From e2422a4fa401d76095e2c58f522698c6c0d0d711 Mon Sep 17 00:00:00 2001
From: Thomas Perronin <thomas.perronin@blablacar.com>
Date: Thu, 6 Jan 2022 21:12:53 +0100
Subject: [PATCH] feat(kube-vip): update template according to new version
 (#183)

---
 .../inventory/group_vars/kubernetes/k3s.yml   |  3 +-
 .../templates/kube-vip-daemonset.yaml.j2      | 21 +++++++++---
 .../playbooks/templates/kube-vip-rbac.yaml.j2 | 33 -------------------
 3 files changed, 18 insertions(+), 39 deletions(-)
 delete mode 100644 provision/ansible/playbooks/templates/kube-vip-rbac.yaml.j2

diff --git a/provision/ansible/inventory/group_vars/kubernetes/k3s.yml b/provision/ansible/inventory/group_vars/kubernetes/k3s.yml
index 7a146010..d6cf2aa3 100644
--- a/provision/ansible/inventory/group_vars/kubernetes/k3s.yml
+++ b/provision/ansible/inventory/group_vars/kubernetes/k3s.yml
@@ -29,10 +29,11 @@ k3s_registration_address: "{{ kubevip_address }}"
 k3s_server_manifests_urls:
   - url: https://docs.projectcalico.org/archive/v3.21/manifests/tigera-operator.yaml
     filename: tigera-operator.yaml
+  - url: https://kube-vip.io/manifests/rbac.yaml
+    filename: kube-vip-rbac.yaml
 
 # (list) A flat list of templates to deploy on the primary control plane
 # /var/lib/rancher/k3s/server/manifests
 k3s_server_manifests_templates:
   - "calico-installation.yaml.j2"
-  - "kube-vip-rbac.yaml.j2"
   - "kube-vip-daemonset.yaml.j2"
diff --git a/provision/ansible/playbooks/templates/kube-vip-daemonset.yaml.j2 b/provision/ansible/playbooks/templates/kube-vip-daemonset.yaml.j2
index fe223774..10bdd3b3 100644
--- a/provision/ansible/playbooks/templates/kube-vip-daemonset.yaml.j2
+++ b/provision/ansible/playbooks/templates/kube-vip-daemonset.yaml.j2
@@ -18,6 +18,16 @@ spec:
         app.kubernetes.io/instance: kube-vip
         app.kubernetes.io/name: kube-vip
     spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: node-role.kubernetes.io/master
+                operator: Exists
+            - matchExpressions:
+              - key: node-role.kubernetes.io/control-plane
+                operator: Exists
       containers:
         - name: kube-vip
           image: ghcr.io/kube-vip/kube-vip:v0.4.1
@@ -39,7 +49,9 @@ spec:
               value: kube-system
             - name: svc_enable
               value: "false"
-            - name: vip_address
+            - name: vip_ddns
+              value: "false"
+            - name: address
               value: "{{ k3s_registration_address }}"
           securityContext:
             capabilities:
@@ -51,10 +63,9 @@ spec:
             - kubernetes
           ip: 127.0.0.1
       hostNetwork: true
-      nodeSelector:
-        node-role.kubernetes.io/master: "true"
       serviceAccountName: kube-vip
       tolerations:
-        - key: node-role.kubernetes.io/master
+        - effect: NoSchedule
+          operator: Exists
+        - effect: NoExecute
           operator: Exists
-          effect: NoSchedule
diff --git a/provision/ansible/playbooks/templates/kube-vip-rbac.yaml.j2 b/provision/ansible/playbooks/templates/kube-vip-rbac.yaml.j2
deleted file mode 100644
index 72f6fda8..00000000
--- a/provision/ansible/playbooks/templates/kube-vip-rbac.yaml.j2
+++ /dev/null
@@ -1,33 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kube-vip
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    rbac.authorization.kubernetes.io/autoupdate: "true"
-  name: system:kube-vip-role
-rules:
-  - apiGroups: [""]
-    resources: ["services", "services/status", "nodes"]
-    verbs: ["list", "get", "watch", "update"]
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["list", "get", "watch", "update", "create"]
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: system:kube-vip-binding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:kube-vip-role
-subjects:
-- kind: ServiceAccount
-  name: kube-vip
-  namespace: kube-system