利用kubeadm快速搭建K8S集群

利用kubeadm快速搭建K8S集群（需要linux可以连接外网）

#linux如何连接外网这部就跳过了，如果调试连接外网成功了，那就开始搭建吧
一、基础环境准备
1、主机准备
本次搭建只用到一个节点，作为自己练习或者测试用
#真正到生产环境中，基本都是用二进制搭建
一个节点的资源就比较好规划了
内存：5G
CPU：2
磁盘：100G
系统：centos7.5-1804
docker版本：v19.03.14
K8S版本：v1.19.10
主机名：k8s-practice
Ip地址设置：选用自己的ip，根据虚拟机设置的ip段

2、初始化环境

①、关闭防火墙
Systemctl stop firewalld
Systemctl disable firewalld

②、关闭iptables
Systemctl stop iptables
Systemctl disable iptables

③、关闭selinux
编辑 /etc/selinux/config文件修改SELINUX的值为disabled
然后可以手动先设置一下，应该上面修改配置文件需要重启才可以启动
setenforce 0
然后用getenforce看一下状态

④、关闭swap分区
编辑分区配置文件 /etc/fstab文件，注释掉swap分区一行

⑤、编辑配置文件 /etc/hosts，添加本机和成员及ip（选用！）

⑥、修改linux的内核参数，添加网桥过滤和地址转发功能
[root@k8s-practice ~]# vim /etc/sysctl.d/kubernetes.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
#重新加载配置
[root@k8s-practice ~]# sysctl -p
#加载网桥过滤模块
[root@k8s-practice ~]# modprobe br_netfilter
#查看网桥过滤模块是否加载成功
[root@k8s_practice ~]# lsmod | grep br_netfilter
br_netfilter 22256 0
bridge 146976 1 br_netfilter

⑦、配置ipvs功能
#kubernetes中service有两种代理模型，一种是基于iptables的，一种是基于ipvs的，两者比较的话，ipvs的性能要明显高一些，但是如果要使用它，需要手动载入ipvs模块
#需要安装ipset和ipvsadm
#可能需要用到yum源：wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo（需要有网络）
[root@k8s-practice ~]# yum -y install ipset ipvsadm
#添加需要加载的模块写入脚本文件
[root@k8s-practice ~]# cat < /etc/sysconfig/modules/ipvs.modules

#! /bin/bash
modprobe – ip_vs
modprobe – ip_vs_rr
modprobe – ip_vs_wrr
modprobe – ip_vs_sh
modprobe – nf_conntrack_ipv4
EOF
#为脚本文件添加权限
[root@k8s-practice ~]# chmod +x /etc/sysconfig/modules/ipvs.modules
#执行脚本文件
[root@k8s-practice ~]# /bin/bash /etc/sysconfig/modules/ipvs.modules
#查看对应的模块是否加载成功
[root@k8s-practice ~]# lsmod | grep -e ip_vs -e nf_conntrack_ipv4

⑧、重启服务
Reboot

二、安装docker
1、加镜像源
wget -O /etc/yum.repos.d/docker-ce.repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

2、查看目前docker这个镜像源都有哪些docker版本
yum list docker-ce --showduplicate

3、指定安装版本
#本次安装的版本是19.03.14，指定版本的命令是–setopt=obsoletes=0
yum -y install --setopt=obsoletes=0 docker-ce-3:19.03.14-3.el7 但是高一些的docker版本这么直接安装会有问题！！
(1/3):containerd.io-1.4.4-3.1.el7.x86_64.rpm
(2/3):docker-ce-19.03.14-3.el7.x86_64.rpm
(3/3): docker-ce-cli-20.10.6-3.el7.x86_64.rpm
上面看，Server端是正常安装你想要的版本，但是client端就不是这样了，直接安装到了最新的版本，如果这样安装就算不报错，后面的K8S安装的时候，是一定会报错的。所以针对这个情况，需要如下安装
[root@k8s-practice ~]# yum -y install docker-ce-19.03.14 docker-ce-cli-19.03.14 containerd.io
#这样安装解决了，安装docker时出现server端和client端的版本不一致问题，但是看资料和视频，有的docker版本并不用这样安装，按照最开始直接安装docker-ce-版本号，就可以了，具体从什么版本开始必须区分开来安装，还不清楚，有兴趣的小伙伴可以研究一下。

