kube-router
containers:
- name: kube-router
- image: docker.io/cloudnativelabs/kube-router:v2.0.0-rc3
+ image: docker.io/cloudnativelabs/kube-router
imagePullPolicy: Always
args:
- - "--run-router=true"
- - "--run-firewall=false"
- - "--run-service-proxy=false"
- - "--enable-cni=false"
- - "--enable-pod-egress=false"
+ - --run-router=true
+ - --run-firewall=true
+ - --run-service-proxy=true
+ - --bgp-graceful-restart=true
+ - --advertise-cluster-ip
- "--enable-ipv4=true"
- "--enable-ipv6=true"
- "--service-cluster-ip-range=10.96.0.0/16"
- "--service-cluster-ip-range=fc00:1::/112"
- - "--enable-ibgp=true"
- - "--enable-overlay=true"
- - "--advertise-cluster-ip=true"
- - "--advertise-external-ip=true"
- - "--advertise-loadbalancer-ip=true"
- - "--overlay-type=full"
- #- "--bgp-graceful-restart=true"
- - "-v=3"
- #- "--peer-router-ips=<CHANGE ME>"
- #- "--peer-router-asns=<CHANGE ME>"
- #- "--cluster-asn=<CHANGE ME>"
- # Metrics
- - "--metrics-port=8081"
+ #- --kubeconfig=/var/lib/kube-router/kubeconfig
env:
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
+ - name: KUBE_ROUTER_CNI_CONF_FILE
+ value: /etc/cni/net.d/10-kuberouter.conflist
livenessProbe:
httpGet:
path: /healthz
port: 20244
initialDelaySeconds: 10
periodSeconds: 3
- ports:
- - containerPort: 8081
- name: monitoring
resources:
requests:
cpu: 250m
@@ -75,9 +82,38 @@ spec:
securityContext:
privileged: true
volumeMounts:
+ - name: lib-modules
+ mountPath: /lib/modules
+ readOnly: true
+ - name: cni-conf-dir
+ mountPath: /etc/cni/net.d
+ #- name: kubeconfig
+ # mountPath: /var/lib/kube-router
+ # readOnly: true
- name: xtables-lock
mountPath: /run/xtables.lock
readOnly: false
+ initContainers:
+ - name: install-cni
+ image: docker.io/cloudnativelabs/kube-router
+ imagePullPolicy: Always
+ command:
+ - /bin/sh
+ - -c
+ - set -e -x;
+ if [ ! -f /etc/cni/net.d/10-kuberouter.conflist ]; then
+ if [ -f /etc/cni/net.d/*.conf ]; then
+ rm -f /etc/cni/net.d/*.conf;
+ fi;
+ TMP=/etc/cni/net.d/.tmp-kuberouter-cfg;
+ cp /etc/kube-router/cni-conf.json ${TMP};
+ mv ${TMP} /etc/cni/net.d/10-kuberouter.conflist;
+ fi
+ volumeMounts:
+ - name: cni-conf-dir
+ mountPath: /etc/cni/net.d
+ - name: kube-router-cfg
+ mountPath: /etc/kube-router
hostNetwork: true
tolerations:
- effect: NoSchedule
@@ -87,6 +123,21 @@ spec:
- effect: NoExecute
operator: Exists
volumes:
+ - name: lib-modules
+ hostPath:
+ path: /lib/modules
+ - name: cni-conf-dir
+ hostPath:
+ path: /etc/cni/net.d
+ - name: kube-router-cfg
+ configMap:
+ name: kube-router-cfg
+ #- name: kubeconfig
+ # configMap:
+ # name: kube-proxy
+ # items:
+ # - key: kubeconfig.conf
+ # path: kubeconfig
- name: xtables-lock
hostPath:
path: /run/xtables.lock
@@ -97,7 +148,6 @@ kind: ServiceAccount
metadata:
name: kube-router
namespace: kube-system
-
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
@@ -133,7 +183,6 @@ rules:
- get
- list
- watch
-
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -147,20 +196,3 @@ subjects:
- kind: ServiceAccount
name: kube-router
namespace: kube-system
----
-apiVersion: monitoring.coreos.com/v1
-kind: PodMonitor
-metadata:
- name: kube-router
- namespace: kube-system
-spec:
- namespaceSelector:
- matchNames:
- - "kube-system"
- podMetricsEndpoints:
- - interval: 5s
- path: /metrics
- port: monitoring
- selector:
- matchLabels:
- k8s-app: kube-router
diff --git a/infrastructure/controllers/kube-router.yaml b/infrastructure/controllers/kube-router_old.yaml
diff --git a/infrastructure/controllers/kustomization.yaml b/infrastructure/controllers/kustomization.yaml
@@ -5,4 +5,4 @@ resources:
- cert-manager.yaml
- weave-gitops.yaml
- image-updater.yaml
- - kube-router.yaml
-\ No newline at end of file
+ #- kube-router.yaml
