tunnel-ds.yml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kube-system
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: tunnel
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: tunnel
  template:
    metadata:
      labels:
        app: tunnel
    spec:
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccount: admin-user
      hostNetwork: true
      hostPID: true
      priorityClassName: system-node-critical
      initContainers:
      - name: install-cni-plugin
        image: cericwu/tunnel
        command:
        - cp
        args:
        - /bridge
        - /tunnel-cni
        - /opt/cni/bin
        volumeMounts:
        - name: cni-plugin
          mountPath: /opt/cni/bin
      containers:
      - name: tunnel
        image: cericwu/tunnel
        securityContext:
          capabilities:
            add: ["NET_ADMIN"]
        volumeMounts:
        - name: cni
          mountPath: /etc/cni/net.d
      volumes:
      - name: cni-plugin
        hostPath:
          path: /opt/cni/bin
      - name: cni
        hostPath:
          path: /etc/cni/net.d