4、给docker添加一个网络镜像源
[root@k8s-practice ~]# mkdir /etc/docker
[root@k8s-practice ~]# cat < /etc/docker/daemon.json
{
“exec-opts”: [“native.cgroupdriver=systemd”],
“registry-mirrors”: [“https://kn0t2bca.mirror.aliyuncs.com”]
}
EOF

5、启动docker，重新加载daemon-reload
[root@k8s-practice ~]# systemctl restart docker
[root@k8s-practice ~]# systemctl enable docker
[root@k8s-practice ~]# systemctl daemon-reload
[root@k8s-practice ~]# docker version #可以查看docker的server、client版本

三、安装K8S
1、添加K8S的镜像源
[root@k8s-practice ~]# vim /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=kubernetes
baseurl=http://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
gpgkey=http://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
http://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg

2、安装kubeadm、kubelet、kubectl
[root@k8s-practice ~]# yum -y install --setopt=obsoletes=0 kubeadm-1.19.10 kubelet-1.19.10 kubectl-1.19.10

3、修改配置文件
[root@k8s-practice ~]# vim /etc/sysconfig/kubelet
KUBELET_EXTRA_ARGS="–cgroup-driver=systemd"
KUBE_PROXY_MODE=“ipvs”
[root@k8s-practice ~]# systemctl enable kubelet

4、准备集群镜像
[root@k8s-practice ~]# kubeadm config images list
I0421 22:27:44.923167 12339 version.go:255] remote version is much newer: v1.21.0; falling back to: stable-1.19
W0421 22:27:47.115513 12339 configset.go:348] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
k8s.gcr.io/kube-apiserver:v1.19.10
k8s.gcr.io/kube-controller-manager:v1.19.10
k8s.gcr.io/kube-scheduler:v1.19.10
k8s.gcr.io/kube-proxy:v1.19.10
k8s.gcr.io/pause:3.2
k8s.gcr.io/etcd:3.4.13-0
k8s.gcr.io/coredns:1.7.0
#这个是检查目前对应1.19.10版本可以匹配的其他组件版本，这里要求的组件版本需要满足，即便满足不了，将其他版本打tag打成它要的这个镜像名字。
这里用一个for循环来循环下载下面的镜像，然后打tag，删除原来的镜像，这里需要强调，从K8S国外官网上下载基本是不可能的，可以用阿里云的相关镜像，然后打tag打成kubeadm安装时需要满足的镜像名字
#这里由于我自己有coredns1.7.0，这里我就没加进去，如果没有你就加进去
images=(
kube-apiserver:v1.19.10
kube-controller-manager:v1.19.10
kube-scheduler:v1.19.10
kube-proxy:v1.19.10
pause:3.2
etcd:3.4.13-0
)

for imageName in $images[@];dodockerpullregistry.cn-hangzhou.aliyuncs.com/googl{e}_{c}ontainers/$imageName
docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/$imageNamek8s.gcr.io/$imageName
docker rmi registry.cn-hangzhou.aliyuncs.com/google_containers/$imageName
done

5、集群初始化
[root@k8s-practice ~]# kubeadm init
–kubernetes-version=v1.19.10
–pod-network-cidr=10.244.0.0/16
–service-cidr=10.96.0.0/12
–apiserver-advertise-address=192.168.200.110

红框显示你的K8S控制面板已经初始化成功！

截图告诉你了，如果你要运行你的集群，你需要跑一下下面的几行提示
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id-u):$(id -g) $HOME/.kube/config
#我们来运行一下
[root@k8s-practice ~]# mkdir -p $HOME/.kube
[root@k8s-practice ~]# sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
[root@k8s-practice ~]# sudo chown $(id-u):$(id -g) $HOME/.kube/config

#截图又告诉你了，如果你想给集群添加个网络请运行
Run “kubectl apply -f [podnetwork].yaml” with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/

