apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kuryr-cni
  namespace: openshift-kuryr
  annotations:
    kubernetes.io/description: |
      This DaemonSet launches the kuryr-daemon component.
    release.openshift.io/version: "{{.ReleaseVersion}}"
spec:
  selector:
    matchLabels:
      app: kuryr-cni
  template:
    metadata:
      name: kuryr-cni
      labels:
        app: kuryr-cni
        component: network
        type: infra
        openshift.io/component: network
        configuration-hash: {{ .ConfigMapHash }}
    spec:
      hostNetwork: true
      serviceAccountName: kuryr
      priorityClassName: system-node-critical
      initContainers:
        - name: block-mcs
          securityContext:
            privileged: true
          image: {{ .DaemonImage }}
          command:
          - /bin/sh
          - -c
          - |
            #!/bin/sh
            set -x -e

            # Block MCS
            iptables -A OUTPUT -p tcp -m tcp --dport 22623 -j REJECT
            iptables -A OUTPUT -p tcp -m tcp --dport 22624 -j REJECT
            iptables -A FORWARD -p tcp -m tcp --dport 22623 -j REJECT
            iptables -A FORWARD -p tcp -m tcp --dport 22624 -j REJECT

            # Block MCS on IPv6, ignore errors in case IPv6 iface is not there
            ip6tables -A OUTPUT -p tcp -m tcp --dport 22623 -j REJECT || true
            ip6tables -A OUTPUT -p tcp -m tcp --dport 22624 -j REJECT || true
            ip6tables -A FORWARD -p tcp -m tcp --dport 22623 -j REJECT || true
            ip6tables -A FORWARD -p tcp -m tcp --dport 22624 -j REJECT || true
          volumeMounts:
          # for the iptables wrapper
          - mountPath: /host
            name: host-slash
            readOnly: true
            mountPropagation: HostToContainer
      containers:
      - name: kuryr-cni
        image: {{ .DaemonImage }}
        env:
        # Tell daemon to talk to the apiserver directly.
        - name: KUBERNETES_SERVICE_PORT_HTTPS
          value: "{{.KUBERNETES_SERVICE_PORT}}"
        - name: KUBERNETES_SERVICE_HOST
          value: "{{.KUBERNETES_SERVICE_HOST}}"
        - name: CNI_DAEMON
          value: "True"
        - name: KUBERNETES_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: KURYR_CNI_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        securityContext:
          privileged: true
        volumeMounts:
        - name: bin
          mountPath: /opt/cni/bin
        - name: net-conf
          mountPath: /etc/cni/net.d
        - name: config-volume
          mountPath: /etc/kuryr
        - name: proc
          mountPath: /host_proc
        - name: openvswitch
          mountPath: /var/run/openvswitch
        - name: netns
          mountPath: /run/netns
          mountPropagation: HostToContainer
{{ if eq (getOr . "DaemonEnableProbes" true) true }}
        readinessProbe:
          failureThreshold: 10
          httpGet:
            path: /ready
            port: {{ default 8090 .DaemonProbesPort }}
            scheme: HTTP
          initialDelaySeconds: 15
          timeoutSeconds: 5
        livenessProbe:
          failureThreshold: 10
          httpGet:
            path: /alive
            port: {{ default 8090 .DaemonProbesPort }}
          initialDelaySeconds: 15
{{ end }}
        ports:
        - name: metrics-port
          containerPort: 9655
      volumes:
      - name: host-slash
        hostPath:
          path: /
      - name: bin
        hostPath:
          path: {{.CNIBinDir}}
      - name: net-conf
        hostPath:
          path: {{.CNIConfDir}}
      - name: config-volume
        configMap:
          name: kuryr-config
      - name: proc
        hostPath:
          path: /proc
      - name: netns
        hostPath:
          path: /run/netns
      - name: openvswitch
        hostPath:
          path: /var/run/openvswitch
      tolerations:
        - operator: Exists
