bashcni-ds.yml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: bashcni
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "watch", "list"]
- apiGroups: [""]
  resources: ["nodes/status"]
  verbs: ["patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: bashcni
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: bashcni
subjects:
- kind: ServiceAccount
  name: bashcni
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bashcni
  namespace: kube-system
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: bashcni
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: bashcni
  template:
    metadata:
      labels:
        app: bashcni
    spec:
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccount: bashcni
      hostNetwork: true
      hostPID: true
      priorityClassName: system-node-critical
      initContainers:
      - name: install-cni-plugin
        image: cericwu/bashcni
        imagePullPolicy: Always
        command:
        - /app/install.sh
        volumeMounts:
        - name: cni-plugin
          mountPath: /opt/cni
      containers:
      - name: bashcni
        image: cericwu/bashcni
        imagePullPolicy: Always
        securityContext:
          capabilities:
            add: ["NET_ADMIN"]
        volumeMounts:
        - name: cni
          mountPath: /etc/cni/net.d
      volumes:
      - name: cni-plugin
        hostPath:
          path: /opt/cni
      - name: cni
        hostPath:
          path: /etc/cni/net.d