apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    k8s-app: cilium
  name: cilium
  namespace: cilium
spec:
  selector:
    matchLabels:
      k8s-app: cilium
  template:
    metadata:
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
      labels:
        k8s-app: cilium
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/os
                    operator: In
                    values:
                      - linux
              - matchExpressions:
                  - key: beta.kubernetes.io/os
                    operator: In
                    values:
                      - linux
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: k8s-app
                    operator: In
                    values:
                      - cilium
              topologyKey: kubernetes.io/hostname
      containers:
        - args:
            - --config-dir=/tmp/cilium/config-map
          command:
            - cilium-agent
          env:
            - name: K8S_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: CILIUM_K8S_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: CILIUM_CLUSTERMESH_CONFIG
              value: /var/lib/cilium/clustermesh/
            - name: CILIUM_CNI_CHAINING_MODE
              valueFrom:
                configMapKeyRef:
                  key: cni-chaining-mode
                  name: cilium-config
                  optional: true
            - name: CILIUM_CUSTOM_CNI_CONF
              valueFrom:
                configMapKeyRef:
                  key: custom-cni-conf
                  name: cilium-config
                  optional: true
          image: quay.io/cilium/cilium:v1.10.11@sha256:48e1a261046c2e534e370f960f0920233f9fd5ad4623aebdca0e403264a06202
          imagePullPolicy: IfNotPresent
          lifecycle:
            postStart:
              exec:
                command:
                  - /cni-install.sh
                  - --enable-debug=false
                  - --cni-exclusive=true
            preStop:
              exec:
                command:
                  - /cni-uninstall.sh
          livenessProbe:
            failureThreshold: 10
            httpGet:
              host: 127.0.0.1
              httpHeaders:
                - name: brief
                  value: 'true'
              path: /healthz
              port: 9876
              scheme: HTTP
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 5
          name: cilium-agent
          readinessProbe:
            failureThreshold: 3
            httpGet:
              host: 127.0.0.1
              httpHeaders:
                - name: brief
                  value: 'true'
              path: /healthz
              port: 9876
              scheme: HTTP
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 5
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
                - SYS_MODULE
            privileged: true
          startupProbe:
            failureThreshold: 105
            httpGet:
              host: 127.0.0.1
              httpHeaders:
                - name: brief
                  value: 'true'
              path: /healthz
              port: 9876
              scheme: HTTP
            periodSeconds: 2
            successThreshold: 1
          volumeMounts:
            - mountPath: /sys/fs/bpf
              mountPropagation: Bidirectional
              name: bpf-maps
            - mountPath: /var/run/cilium
              name: cilium-run
            - mountPath: /host/opt/cni/bin
              name: cni-path
            - mountPath: /host/etc/cni/net.d
              name: etc-cni-netd
            - mountPath: /var/lib/cilium/clustermesh
              name: clustermesh-secrets
              readOnly: true
            - mountPath: /tmp/cilium/config-map
              name: cilium-config-path
              readOnly: true
            - mountPath: /lib/modules
              name: lib-modules
              readOnly: true
            - mountPath: /run/xtables.lock
              name: xtables-lock
      hostNetwork: true
      initContainers:
        - command:
            - sh
            - -c
            - cp /usr/bin/cilium-mount /hostbin/cilium-mount && nsenter --cgroup=/hostproc/1/ns/cgroup
              --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-mount" $CGROUP_ROOT;
              rm /hostbin/cilium-mount
          env:
            - name: CGROUP_ROOT
              value: /run/cilium/cgroupv2
            - name: BIN_PATH
              value: /var/lib/cni/bin
          image: quay.io/cilium/cilium:v1.10.11@sha256:48e1a261046c2e534e370f960f0920233f9fd5ad4623aebdca0e403264a06202
          imagePullPolicy: IfNotPresent
          name: mount-cgroup
          securityContext:
            privileged: true
          volumeMounts:
            - mountPath: /hostproc
              name: hostproc
            - mountPath: /hostbin
              name: cni-path
        - command:
            - /init-container.sh
          env:
            - name: CILIUM_ALL_STATE
              valueFrom:
                configMapKeyRef:
                  key: clean-cilium-state
                  name: cilium-config
                  optional: true
            - name: CILIUM_BPF_STATE
              valueFrom:
                configMapKeyRef:
                  key: clean-cilium-bpf-state
                  name: cilium-config
                  optional: true
          image: quay.io/cilium/cilium:v1.10.11@sha256:48e1a261046c2e534e370f960f0920233f9fd5ad4623aebdca0e403264a06202
          imagePullPolicy: IfNotPresent
          name: clean-cilium-state
          resources:
            requests:
              cpu: 100m
              memory: 100Mi
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
            privileged: true
          volumeMounts:
            - mountPath: /sys/fs/bpf
              name: bpf-maps
            - mountPath: /run/cilium/cgroupv2
              mountPropagation: HostToContainer
              name: cilium-cgroup
            - mountPath: /var/run/cilium
              name: cilium-run
      priorityClassName: system-node-critical
      restartPolicy: Always
      serviceAccount: cilium
      serviceAccountName: cilium
      terminationGracePeriodSeconds: 1
      tolerations:
        - operator: Exists
      volumes:
        - hostPath:
            path: /var/run/cilium
            type: DirectoryOrCreate
          name: cilium-run
        - hostPath:
            path: /sys/fs/bpf
            type: DirectoryOrCreate
          name: bpf-maps
        - hostPath:
            path: /proc
            type: Directory
          name: hostproc
        - hostPath:
            path: /run/cilium/cgroupv2
            type: DirectoryOrCreate
          name: cilium-cgroup
        - hostPath:
            path: /var/lib/cni/bin
            type: DirectoryOrCreate
          name: cni-path
        - hostPath:
            path: /var/run/multus/cni/net.d
            type: DirectoryOrCreate
          name: etc-cni-netd
        - hostPath:
            path: /lib/modules
          name: lib-modules
        - hostPath:
            path: /run/xtables.lock
            type: FileOrCreate
          name: xtables-lock
        - name: clustermesh-secrets
          secret:
            defaultMode: 420
            optional: true
            secretName: cilium-clustermesh
        - configMap:
            name: cilium-config
          name: cilium-config-path
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 2
    type: RollingUpdate
