ovnkube-master.yaml.j2

# ovnkube-master
# daemonset version 3
# starts master daemons (ovnkube-master and ovn-northd), each in a separate container
# it is run on the master(s)
kind: Deployment
apiVersion: apps/v1
metadata:
  name: ovnkube-master
  # namespace set up by install
  namespace: ovn-kubernetes
  annotations:
    kubernetes.io/description: |
      This Deployment launches the ovn-kubernetes master networking components.
spec:
  progressDeadlineSeconds: 600
  replicas: {{ ovn_master_count | default(1|int) }}
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      name: ovnkube-master
  strategy:
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        name: ovnkube-master
        component: network
        type: infra
        kubernetes.io/os: "linux"
    spec:
      priorityClassName: "system-cluster-critical"
      # Requires fairly broad permissions - ability to read all services and network functions as well
      # as all pods.
      serviceAccountName: ovnkube-master
      hostNetwork: true
      dnsPolicy: Default
      {% if ovnkube_compact_mode_enable=="true" and ovn_unprivileged_mode=="no" %}
      hostPID: true
      {% endif %}
      # required to be scheduled on a linux node with node-role.kubernetes.io/control-plane label and
      # only one instance of ovnkube-master pod per node
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: node-role.kubernetes.io/control-plane
                    operator: In
                    values:
                      - ""
                  - key: kubernetes.io/os
                    operator: In
                    values:
                      - "linux"
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: name
                    operator: In
                    values:
                      - ovnkube-master
              topologyKey: kubernetes.io/hostname

      containers:
      # ovn-northd - v3
      - name: ovn-northd
        image: "{{ ovn_image | default('docker.io/ovnkube/ovn-daemonset:latest') }}"
        imagePullPolicy: "{{ ovn_image_pull_policy | default('IfNotPresent') }}"

        command: ["/root/ovnkube.sh", "run-ovn-northd"]

        securityContext:
          runAsUser: 0
          capabilities:
            add: ["SYS_NICE"]

        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        # Run directories where we need to be able to access sockets
        - mountPath: /var/run/dbus/
          name: host-var-run-dbus
          readOnly: true
        - mountPath: /var/log/openvswitch/
          name: host-var-log-ovs
        - mountPath: /var/log/ovn/
          name: host-var-log-ovs
        - mountPath: /var/run/openvswitch/
          name: host-var-run-ovs
        - mountPath: /var/run/ovn/
          name: host-var-run-ovs
        - mountPath: /ovn-cert
          name: host-ovn-cert
          readOnly: true

        resources:
          requests:
            cpu: 100m
            memory: 300Mi
        env:
        - name: OVN_DAEMONSET_VERSION
          value: "1.2.0"
        - name: OVN_LOGLEVEL_NORTHD
          value: "{{ ovn_loglevel_northd }}"
        - name: K8S_APISERVER
          valueFrom:
            configMapKeyRef:
              name: ovn-config
              key: k8s_apiserver
        - name: OVN_KUBERNETES_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: OVN_SSL_ENABLE
          value: "{{ ovn_ssl_en }}"
        readinessProbe:
          exec:
            command: ["/usr/bin/ovn-kube-util", "readiness-probe", "-t", "ovn-northd"]
          initialDelaySeconds: 30
          timeoutSeconds: 30
          periodSeconds: 60
      # end of container

