mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-02-03 02:28:15 -03:30
add Kube-OVN cni to kubespray (#5020)
This commit is contained in:
Oilbeater
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
8afbf339f7
commit
1be788f785
6
roles/network_plugin/kube-ovn/OWNERS
Normal file
6
roles/network_plugin/kube-ovn/OWNERS
Normal file
@@ -0,0 +1,6 @@
|
||||
# See the OWNERS docs at https://go.k8s.io/owners
|
||||
|
||||
approvers:
|
||||
- oilbeater
|
||||
reviewers:
|
||||
- oilbeater
|
||||
11
roles/network_plugin/kube-ovn/defaults/main.yml
Normal file
11
roles/network_plugin/kube-ovn/defaults/main.yml
Normal file
@@ -0,0 +1,11 @@
|
||||
---
|
||||
kube_ovn_db_cpu_request: 200m
|
||||
kube_ovn_db_memory_request: 300Mi
|
||||
kube_ovn_db_cpu_limit: 400m
|
||||
kube_ovn_db_memory_limit: 500Mi
|
||||
kube_ovn_node_cpu_request: 100m
|
||||
kube_ovn_node_memory_request: 300Mi
|
||||
kube_ovn_node_cpu_limit: 200m
|
||||
kube_ovn_node_memory_limit: 500Mi
|
||||
|
||||
traffic_mirror: true
|
||||
16
roles/network_plugin/kube-ovn/tasks/main.yml
Normal file
16
roles/network_plugin/kube-ovn/tasks/main.yml
Normal file
@@ -0,0 +1,16 @@
|
||||
---
|
||||
- name: Kube-OVN | Label ovn-db node
|
||||
shell: >-
|
||||
{{ bin_dir }}/kubectl label --overwrite node {{ groups['kube-master'] | first }} kube-ovn/role=master
|
||||
when:
|
||||
- inventory_hostname == groups['kube-master'][0]
|
||||
|
||||
- name: Kube-OVN | Create Kube-OVN manifests
|
||||
template:
|
||||
src: "{{ item.file }}.j2"
|
||||
dest: "{{ kube_config_dir }}/{{ item.file }}"
|
||||
with_items:
|
||||
- {name: kube-ovn-crd, file: cni-kube-ovn-crd.yml}
|
||||
- {name: ovn, file: cni-ovn.yml}
|
||||
- {name: kube-ovn, file: cni-kube-ovn.yml}
|
||||
register: kube_ovn_node_manifests
|
||||
@@ -0,0 +1,65 @@
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: ips.kubeovn.io
|
||||
spec:
|
||||
group: kubeovn.io
|
||||
version: v1
|
||||
scope: Cluster
|
||||
names:
|
||||
plural: ips
|
||||
singular: ip
|
||||
kind: IP
|
||||
shortNames:
|
||||
- ip
|
||||
additionalPrinterColumns:
|
||||
- name: IP
|
||||
type: string
|
||||
JSONPath: .spec.ipAddress
|
||||
- name: Mac
|
||||
type: string
|
||||
JSONPath: .spec.macAddress
|
||||
- name: Node
|
||||
type: string
|
||||
JSONPath: .spec.nodeName
|
||||
- name: Subnet
|
||||
type: string
|
||||
JSONPath: .spec.subnet
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: subnets.kubeovn.io
|
||||
spec:
|
||||
group: kubeovn.io
|
||||
version: v1
|
||||
scope: Cluster
|
||||
names:
|
||||
plural: subnets
|
||||
singular: subnet
|
||||
kind: Subnet
|
||||
shortNames:
|
||||
- subnet
|
||||
additionalPrinterColumns:
|
||||
- name: Protocol
|
||||
type: string
|
||||
JSONPath: .spec.protocol
|
||||
- name: CIDR
|
||||
type: string
|
||||
JSONPath: .spec.cidrBlock
|
||||
- name: Private
|
||||
type: boolean
|
||||
JSONPath: .spec.private
|
||||
- name: NAT
|
||||
type: boolean
|
||||
JSONPath: .spec.natOutgoing
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
spec:
|
||||
required: ["cidrBlock","gateway"]
|
||||
properties:
|
||||
cidrBlock:
|
||||
type: "string"
|
||||
gateway:
|
||||
type: "string"
|
||||
176
roles/network_plugin/kube-ovn/templates/cni-kube-ovn.yml.j2
Normal file
176
roles/network_plugin/kube-ovn/templates/cni-kube-ovn.yml.j2
Normal file
@@ -0,0 +1,176 @@
|
||||
---
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: kube-ovn-controller
|
||||
namespace: kube-ovn
|
||||
annotations:
|
||||
kubernetes.io/description: |
|
||||
kube-ovn controller
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: kube-ovn-controller
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 0%
|
||||
maxUnavailable: 100%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: kube-ovn-controller
|
||||
component: network
|
||||
type: infra
|
||||
spec:
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
effect: NoSchedule
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app: kube-ovn-controller
|
||||
topologyKey: kubernetes.io/hostname
|
||||
serviceAccountName: ovn
|
||||
hostNetwork: true
|
||||
containers:
|
||||
- name: kube-ovn-controller
|
||||
image: {{ kube_ovn_controller_image_repo }}:{{ kube_ovn_controller_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
command:
|
||||
- /kube-ovn/start-controller.sh
|
||||
args:
|
||||
- --default-cidr={{ kube_pods_subnet }}
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: KUBE_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: KUBE_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- nc
|
||||
- -z
|
||||
- -w3
|
||||
- 127.0.0.1
|
||||
- "10660"
|
||||
periodSeconds: 3
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- nc
|
||||
- -z
|
||||
- -w3
|
||||
- 127.0.0.1
|
||||
- "10660"
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 7
|
||||
failureThreshold: 5
|
||||
nodeSelector:
|
||||
beta.kubernetes.io/os: "linux"
|
||||
|
||||
---
|
||||
kind: DaemonSet
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: kube-ovn-cni
|
||||
namespace: kube-ovn
|
||||
annotations:
|
||||
kubernetes.io/description: |
|
||||
This daemon set launches the kube-ovn cni daemon.
