apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app.kubernetes.io/name: ovn-chassis
  annotations:
    kubernetes.io/description: |
      An OVN chassis is a node in an open virtual network and
      hosts the ovsdb, vswitchd and ovn-controller on selected nodes.

      See https://github.com/alauda/kube-ovn/blob/v1.5.0/dist/images/start-ovs.sh
  name: ovn-chassis
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: ovn-chassis
  updateStrategy:
    type: OnDelete
  template:
    metadata:
      labels:
        app.kubernetes.io/name: ovn-chassis
    spec:
      nodeSelector:
        kubernetes.io/os: linux
        node-role.kubernetes.io/ovn-chassis: "true"
      affinity:
        # Even though we are a daemon set,
        # require no other ovn-chassis on the same node.
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: ovn-chassis
              topologyKey: kubernetes.io/hostname
        podAffinity:
          # Even though we are a daemon set,
          # prefer running on ovn-chassis along with ovn-central.
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                topologyKey: kubernetes.io/hostname
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: ovn-central
              weight: 1
      hostNetwork: true
      hostPID: true
      priorityClassName: system-node-critical
      serviceAccountName: ovn
      tolerations:
        - effect: NoSchedule
          operator: Exists
      containers:
      - name: chassis
        command:
        - /kube-ovn/start-ovs.sh
        env:
        - name: ENABLE_SSL
          value: "true"
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: HW_OFFLOAD
          value: "false"
        - name: KUBE_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        image: kubeovn/kube-ovn
        imagePullPolicy: IfNotPresent
        livenessProbe:
          exec:
            command:
            - sh
            - /kube-ovn/ovs-healthcheck.sh
          failureThreshold: 5
          initialDelaySeconds: 10
          periodSeconds: 5
          timeoutSeconds: 45
        readinessProbe:
          exec:
            command:
            - sh
            - /kube-ovn/ovs-healthcheck.sh
          periodSeconds: 5
          timeoutSeconds: 45
        resources:
          limits:
            cpu: 1000m
            memory: 800Mi
          requests:
            cpu: 200m
            memory: 300Mi
        securityContext:
          privileged: true
          runAsUser: 0
        volumeMounts:
        - mountPath: /lib/modules
          name: host-modules
          readOnly: true
        - mountPath: /var/run/openvswitch
          name: host-run-ovs
        - mountPath: /var/run/ovn
          name: host-run-ovn
        - mountPath: /sys
          name: host-sys
          readOnly: true
        - mountPath: /etc/openvswitch
          name: host-config-openvswitch
        - mountPath: /etc/ovn
          name: host-config-ovn
        - mountPath: /var/log/openvswitch
          name: host-log-ovs
        - mountPath: /var/log/ovn
          name: host-log-ovn
        - mountPath: /var/run/tls
          name: ovn-tls
      volumes:
      - hostPath:
          path: /lib/modules
        name: host-modules
      - hostPath:
          path: /run/openvswitch
        name: host-run-ovs
      - hostPath:
          path: /run/ovn
        name: host-run-ovn
      - hostPath:
          path: /sys
        name: host-sys
      - hostPath:
          path: /etc/origin/openvswitch
        name: host-config-openvswitch
      - hostPath:
          path: /etc/origin/ovn
        name: host-config-ovn
      - hostPath:
          path: /var/log/openvswitch
        name: host-log-ovs
      - hostPath:
          path: /var/log/ovn
        name: host-log-ovn
      - name: ovn-tls
        secret:
          optional: false
          secretName: ovn-tls
