# Copyright (c) 2020 SIGHUP s.r.l All rights reserved.
# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE file.

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: calico-node
  labels:
    k8s-app: calico-node
spec:
  selector:
    matchLabels:
      k8s-app: calico-node
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  template:
    metadata:
      labels:
        k8s-app: calico-node
    spec:
      nodeSelector:
        kubernetes.io/os: linux
      hostNetwork: true
      tolerations:
      - effect: NoSchedule
        operator: Exists
      - key: CriticalAddonsOnly
        operator: Exists
      - effect: NoExecute
        operator: Exists
      serviceAccountName: calico-node
      terminationGracePeriodSeconds: 0
      priorityClassName: system-node-critical
      initContainers:
      - name: upgrade-ipam
        image: calico/cni
        command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
        envFrom:
        - configMapRef:
            # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
            name: kubernetes-services-endpoint
            optional: true
        env:
          - name: KUBERNETES_NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: CALICO_NETWORKING_BACKEND
            valueFrom:
              configMapKeyRef:
                name: calico-config
                key: calico_backend
        volumeMounts:
          - mountPath: /var/lib/cni/networks
            name: host-local-net-dir
          - mountPath: /host/opt/cni/bin
            name: cni-bin-dir
        securityContext:
          privileged: true
      - name: install-cni
        image: calico/cni
        command: ["/opt/cni/bin/install"]
        envFrom:
        - configMapRef:
            # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
            name: kubernetes-services-endpoint
            optional: true
        env:
          - name: CNI_CONF_NAME
            value: "10-calico.conflist"
          - name: CNI_NETWORK_CONFIG
            valueFrom:
              configMapKeyRef:
                name: calico-config
                key: cni_network_config
          - name: KUBERNETES_NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: CNI_MTU
            valueFrom:
              configMapKeyRef:
                name: calico-config
                key: veth_mtu
          - name: SLEEP
            value: "false"
        volumeMounts:
          - mountPath: /host/opt/cni/bin
            name: cni-bin-dir
          # For maintaining CNI plugin API credentials.
          - mountPath: /host/etc/cni/net.d
            name: cni-net-dir
            readOnly: false
        securityContext:
          privileged: true
      - name: flexvol-driver
        image: calico/pod2daemon-flexvol
        volumeMounts:
        - name: flexvol-driver-host
          mountPath: /host/driver
        securityContext:
          privileged: true
      containers:
        - name: calico-node
          image: calico/node
          envFrom:
          - configMapRef:
              # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
              name: kubernetes-services-endpoint
              optional: true
          env:
          - name: DATASTORE_TYPE
            value: "kubernetes"
          - name: WAIT_FOR_DATASTORE
            value: "true"
          - name: NODENAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: CALICO_NETWORKING_BACKEND
            valueFrom:
              configMapKeyRef:
                name: calico-config
                key: calico_backend
          - name: CLUSTER_TYPE
            value: "k8s,bgp"
          - name: IP
            value: "autodetect"
          - name: CALICO_IPV4POOL_IPIP
            value: "Always"
          - name: CALICO_IPV4POOL_VXLAN
            value: "Never"
          - name: FELIX_PROMETHEUSMETRICSENABLED
            value: "true"
          - name: FELIX_IPINIPMTU
            valueFrom:
              configMapKeyRef:
                name: calico-config
                key: veth_mtu
          - name: FELIX_VXLANMTU
            valueFrom:
              configMapKeyRef:
                name: calico-config
                key: veth_mtu
          - name: FELIX_WIREGUARDMTU
            valueFrom:
              configMapKeyRef:
                name: calico-config
                key: veth_mtu
          - name: CALICO_IPV4POOL_CIDR
            value: "172.16.0.0/16"
          - name: CALICO_DISABLE_FILE_LOGGING
            value: "true"
          - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
            value: "ACCEPT"
          - name: FELIX_IPV6SUPPORT
            value: "false"
          - name: FELIX_LOGSEVERITYSCREEN
            value: "error"
          - name: FELIX_HEALTHENABLED
            value: "true"
          ports:
            - name: metrics
              protocol: TCP
              containerPort: 9091
          securityContext:
            privileged: true
          resources:
            requests:
              cpu: 250m
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/calico-node
                - -shutdown
          livenessProbe:
            exec:
              command:
              - /bin/calico-node
              - -felix-live
              - -bird-live
            periodSeconds: 10
            initialDelaySeconds: 10
            failureThreshold: 6
          readinessProbe:
            exec:
              command:
              - /bin/calico-node
              - -bird-ready
              - -felix-ready
            periodSeconds: 10
          volumeMounts:
          - mountPath: /lib/modules
            name: lib-modules
            readOnly: true
          - mountPath: /run/xtables.lock
            name: xtables-lock
            readOnly: false
          - mountPath: /var/run/calico
            name: var-run-calico
            readOnly: false
          - mountPath: /var/lib/calico
            name: var-lib-calico
            readOnly: false
          - name: policysync
            mountPath: /var/run/nodeagent
          - name: sysfs
            mountPath: /sys/fs/
            # Bidirectional means that, if we mount the BPF filesystem at /sys/fs/bpf it will propagate to the host.
            # If the host is known to mount that filesystem already then Bidirectional can be omitted.
            mountPropagation: Bidirectional
          - name: cni-log-dir
            mountPath: /var/log/calico/cni
            readOnly: true
      volumes:
      - name: lib-modules
        hostPath:
          path: /lib/modules
      - name: var-run-calico
        hostPath:
          path: /var/run/calico
      - name: var-lib-calico
        hostPath:
          path: /var/lib/calico
      - name: xtables-lock
        hostPath:
          path: /run/xtables.lock
          type: FileOrCreate
      - name: sysfs
        hostPath:
          path: /sys/fs/
          type: DirectoryOrCreate
      - name: cni-bin-dir
        hostPath:
          path: /opt/cni/bin
      - name: cni-net-dir
        hostPath:
          path: /etc/cni/net.d
      - name: cni-log-dir
        hostPath:
          path: /var/log/calico/cni
      - name: host-local-net-dir
        hostPath:
          path: /var/lib/cni/networks
      - name: policysync
        hostPath:
          type: DirectoryOrCreate
          path: /var/run/nodeagent
      - name: flexvol-driver-host
        hostPath:
          type: DirectoryOrCreate
          path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds
