daemonset.yaml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: calico-node
  namespace: kube-system
  labels:
    k8s-app: calico-node
spec:
  selector:
    matchLabels:
      k8s-app: calico-node
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  template:
    metadata:
      labels:
        k8s-app: calico-node
    spec:
      nodeSelector:
        kubernetes.io/os: linux
      hostNetwork: true
      priorityClassName: system-node-critical
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: calico-node
      tolerations:
      - key: node-role.kubernetes.io/controller
        operator: Exists
      - key: node.kubernetes.io/not-ready
        operator: Exists
      %{~ for key in daemonset_tolerations ~}
      - key: ${key}
        operator: Exists
      %{~ endfor ~}
      initContainers:
        # Install Calico CNI binaries and CNI network config file on nodes
        - name: install-cni
          image: ${calico_cni_image}
          command: ["/opt/cni/bin/install"]
          env:
            # Name of the CNI config file to create on each node.
            - name: CNI_CONF_NAME
              value: "10-calico.conflist"
            # Contents of the CNI config to create on each node.
            - name: CNI_NETWORK_CONFIG
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: cni_network_config
            # Set node name based on k8s nodeName
            - name: KUBERNETES_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: CNI_MTU
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: veth_mtu
            - name: SLEEP
              value: "false"
            - name: CNI_NET_DIR
              value: "/etc/cni/net.d"
          volumeMounts:
            - name: cni-bin-dir
              mountPath: /host/opt/cni/bin
            - name: cni-conf-dir
              mountPath: /host/etc/cni/net.d
      containers:
        - name: calico-node
          image: ${calico_image}
          env:
            # Use Kubernetes API as the backing datastore.
            - name: DATASTORE_TYPE
              value: "kubernetes"
            # Wait for datastore
            - name: WAIT_FOR_DATASTORE
              value: "true"
            # Typha support: controlled by the ConfigMap.
            - name: FELIX_TYPHAK8SSERVICENAME
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: typha_service_name
            - name: FELIX_USAGEREPORTINGENABLED
              value: "${enable_reporting}"
            # Set node name based on k8s nodeName.
            - name: NODENAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            # Calico network backend
            - name: CALICO_NETWORKING_BACKEND
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: calico_backend
            # Cluster type to identify the deployment type
            - name: CLUSTER_TYPE
              value: "k8s,bgp"
            # Auto-detect the BGP IP address.
            - name: IP
              value: "autodetect"
            - name: IP_AUTODETECTION_METHOD
              value: "${network_ip_autodetection_method}"
            # Whether Felix should enable IP-in-IP tunnel
            - name: FELIX_IPINIPENABLED
              value: "${ipip_enabled}"
            # MTU to set on the IPIP tunnel (if enabled)
            - name: FELIX_IPINIPMTU
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: veth_mtu
            # Whether Felix should enable VXLAN tunnel
            - name: FELIX_VXLANENABLED
              value: "${vxlan_enabled}"
            # MTU to set on the VXLAN tunnel (if enabled)
            - name: FELIX_VXLANMTU
              valueFrom:
                configMapKeyRef:
                  name: calico-config
                  key: veth_mtu
            - name: NO_DEFAULT_POOLS
              value: "true"
            # Disable file logging so `kubectl logs` works.
            - name: CALICO_DISABLE_FILE_LOGGING
              value: "true"
            # Set Felix endpoint to host default action to ACCEPT.
            - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
              value: "ACCEPT"
            # Disable IPV6 on Kubernetes.
            - name: FELIX_IPV6SUPPORT
              value: "false"
            - name: FELIX_HEALTHENABLED
              value: "true"
            # Detect iptables legacy or nft
            - name: FELIX_IPTABLESBACKEND
              value: "Auto"
          securityContext:
            privileged: true
          resources:
            requests:
              cpu: 100m
          livenessProbe:
            exec:
              command:
                - /bin/calico-node
                - -felix-ready
            periodSeconds: 10
            initialDelaySeconds: 10
            failureThreshold: 6
            timeoutSeconds: 10
          readinessProbe:
            exec:
              command:
                - /bin/calico-node
                - -felix-ready
                ${ipip_readiness}
            periodSeconds: 10
          volumeMounts:
            - name: lib-modules
              mountPath: /lib/modules
              readOnly: true
            - name: var-lib-calico
              mountPath: /var/lib/calico
              readOnly: false
            - name: var-run-calico
              mountPath: /var/run/calico
              readOnly: false
            - name: xtables-lock
              mountPath: /run/xtables.lock
              readOnly: false
            # For maintaining CNI plugin API credentials
            - name: cni-conf-dir
              mountPath: /host/etc/cni/net.d
              readOnly: false
      terminationGracePeriodSeconds: 0
      volumes:
        # Used by calico/node
        - name: lib-modules
          hostPath:
            path: /lib/modules
        - name: var-lib-calico
          hostPath:
            path: /var/lib/calico
        - name: var-run-calico
          hostPath:
            path: /var/run/calico
        - name: xtables-lock
          hostPath:
            type: FileOrCreate
            path: /run/xtables.lock
        # Used by install-cni
        - name: cni-bin-dir
          hostPath:
            path: /opt/cni/bin
        - name: cni-conf-dir
          hostPath:
            type: DirectoryOrCreate
            path: /etc/cni/net.d