---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  annotations:
    deprecated.daemonset.template.generation: "1"
    kubernetes.io/description: |
      This daemon set launches the OpenShift networking components (kube-proxy and openshift-sdn).
      It expects that OVS is running on the node.
    release.openshift.io/version: 4.6.52
  creationTimestamp: "2022-03-08T10:38:11Z"
  generation: 1
  managedFields:
  - apiVersion: apps/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:deprecated.daemonset.template.generation: {}
          f:kubernetes.io/description: {}
          f:release.openshift.io/version: {}
        f:ownerReferences:
          .: {}
          k:{"uid":"b48e3238-e625-4cc0-acf5-5166b34864a9"}:
            .: {}
            f:apiVersion: {}
            f:blockOwnerDeletion: {}
            f:controller: {}
            f:kind: {}
            f:name: {}
            f:uid: {}
      f:spec:
        f:revisionHistoryLimit: {}
        f:selector:
          f:matchLabels:
            .: {}
            f:app: {}
        f:template:
          f:metadata:
            f:labels:
              .: {}
              f:app: {}
              f:component: {}
              f:openshift.io/component: {}
              f:type: {}
          f:spec:
            f:containers:
              k:{"name":"kube-rbac-proxy"}:
                .: {}
                f:command: {}
                f:image: {}
                f:imagePullPolicy: {}
                f:name: {}
                f:ports:
                  .: {}
                  k:{"containerPort":9101,"protocol":"TCP"}:
                    .: {}
                    f:containerPort: {}
                    f:hostPort: {}
                    f:name: {}
                    f:protocol: {}
                f:resources:
                  .: {}
                  f:requests:
                    .: {}
                    f:cpu: {}
                    f:memory: {}
                f:terminationMessagePath: {}
                f:terminationMessagePolicy: {}
                f:volumeMounts:
                  .: {}
                  k:{"mountPath":"/etc/pki/tls/metrics-certs"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                    f:readOnly: {}
              k:{"name":"sdn"}:
                .: {}
                f:command: {}
                f:env:
                  .: {}
                  k:{"name":"K8S_NODE_IP"}:
                    .: {}
                    f:name: {}
                    f:valueFrom:
                      .: {}
                      f:fieldRef:
                        .: {}
                        f:apiVersion: {}
                        f:fieldPath: {}
                  k:{"name":"K8S_NODE_NAME"}:
                    .: {}
                    f:name: {}
                    f:valueFrom:
                      .: {}
                      f:fieldRef:
                        .: {}
                        f:apiVersion: {}
                        f:fieldPath: {}
                  k:{"name":"KUBERNETES_SERVICE_HOST"}:
                    .: {}
                    f:name: {}
                    f:value: {}
                  k:{"name":"KUBERNETES_SERVICE_PORT"}:
                    .: {}
                    f:name: {}
                    f:value: {}
                  k:{"name":"OPENSHIFT_DNS_DOMAIN"}:
                    .: {}
                    f:name: {}
                    f:value: {}
                f:image: {}
                f:imagePullPolicy: {}
                f:lifecycle:
                  .: {}
                  f:preStop:
                    .: {}
                    f:exec:
                      .: {}
                      f:command: {}
                f:name: {}
                f:ports:
                  .: {}
                  k:{"containerPort":10256,"protocol":"TCP"}:
                    .: {}
                    f:containerPort: {}
                    f:hostPort: {}
                    f:name: {}
                    f:protocol: {}
                f:readinessProbe:
                  .: {}
                  f:exec:
                    .: {}
                    f:command: {}
                  f:failureThreshold: {}
                  f:initialDelaySeconds: {}
                  f:periodSeconds: {}
                  f:successThreshold: {}
                  f:timeoutSeconds: {}
                f:resources:
                  .: {}
                  f:requests:
                    .: {}
                    f:cpu: {}
                    f:memory: {}
                f:securityContext:
                  .: {}
                  f:privileged: {}
                f:terminationMessagePath: {}
                f:terminationMessagePolicy: {}
                f:volumeMounts:
                  .: {}
                  k:{"mountPath":"/config"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                    f:readOnly: {}
                  k:{"mountPath":"/env"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                  k:{"mountPath":"/etc/cni/net.d"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                  k:{"mountPath":"/etc/sysconfig"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                    f:readOnly: {}
