loxilb-service-proxy-non-privileged.yml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: loxilb-lb
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: loxilb-app
  template:
    metadata:
      name: loxilb-lb
      labels:
        app: loxilb-app
    spec:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      tolerations:
      - key: "node-role.kubernetes.io/master"
        operator: Exists
      - key: "node-role.kubernetes.io/control-plane"
        operator: Exists
      #affinity:
      #  nodeAffinity:
      #    requiredDuringSchedulingIgnoredDuringExecution:
      #      nodeSelectorTerms:
      #      - matchExpressions:
      #        - key: "node-role.kubernetes.io/master"
      #          operator: Exists
      #        - key: "node-role.kubernetes.io/control-plane"
      #          operator: Exists
      volumes:
      - name: hllb
        hostPath:
          path: /etc/loxilb
          type: DirectoryOrCreate
      containers:
      - name: loxilb-app
        image: "ghcr.io/loxilb-io/loxilb:latest"
        imagePullPolicy: Always  
        command:
        - /root/loxilb-io/loxilb/loxilb
        args:
        - --egr-hooks
        - --ipvs-compat
        - --blacklist=eth0
        volumeMounts:
        - name: hllb
          mountPath: /etc/loxilb
        ports:
        - containerPort: 11111
        - containerPort: 179
        securityContext:
          #privileged: true
          capabilities:
            add:
              - SYS_ADMIN
              - DAC_OVERRIDE
              - FOWNER
              - SETGID
              - SETUID
              - IPC_LOCK
              - SYS_MODULE
              - SYS_ADMIN
              - SYS_RESOURCE
              - CHOWN
              - KILL
              - NET_ADMIN
              - NET_RAW
              - BPF
---
apiVersion: v1
kind: Service
metadata:
  name: loxilb-egress-service
  namespace: kube-system
  annotations:
    loxilb.io/egress: "yes"
    loxilb.io/probetype: "none"
spec:
  externalTrafficPolicy: Local
  type: LoadBalancer
  loadBalancerClass: loxilb.io/loxilb
  selector:
    app: loxilb-app
  ports:
  - name: loxilb-egress
    port: 9999
    targetPort: 9999
    protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  name: loxilb-lb-service
  namespace: kube-system
spec:
  clusterIP: None
  selector:
    app: loxilb-app
  ports:
  - name: loxilb-app
    port: 11111
    targetPort: 11111
    protocol: TCP