crd-ipkeeper.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: crd-ipkeeper
  namespace: kube-system

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: crd-ipkeeper
rules:
## 注意: 在此处修改了某一资源的权限并更新后, 
## SA 账号对应的 Pod(这里是crd-ipkeeper的各 Pod)权限将立刻生效, 无需重启这些 Pod.
- apiGroups: [""]
  ## configmap用于创建分布式资源锁
  resources: ["configmaps"]
  verbs: ["get", "list", "watch", "create", "patch", "update"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch", "delete"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["ipkeeper.generals.space"]
  ## 自定义类型资源也需要通过 rbac 赋予权限.
  resources: ["staticips"]
  verbs: ["get", "list", "watch", "create", "patch", "update"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: crd-ipkeeper
roleRef:
  name: crd-ipkeeper
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: crd-ipkeeper
  namespace: kube-system
  
---
## 由于 crd-ipkeeper 会监听 deployment/daemonset 等, 
## 然后可能创建并修改 StaticIP 资源, 所以必须要事先创建 CRD, 
## 同时在 RBAC 配置中添加上对 staticips 类型资源的访问权限
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  ## metadata.name = plural值 + group值
  name: staticips.ipkeeper.generals.space
spec:
  group: ipkeeper.generals.space
  version: v1
  ## Namespaced 或 Cluster
  scope: Namespaced
  names:
    kind: StaticIP
    ## 单数
    singular: staticip
    ## 复数
    plural: staticips
    ## 缩写
    shortNames: ["sip"]
  ## `kubectl get sip`时的额外输出列
  additionalPrinterColumns:
  - name: OwnerKind
    type: string
    description: 所属资源(Pod, Deployment, Daemonset等)
    JSONPath: .spec.ownerKind
  - name: Namespace
    type: string
    JSONPath: .spec.namespace
  - name: Used
    type: string
    description: 使用比例
    JSONPath: .spec.ratio
  - name: IPPool
    type: string
    description: IP池
    JSONPath: .spec.ipPool

---
kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: crd-ipkeeper
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: crd-ipkeeper
  template:
    metadata:
      labels:
        app: crd-ipkeeper
        component: network
        type: infra
    spec:
      tolerations:
      - effect: NoSchedule
        operator: Exists
      serviceAccountName: crd-ipkeeper
      hostNetwork: true
      hostPID: true
      containers:
      - name: crd-ipkeeper
        image: registry.cn-hangzhou.aliyuncs.com/generals-kuber/crd-ipkeeper:0.0.84
        securityContext:
          privileged: true
          capabilities:
            add: ["NET_ADMIN", "SYS_PTRACE", "SYS_ADMIN"]
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NS
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        volumeMounts:
        - mountPath: /var/run
          name: socket
        - mountPath: /var/run/netns
          name: host-netns
      volumes:
      - name: socket
        hostPath:
          path: /var/run
      - name: host-netns
        hostPath:
          path: /var/run/netns