                  k:{"mountPath":"/host"}:
                    .: {}
                    f:mountPath: {}
                    f:mountPropagation: {}
                    f:name: {}
                    f:readOnly: {}
                  k:{"mountPath":"/host/opt/cni/bin"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                  k:{"mountPath":"/host/var/run/netns"}:
                    .: {}
                    f:mountPath: {}
                    f:mountPropagation: {}
                    f:name: {}
                    f:readOnly: {}
                  k:{"mountPath":"/lib/modules"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                    f:readOnly: {}
                  k:{"mountPath":"/run/netns"}:
                    .: {}
                    f:mountPath: {}
                    f:mountPropagation: {}
                    f:name: {}
                    f:readOnly: {}
                  k:{"mountPath":"/var/lib/cni/networks/openshift-sdn"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                  k:{"mountPath":"/var/run"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                  k:{"mountPath":"/var/run/dbus/"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                    f:readOnly: {}
                  k:{"mountPath":"/var/run/kubernetes/"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                    f:readOnly: {}
                  k:{"mountPath":"/var/run/openshift-sdn"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                  k:{"mountPath":"/var/run/openvswitch/"}:
                    .: {}
                    f:mountPath: {}
                    f:name: {}
                    f:readOnly: {}
            f:dnsPolicy: {}
            f:hostNetwork: {}
            f:hostPID: {}
            f:nodeSelector:
              .: {}
              f:kubernetes.io/os: {}
            f:priorityClassName: {}
            f:restartPolicy: {}
            f:schedulerName: {}
            f:securityContext: {}
            f:serviceAccount: {}
            f:serviceAccountName: {}
            f:terminationGracePeriodSeconds: {}
            f:tolerations: {}
            f:volumes:
              .: {}
              k:{"name":"config"}:
                .: {}
                f:configMap:
                  .: {}
                  f:defaultMode: {}
                  f:name: {}
                f:name: {}
              k:{"name":"env-overrides"}:
                .: {}
                f:configMap:
                  .: {}
                  f:defaultMode: {}
                  f:name: {}
                  f:optional: {}
                f:name: {}
              k:{"name":"etc-sysconfig"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"host-cni-bin"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"host-cni-conf"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"host-modules"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"host-run-netns"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"host-slash"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"host-var-lib-cni-networks-openshift-sdn"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"host-var-run"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"host-var-run-dbus"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"host-var-run-kubernetes"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"host-var-run-netns"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"host-var-run-openshift-sdn"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"host-var-run-ovs"}:
                .: {}
                f:hostPath:
                  .: {}
                  f:path: {}
                  f:type: {}
                f:name: {}
              k:{"name":"sdn-metrics-certs"}:
                .: {}
                f:name: {}
                f:secret:
                  .: {}
                  f:defaultMode: {}
                  f:optional: {}
                  f:secretName: {}
        f:updateStrategy:
          f:rollingUpdate:
            .: {}
            f:maxUnavailable: {}
          f:type: {}
      f:status:
        f:currentNumberScheduled: {}
        f:desiredNumberScheduled: {}
        f:numberReady: {}
    manager: cluster-network-operator
    operation: Update
    time: "2022-03-08T10:50:14Z"
  name: sdn
  namespace: openshift-sdn
  ownerReferences:
  - apiVersion: operator.openshift.io/v1
    blockOwnerDeletion: true
    controller: true
    kind: Network
    name: cluster
    uid: b48e3238-e625-4cc0-acf5-5166b34864a9
  resourceVersion: "22531"
  selfLink: /apis/apps/v1/namespaces/openshift-sdn/daemonsets/sdn
  uid: b00eb0b3-e2b2-46b1-b233-ccd1a93462cd
spec:
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: sdn
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: sdn
        component: network
        openshift.io/component: network
        type: infra
    spec:
      containers:
      - command:
        - /bin/bash
        - -c
        - |
          #!/bin/bash
          set -euo pipefail