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: kube-ovn-cni
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: kube-ovn-cni
|
||||
component: network
|
||||
type: infra
|
||||
spec:
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
effect: NoSchedule
|
||||
serviceAccountName: ovn
|
||||
hostNetwork: true
|
||||
hostPID: true
|
||||
initContainers:
|
||||
- name: install-cni
|
||||
image: {{ kube_ovn_cni_image_repo }}:{{ kube_ovn_cni_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
command: ["/kube-ovn/install-cni.sh"]
|
||||
volumeMounts:
|
||||
- mountPath: /etc/cni/net.d
|
||||
name: cni-conf
|
||||
- mountPath: /opt/cni/bin
|
||||
name: cni-bin
|
||||
containers:
|
||||
- name: cni-server
|
||||
image: {{ kube_ovn_cni_image_repo }}:{{ kube_ovn_cni_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
command:
|
||||
- sh
|
||||
- /kube-ovn/start-cniserver.sh
|
||||
args:
|
||||
- --enable-mirror={{ traffic_mirror }}
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
privileged: true
|
||||
env:
|
||||
- name: POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
- name: KUBE_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
volumeMounts:
|
||||
- mountPath: /run/openvswitch
|
||||
name: host-run-ovs
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- nc
|
||||
- -z
|
||||
- -w3
|
||||
- 127.0.0.1
|
||||
- "10665"
|
||||
periodSeconds: 3
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- nc
|
||||
- -z
|
||||
- -w3
|
||||
- 127.0.0.1
|
||||
- "10665"
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 7
|
||||
failureThreshold: 5
|
||||
nodeSelector:
|
||||
beta.kubernetes.io/os: "linux"
|
||||
volumes:
|
||||
- name: host-run-ovs
|
||||
hostPath:
|
||||
path: /run/openvswitch
|
||||
- name: cni-conf
|
||||
hostPath:
|
||||
path: /etc/cni/net.d
|
||||
- name: cni-bin
|
||||
hostPath:
|
||||
path: /opt/cni/bin
|
||||
309
roles/network_plugin/kube-ovn/templates/cni-ovn.yml.j2
Normal file
309
roles/network_plugin/kube-ovn/templates/cni-ovn.yml.j2
Normal file
@@ -0,0 +1,309 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: kube-ovn
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: ovn-config
|
||||
namespace: kube-ovn
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ovn
|
||||
namespace: kube-ovn
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
annotations:
|
||||
rbac.authorization.k8s.io/system-only: "true"
|
||||
name: system:ovn
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "kubeovn.io"
|
||||
resources:
|
||||
- subnets
|
||||
- ips
|
||||
verbs:
|
||||
- "*"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- namespaces
|
||||
- nodes
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
- networking.k8s.io
|
||||
- apps
|
||||
resources:
|
||||
- networkpolicies
|
||||
- services
|
||||
- endpoints
|
||||
- statefulsets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- update
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: ovn
|
||||
roleRef:
|
||||
name: system:ovn
|
||||
kind: ClusterRole
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ovn
|
||||
namespace: kube-ovn
|
||||
|
||||
---
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: ovn-nb
|
||||
namespace: kube-ovn
|
||||
spec:
|
||||
ports:
|
||||
- name: ovn-nb
|
||||
protocol: TCP
|
||||
port: 6641
|
||||
targetPort: 6641
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: ovn-central
|
||||
sessionAffinity: None
|
||||
|
||||
---
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: ovn-sb
|
||||
namespace: kube-ovn
|
||||
spec:
|
||||
ports:
|
||||
- name: ovn-sb
|
||||
protocol: TCP
|
||||
port: 6642
|
||||
targetPort: 6642
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: ovn-central
|
||||
sessionAffinity: None
|
||||
|
||||
---
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: ovn-central
|
||||
namespace: kube-ovn
|
||||
annotations:
|
||||
kubernetes.io/description: |
|
||||
OVN components: northd, nb and sb.
