feat: add helm values for affinity and ns on fabric ds

Author: fra98

deployments/liqo/README.md

@@ -12,12 +12,12 @@
 | authentication.awsConfig.useExistingSecret | bool | `false` | Use an existing secret to configure the AWS credentials. |
 | authentication.enabled | bool | `true` | Enable/Disable the authentication module. |
 | authentication.tlsCompatibilityMode | bool | `false` | Enable TLS compatibility mode for client certificates and keys. If set to true, Liqo will use widely supported algorithm (RSA) instead of Ed25519 (default) for generating private keys and CSRs. Enable this option to ensure compatibility with systems that do not yet support Ed25519 as signature algorithm. |
-| common.affinity | object | `{}` | Affinity for all liqo pods, excluding virtual kubelet. |
+| common.affinity | object | `{}` | Affinity for all liqo pods, excluding virtual kubelet pod and fabric daemonset. |
 | common.extraArgs | list | `[]` | Extra arguments for all liqo pods, excluding virtual kubelet. |
 | common.globalAnnotations | object | `{}` | Global annotations to be added to all resources created by Liqo controllers |
 | common.globalLabels | object | `{"liqo.io/managed":"true"}` | Global labels to be added to all resources created by Liqo controllers |
-| common.nodeSelector | object | `{}` | NodeSelector for all liqo pods, excluding virtual kubelet. |
-| common.tolerations | list | `[]` | Tolerations for all liqo pods, excluding virtual kubelet. |
+| common.nodeSelector | object | `{}` | NodeSelector for all liqo pods, excluding virtual kubelet pod and fabric daemonset. |
+| common.tolerations | list | `[]` | Tolerations for all liqo pods, excluding virtual kubelet pod and fabric daemonset. |
 | controllerManager.config.defaultLimitsEnforcement | string | `"None"` | Defines how strict is the enforcement of the quota offered by the remote cluster. enableResourceEnforcement must be enabled to use this feature. Possible values are: None, Soft, Hard. None: the offloaded pods might not have the resource `requests` or `limits`. Soft: it forces the offloaded pods to have `requests` set. If the pods go over the requests, the total used resources might go over the quota. Hard: it forces the offloaded pods to have `limits` and `requests` set, with `requests` == `limits`. This is the safest mode as the consumer cluster cannot go over the quota. |
 | controllerManager.config.enableNodeFailureController | bool | `false` | Ensure offloaded pods running on a failed node are evicted and rescheduled on a healthy node, preventing them to remain in a terminating state indefinitely. This feature can be useful in case of remote node failure to guarantee better service continuity and to have the expected pods workload on the remote cluster. However, enabling this feature could produce zombies in the worker node, in case the node returns Ready again without a restart. |
 | controllerManager.config.enableResourceEnforcement | bool | `true` | It enforces offerer-side that offloaded pods do not exceed offered resources (based on container limits). This feature is suggested to be enabled when consumer-side enforcement is not sufficient. It makes sure that the sum of the requests of the offloaded pods never exceeds the quota offered by the remote cluster. The quota can be still exceeded if no limits and requests are defined in the offloaded pods or if the limits are larger than the requests. For a stricter enforcement, the defaultLimitsEnforcement can be set to Hard. |
@@ -86,19 +86,21 @@
 | nameOverride | string | `""` | Override the standard name used by Helm and associated to Kubernetes/Liqo resources. |
 | networking.clientResources | list | `[{"apiVersion":"networking.liqo.io/v1beta1","resource":"wggatewayclients"}]` | Set the list of resources that implement the GatewayClient |
 | networking.enabled | bool | `true` | Use the default Liqo networking module. |
+| networking.fabric.affinity | object | `{"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"liqo.io/type","operator":"NotIn","values":["virtual-node"]}]}]}}}` | Affinity for the fabric pod. |
 | networking.fabric.config.fullMasquerade | bool | `false` | Enabe/Disable the full masquerade mode for the fabric pod. It means that all traffic will be masquerade using the first external cidr IP, instead of using the pod IP. Full masquerade is useful when the cluster nodeports uses a PodCIDR IP to masqerade the incoming traffic. IMPORTANT: Please consider that enabling this feature will masquerade the source IP of traffic towards a remote cluster, making impossible for a pod that receives the traffic to know the original source IP. |
 | networking.fabric.config.gatewayMasqueradeBypass | bool | `false` | Enable/Disable the masquerade bypass for the gateway pods. It means that the packets from gateway pods will not be masqueraded from the host where the pod is scheduled. This is useful in scenarios where CNIs masquerade the traffic from pod to nodes. For example this is required when using the Azure CNI or Kindnet. |
 | networking.fabric.config.healthProbeBindAddressPort | string | `"8081"` | Set the port where the fabric pod will expose the health probe. To disable the health probe, set the port to 0. |
 | networking.fabric.config.metricsAddressPort | string | `"8082"` | Set the port where the fabric pod will expose the metrics. To disable the metrics, set the port to 0. |
 | networking.fabric.config.nftablesMonitor | bool | `false` | Enable/Disable the nftables monitor for the fabric pod. It means that the fabric pod will monitor the nftables rules and will restore them in case of changes. In some cases (like K3S), this monitor can cause a huge amount of CPU usage. If you are experiencing high CPU usage, you can disable this feature. |
 | networking.fabric.image.name | string | `"ghcr.io/liqotech/fabric"` | Image repository for the fabric pod. |
 | networking.fabric.image.version | string | `""` | Custom version for the fabric image. If not specified, the global tag is used. |
+| networking.fabric.nodeSelector | object | `{}` | NodeSelector for the fabric pod. |
 | networking.fabric.pod.annotations | object | `{}` | Annotations for the fabric pod. |
 | networking.fabric.pod.extraArgs | list | `[]` | Extra arguments for the fabric pod. |
 | networking.fabric.pod.labels | object | `{}` | Labels for the fabric pod. |
 | networking.fabric.pod.priorityClassName | string | `""` | PriorityClassName (https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority) for the fabric pod. |
 | networking.fabric.pod.resources | object | `{"limits":{},"requests":{}}` | Resource requests and limits (https://kubernetes.io/docs/user-guide/compute-resources/) for the fabric pod. |
-| networking.fabric.tolerations | list | `[]` | Extra tolerations for the fabric daemonset. |
+| networking.fabric.tolerations | list | `[]` | Extra tolerations for the fabric pod. |
 | networking.gatewayTemplates | object | `{"container":{"gateway":{"image":{"name":"ghcr.io/liqotech/gateway","version":""}},"geneve":{"image":{"name":"ghcr.io/liqotech/gateway/geneve","version":""}},"wireguard":{"image":{"name":"ghcr.io/liqotech/gateway/wireguard","version":""}}},"ping":{"interval":"2s","lossThreshold":5,"updateStatusInterval":"10s"},"replicas":1,"server":{"service":{"allocateLoadBalancerNodePorts":"","annotations":{}}},"wireguard":{"implementation":"kernel"}}` | Set the options for the default gateway (server/client) templates. The default templates use a WireGuard implementation to connect the gateway of the clusters. These options are used to configure only the default templates and should not be considered if a custom template is used. |
 | networking.gatewayTemplates.container.gateway.image.name | string | `"ghcr.io/liqotech/gateway"` | Image repository for the gateway container. |
 | networking.gatewayTemplates.container.gateway.image.version | string | `""` | Custom version for the gateway image. If not specified, the global tag is used. |

