forked from rook/rook
Nikhil-Ladha
9fea9cd865
added a sample job manifest named `multus-validation` that validates the multus configuration in the cluster. Signed-off-by: Nikhil-Ladha <nikhilladha1999@gmail.com>
141 lines
4.8 KiB
YAML
141 lines
4.8 KiB
YAML
#################################################################################################################
|
|
# We highly recommend validating your Multus configuration before you install Rook.
|
|
# This job aims to automate that operation by using the validation tool. Run this job after
|
|
# installing the rook operator and before installing any Custom Resources.
|
|
# Insert the NAD name for public network and cluster network in the Job definition below.
|
|
# If you want to use any other flags along with the basic command in the Job,
|
|
# add the `--help` flag in the end to see the list of flags available, and use accordingly.
|
|
#################################################################################################################
|
|
---
|
|
# Service account for job that validates multus configuration
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: rook-ceph-multus-validation
|
|
namespace: rook-ceph # namespace:cluster
|
|
# imagePullSecrets:
|
|
# - name: my-registry-secret
|
|
---
|
|
# Aspects of multus validation job that require access to the operator/cluster namespace
|
|
kind: Role
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: rook-ceph-multus-validation
|
|
namespace: rook-ceph # namespace:cluster
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["configmaps", "configmaps/finalizers", "pods"]
|
|
verbs: ["get", "list", "create", "update", "delete"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["daemonsets"]
|
|
verbs: ["list", "create", "delete", "deletecollection"]
|
|
- apiGroups: ["k8s.cni.cncf.io"]
|
|
resources: ["network-attachment-definitions"]
|
|
verbs: ["get"]
|
|
- apiGroups: ["batch"]
|
|
resources: ["jobs"]
|
|
verbs: ["get", "list", "delete"]
|
|
---
|
|
# Allow the multus validation job to run in this namespace
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: rook-ceph-multus-validation
|
|
namespace: rook-ceph # namespace:cluster
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: rook-ceph-multus-validation
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: rook-ceph-multus-validation
|
|
namespace: rook-ceph # namespace:cluster
|
|
---
|
|
# A job that runs the multus validation tool
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: rook-ceph-multus-validation
|
|
namespace: rook-ceph # namespace:cluster
|
|
labels:
|
|
app: rook-ceph-multus-validation
|
|
spec:
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: rook-ceph-multus-validation
|
|
spec:
|
|
serviceAccountName: rook-ceph-multus-validation
|
|
containers:
|
|
- name: multus-validation
|
|
image: rook/ceph:master
|
|
command: ["rook"]
|
|
args:
|
|
- "multus"
|
|
- "validation"
|
|
- "run"
|
|
# - "--public-network=<NAD-NAME>" # uncomment and replace NAD name if using public network
|
|
# - "--cluster-network=<NAD-NAME>" # uncomment and replace NAD name if using cluster network
|
|
# - "--nginx-image=<IMAGE>" # uncomment and replace IMAGE with the nginx image you want use for the validation server and clients
|
|
# - "--daemons-per-node=<COUNT>" # uncomment and replace COUNT with the maximum number of daemons that should be running on each node during validation
|
|
env:
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: ROOK_LOG_LEVEL
|
|
value: DEBUG
|
|
restartPolicy: Never
|
|
---
|
|
# This Pod Security Policy (PSP) allows the job to run in Kubernetes environments using PSPs
|
|
# apiVersion: rbac.authorization.k8s.io/v1
|
|
# kind: RoleBinding
|
|
# metadata:
|
|
# name: rook-ceph-multus-validation-psp
|
|
# namespace: rook-ceph # namespace:cluster
|
|
# roleRef:
|
|
# apiGroup: rbac.authorization.k8s.io
|
|
# kind: ClusterRole
|
|
# name: psp:rook
|
|
# subjects:
|
|
# - kind: ServiceAccount
|
|
# name: rook-ceph-multus-validation
|
|
# namespace: rook-ceph # namespace:cluster
|
|
# ---
|
|
# SecurityContextConstraints(SCC) for the Rook and Ceph daemons
|
|
# kind: SecurityContextConstraints
|
|
# apiVersion: security.openshift.io/v1
|
|
# metadata:
|
|
# name: rook-ceph-multus-validation
|
|
# allowPrivilegedContainer: true
|
|
# allowHostDirVolumePlugin: true
|
|
# allowHostPID: false
|
|
# # set to true if running rook with host networking enabled
|
|
# allowHostNetwork: true
|
|
# # set to true if running rook with the provider as host
|
|
# allowHostPorts: true
|
|
# priority:
|
|
# allowedCapabilities: ["MKNOD"]
|
|
# allowHostIPC: true
|
|
# readOnlyRootFilesystem: false
|
|
# # drop all default privileges
|
|
# requiredDropCapabilities: ["All"]
|
|
# defaultAddCapabilities: []
|
|
# runAsUser:
|
|
# type: RunAsAny
|
|
# seLinuxContext:
|
|
# type: RunAsAny
|
|
# fsGroup:
|
|
# type: RunAsAny
|
|
# supplementalGroups:
|
|
# type: RunAsAny
|
|
# seccompProfiles:
|
|
# - "*"
|
|
# volumes:
|
|
# - configMap
|
|
# - emptyDir
|
|
# - projected
|
|
# users:
|
|
# - system:serviceaccount:rook-ceph:rook-ceph-multus-validation # serviceaccount:namespace:cluster
|
|
---
|