cluster

Infrastructure files for Nordgedanken and Midnightthoughts.
git clone git://archive.git.mtrnord.blog/MTRNord/cluster.git
Log | Files | Refs | README

binfmt-daemonset.yaml (1767B)

      1 # Registers QEMU x86_64 binfmt_misc handler on worker nodes so that
      2 # buildkitd can transparently cross-compile linux/amd64 images.
      3 # Runs on workers only — control-plane nodes are excluded via nodeAffinity.
      4 #
      5 # tonistiigi/binfmt uses the kernel "F" (fixed-binary) flag, meaning the
      6 # QEMU binary fd is held by the kernel and persists even if this pod restarts.
      7 # Registrations are cleared on node reboot only.
      8 apiVersion: apps/v1
      9 kind: DaemonSet
     10 metadata:
     11   name: binfmt
     12   namespace: image-builder
     13 spec:
     14   selector:
     15     matchLabels:
     16       app: binfmt
     17   updateStrategy:
     18     type: RollingUpdate
     19   template:
     20     metadata:
     21       labels:
     22         app: binfmt
     23     spec:
     24       # Only worker nodes run builds — no need for binfmt on control plane
     25       affinity:
     26         nodeAffinity:
     27           requiredDuringSchedulingIgnoredDuringExecution:
     28             nodeSelectorTerms:
     29               - matchExpressions:
     30                   - key: node-role.kubernetes.io/control-plane
     31                     operator: DoesNotExist
     32       initContainers:
     33         - name: binfmt-install
     34           image: tonistiigi/binfmt:qemu-v8.1.5
     35           args:
     36             - --install
     37             - qemu-aarch64
     38           securityContext:
     39             privileged: true
     40       containers:
     41         # Pause container keeps the DaemonSet pod alive so we can track which
     42         # nodes have had the registration applied.
     43         - name: pause
     44           image: alpine:3
     45           command:
     46             - sleep
     47             - infinity
     48           securityContext:
     49             allowPrivilegeEscalation: false
     50             capabilities:
     51               drop:
     52                 - ALL
     53           resources:
     54             requests:
     55               cpu: 1m
     56               memory: 8Mi
     57             limits:
     58               memory: 16Mi