github.com/alibaba/sealer@v0.8.6-0.20220430115802-37a2bdaa8173/applications/flannel/kube-flannel.yml (about)

     1  ---
     2  apiVersion: policy/v1beta1
     3  kind: PodSecurityPolicy
     4  metadata:
     5    name: psp.flannel.unprivileged
     6    annotations:
     7      seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
     8      seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
     9      apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
    10      apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
    11  spec:
    12    privileged: false
    13    volumes:
    14    - configMap
    15    - secret
    16    - emptyDir
    17    - hostPath
    18    allowedHostPaths:
    19    - pathPrefix: "/etc/cni/net.d"
    20    - pathPrefix: "/etc/kube-flannel"
    21    - pathPrefix: "/run/flannel"
    22    readOnlyRootFilesystem: false
    23    # Users and groups
    24    runAsUser:
    25      rule: RunAsAny
    26    supplementalGroups:
    27      rule: RunAsAny
    28    fsGroup:
    29      rule: RunAsAny
    30    # Privilege Escalation
    31    allowPrivilegeEscalation: false
    32    defaultAllowPrivilegeEscalation: false
    33    # Capabilities
    34    allowedCapabilities: ['NET_ADMIN', 'NET_RAW']
    35    defaultAddCapabilities: []
    36    requiredDropCapabilities: []
    37    # Host namespaces
    38    hostPID: false
    39    hostIPC: false
    40    hostNetwork: true
    41    hostPorts:
    42    - min: 0
    43      max: 65535
    44    # SELinux
    45    seLinux:
    46      # SELinux is unused in CaaSP
    47      rule: 'RunAsAny'
    48  ---
    49  kind: ClusterRole
    50  apiVersion: rbac.authorization.k8s.io/v1
    51  metadata:
    52    name: flannel
    53  rules:
    54  - apiGroups: ['extensions']
    55    resources: ['podsecuritypolicies']
    56    verbs: ['use']
    57    resourceNames: ['psp.flannel.unprivileged']
    58  - apiGroups:
    59    - ""
    60    resources:
    61    - pods
    62    verbs:
    63    - get
    64  - apiGroups:
    65    - ""
    66    resources:
    67    - nodes
    68    verbs:
    69    - list
    70    - watch
    71  - apiGroups:
    72    - ""
    73    resources:
    74    - nodes/status
    75    verbs:
    76    - patch
    77  ---
    78  kind: ClusterRoleBinding
    79  apiVersion: rbac.authorization.k8s.io/v1
    80  metadata:
    81    name: flannel
    82  roleRef:
    83    apiGroup: rbac.authorization.k8s.io
    84    kind: ClusterRole
    85    name: flannel
    86  subjects:
    87  - kind: ServiceAccount
    88    name: flannel
    89    namespace: kube-system
    90  ---
    91  apiVersion: v1
    92  kind: ServiceAccount
    93  metadata:
    94    name: flannel
    95    namespace: kube-system
    96  ---
    97  kind: ConfigMap
    98  apiVersion: v1
    99  metadata:
   100    name: kube-flannel-cfg
   101    namespace: kube-system
   102    labels:
   103      tier: node
   104      app: flannel
   105  data:
   106    cni-conf.json: |
   107      {
   108        "name": "cbr0",
   109        "cniVersion": "0.3.1",
   110        "plugins": [
   111          {
   112            "type": "flannel",
   113            "delegate": {
   114              "hairpinMode": true,
   115              "isDefaultGateway": true
   116            }
   117          },
   118          {
   119            "type": "portmap",
   120            "capabilities": {
   121              "portMappings": true
   122            }
   123          }
   124        ]
   125      }
   126    net-conf.json: |
   127      {
   128        "Network": "10.244.0.0/16",
   129        "Backend": {
   130          "Type": "vxlan"
   131        }
   132      }
   133  ---
   134  apiVersion: apps/v1
   135  kind: DaemonSet
   136  metadata:
   137    name: kube-flannel-ds
   138    namespace: kube-system
   139    labels:
   140      tier: node
   141      app: flannel
   142  spec:
   143    selector:
   144      matchLabels:
   145        app: flannel
   146    template:
   147      metadata:
   148        labels:
   149          tier: node
   150          app: flannel
   151      spec:
   152        affinity:
   153          nodeAffinity:
   154            requiredDuringSchedulingIgnoredDuringExecution:
   155              nodeSelectorTerms:
   156              - matchExpressions:
   157                - key: kubernetes.io/os
   158                  operator: In
   159                  values:
   160                  - linux
   161        hostNetwork: true
   162        priorityClassName: system-node-critical
   163        tolerations:
   164        - operator: Exists
   165          effect: NoSchedule
   166        serviceAccountName: flannel
   167        initContainers:
   168        - name: install-cni
   169          image: quay.io/coreos/flannel:v0.14.0
   170          command:
   171          - cp
   172          args:
   173          - -f
   174          - /etc/kube-flannel/cni-conf.json
   175          - /etc/cni/net.d/10-flannel.conflist
   176          volumeMounts:
   177          - name: cni
   178            mountPath: /etc/cni/net.d
   179          - name: flannel-cfg
   180            mountPath: /etc/kube-flannel/
   181        containers:
   182        - name: kube-flannel
   183          image: quay.io/coreos/flannel:v0.14.0
   184          command:
   185          - /opt/bin/flanneld
   186          args:
   187          - --ip-masq
   188          - --kube-subnet-mgr
   189          resources:
   190            requests:
   191              cpu: "100m"
   192              memory: "50Mi"
   193            limits:
   194              cpu: "100m"
   195              memory: "50Mi"
   196          securityContext:
   197            privileged: false
   198            capabilities:
   199              add: ["NET_ADMIN", "NET_RAW"]
   200          env:
   201          - name: POD_NAME
   202            valueFrom:
   203              fieldRef:
   204                fieldPath: metadata.name
   205          - name: POD_NAMESPACE
   206            valueFrom:
   207              fieldRef:
   208                fieldPath: metadata.namespace
   209          volumeMounts:
   210          - name: run
   211            mountPath: /run/flannel
   212          - name: flannel-cfg
   213            mountPath: /etc/kube-flannel/
   214        volumes:
   215        - name: run
   216          hostPath:
   217            path: /run/flannel
   218        - name: cni
   219          hostPath:
   220            path: /etc/cni/net.d
   221        - name: flannel-cfg
   222          configMap:
   223            name: kube-flannel-cfg