---
# ovs-node
# daemonset version 3
# starts node daemons for ovs
# it is run on all nodes
kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: ovs-node
  # namespace set up by install
  namespace: ovn-kubernetes
  annotations:
    kubernetes.io/description: |
      This DaemonSet launches the ovs networking components for all nodes.
spec:
  selector:
    matchLabels:
      app: ovs-node
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: ovs-node
        name: ovs-node
        component: network
        type: infra
        kubernetes.io/os: "linux"
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
      hostNetwork: true
      {{ "hostPID: true" if ovn_unprivileged_mode=="no" }}
      containers:

      # ovsdb-server and ovs-switchd daemons
      - name: ovs-daemons
        image: "{{ ovn_image | default('docker.io/ovnkube/ovn-daemonset:latest') }}"
        imagePullPolicy: "{{ ovn_image_pull_policy | default('IfNotPresent') }}"

        command: ["/root/ovnkube.sh", "ovs-server"]

        livenessProbe:
          exec:
            command:
            - /usr/share/openvswitch/scripts/ovs-ctl
            - status
          initialDelaySeconds: 30
          timeoutSeconds: 30
          periodSeconds: 60
        readinessProbe:
          exec:
            command: ["/usr/bin/ovn-kube-util", "readiness-probe", "-t", "ovs-daemons"]
          initialDelaySeconds: 30
          timeoutSeconds: 30
          periodSeconds: 60

        securityContext:
          runAsUser: 0
          # Permission could be reduced by selecting an appropriate SELinux policy
          privileged: true

        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /lib/modules
          name: host-modules
          readOnly: true
        - mountPath: /run/openvswitch
          name: host-run-ovs
        - mountPath: /var/run/openvswitch
          name: host-var-run-ovs
        - mountPath: /sys
          name: host-sys
        - mountPath: /etc/openvswitch
          name: host-config-openvswitch
        - mountPath: /var/run/dbus/
          name: host-var-run-dbus
        - mountPath: /var/log/openvswitch/
          name: host-var-log-ovs
        - mountPath: /var/lib/openvswitch/
          name: host-var-lib-ovs

        resources:
          requests:
            cpu: 100m
            memory: 300Mi
          limits:
            cpu: 200m
            memory: 400Mi
        env:
        - name: OVN_DAEMONSET_VERSION
          value: "3"
        lifecycle:
          preStop:
            exec:
              command: ["/root/ovnkube.sh", "cleanup-ovs-server"]

      nodeSelector:
        kubernetes.io/os: "linux"
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: k8s.ovn.org/dpu-host
                operator: DoesNotExist
      volumes:
      - name: host-modules
        hostPath:
          path: /lib/modules
      - name: host-var-run-dbus
        hostPath:
          path: /var/run/dbus
      - name: host-var-log-ovs
        hostPath:
          path: /var/log/openvswitch
      - name: host-run-ovs
        hostPath:
          path: /run/openvswitch
      - name: host-var-run-ovs
        hostPath:
          path: /var/run/openvswitch
      - name: host-sys
        hostPath:
          path: /sys
      - name: host-config-openvswitch
        hostPath:
          path: /etc/origin/openvswitch
      - name: host-var-lib-ovs
        hostPath:
          path: /var/lib/openvswitch

      tolerations:
      - operator: "Exists"