#截图还告诉你了
如果你想在这个集群里添加其他节点，请执行这句话
kubeadm join 192.168.200.110:6443 --token ak1b2i.jy8njuxh7kzl71uy
–discovery-token-ca-cert-hash sha256:60c2c930fb13e32b91dea5916f667218f085ae7ea6c7a865f849c635e7b47b24
#加节点这个怎么用！—首先其他你想加的节点要做到集群初始化前一步也就是第三安装K8S的第四小步，别多做，做好后执行上面的命令就可以了

四、安装网络插件
网络插件并不是K8S一起带来的，都是由第三方提供的，目前主流的就是calico，用于部署生产大规模集群使用，对于calico的配置，可能后面会出，这次搭建集群所用的网络插件是flannel

1、下载并修改flannel网络插件
[root@k8s-practice ~]# wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
#意思是从网上下载了一个yml文件，里面主要使用DS这个pod控制器，将在每一个节点上运行
#提示：如果下载不下来可以留言问我要，我是下下来了，而且还是用的电信流量下的
如果下载下来了，用vim来编辑一下这个yml文件，来修改几个参数
169 image: quay-mirror.qiniu.com/coreos/flannel:v0.14.0-rc1
183 image: quay-mirror.qiniu.com/coreos/flannel:v0.14.0-rc1
#将上面的镜像地址修改一下由quay.io修改成quay-mirror.qiniu.com
#这里请注意，根据网络情况，有可能用quay.io是可以成功的，这个在创建的时候需要自己尝试一下，利用yaml创建完成后需要稍微的等一下，它需要从网上去拉取它需要的资源，需要等待一下。

2、执行yml文件
[root@k8s-practice ~]# kubectl apply -f kube-flannel.yml
podsecuritypolicy.policy/psp.flannel.unprivileged created
clusterrole.rbac.authorization.k8s.io/flannel created
clusterrolebinding.rbac.authorization.k8s.io/flannel created
serviceaccount/flannel created
configmap/kube-flannel-cfg created
daemonset.apps/kube-flannel-ds created

3、验证一下网络

4、随便创建一个服务看下
kubectl create deployment nginx --image=nginx:1.14-alpine
#从上图可以看到，pod启动正常，只要在暴露一下端口就可以通过宿主机来访问这个nginx的服务了
kubectl expose deployment nginx --port=80 --type=NodePort

