ef100b12f6
Automatic merge from submit-queue (batch tested with PRs 52003, 54559, 54518). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Load kernel modules automatically inside a kube-proxy pod **What this PR does / why we need it**: This change will mount `/lib/modules` on host to the kube-proxy pod, so that a kube-proxy pod can load kernel modules by need or when `modprobe <kmod>` is run inside the pod. This will be convenient for kube-proxy running in IPVS mode. Users will don't have to run `modprobe ip_vs` on nodes before starting a kube-proxy pod. **Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes # **Special notes for your reviewer**: The kube-proxy IPVS proxier will check if the kernel supports IPVS, or it will fallback to iptables or userspace modes. There is a false negative condition in the check, #51874 addressed that issue. **Release note**: ```release-note Load kernel modules automatically inside a kube-proxy pod ```
70 lines
1.9 KiB
YAML
70 lines
1.9 KiB
YAML
# Please keep kube-proxy configuration in-sync with:
|
|
# cluster/saltbase/salt/kube-proxy/kube-proxy.manifest
|
|
|
|
apiVersion: extensions/v1beta1
|
|
kind: DaemonSet
|
|
metadata:
|
|
labels:
|
|
k8s-app: kube-proxy
|
|
addonmanager.kubernetes.io/mode: Reconcile
|
|
name: kube-proxy
|
|
namespace: kube-system
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
k8s-app: kube-proxy
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 10%
|
|
template:
|
|
metadata:
|
|
labels:
|
|
k8s-app: kube-proxy
|
|
annotations:
|
|
scheduler.alpha.kubernetes.io/critical-pod: ''
|
|
spec:
|
|
{{pod_priority}}
|
|
hostNetwork: true
|
|
nodeSelector:
|
|
beta.kubernetes.io/kube-proxy-ds-ready: "true"
|
|
containers:
|
|
- name: kube-proxy
|
|
image: {{pillar['kube_docker_registry']}}/kube-proxy:{{pillar['kube-proxy_docker_tag']}}
|
|
resources:
|
|
requests:
|
|
cpu: {{ cpurequest }}
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- kube-proxy {{cluster_cidr}} --resource-container="" --oom-score-adj=-998 {{params}} 1>>/var/log/kube-proxy.log 2>&1
|
|
env:
|
|
- name: KUBERNETES_SERVICE_HOST
|
|
value: {{kubernetes_service_host_env_value}}
|
|
{{kube_cache_mutation_detector_env_name}}
|
|
{{kube_cache_mutation_detector_env_value}}
|
|
securityContext:
|
|
privileged: true
|
|
volumeMounts:
|
|
- mountPath: /var/log
|
|
name: varlog
|
|
readOnly: false
|
|
- mountPath: /run/xtables.lock
|
|
name: xtables-lock
|
|
readOnly: false
|
|
- mountPath: /lib/modules
|
|
name: lib-modules
|
|
readOnly: true
|
|
volumes:
|
|
- name: varlog
|
|
hostPath:
|
|
path: /var/log
|
|
- name: xtables-lock
|
|
hostPath:
|
|
path: /run/xtables.lock
|
|
type: FileOrCreate
|
|
- name: lib-modules
|
|
hostPath:
|
|
path: /lib/modules
|
|
serviceAccountName: kube-proxy
|