From f8cd80702545e8f7c562dbca8872cd53c0f984e3 Mon Sep 17 00:00:00 2001
From: Trekkie Coder <trekkie@netlox.io>
Date: Thu, 17 Oct 2024 09:43:15 +0900
Subject: [PATCH] gh-187 updated kube-loxilb manifests

---
 manifest/virtual-cluster/kube-loxilb.yaml | 196 ++++++++++++++++++++++
 1 file changed, 196 insertions(+)
 create mode 100644 manifest/virtual-cluster/kube-loxilb.yaml

diff --git a/manifest/virtual-cluster/kube-loxilb.yaml b/manifest/virtual-cluster/kube-loxilb.yaml
new file mode 100644
index 0000000..fc660f0
--- /dev/null
+++ b/manifest/virtual-cluster/kube-loxilb.yaml
@@ -0,0 +1,196 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kube-loxilb
+  namespace: kube-system
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kube-loxilb
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+      - watch
+      - list
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - watch
+      - list
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - endpoints
+      - services
+      - namespaces
+      - services/status
+    verbs:
+      - get
+      - watch
+      - list
+      - patch
+      - update
+  - apiGroups:
+      - gateway.networking.k8s.io
+    resources:
+      - gatewayclasses
+      - gatewayclasses/status
+      - gateways
+      - gateways/status
+      - tcproutes
+      - udproutes
+    verbs: ["get", "watch", "list", "patch", "update"]
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - get
+      - watch
+      - list
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - watch
+      - list
+  - apiGroups:
+      - authentication.k8s.io
+    resources:
+      - tokenreviews
+    verbs:
+      - create
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - subjectaccessreviews
+    verbs:
+      - create
+  - apiGroups:
+      - bgppeer.loxilb.io
+    resources:
+      - bgppeerservices
+    verbs:
+      - get
+      - watch
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - bgppolicydefinedsets.loxilb.io
+    resources:
+      - bgppolicydefinedsetsservices
+    verbs:
+      - get
+      - watch
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - bgppolicydefinition.loxilb.io
+    resources:
+      - bgppolicydefinitionservices
+    verbs:
+      - get
+      - watch
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - bgppolicyapply.loxilb.io
+    resources:
+      - bgppolicyapplyservices
+    verbs:
+      - get
+      - watch
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - loxiurl.loxilb.io
+    resources:
+      - loxiurls
+    verbs:
+      - get
+      - watch
+      - list
+      - create
+      - update
+      - delete
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kube-loxilb
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kube-loxilb
+subjects:
+  - kind: ServiceAccount
+    name: kube-loxilb
+    namespace: kube-system
+---
+apiVersion: apps/v1             
+kind: Deployment           
+metadata:                           
+  name: kube-loxilb                        
+  namespace: kube-system                           
+  labels:                          
+    app: kube-loxilb-app                           
+spec:                             
+  replicas: 1                             
+  selector:                          
+    matchLabels:                      
+      app: kube-loxilb-app                            
+  template:                         
+    metadata:                          
+      labels:                       
+        app: kube-loxilb-app                    
+    spec:                       
+      dnsPolicy: ClusterFirstWithHostNet                         
+      tolerations:                      
+        # Mark the pod as a critical add-on for rescheduling.           
+        - key: CriticalAddonsOnly            
+          operator: Exists                          
+      priorityClassName: system-node-critical                      
+      serviceAccountName: kube-loxilb                       
+      terminationGracePeriodSeconds: 0                    
+      containers:                     
+      - name: kube-loxilb                     
+        image: ghcr.io/loxilb-io/kube-loxilb:latest              
+        imagePullPolicy: Always                      
+        command:                   
+        - /bin/kube-loxilb                
+        args:               
+        - --loxiURL=http://127.0.0.1:11111                    
+        - --cidrPools=defaultPool=192.168.80.250/32                   
+        - --setRoles=0.0.0.0
+        resources:             
+          requests:           
+            cpu: "100m"
+            memory: "50Mi"             
+          limits:              
+            cpu: "100m"                
+            memory: "50Mi"              
+        securityContext:           
+          privileged: true             
+          capabilities:            
+            add: ["NET_ADMIN", "NET_RAW"]
\ No newline at end of file