{#
Copyright 2019 Nokia

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
#}
---
apiVersion: v1
kind: Pod
metadata:
  name: kube-proxy
  namespace: kube-system
spec:
  hostNetwork: true
  containers:
    - name: kube-proxy
      image: {{ container_image_names | select('search', '/hyperkube') | list | last }}
      securityContext:
        privileged: true
      command:
        - "/kube-proxy"
        - "--kubeconfig=/etc/kubernetes/kubeconfig/proxyc.yml"
        - "--bind-address={{ networking.infra_internal.ip }}"
        - "--hostname-override={{ networking.infra_internal.ip }}"
        - "--masquerade-all=true"
      resources:
        requests:
          cpu: "10m"
      volumeMounts:
        - name: time-mount
          mountPath: /etc/localtime
          readOnly: true
        - name: secret-kubernetes
          mountPath: /etc/kubernetes/ssl
          readOnly: true
        - name: secret-root-ca
          mountPath: /etc/openssl/ca.pem
          readOnly: true
        - name: kubeconfig
          mountPath: /etc/kubernetes/kubeconfig
          readOnly: true
  volumes:
    - name: time-mount
      hostPath:
        path: /etc/localtime
    - name: secret-kubernetes
      hostPath:
        path: /etc/kubernetes/ssl
    - name: secret-root-ca
      hostPath:
        path: /etc/openssl/ca.pem
    - name: kubeconfig
      hostPath:
        path: /etc/kubernetes/kubeconfig