mirror of
https://github.com/containers/youki
synced 2026-07-21 19:14:56 +02:00
Yusuke Sakurai
104 lines
2.5 KiB
YAML
104 lines
2.5 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: youki-system
|
|
labels:
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
---
|
|
apiVersion: node.k8s.io/v1
|
|
kind: RuntimeClass
|
|
metadata:
|
|
name: youki
|
|
handler: youki
|
|
# Only schedule pods using this RuntimeClass onto nodes where the installer
|
|
# has finished. The label is applied by install-youki.sh once youki is
|
|
# installed and containerd has been reconfigured on the node.
|
|
scheduling:
|
|
nodeSelector:
|
|
youki.dev/runtime-ready: "true"
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: youki-deploy
|
|
namespace: youki-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: youki-deploy
|
|
rules:
|
|
# Required by install-youki.sh to label its own node as runtime-ready.
|
|
- apiGroups: [""]
|
|
resources: ["nodes"]
|
|
verbs: ["get", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: youki-deploy
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: youki-deploy
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: youki-deploy
|
|
namespace: youki-system
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: youki-deploy
|
|
namespace: youki-system
|
|
labels:
|
|
app: youki-deploy
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: youki-deploy
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: youki-deploy
|
|
spec:
|
|
serviceAccountName: youki-deploy
|
|
hostPID: true
|
|
tolerations:
|
|
- operator: Exists
|
|
effect: NoSchedule
|
|
- operator: Exists
|
|
effect: NoExecute
|
|
containers:
|
|
- name: installer
|
|
image: youki-installer:latest
|
|
imagePullPolicy: IfNotPresent
|
|
securityContext:
|
|
privileged: true
|
|
env:
|
|
- name: NODE_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
- name: HOST_BIN_DIR
|
|
value: /host/usr/local/bin
|
|
- name: HOST_CONTAINERD_CONFIG
|
|
value: /host/etc/containerd/config.toml
|
|
- name: RUNTIME_HANDLER
|
|
value: youki
|
|
volumeMounts:
|
|
- name: host-usr-local-bin
|
|
mountPath: /host/usr/local/bin
|
|
- name: host-etc-containerd
|
|
mountPath: /host/etc/containerd
|
|
volumes:
|
|
- name: host-usr-local-bin
|
|
hostPath:
|
|
path: /usr/local/bin
|
|
type: Directory
|
|
- name: host-etc-containerd
|
|
hostPath:
|
|
path: /etc/containerd
|
|
type: Directory
|