kpng-deployment-ds-template.txt

apiVersion: apps/v1
kind: DaemonSet
metadata:
  creationTimestamp: null
  labels:
    app: kpng
  name: kpng
  namespace: {{ .Namespace }}
spec:
  selector:
    matchLabels:
      app: kpng
  template:
    metadata:
      labels:
        app: kpng
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "9099"
    spec:
      # to enable progressive deployment on existing cluster you can use node labels:
      #nodeSelector:
      #  kpng: kpng
      serviceAccountName: {{ .ServiceAccountName }}
      hostNetwork: true
      # so that kpng always runs on the controlplane nodes...
      tolerations:
      - operator: "Exists"
        effect: "NoSchedule"
      containers:
      # only spin up bpftools image if ebpf is the selected backend. 
      {{- if .IsEbpfBackend }}
      - image: cilium/cilium-bpftool:b5ba881d2a7ec68d88ecd72efd60ac551c720701
        imagePullPolicy: {{ .ImagePullPolicy }}
        name: kpng-ebpf-tools
        securityContext:
          privileged: true
        command: [ "/bin/bash", "-c", "--", "mount bpffs /sys/fs/bpf -t bpf && sleep infinity" ]
        volumeMounts:
        - name: modules
          mountPath: /lib/modules
          readOnly: true
        - name: bpf-maps
          mountPath: /sys/fs/bpf
          mountPropagation: Bidirectional
        - name: bpf-log
          mountPath: /tracing
      {{- end }}
      # spinup single container when running in one process
      {{- if eq .Deployment_model "single-process-per-node" }}
      - image: {{ .KpngImage }}
        imagePullPolicy: {{ .ImagePullPolicy }}
        env:
        - name: GOLANG_PROTOBUF_REGISTRATION_CONFLICT
          value: warn
        name: kpng-{{ .Backend }}
        securityContext:
            privileged: true
        volumeMounts:
        - name: empty
          mountPath: /k8s
        - name: modules
          mountPath: /lib/modules
          readOnly: true
        - mountPath: /var/lib/kpng
          name: kpng-config
        {{- if .IsEbpfBackend }}
        - name: bpf-maps
          mountPath: /sys/fs/bpf
          mountPropagation: Bidirectional
        - name: cgroup-v2-fs
          mountPath: /sys/fs/cgroup/unified
          readOnly: true
        - name: cgroup-v2-mount
          mountPath: /host-mount/mounts
          mountPropagation: HostToContainer
        {{- end }}
        args: {{ .E2eBackendArgs }}
      {{- else }}
      - image: {{ .KpngImage }}
        imagePullPolicy: {{ .ImagePullPolicy }}
        env:
        - name: GOLANG_PROTOBUF_REGISTRATION_CONFLICT
          value: warn
        name: kpng
        ports:
        - containerPort: 9099
          protocol: TCP
        volumeMounts:
        - name: empty
          mountPath: /k8s
        - mountPath: /var/lib/kpng
          name: kpng-config
        args: {{ .E2eServerArgs }}
      - image: {{ .KpngImage }}
        imagePullPolicy: {{ .ImagePullPolicy }}
        env:
        - name: GOLANG_PROTOBUF_REGISTRATION_CONFLICT
          value: warn
        name: kpng-{{ .Backend }}
        securityContext:
            privileged: true
        volumeMounts:
        - name: empty
          mountPath: /k8s
        - name: modules
          mountPath: /lib/modules
          readOnly: true
        {{- if .IsEbpfBackend }}
        - name: bpf-maps
          mountPath: /sys/fs/bpf
          mountPropagation: Bidirectional
        - name: cgroup-v2-fs
          mountPath: /sys/fs/cgroup/unified
          readOnly: true
        - name: cgroup-v2-mount
          mountPath: /host-mount/mounts
          mountPropagation: HostToContainer
        {{- end }}
        args: {{ .E2eBackendArgs }}
      {{- end }}
      volumes:
      - name: empty
        emptyDir: {}
      - name: modules
        hostPath:
          path: /lib/modules
      - name: kpng-config
        configMap:
          name: {{ .ConfigMapName }}
      {{- if .IsEbpfBackend }}
      - name: bpf-maps
        hostPath:
          path: /sys/fs/bpf
          type: DirectoryOrCreate
      - name: bpf-log
        hostPath:
          path: /sys/kernel/debug/tracing
      - name: cgroup-v2-fs
        hostPath:
          path: /sys/fs/cgroup/unified
      - name: cgroup-v2-mount
        hostPath:
          path: /proc/mounts
      {{- end }}