到此一个用kubeadm搭建的K8S练习环境已经搭建完成。

温馨提示：在操作的过程中如果选择直接复制粘贴的话一定要看清楚格式，尤其是“”“”：这些符号
温馨提示2：如果 flannel的文件无法下载请复制

---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: psp.flannel.unprivileged
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
    seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
    apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
    apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
spec:
  privileged: false
  volumes:
    - configMap
    - secret
    - emptyDir
    - hostPath
  allowedHostPaths:
    - pathPrefix: "/etc/cni/net.d"
    - pathPrefix: "/etc/kube-flannel"
    - pathPrefix: "/run/flannel"
  readOnlyRootFilesystem: false
  # Users and groups
  runAsUser:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  fsGroup:
    rule: RunAsAny
  # Privilege Escalation
  allowPrivilegeEscalation: false
  defaultAllowPrivilegeEscalation: false
  # Capabilities
  allowedCapabilities: ['NET_ADMIN']
  defaultAddCapabilities: []
  requiredDropCapabilities: []
  # Host namespaces
  hostPID: false
  hostIPC: false
  hostNetwork: true
  hostPorts:
  - min: 0
    max: 65535
  # SELinux
  seLinux:
    # SELinux is unused in CaaSP
    rule: 'RunAsAny'
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: flannel
rules:
  - apiGroups: ['extensions']
    resources: ['podsecuritypolicies']
    verbs: ['use']
    resourceNames: ['psp.flannel.unprivileged']
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - nodes/status
    verbs:
      - patch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: flannel
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: flannel
subjects:
- kind: ServiceAccount
  name: flannel
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: flannel
  namespace: kube-system
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: kube-flannel-cfg
  namespace: kube-system
  labels:
    tier: node
    app: flannel
data:
  cni-conf.json: |
    {
      "name": "cbr0",
      "cniVersion": "0.3.1",
      "plugins": [
        {
          "type": "flannel",
          "delegate": {
            "hairpinMode": true,
            "isDefaultGateway": true
          }
        },
        {
          "type": "portmap",
          "capabilities": {
            "portMappings": true
          }
        }
      ]
    }
  net-conf.json: |
    {
      "Network": "10.244.0.0/16",
      "Backend": {
        "Type": "vxlan"
      }
    }
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-flannel-ds-amd64
  namespace: kube-system
  labels:
    tier: node
    app: flannel
spec:
  selector:
    matchLabels:
      app: flannel
  template:
    metadata:
      labels:
        tier: node
        app: flannel
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: beta.kubernetes.io/os
                    operator: In
                    values:
                      - linux
                  - key: beta.kubernetes.io/arch
                    operator: In
                    values:
                      - amd64
      hostNetwork: true
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccountName: flannel
      initContainers:
      - name: install-cni
        image: quay.io/coreos/flannel:v0.11.0-amd64
        command:
        - cp
        args:
        - -f
        - /etc/kube-flannel/cni-conf.json
        - /etc/cni/net.d/10-flannel.conflist
        volumeMounts:
        - name: cni
          mountPath: /etc/cni/net.d
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      containers:
      - name: kube-flannel
        image: quay.io/coreos/flannel:v0.11.0-amd64
        command:
        - /opt/bin/flanneld
        args:
        - --ip-masq
        - --kube-subnet-mgr
        resources:
          requests:
            cpu: "100m"
            memory: "50Mi"
          limits:
            cpu: "100m"
            memory: "50Mi"
        securityContext:
          privileged: false
          capabilities:
            add: ["NET_ADMIN"]
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        volumeMounts:
        - name: run
          mountPath: /run/flannel
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      volumes:
        - name: run
          hostPath:
            path: /run/flannel
        - name: cni
          hostPath:
            path: /etc/cni/net.d
        - name: flannel-cfg
          configMap:
            name: kube-flannel-cfg
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-flannel-ds-arm64
  namespace: kube-system
  labels:
    tier: node
    app: flannel
spec:
  selector:
    matchLabels:
      app: flannel
  template:
    metadata:
      labels:
        tier: node
        app: flannel
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: beta.kubernetes.io/os
                    operator: In
                    values:
                      - linux
                  - key: beta.kubernetes.io/arch
                    operator: In
                    values:
                      - arm64
      hostNetwork: true
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccountName: flannel
      initContainers:
      - name: install-cni
        image: quay.io/coreos/flannel:v0.11.0-arm64
        command:
        - cp
        args:
        - -f
        - /etc/kube-flannel/cni-conf.json
        - /etc/cni/net.d/10-flannel.conflist
        volumeMounts:
        - name: cni
          mountPath: /etc/cni/net.d
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      containers:
      - name: kube-flannel
        image: quay.io/coreos/flannel:v0.11.0-arm64
        command:
        - /opt/bin/flanneld
        args:
        - --ip-masq
        - --kube-subnet-mgr
        resources:
          requests:
            cpu: "100m"
            memory: "50Mi"
          limits:
            cpu: "100m"
            memory: "50Mi"
        securityContext:
          privileged: false
          capabilities:
             add: ["NET_ADMIN"]
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        volumeMounts:
        - name: run
          mountPath: /run/flannel
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      volumes:
        - name: run
          hostPath:
            path: /run/flannel
        - name: cni
          hostPath:
            path: /etc/cni/net.d
        - name: flannel-cfg
          configMap:
            name: kube-flannel-cfg
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-flannel-ds-arm
  namespace: kube-system
  labels:
    tier: node
    app: flannel
spec:
  selector:
    matchLabels:
      app: flannel
  template:
    metadata:
      labels:
        tier: node
        app: flannel
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: beta.kubernetes.io/os
                    operator: In
                    values:
                      - linux
                  - key: beta.kubernetes.io/arch
                    operator: In
                    values:
                      - arm
      hostNetwork: true
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccountName: flannel
      initContainers:
      - name: install-cni
        image: quay.io/coreos/flannel:v0.11.0-arm
        command:
        - cp
        args:
        - -f
        - /etc/kube-flannel/cni-conf.json
        - /etc/cni/net.d/10-flannel.conflist
        volumeMounts:
        - name: cni
          mountPath: /etc/cni/net.d
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      containers:
      - name: kube-flannel
        image: quay.io/coreos/flannel:v0.11.0-arm
        command:
        - /opt/bin/flanneld
        args:
        - --ip-masq
        - --kube-subnet-mgr
        resources:
          requests:
            cpu: "100m"
            memory: "50Mi"
          limits:
            cpu: "100m"
            memory: "50Mi"
        securityContext:
          privileged: false
          capabilities:
             add: ["NET_ADMIN"]
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        volumeMounts:
        - name: run
          mountPath: /run/flannel
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      volumes:
        - name: run
          hostPath:
            path: /run/flannel
        - name: cni
          hostPath:
            path: /etc/cni/net.d
        - name: flannel-cfg
          configMap:
            name: kube-flannel-cfg
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-flannel-ds-ppc64le
  namespace: kube-system
  labels:
    tier: node
    app: flannel
spec:
  selector:
    matchLabels:
      app: flannel
  template:
    metadata:
      labels:
        tier: node
        app: flannel
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: beta.kubernetes.io/os
                    operator: In
                    values:
                      - linux
                  - key: beta.kubernetes.io/arch
                    operator: In
                    values:
                      - ppc64le
      hostNetwork: true
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccountName: flannel
      initContainers:
      - name: install-cni
        image: quay.io/coreos/flannel:v0.11.0-ppc64le
        command:
        - cp
        args:
        - -f
        - /etc/kube-flannel/cni-conf.json
        - /etc/cni/net.d/10-flannel.conflist
        volumeMounts:
        - name: cni
          mountPath: /etc/cni/net.d
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      containers:
      - name: kube-flannel
        image: quay.io/coreos/flannel:v0.11.0-ppc64le
        command:
        - /opt/bin/flanneld
        args:
        - --ip-masq
        - --kube-subnet-mgr
        resources:
          requests:
            cpu: "100m"
            memory: "50Mi"
          limits:
            cpu: "100m"
            memory: "50Mi"
        securityContext:
          privileged: false
          capabilities:
             add: ["NET_ADMIN"]
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        volumeMounts:
        - name: run
          mountPath: /run/flannel
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      volumes:
        - name: run
          hostPath:
            path: /run/flannel
        - name: cni
          hostPath:
            path: /etc/cni/net.d
        - name: flannel-cfg
          configMap:
            name: kube-flannel-cfg
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-flannel-ds-s390x
  namespace: kube-system
  labels:
    tier: node
    app: flannel
spec:
  selector:
    matchLabels:
      app: flannel
  template:
    metadata:
      labels:
        tier: node
        app: flannel
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: beta.kubernetes.io/os
                    operator: In
                    values:
                      - linux
                  - key: beta.kubernetes.io/arch
                    operator: In
                    values:
                      - s390x
      hostNetwork: true
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccountName: flannel
      initContainers:
      - name: install-cni
        image: quay.io/coreos/flannel:v0.11.0-s390x
        command:
        - cp
        args:
        - -f
        - /etc/kube-flannel/cni-conf.json
        - /etc/cni/net.d/10-flannel.conflist
        volumeMounts:
        - name: cni
          mountPath: /etc/cni/net.d
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      containers:
      - name: kube-flannel
        image: quay.io/coreos/flannel:v0.11.0-s390x
        command:
        - /opt/bin/flanneld
        args:
        - --ip-masq
        - --kube-subnet-mgr
        resources:
          requests:
            cpu: "100m"
            memory: "50Mi"
          limits:
            cpu: "100m"
            memory: "50Mi"
        securityContext:
          privileged: false
          capabilities:
             add: ["NET_ADMIN"]
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        volumeMounts:
        - name: run
          mountPath: /run/flannel
        - name: flannel-cfg
          mountPath: /etc/kube-flannel/
      volumes:
        - name: run
          hostPath:
            path: /run/flannel
        - name: cni
          hostPath:
            path: /etc/cni/net.d
        - name: flannel-cfg
          configMap:
            name: kube-flannel-cfg