      - name: ovnkube-master
        image: "{{ ovn_image | default('docker.io/ovnkube/ovn-daemonset:latest') }}"
        imagePullPolicy: "{{ ovn_image_pull_policy | default('IfNotPresent') }}"
        {% if ovnkube_compact_mode_enable=="true" %}
        command: ["/root/ovnkube.sh", "ovn-master"]
        securityContext:
          runAsUser: 0
          {% if ovn_unprivileged_mode=="no" -%}
          privileged: true
          {% else %}
          capabilities:
            add:
            - NET_ADMIN
          {% endif %}
        {% if ovn_dummy_gateway_bridge=="true" %}
        lifecycle:
          postStart:
            exec:
              command:
              - /bin/bash
              - -c
              - |
                #!/bin/bash
                ovs-vsctl --may-exist add-br br-ex
                ip a a dev br-ex 10.44.0.1/32 || /bin/true
        {% endif %}
        {% else %}
        command: ["/root/ovnkube.sh", "ovn-master"]
        securityContext:
          runAsUser: 0
        {% endif %}
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        # Run directories where we need to be able to access sockets
        - mountPath: /var/run/dbus/
          name: host-var-run-dbus
          readOnly: true
        - mountPath: /var/log/ovn-kubernetes/
          name: host-var-log-ovnkube
        - mountPath: /var/run/openvswitch/
          name: host-var-run-ovs
        - mountPath: /var/run/ovn/
          name: host-var-run-ovs
        - mountPath: /ovn-cert
          name: host-ovn-cert
          readOnly: true
        - mountPath: /run/ovnkube-config
          name: ovnkube-config
          readOnly: true
        {% if ovnkube_compact_mode_enable=="true" %}
        # Common mounts
        # for the iptables wrapper
        - mountPath: /host
          name: host-slash
          readOnly: true
        # CNI related mounts which we take over
        - mountPath: /opt/cni/bin
          name: host-opt-cni-bin
        - mountPath: /etc/cni/net.d
          name: host-etc-cni-netd
        - mountPath: /var/run/netns
          name: host-netns
          mountPropagation: HostToContainer
        - mountPath: /etc/openvswitch/
          name: host-var-lib-ovs
          readOnly: true
        - mountPath: /etc/ovn/
          name: host-var-lib-ovs
          readOnly: true
        - mountPath: /var/run/ovn-kubernetes
          name: host-var-run-ovn-kubernetes
        {% endif %}
        resources:
          requests:
            cpu: 100m
            memory: 300Mi
        env:
        {% if (enable_coredumps | default("false")) == "true" -%}
        - name: GOTRACEBACK
          value: "crash"
        {% endif -%}
        - name: OVN_DAEMONSET_VERSION
          value: "1.2.0"
        - name: OVNKUBE_LOGLEVEL
          value: "{{ ovnkube_master_loglevel }}"
        - name: OVNKUBE_LOGFILE_MAXSIZE
          value: "{{ ovnkube_logfile_maxsize }}"
        - name: OVNKUBE_LOGFILE_MAXBACKUPS
          value: "{{ ovnkube_logfile_maxbackups }}"
        - name: OVNKUBE_LOGFILE_MAXAGE
          value: "{{ ovnkube_logfile_maxage }}"
        - name: OVNKUBE_LIBOVSDB_CLIENT_LOGFILE
          value: "{{ ovnkube_libovsdb_client_logfile }}"
        - name: OVNKUBE_CONFIG_DURATION_ENABLE
          value: "{{ ovnkube_config_duration_enable }}"
        - name: OVNKUBE_METRICS_SCALE_ENABLE
          value: "{{ ovnkube_metrics_scale_enable }}"
        - name: METRICS_IP
          value: "{{ metrics_ip }}"
        - name: OVNKUBE_COMPACT_MODE_ENABLE
          value: "{{ ovnkube_compact_mode_enable }}"
        - name: OVN_NET_CIDR
          valueFrom:
            configMapKeyRef:
              name: ovn-config
              key: net_cidr
        - name: OVN_SVC_CIDR
          valueFrom:
            configMapKeyRef:
              name: ovn-config
              key: svc_cidr
        - name: K8S_APISERVER
          valueFrom:
            configMapKeyRef:
              name: ovn-config
              key: k8s_apiserver
        - name: K8S_NODE
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: K8S_NODE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: OVN_KUBERNETES_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: OVN_HYBRID_OVERLAY_ENABLE
          value: "{{ ovn_hybrid_overlay_enable }}"
        - name: OVN_ADMIN_NETWORK_POLICY_ENABLE
          value: "{{ ovn_admin_network_policy_enable }}"
        - name: OVN_EGRESSIP_ENABLE
          value: "{{ ovn_egress_ip_enable }}"
        - name: OVN_EGRESSIP_HEALTHCHECK_PORT
          value: "{{ ovn_egress_ip_healthcheck_port }}"
        - name: OVN_EGRESSFIREWALL_ENABLE
          value: "{{ ovn_egress_firewall_enable }}"
        - name: OVN_EGRESSQOS_ENABLE
          value: "{{ ovn_egress_qos_enable }}"
        - name: OVN_MULTI_NETWORK_ENABLE
          value: "{{ ovn_multi_network_enable }}"
        - name: OVN_NETWORK_SEGMENTATION_ENABLE
          value: "{{ ovn_network_segmentation_enable }}"
        - name: OVN_ROUTE_ADVERTISEMENTS_ENABLE
          value: "{{ ovn_route_advertisements_enable }}"
        - name: OVN_EVPN_ENABLE
          value: "{{ ovn_evpn_enable }}"
        - name: OVN_ADVERTISED_UDN_ISOLATION_MODE
          value: "{{ ovn_advertised_udn_isolation_mode }}"
        - name: OVN_DYNAMIC_UDN_ALLOCATION
          value: "{{ ovn_enable_dynamic_udn_allocation }}"
        - name: OVN_DYNAMIC_UDN_GRACE_PERIOD
          value: "{{ ovn_dynamic_udn_grace_period }}"
        - name: OVN_NO_OVERLAY_ENABLE
          value: "{{ ovn_no_overlay_enable }}"
        - name: OVN_EGRESSSERVICE_ENABLE
          value: "{{ ovn_egress_service_enable }}"
        - name: OVN_HYBRID_OVERLAY_NET_CIDR
          value: "{{ ovn_hybrid_overlay_net_cidr }}"
        - name: OVN_DISABLE_SNAT_MULTIPLE_GWS
          value: "{{ ovn_disable_snat_multiple_gws }}"
        - name: OVN_DISABLE_FORWARDING
          value: "{{ ovn_disable_forwarding }}"
        - name: OVN_ENCAP_PORT
          value: "{{ ovn_encap_port }}"
        - name: OVN_EMPTY_LB_EVENTS
          value: "{{ ovn_empty_lb_events }}"
        - name: OVN_V4_JOIN_SUBNET
          value: "{{ ovn_v4_join_subnet }}"
        - name: OVN_V6_JOIN_SUBNET
          value: "{{ ovn_v6_join_subnet }}"
        - name: OVN_V4_MASQUERADE_SUBNET
          value: "{{ ovn_v4_masquerade_subnet }}"
        - name: OVN_V6_MASQUERADE_SUBNET
          value: "{{ ovn_v6_masquerade_subnet }}"
        - name: OVN_SSL_ENABLE
          value: "{{ ovn_ssl_en }}"
        - name: OVN_GATEWAY_MODE
          value: "{{ ovn_gateway_mode }}"
        - name: OVN_GATEWAY_OPTS
          value: "{{ ovn_gateway_opts }}"
        - name: OVN_MULTICAST_ENABLE
          value: "{{ ovn_multicast_enable }}"
        - name: OVN_ACL_LOGGING_RATE_LIMIT
          value: "{{ ovn_acl_logging_rate_limit }}"
        - name: OVN_STATELESS_NETPOL_ENABLE
          value: "{{ ovn_stateless_netpol_enable }}"
        - name: OVN_ENABLE_MULTI_EXTERNAL_GATEWAY
          value: "{{ ovn_enable_multi_external_gateway }}"
        - name: OVN_ENABLE_SVC_TEMPLATE_SUPPORT
          value: "{{ ovn_enable_svc_template_support }}"
        - name: OVN_NOHOSTSUBNET_LABEL
          value: "{{ ovn_nohostsubnet_label }}"
        - name: OVN_DISABLE_REQUESTEDCHASSIS
          value: "{{ ovn_disable_requestedchassis }}"
        - name: OVN_HOST_NETWORK_NAMESPACE
          valueFrom:
            configMapKeyRef:
              name: ovn-config
              key: host_network_namespace
        - name: OVN_ENABLE_PERSISTENT_IPS
          value: "{{ ovn_enable_persistent_ips }}"
        - name: OVN_NETWORK_QOS_ENABLE
          value: "{{ ovn_network_qos_enable }}"
        - name: OVN_ENABLE_DNSNAMERESOLVER
          value: "{{ ovn_enable_dnsnameresolver }}"
        - name: OVN_ALLOW_ICMP_NETPOL
          value: "{{ ovn_allow_icmp_netpol }}"
      # end of container

