gistfile1.txt

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: cilium
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - namespaces
  - nodes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  resources:
  - networkpolicies
  verbs:
  - get
  - list
  - watch
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium
  namespace: kube-system
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium
subjects:
- kind: ServiceAccount
  name: cilium
  namespace: kube-system
---
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: cilium-consul
  namespace: kube-system
spec:
  template:
    metadata:
      labels:
        k8s-app: consul
        kubernetes.io/cluster-service: "true"
    spec:
      containers:
      - image: consul:v0.6.4
        imagePullPolicy: Always
        name: cilium-consul
        command: [ "consul" ]
        args:
          - "agent"
          - "-server"
          - "-bootstrap-expect"
          - "1"
          - "-data-dir=/var/lib/consul"
          - "-bind=127.0.0.1"
        env:
          - name: "CONSUL_LOCAL_CONFIG"
            value: "{\"skip_leave_on_interrupt\": true}"
        securityContext:
          privileged: true
      hostNetwork: true
---
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: cilium
  namespace: kube-system
spec:
  template:
    metadata:
      labels:
        k8s-app: cilium
        kubernetes.io/cluster-service: "true"
    spec:
      containers:
      - image: cilium/cilium:latest
        imagePullPolicy: Always
        name: cilium-agent
        command: [ "cilium-agent" ]
        args:
          - "--debug"
          - "--k8s-api-server"
          - "${K8S_MASTER}"
          - "--labels"
          - "role,app"
          - "--kvstore"
          - "consul"
          - "--consul"
          - "http://127.0.0.1:8500"
          - "-t"
          - "vxlan"
        lifecycle:
          postStart:
            exec:
              command:
                - "/cni-install.sh"
          preStop:
            exec:
              command:
                - "/cni-uninstall.sh"
        env:
          - name: "K8S_NODE_NAME"
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
        volumeMounts:
          - name: bpf-maps
            mountPath: /sys/fs/bpf
          - name: cilium-run
            mountPath: /var/run/cilium
          - name: cni-path
            mountPath: /host/opt/cni/bin
          - name: etc-cni-netd
            mountPath: /host/etc/cni/net.d
          - name: docker-socket
            mountPath: /var/run/docker.sock
            readOnly: true
        securityContext:
          capabilities:
            add:
              - "NET_ADMIN"
          privileged: true
      hostNetwork: true
      volumes:
        - name: cilium-run
          hostPath:
            path: /var/run/cilium
        - name: cni-path
          hostPath:
            path: /opt/cni/bin
        - name: bpf-maps
          hostPath:
            path: /sys/fs/bpf
        - name: docker-socket
          hostPath:
            path: /var/run/docker.sock
        - name: etc-cni-netd
          hostPath:
              path: /etc/cni/net.d