diff --git a/deployment/base/master-worker-combined/kustomization.yaml b/deployment/base/master-worker-combined/kustomization.yaml new file mode 100644 index 000000000..665515737 --- /dev/null +++ b/deployment/base/master-worker-combined/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +namespace: node-feature-discovery + +resources: +- master-worker-daemonset.yaml diff --git a/deployment/base/master-worker-combined/master-worker-daemonset.yaml b/deployment/base/master-worker-combined/master-worker-daemonset.yaml new file mode 100644 index 000000000..e8f305746 --- /dev/null +++ b/deployment/base/master-worker-combined/master-worker-daemonset.yaml @@ -0,0 +1,29 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + labels: + app: nfd + name: nfd +spec: + selector: + matchLabels: + app: nfd + template: + metadata: + labels: + app: nfd + spec: + serviceAccount: nfd-master + tolerations: [] + containers: + - name: nfd-master + image: gcr.io/k8s-staging-nfd/node-feature-discovery:master + imagePullPolicy: Always + command: + - "nfd-master" + - name: nfd-worker + image: gcr.io/k8s-staging-nfd/node-feature-discovery:master + imagePullPolicy: Always + command: + - "nfd-worker" + args: [] diff --git a/deployment/components/common/env-combined.yaml b/deployment/components/common/env-combined.yaml new file mode 100644 index 000000000..f490d8784 --- /dev/null +++ b/deployment/components/common/env-combined.yaml @@ -0,0 +1,14 @@ +- op: add + path: "/spec/template/spec/containers/0/env" + value: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName +- op: add + path: "/spec/template/spec/containers/1/env" + value: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName diff --git a/deployment/components/common/kustomization.yaml b/deployment/components/common/kustomization.yaml index 7b1ee1a52..459b0cfa5 100644 --- a/deployment/components/common/kustomization.yaml +++ b/deployment/components/common/kustomization.yaml @@ -18,3 +18,20 @@ patches: target: labelSelector: app=nfd name: nfd-worker +# We need separate patches for the "combined" daemonset with two containers in the pod :/ +- path: env-combined.yaml + target: + labelSelector: app=nfd + name: nfd +- path: securitycontext-combined.yaml + target: + labelSelector: app=nfd + name: nfd +- path: master-affinity.yaml + target: + labelSelector: app=nfd + name: nfd +- path: worker-mounts-combined.yaml + target: + labelSelector: app=nfd + name: nfd diff --git a/deployment/components/common/securitycontext-combined.yaml b/deployment/components/common/securitycontext-combined.yaml new file mode 100644 index 000000000..7552313e6 --- /dev/null +++ b/deployment/components/common/securitycontext-combined.yaml @@ -0,0 +1,16 @@ +- op: add + path: "/spec/template/spec/containers/0/securityContext" + value: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + readOnlyRootFilesystem: true + runAsNonRoot: true +- op: add + path: "/spec/template/spec/containers/1/securityContext" + value: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + readOnlyRootFilesystem: true + runAsNonRoot: true diff --git a/deployment/components/common/worker-mounts-combined.yaml b/deployment/components/common/worker-mounts-combined.yaml new file mode 100644 index 000000000..2a1faec0d --- /dev/null +++ b/deployment/components/common/worker-mounts-combined.yaml @@ -0,0 +1,55 @@ +- op: add + path: /spec/template/spec/volumes + value: + - name: host-boot + hostPath: + path: "/boot" + - name: host-os-release + hostPath: + path: "/etc/os-release" + - name: host-sys + hostPath: + path: "/sys" + - name: host-usr-lib + hostPath: + path: "/usr/lib" + - name: host-usr-src + hostPath: + path: "/usr/src" + - name: source-d + hostPath: + path: "/etc/kubernetes/node-feature-discovery/source.d/" + - name: features-d + hostPath: + path: "/etc/kubernetes/node-feature-discovery/features.d/" + - name: nfd-worker-conf + configMap: + name: nfd-worker-conf + +- op: add + path: /spec/template/spec/containers/1/volumeMounts + value: + - name: host-boot + mountPath: "/host-boot" + readOnly: true + - name: host-os-release + mountPath: "/host-etc/os-release" + readOnly: true + - name: host-sys + mountPath: "/host-sys" + readOnly: true + - name: host-usr-lib + mountPath: "/host-usr/lib" + readOnly: true + - name: host-usr-src + mountPath: "/host-usr/src" + readOnly: true + - name: source-d + mountPath: "/etc/kubernetes/node-feature-discovery/source.d/" + readOnly: true + - name: features-d + mountPath: "/etc/kubernetes/node-feature-discovery/features.d/" + readOnly: true + - name: nfd-worker-conf + mountPath: "/etc/kubernetes/node-feature-discovery" + readOnly: true diff --git a/deployment/overlays/default-combined/kustomization.yaml b/deployment/overlays/default-combined/kustomization.yaml new file mode 100644 index 000000000..89de02aaa --- /dev/null +++ b/deployment/overlays/default-combined/kustomization.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +namespace: node-feature-discovery + +bases: +- ../../base/rbac +- ../../base/master-worker-combined + +resources: +- namespace.yaml + +components: +- ../../components/worker-config +- ../../components/common diff --git a/deployment/overlays/default-combined/namespace.yaml b/deployment/overlays/default-combined/namespace.yaml new file mode 100644 index 000000000..8e54de2e3 --- /dev/null +++ b/deployment/overlays/default-combined/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: node-feature-discovery