          # if another process is listening on the cni-server socket, wait until it exits
          trap 'kill $(jobs -p); rm -f /etc/cni/net.d/80-openshift-network.conf ; exit 0' TERM
          retries=0
          while true; do
            if echo 'test' | socat - UNIX-CONNECT:/var/run/openshift-sdn/cniserver/socket &>/dev/null; then
              echo "warning: Another process is currently listening on the CNI socket, waiting 15s ..." 2>&1
              sleep 15 & wait
              (( retries += 1 ))
            else
              break
            fi
            if [[ "${retries}" -gt 40 ]]; then
              echo "error: Another process is currently listening on the CNI socket, exiting" 2>&1
              exit 1
            fi
          done

          # local environment overrides
          if [[ -f /etc/sysconfig/openshift-sdn ]]; then
            set -o allexport
            source /etc/sysconfig/openshift-sdn
            set +o allexport
          fi
          #BUG: cdc accidentally mounted /etc/sysconfig/openshift-sdn as DirectoryOrCreate; clean it up so we can ultimately mount /etc/sysconfig/openshift-sdn as FileOrCreate
          # Once this is released, then we can mount it properly
          if [[ -d /etc/sysconfig/openshift-sdn ]]; then
            rmdir /etc/sysconfig/openshift-sdn || true
          fi

          # configmap-based overrides
          if [[ -f /env/${K8S_NODE_NAME} ]]; then
            set -o allexport
            source /env/${K8S_NODE_NAME}
            set +o allexport
          fi

          # Take over network functions on the node
          rm -f /etc/cni/net.d/80-openshift-network.conf
          cp -f /opt/cni/bin/openshift-sdn /host/opt/cni/bin/

          # Launch the network process
          exec /usr/bin/openshift-sdn-node \
            --node-name ${K8S_NODE_NAME} --node-ip ${K8S_NODE_IP} \
            --proxy-config /config/kube-proxy-config.yaml \
            --v ${OPENSHIFT_SDN_LOG_LEVEL:-2}
        env:
        - name: KUBERNETES_SERVICE_PORT
          value: "6443"
        - name: KUBERNETES_SERVICE_HOST
          value: api-int.case03116926.lab.upshift.rdu2.redhat.com
        - name: OPENSHIFT_DNS_DOMAIN
          value: cluster.local
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: K8S_NODE_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.hostIP
        image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:980d20b31cdcd9db0a94e393b53799985ea399bbe8dbd552bf2e27e32cf0be7e
        imagePullPolicy: IfNotPresent
        lifecycle:
          preStop:
            exec:
              command:
              - rm
              - -f
              - /etc/cni/net.d/80-openshift-network.conf
              - /host/opt/cni/bin/openshift-sdn
        name: sdn
        ports:
        - containerPort: 10256
          hostPort: 10256
          name: healthz
          protocol: TCP
        readinessProbe:
          exec:
            command:
            - test
            - -f
            - /etc/cni/net.d/80-openshift-network.conf
          failureThreshold: 3
          initialDelaySeconds: 5
          periodSeconds: 5
          successThreshold: 1
          timeoutSeconds: 1
        resources:
          requests:
            cpu: 100m
            memory: 200Mi
        securityContext:
          privileged: true
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /config
          name: config
          readOnly: true
        - mountPath: /env
          name: env-overrides
        - mountPath: /var/run
          name: host-var-run
        - mountPath: /var/run/dbus/
          name: host-var-run-dbus
          readOnly: true
        - mountPath: /var/run/openvswitch/
          name: host-var-run-ovs
          readOnly: true
        - mountPath: /var/run/kubernetes/
          name: host-var-run-kubernetes
          readOnly: true
        - mountPath: /run/netns
          mountPropagation: HostToContainer
          name: host-run-netns
          readOnly: true
        - mountPath: /host/var/run/netns
          mountPropagation: HostToContainer
          name: host-var-run-netns
          readOnly: true
        - mountPath: /var/run/openshift-sdn
          name: host-var-run-openshift-sdn
        - mountPath: /host
          mountPropagation: HostToContainer
          name: host-slash
          readOnly: true
        - mountPath: /host/opt/cni/bin
          name: host-cni-bin
        - mountPath: /etc/cni/net.d
          name: host-cni-conf
        - mountPath: /var/lib/cni/networks/openshift-sdn
          name: host-var-lib-cni-networks-openshift-sdn
        - mountPath: /lib/modules
          name: host-modules
          readOnly: true
        - mountPath: /etc/sysconfig
          name: etc-sysconfig
          readOnly: true
      - command:
        - /bin/bash
        - -c
        - |
          #!/bin/bash
          set -euo pipefail
          TLS_PK=/etc/pki/tls/metrics-certs/tls.key
          TLS_CERT=/etc/pki/tls/metrics-certs/tls.crt

