kindnet-bridge.yml

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kindnet
rules:
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - list
      - watch
      - patch
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kindnet
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kindnet
subjects:
  - kind: ServiceAccount
    name: kindnet
    namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kindnet
  namespace: kube-system
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kindnet
  namespace: kube-system
  labels:
    tier: node
    app: kindnet
    k8s-app: kindnet
spec:
  selector:
    matchLabels:
      app: kindnet
  template:
    metadata:
      labels:
        tier: node
        app: kindnet
        k8s-app: kindnet
    spec:
      hostNetwork: true
      tolerations:
        - operator: Exists
          effect: NoSchedule
      serviceAccountName: kindnet
      initContainers:
        - name: install-cni-bin
          image: ghcr.io/hellt/kindnetd:1.0.0-offload-fix
          command: ["sh", "-c", "cp -f /opt/cni/bin/* /cni/ "]
          volumeMounts:
            - name: cni-bin
              mountPath: /cni
      containers:
        - name: kindnet-cni
          image: ghcr.io/hellt/kindnetd:1.0.0-offload-fix
          env:
            - name: HOST_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: CNI_BRIDGE
              value: "true"
            - name: DISABLE_CNI_BRIDGE_OFFLOAD
              value: "true"
          volumeMounts:
            - name: cni-cfg
              mountPath: /etc/cni/net.d
            - name: xtables-lock
              mountPath: /run/xtables.lock
              readOnly: false
            - name: lib-modules
              mountPath: /lib/modules
              readOnly: true
          resources:
            requests:
              cpu: "100m"
              memory: "50Mi"
            limits:
              cpu: "100m"
              memory: "50Mi"
          securityContext:
            privileged: false
            capabilities:
              add: ["NET_RAW", "NET_ADMIN"]
      volumes:
        - name: cni-bin
          hostPath:
            path: /opt/cni/bin
            type: DirectoryOrCreate
        - name: cni-cfg
          hostPath:
            path: /etc/cni/net.d
            type: DirectoryOrCreate
        - name: xtables-lock
          hostPath:
            path: /run/xtables.lock
            type: FileOrCreate
        - name: lib-modules
          hostPath:
            path: /lib/modules
---