# Source: metallb/templates/speaker-daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: metallb
    component: speaker
    gitops.jenkins-x.io/pipeline: 'namespaces'
  name: speaker
  namespace: metallb-system
  annotations:
    meta.helm.sh/release-name: 'metallb'
spec:
  selector:
    matchLabels:
      app: metallb
      component: speaker
  template:
    metadata:
      annotations:
        prometheus.io/port: '7472'
        prometheus.io/scrape: 'true'
      labels:
        app: metallb
        component: speaker
    spec:
      containers:
        - args:
            - --port=7472
            - --config=config
          env:
            - name: METALLB_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: METALLB_HOST
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            - name: METALLB_ML_BIND_ADDR
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            # needed when another software is also using memberlist / port 7946
            # when changing this default you also need to update the container ports definition
            # and the PodSecurityPolicy hostPorts definition
            #- name: METALLB_ML_BIND_PORT
            #  value: "7946"
            - name: METALLB_ML_LABELS
              value: "app=metallb,component=speaker"
            - name: METALLB_ML_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: memberlist
                  key: secretkey
          image: quay.io/metallb/speaker:main
          name: speaker
          ports:
            - containerPort: 7472
              name: monitoring
            - containerPort: 7946
              name: memberlist-tcp
            - containerPort: 7946
              name: memberlist-udp
              protocol: UDP
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
                - NET_RAW
              drop:
                - ALL
            readOnlyRootFilesystem: true
      hostNetwork: true
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: speaker
      terminationGracePeriodSeconds: 2
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master
          operator: Exists
