meshrr-core.yaml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: meshrr-core-conf
data:
  meshrr.conf.yml: |+
    encrypted_root_pw: NOLOGIN
    asn: "65000"
    mode: ipv4rr
    bgpgroups:
    - name: MESHRR-MESH
      type: mesh
      source:
        sourcetype: dns
        hostname: meshrr-core
    - name: MESHRR-CLIENTS
      type: subtractive
      prefixes:
      - 10.42.0.0/16

---
apiVersion: v1
kind: Service
metadata:
  creationTimestamp: null
  name: meshrr-core
  selfLink: /api/v1/namespaces/default/services/meshrr-core
spec:
  clusterIP: None
  ports:
  - name: bgp
    port: 179
    protocol: TCP
    targetPort: bgp
  selector:
    app: meshrr
    meshrr_region_core: "true"
  sessionAffinity: None
  type: ClusterIP
status:
  loadBalancer: {}

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: meshrr-core
  labels:
    app: meshrr
    meshrr_region_core: "true"
spec:
  selector:
    matchLabels:
      app: meshrr
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  template:
    metadata:
      labels:
        app: meshrr
        meshrr_region_core: "true"
    spec:
      dnsPolicy: ClusterFirst
      terminationGracePeriodSeconds: 30
      volumes:
        - name: config
          emptyDir: {}
        - name: ssh-id
          emptyDir: {}
        - name: meshrr-conf
          configMap:
            defaultMode: 256
            items:
            - key: meshrr.conf.yml
              mode: 256
              path: meshrr.conf.yml
            name: meshrr-core-conf
            optional: false
      initContainers:
        - name: meshrr-init
          image: ghcr.io/juniper/meshrr:0.2
          imagePullPolicy: IfNotPresent
          args: ["init"]
          volumeMounts:
            - name: ssh-id
              mountPath: /secret/ssh/
            - name: config
              mountPath: /config/
            - name: meshrr-conf
              mountPath: /opt/meshrr/conf/meshrr.conf.yml
              readOnly: true
              subPath: meshrr.conf.yml
          env:
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: LICENSE_KEY
              valueFrom:
                secretKeyRef:
                  name: crpd-license
                  key: crpd-license
      containers:
        - name: crpd
          image: localhost/juniper/crpd:23.2R1.13
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 15
            periodSeconds: 2
            successThreshold: 1
            tcpSocket:
              port: bgp
            timeoutSeconds: 3
          readinessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 2
            successThreshold: 2
            tcpSocket:
              port: bgp
            timeoutSeconds: 3
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          ports:
            - name: bgp
              containerPort: 179
              protocol: TCP
          volumeMounts:
            - name: config
              mountPath: /config/
          securityContext:
            allowPrivilegeEscalation: true
            privileged: true
            runAsNonRoot: false
        - name: meshrr
          image: ghcr.io/juniper/meshrr:0.2
          imagePullPolicy: IfNotPresent
          args: ["sidecar"]
          startupProbe:
            exec:
              command:
              - cat
              - /tmp/connected-to-crpd
            initialDelaySeconds: 5
            periodSeconds: 3
          volumeMounts:
            - name: ssh-id
              mountPath: /secret/ssh/
            - name: meshrr-conf
              mountPath: /opt/meshrr/conf/meshrr.conf.yml
              readOnly: true
              subPath: meshrr.conf.yml
          env:
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: meshrr_region_core
                    operator: In
                    values:
                      - "true"
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: meshrr_region_core
                    operator: In
                    values:
                      - 'true'
                  - key: app
                    operator: In
                    values:
                      - meshrr
              topologyKey: kubernetes.io/hostname
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 50
              podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: app
                      operator: In
                      values:
                        - meshrr
                    - key: meshrr_region_core
                      operator: In
                      values:
                        - 'true'
                topologyKey: redundancy_group