---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: antrea-agent
  labels:
    component: antrea-agent
spec:
  selector:
    matchLabels:
      component: antrea-agent
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        component: antrea-agent
    spec:
      hostNetwork: true
      priorityClassName: system-node-critical
      tolerations:
        # Mark it as a critical add-on.
        - key: CriticalAddonsOnly
          operator: Exists
        # Make sure it gets scheduled on all nodes.
        - effect: NoSchedule
          operator: Exists
        # Make sure it doesn't get evicted.
        - effect: NoExecute
          operator: Exists
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: antrea-agent
      initContainers:
        - name: install-cni
          image: antrea
          resources:
            requests:
              cpu: "100m"
          command: ["install_cni"]
          securityContext:
            capabilities:
              add:
                # SYS_MODULE is required to load the OVS kernel module.
                - SYS_MODULE
          volumeMounts:
          - name: antrea-config
            mountPath: /etc/antrea/antrea-cni.conflist
            subPath: antrea-cni.conflist
            readOnly: true
          - name: host-cni-conf
            mountPath: /host/etc/cni/net.d
          - name: host-cni-bin
            mountPath: /host/opt/cni/bin
          # For loading the OVS kernel module.
          - name: host-lib-modules
            mountPath: /lib/modules
            readOnly: true
          # depmod is required by modprobe when the Node OS is different from
          # that of the Antrea Docker image.
          - name: host-depmod
            mountPath: /sbin/depmod
            readOnly: true
      containers:
        - name: antrea-agent
          image: antrea
          resources:
            requests:
              cpu: "200m"
          command: ["antrea-agent"]
          # Log to both "/var/log/antrea/" and stderr (so "kubectl logs" can work).
          args: ["--config", "/etc/antrea/antrea-agent.conf", "--logtostderr=false", "--log_dir", "/var/log/antrea", "--alsologtostderr"]
          env:
            # Provide pod and node information for clusterinformation CRD.
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - containerPort: 10350
              name: api
              protocol: TCP
          livenessProbe:
            exec:
              command:
                - /bin/sh
                - -c
                - container_liveness_probe agent
            initialDelaySeconds: 5
            timeoutSeconds: 5
            periodSeconds: 10
            failureThreshold: 5
          readinessProbe:
            httpGet:
              host: 127.0.0.1
              path: /healthz
              port: api
              scheme: HTTPS
            initialDelaySeconds: 5
            timeoutSeconds: 5
            periodSeconds: 10
            failureThreshold: 5
          securityContext:
            # antrea-agent needs to manipulate "/proc/sys/net/ipv4/conf/XXX/send_redirects".
            privileged: true
          volumeMounts:
          - name: antrea-config
            mountPath: /etc/antrea/antrea-agent.conf
            subPath: antrea-agent.conf
            readOnly: true
          - name: host-var-run-antrea
            mountPath: /var/run/antrea
          - name: host-var-run-antrea
            mountPath: /var/run/openvswitch
            subPath: openvswitch
          # host-local IPAM stores allocated IP addresses as files in /var/lib/cni/networks/$NETWORK_NAME.
          # Mount a sub-directory of host-var-run-antrea to it for persistence of IP allocation.
          - name: host-var-run-antrea
            mountPath: /var/lib/cni
            subPath: cni
          # We need to mount both the /proc directory and the /var/run/netns directory so that
          # antrea-agent can open the network namespace path when setting up Pod
          # networking. Different container runtimes may use /proc or /var/run/netns when invoking
          # the CNI commands. Docker uses /proc and containerd uses /var/run/netns.
          - name: host-var-log-antrea
            mountPath: /var/log/antrea
          - name: host-proc
            mountPath: /host/proc
            readOnly: true
          - name: host-var-run-netns
            mountPath: /host/var/run/netns
            readOnly: true
            # When a container is created, a mount point for the network namespace is added under
            # /var/run/netns on the host, which needs to be propagated to the antrea-agent container.
            mountPropagation: HostToContainer
          - name: xtables-lock
            mountPath: /run/xtables.lock
        - name: antrea-ovs
          image: antrea
          resources:
            requests:
              cpu: "200m"
          command: ["start_ovs"]
          securityContext:
            # capabilities required by OVS daemons
            capabilities:
              add:
                - SYS_NICE
                - NET_ADMIN
                - SYS_ADMIN
                - IPC_LOCK
          livenessProbe:
            exec:
              command:
                - /bin/sh
                - -c
                - timeout 5 container_liveness_probe ovs
            initialDelaySeconds: 5
            periodSeconds: 5
          volumeMounts:
          - name: host-var-run-antrea
            mountPath: /var/run/openvswitch
            subPath: openvswitch
          - name: host-var-log-antrea
            mountPath: /var/log/openvswitch
            subPath: openvswitch
      volumes:
        - name: antrea-config
          configMap:
            name: antrea-config
        - name: host-cni-conf
          hostPath:
            path: /etc/cni/net.d
        - name: host-cni-bin
          hostPath:
            path: /opt/cni/bin
        - name: host-proc
          hostPath:
            path: /proc
        - name: host-var-run-netns
          hostPath:
            path: /var/run/netns
        - name: host-var-run-antrea
          hostPath:
            path: /var/run/antrea
            # we use subPath to create run subdirectories for different component (e.g. OVS) and
            # subPath requires the base volume to exist
            type: DirectoryOrCreate
        - name: host-var-log-antrea
          hostPath:
            path: /var/log/antrea
            # we use subPath to create logging subdirectories for different component (e.g. OVS)
            type: DirectoryOrCreate
        - name: host-lib-modules
          hostPath:
            path: /lib/modules
        - name: host-depmod
          hostPath:
            path: /sbin/depmod
        - name: xtables-lock
          hostPath:
            path: /run/xtables.lock
            type: FileOrCreate