deployments/liqo/templates/liqo-fabric-daemonset.yaml

@@ -25,6 +25,14 @@ spec:
           {{- toYaml .Values.networking.fabric.pod.labels | nindent 8 }}
         {{- end }}
     spec:
+      {{- if .Values.networking.fabric.nodeSelector }}
+      nodeSelector:
+      {{- toYaml .Values.networking.fabric.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.networking.fabric.affinity }}
+      affinity:
+      {{- toYaml .Values.networking.fabric.affinity | nindent 8 }}
+      {{- end }}
       tolerations:
         - key: CriticalAddonsOnly
           operator: Exists
@@ -38,7 +46,7 @@ spec:
         {{- toYaml .Values.networking.fabric.tolerations | nindent 8 }}
         {{- end }}
       serviceAccountName: {{ include "liqo.prefixedName" $fabricConfig }}
-      {{- include "liqo.imagePullSecrets" . | nindent 6 }}
+      {{- include "liqo.imagePullSecrets" . | nindent 6 -}}
       containers:
         - image: {{ .Values.networking.fabric.image.name }}{{ include "liqo.suffix" $fabricConfig }}:{{ include "liqo.version" $fabricConfig }}
           imagePullPolicy: {{ .Values.pullPolicy }}
@@ -98,5 +106,4 @@ spec:
       {{- if .Values.networking.fabric.pod.priorityClassName }}
       priorityClassName: {{ .Values.networking.fabric.pod.priorityClassName }}
       {{- end }}
-
 {{- end }}

deployments/liqo/values.yaml

@@ -112,7 +112,19 @@ networking:
       name: "ghcr.io/liqotech/fabric"
       # -- Custom version for the fabric image. If not specified, the global tag is used.
       version: ""
-    # -- Extra tolerations for the fabric daemonset.
+    # -- NodeSelector for the fabric pod.
+    nodeSelector: {}
+    # -- Affinity for the fabric pod.
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+          - matchExpressions:
+            - key: liqo.io/type
+              operator: NotIn
+              values:
+              - virtual-node
+    # -- Extra tolerations for the fabric pod.
     tolerations: []
     config:
       # -- Enabe/Disable the full masquerade mode for the fabric pod.
@@ -304,11 +316,11 @@ storage:
   storageNamespace: liqo-storage
 
 common:
-  # -- NodeSelector for all liqo pods, excluding virtual kubelet.
+  # -- NodeSelector for all liqo pods, excluding virtual kubelet pod and fabric daemonset.
   nodeSelector: {}
-  # -- Tolerations for all liqo pods, excluding virtual kubelet.
+  # -- Tolerations for all liqo pods, excluding virtual kubelet pod and fabric daemonset.
   tolerations: []
-  # -- Affinity for all liqo pods, excluding virtual kubelet.
+  # -- Affinity for all liqo pods, excluding virtual kubelet pod and fabric daemonset.
   affinity: {}
   # -- Extra arguments for all liqo pods, excluding virtual kubelet.
   extraArgs: []