      volumes:
      # TODO: Need to check why we need this?
      - name: host-var-run-dbus
        hostPath:
          path: /var/run/dbus
      - name: host-var-log-ovs
        hostPath:
          path: /var/log/openvswitch
      - name: host-var-log-ovnkube
        hostPath:
          path: /var/log/ovn-kubernetes
      - name: host-var-run-ovs
        hostPath:
          path: /var/run/openvswitch
      - name: host-ovn-cert
        hostPath:
          path: /etc/ovn
          type: DirectoryOrCreate
      - name: ovnkube-config
        configMap:
          name: ovnkube-config
      {% if ovnkube_compact_mode_enable=="true" %}
      - name: host-slash
        hostPath:
          path: /
      - name: host-opt-cni-bin
        hostPath:
          path: /opt/cni/bin
      - name: host-etc-cni-netd
        hostPath:
          path: /etc/cni/net.d
      - name: host-netns
        hostPath:
          path: /var/run/netns
      - name: host-run-ovs
        hostPath:
          path: /run/openvswitch
      - name: host-var-lib-ovs
        hostPath:
          path: /var/lib/openvswitch
      - name: host-var-run-ovn-kubernetes
        hostPath:
          path: /var/run/ovn-kubernetes
      {% endif %}
      tolerations:
      - operator: "Exists"