          # As the secret mount is optional we must wait for the files to be present.
          # The service is created in monitor.yaml and this is created in sdn.yaml.
          # If it isn't created there is probably an issue so we want to crashloop.
          TS=$(date +%s)
          WARN_TS=$(( ${TS} + $(( 20 * 60)) ))
          HAS_LOGGED_INFO=0

          log_missing_certs(){
              CUR_TS=$(date +%s)
              if [[ "${CUR_TS}" -gt "WARN_TS"  ]]; then
                echo $(date -Iseconds) WARN: sdn-metrics-certs not mounted after 20 minutes.
              elif [[ "${HAS_LOGGED_INFO}" -eq 0 ]] ; then
                echo $(date -Iseconds) INFO: sdn-metrics-certs not mounted. Waiting 20 minutes.
                HAS_LOGGED_INFO=1
              fi
          }

          while [[ ! -f "${TLS_PK}" ||  ! -f "${TLS_CERT}" ]] ; do
            log_missing_certs
            sleep 5
          done

          echo $(date -Iseconds) INFO: sdn-metrics-certs mounted, starting kube-rbac-proxy
          exec /usr/bin/kube-rbac-proxy \
            --logtostderr \
            --secure-listen-address=:9101 \
            --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 \
            --upstream=http://127.0.0.1:29101/ \
            --tls-private-key-file=${TLS_PK} \
            --tls-cert-file=${TLS_CERT}
        image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:533973e0b3b8e64b0fd672a78ebabc5accc5f9a969c6a610ce14aa73d9685874
        imagePullPolicy: IfNotPresent
        name: kube-rbac-proxy
        ports:
        - containerPort: 9101
          hostPort: 9101
          name: https
          protocol: TCP
        resources:
          requests:
            cpu: 10m
            memory: 20Mi
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /etc/pki/tls/metrics-certs
          name: sdn-metrics-certs
          readOnly: true
      dnsPolicy: ClusterFirst
      hostNetwork: true
      hostPID: true
      nodeSelector:
        kubernetes.io/os: linux
      priorityClassName: system-node-critical
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: sdn
      serviceAccountName: sdn
      terminationGracePeriodSeconds: 30
      tolerations:
      - operator: Exists
      volumes:
      - configMap:
          defaultMode: 420
          name: sdn-config
        name: config
      - configMap:
          defaultMode: 420
          name: env-overrides
          optional: true
        name: env-overrides
      - hostPath:
          path: /etc/sysconfig
          type: ""
        name: etc-sysconfig
      - hostPath:
          path: /lib/modules
          type: ""
        name: host-modules
      - hostPath:
          path: /var/run
          type: ""
        name: host-var-run
      - hostPath:
          path: /run/netns
          type: ""
        name: host-run-netns
      - hostPath:
          path: /var/run/netns
          type: ""
        name: host-var-run-netns
      - hostPath:
          path: /var/run/dbus
          type: ""
        name: host-var-run-dbus
      - hostPath:
          path: /var/run/openvswitch
          type: ""
        name: host-var-run-ovs
      - hostPath:
          path: /var/run/kubernetes
          type: ""
        name: host-var-run-kubernetes
      - hostPath:
          path: /var/run/openshift-sdn
          type: ""
        name: host-var-run-openshift-sdn
      - hostPath:
          path: /
          type: ""
        name: host-slash
      - hostPath:
          path: /var/lib/cni/bin
          type: ""
        name: host-cni-bin
      - hostPath:
          path: /var/run/multus/cni/net.d
          type: ""
        name: host-cni-conf
      - hostPath:
          path: /var/lib/cni/networks/openshift-sdn
          type: ""
        name: host-var-lib-cni-networks-openshift-sdn
      - name: sdn-metrics-certs
        secret:
          defaultMode: 420
          optional: true
          secretName: sdn-metrics-certs
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
status:
  currentNumberScheduled: 6
  desiredNumberScheduled: 6
  numberAvailable: 6
  numberMisscheduled: 0
  numberReady: 6
  observedGeneration: 1
  updatedNumberScheduled: 6