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 0%
|
||||
maxUnavailable: 100%
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ovn-central
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ovn-central
|
||||
component: network
|
||||
type: infra
|
||||
spec:
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
effect: NoSchedule
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app: ovn-central
|
||||
topologyKey: kubernetes.io/hostname
|
||||
serviceAccountName: ovn
|
||||
hostNetwork: true
|
||||
containers:
|
||||
- name: ovn-central
|
||||
image: {{ kube_ovn_db_image_repo }}:{{ kube_ovn_db_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
env:
|
||||
- name: POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
resources:
|
||||
requests:
|
||||
cpu: {{ kube_ovn_db_cpu_request }}
|
||||
memory: {{ kube_ovn_db_memory_request }}
|
||||
limits:
|
||||
cpu: {{ kube_ovn_db_cpu_limit }}
|
||||
memory: {{ kube_ovn_db_memory_limit }}
|
||||
volumeMounts:
|
||||
- mountPath: /run/openvswitch
|
||||
name: host-run-ovs
|
||||
- mountPath: /var/run/openvswitch
|
||||
name: host-run-ovs
|
||||
- mountPath: /sys
|
||||
name: host-sys
|
||||
readOnly: true
|
||||
- mountPath: /etc/openvswitch
|
||||
name: host-config-openvswitch
|
||||
- mountPath: /var/log/openvswitch
|
||||
name: host-log
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- /root/ovn-is-leader.sh
|
||||
periodSeconds: 3
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- /root/ovn-healthcheck.sh
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 7
|
||||
failureThreshold: 5
|
||||
nodeSelector:
|
||||
beta.kubernetes.io/os: "linux"
|
||||
kube-ovn/role: "master"
|
||||
volumes:
|
||||
- name: host-run-ovs
|
||||
hostPath:
|
||||
path: /run/openvswitch
|
||||
- name: host-sys
|
||||
hostPath:
|
||||
path: /sys
|
||||
- name: host-config-openvswitch
|
||||
hostPath:
|
||||
path: /etc/origin/openvswitch
|
||||
- name: host-log
|
||||
hostPath:
|
||||
path: /var/log/openvswitch
|
||||
|
||||
---
|
||||
kind: DaemonSet
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: ovs-ovn
|
||||
namespace: kube-ovn
|
||||
annotations:
|
||||
kubernetes.io/description: |
|
||||
This daemon set launches the openvswitch daemon.
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ovs
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ovs
|
||||
component: network
|
||||
type: infra
|
||||
spec:
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
effect: NoSchedule
|
||||
serviceAccountName: ovn
|
||||
hostNetwork: true
|
||||
hostPID: true
|
||||
containers:
|
||||
- name: openvswitch
|
||||
image: {{ kube_ovn_node_image_repo }}:{{ kube_ovn_node_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
privileged: true
|
||||
env:
|
||||
- name: POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
volumeMounts:
|
||||
- mountPath: /lib/modules
|
||||
name: host-modules
|
||||
readOnly: true
|
||||
- mountPath: /run/openvswitch
|
||||
name: host-run-ovs
|
||||
- mountPath: /var/run/openvswitch
|
||||
name: host-run-ovs
|
||||
- mountPath: /sys
|
||||
name: host-sys
|
||||
readOnly: true
|
||||
- mountPath: /etc/openvswitch
|
||||
name: host-config-openvswitch
|
||||
- mountPath: /var/log/openvswitch
|
||||
name: host-log
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- /root/ovs-healthcheck.sh
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- /root/ovs-healthcheck.sh
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 5
|
||||
failureThreshold: 5
|
||||
resources:
|
||||
requests:
|
||||
cpu: {{ kube_ovn_node_cpu_request }}
|
||||
memory: {{ kube_ovn_node_memory_request }}
|
||||
limits:
|
||||
cpu: {{ kube_ovn_node_cpu_limit }}
|
||||
memory: {{ kube_ovn_node_memory_limit }}
|
||||
nodeSelector:
|
||||
beta.kubernetes.io/os: "linux"
|
||||
volumes:
|
||||
- name: host-modules
|
||||
hostPath:
|
||||
path: /lib/modules
|
||||
- name: host-run-ovs
|
||||
hostPath:
|
||||
path: /run/openvswitch
|
||||
- name: host-sys
|
||||
hostPath:
|
||||
path: /sys
|
||||
- name: host-config-openvswitch
|
||||
hostPath:
|
||||
path: /etc/origin/openvswitch
|
||||
- name: host-log
|
||||
hostPath:
|
||||
path: /var/log/openvswitch
|
||||
@@ -40,6 +40,11 @@ dependencies:
|
||||
tags:
|
||||
- contiv
|
||||
|
||||
- role: network_plugin/kube-ovn
|
||||
when: kube_network_plugin == 'kube-ovn'
|
||||
tags:
|
||||
- kube-ovn
|
||||
|
||||
- role: network_plugin/kube-router
|
||||
when: kube_network_plugin == 'kube-router'
|
||||
tags:
|
||||
|
||||
Reference in New Issue
Block a user