terway-windows-eni.yml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: terway
  namespace: kube-system

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: terway-pod-reader
  namespace: kube-system
rules:
  - apiGroups: [ "" ]
    resources: [ "pods", "nodes", "namespaces", "configmaps", "serviceaccounts" ]
    verbs: [ "get", "watch", "list", "update" ]
  - apiGroups: [ "" ]
    resources:
      - events
    verbs:
      - create
  - apiGroups: [ "networking.k8s.io" ]
    resources:
      - networkpolicies
    verbs:
      - get
      - list
      - watch
  - apiGroups: [ "extensions" ]
    resources:
      - networkpolicies
    verbs:
      - get
      - list
      - watch
  - apiGroups: [ "" ]
    resources:
      - pods/status
    verbs:
      - update
  - apiGroups: [ "crd.projectcalico.org" ]
    resources: [ "*" ]
    verbs: [ "*" ]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: terway-binding
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: terway-pod-reader
subjects:
  - kind: ServiceAccount
    name: terway
    namespace: kube-system

---
kind: ConfigMap
apiVersion: v1
metadata:
  name: eni-config
  namespace: kube-system
data:
  eni_conf: |
    {
      "version": "1",
      "access_key": "ak",
      "access_secret": "sk",
      "service_cidr": "172.16.0.0/16",
      "security_group": "sg-xxxxxxxxxxx",
      "max_pool_size": 5,
      "min_pool_size": 0
    }
  10-terway.conf: |
    {
      "cniVersion": "0.4.0",
      "name": "terway",
      "type": "terway"
    }

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: terway-eni-windows
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: terway-eni-windows
  updateStrategy:
    type: OnDelete
  template:
    metadata:
      labels:
        app: terway-eni-windows
      annotations:
        priorityClassName: ""
    spec:
      terminationGracePeriodSeconds: 0
      tolerations:
        - operator: "Exists"
      serviceAccountName: terway
      hostNetwork: true
      priorityClassName: system-node-critical
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: type
                    operator: NotIn
                    values:
                      - virtual-kubelet
                  - key: kubernetes.io/os
                    operator: In
                    values:
                      - windows
                  - key: windows.alibabacloud.com/deployment-topology
                    operator: In
                    values:
                      - "2.0"
              - matchExpressions:
                  - key: type
                    operator: NotIn
                    values:
                      - virtual-kubelet
                  - key: kubernetes.io/os
                    operator: In
                    values:
                      - windows
                  - key: windows.alibabacloud.com/deployment-topology
                    operator: In
                    values:
                      - "2.0"
      containers:
        - name: terway
          command:
            - pwsh.exe
            - -NoLogo
            - -NonInteractive
            - -File
            - entrypoint.ps1
          env:
            - name: CLUSTER_SERVER
              value: 'https://192.168.0.155:6443'
            - name: BACKEND_TYPE
              value: "ENIOnly"
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: CONTAINER_NAME
              value: "terway"
          image: registry.aliyuncs.com/acs/terway:v1.2.3
          imagePullPolicy: Always
          resources:
            requests:
              cpu: "100m"
              memory: "100Mi"
            limits:
              cpu: "100m"
              memory: "256Mi"
          volumeMounts:
            - name: addon-token
              mountPath: 'c:/var/addon'
            - name: config
              mountPath: 'c:/etc/eni'
            - name: host-config
              mountPath: 'c:/host/etc/eni/'
            - name: host-binary
              mountPath: 'c:/host/opt/bin/'
            - name: host-cni-binary
              mountPath: 'c:/host/opt/cni/bin/'
            - name: host-cni-config
              mountPath: 'c:/host/etc/cni/net.d/'
            - name: project-run-eni
              mountPath: 'c:/var/run/eni/'
            - name: project-wins-pipe
              mountPath: \\.\pipe\rancher_wins
        # doesn't support NetworkPolicy in ENIOnly mode
      volumes:
        - name: addon-token
          secret:
            secretName: addon.network.token
            items:
              - key: addon.token.config
                path: token-config
        - name: config
          configMap:
            name: eni-config
            items:
              - key: eni_conf
                path: eni.json
              - key: 10-terway.conf
                path: 10-terway.conf
        - name: host-config
          hostPath:
            path: 'c:/etc/eni'
            type: DirectoryOrCreate
        - name: host-binary
          hostPath:
            path: 'c:/opt/bin'
            type: DirectoryOrCreate
        - name: host-cni-binary
          hostPath:
            path: 'c:/opt/cni/bin'
            type: DirectoryOrCreate
        - name: host-cni-config
          hostPath:
            path: 'c:/etc/cni/net.d'
            type: DirectoryOrCreate
        - name: project-run-eni
          hostPath:
            path: 'c:/var/run/eni'
            type: DirectoryOrCreate
        - name: project-wins-pipe
          hostPath:
            path: \\.\pipe\rancher_wins
            type: ''