69cb269230
In K8S version 1.10, the proxy can sometimes get stuck believing that some services do not have any endpoints. This seems to be triggered by network instability, though the proxy doesn't seem to recover on its own, while bouncing the pod fixes the issue. This change adds a naive means of detecting and recoverying from this (`iptables-save | grep 'has no endpoints'` in the liveness probe) that may occasionally have false positives. As such, the liveness probe is configured very conservatively to avoid triggering CrashLoopBackoff in the event of a false positive. Finally, there is a whitelist feature to help avoid false positives for services that are known to legitimately have empty endpoints during the course of normal operation (e.g. Patroni might manage such an endpoint list). Change-Id: I29a770fab70b1fb79db59ef5408f40b2af1c01f9
86 lines
2.7 KiB
YAML
86 lines
2.7 KiB
YAML
{{/*
|
|
Copyright 2017 AT&T Intellectual Property. All other rights reserved.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/}}
|
|
|
|
{{- if .Values.manifests.daemonset_proxy }}
|
|
{{- $envAll := . }}
|
|
|
|
---
|
|
apiVersion: "extensions/v1beta1"
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: kubernetes-proxy
|
|
spec:
|
|
{{ tuple $envAll "proxy" | include "helm-toolkit.snippets.kubernetes_upgrades_daemonset" | indent 2 }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{ tuple $envAll "kubernetes" "proxy" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
|
annotations:
|
|
scheduler.alpha.kubernetes.io/critical-pod: ''
|
|
spec:
|
|
hostNetwork: true
|
|
dnsPolicy: Default
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/master
|
|
effect: NoSchedule
|
|
- key: CriticalAddonsOnly
|
|
operator: Exists
|
|
containers:
|
|
- name: proxy
|
|
image: {{ .Values.images.tags.proxy }}
|
|
imagePullPolicy: {{ .Values.images.pull_policy }}
|
|
command:
|
|
{{- range .Values.command_prefix }}
|
|
- {{ . }}
|
|
{{- end }}
|
|
- --hostname-override=$(NODE_NAME)
|
|
{{ tuple $envAll $envAll.Values.pod.resources.proxy | include "helm-toolkit.snippets.kubernetes_resources" | indent 8 }}
|
|
securityContext:
|
|
privileged: true
|
|
# volumeMounts:
|
|
# - mountPath: /run/xtables.lock
|
|
# name: xtables-lock
|
|
# readOnly: false
|
|
# - mountPath: /lib/modules
|
|
# name: lib-modules
|
|
# readOnly: true
|
|
env:
|
|
- name: KUBERNETES_SERVICE_HOST
|
|
value: {{ .Values.kube_service.host }}
|
|
- name: KUBERNETES_SERVICE_PORT
|
|
value: {{ .Values.kube_service.port | quote }}
|
|
livenessProbe:
|
|
{{ toYaml .Values.livenessProbe.config | indent 10 }}
|
|
exec:
|
|
command:
|
|
- /tmp/bin/liveness-probe.sh
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- /tmp/bin/readiness-probe.sh
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 15
|
|
volumeMounts:
|
|
- name: bin
|
|
mountPath: /tmp/bin/
|
|
serviceAccountName: kube-proxy
|
|
volumes:
|
|
- name: bin
|
|
configMap:
|
|
name: kubernetes-proxy-bin
|
|
defaultMode: 0555
|
|
{{- end }}
|