Template CCM chart to run it as remote container

deploy/chart/templates/clusterrole-rbac.yaml

@@ -1,3 +1,5 @@
+{{- $rbac := .Values.rbac | default dict }}
+{{- if or (eq $rbac.enabled true ) (eq $rbac.enabled nil ) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -38,3 +40,4 @@ rules:
     resources: ["ciliumbgppeeringpolicies"]
     verbs: ["get", "watch", "list", "create"]
 {{- end }}
+{{- end }}

deploy/chart/templates/clusterrolebinding-rbac.yaml

@@ -1,3 +1,5 @@
+{{- $rbac := .Values.rbac | default dict }}
+{{- if or (eq $rbac.enabled true ) (eq $rbac.enabled nil ) }}
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
@@ -10,3 +12,4 @@ subjects:
   - kind: ServiceAccount
     name: ccm-linode
     namespace: {{ required ".Values.namespace required" .Values.namespace }}
+{{- end }}

deploy/chart/templates/daemonset.yaml

@@ -9,6 +9,10 @@ spec:
   selector:
     matchLabels:
       app: ccm-linode
+  {{- with .Values.updateStrategy }}
+  updateStrategy: 
+  {{- toYaml . | nindent 4 }}
+  {{- end }}
   template:
     metadata:
       labels:
@@ -31,14 +35,14 @@ spec:
       tolerations:
       {{- toYaml . | nindent 8 }}
       {{- end }}
-      hostNetwork: true
+      hostNetwork: {{ default true .Values.enableHostNetwork }}
       containers:
         - image: {{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           name: ccm-linode
           args:
             - --leader-elect-resource-lock=leases
-            - --v=3
+            - --v={{ default 2 .Values.logVerbosity }}
             - --secure-port=10253
             - --webhook-secure-port=0
             {{- with .Values.linodegoDebug }}
@@ -106,10 +110,21 @@ spec:
             {{- if .Values.nodeBalancerBackendIPv4Subnet }}
             - --nodebalancer-backend-ipv4-subnet={{ .Values.nodeBalancerBackendIPv4Subnet }}
             {{- end }}
+            {{- if .Values.extraArgs }}
+            {{- toYaml .Values.extraArgs | nindent 12 }}
+            {{- end }}
           {{- with .Values.containerSecurityContext }}
           securityContext:
           {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe: 
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.livenessProbe }}
+          livenessProbe: 
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
           {{- with .Values.resources }}
           resources: 
           {{- toYaml . | nindent 12 }}
@@ -135,9 +150,13 @@ spec:
             {{- toYaml . | nindent 12 }}
             {{- end}}
       volumes:
+        {{- if .Values.k8sVolume }}
+        {{- toYaml .Values.k8sVolume | nindent 8 }}
+        {{- else }}
         - name: k8s
           hostPath:
             path: /etc/kubernetes
+        {{- end }}
         {{- with .Values.volumes}}
         {{- toYaml . | nindent 8 }}
         {{- end}}

deploy/chart/templates/serviceaccount.yaml

@@ -1,5 +1,8 @@
+{{- $rbac := .Values.rbac | default dict }}
+{{- if or (eq $rbac.enabled true ) (eq $rbac.enabled nil ) }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: ccm-linode
   namespace: {{ required ".Values.namespace required" .Values.namespace }}
+{{- end }}

deploy/chart/values.yaml

@@ -1,8 +1,8 @@
 # apiToken [Required if secretRef is not set] - Must be a Linode APIv4 Personal Access Token with all permissions. (https://cloud.linode.com/profile/tokens)
-apiToken: ""
+apiToken: "qwe"
 
 # region [Required if secretRef is not set] - Must be a Linode region. (https://api.linode.com/v4/regions)
-region: ""
+region: "qwe"
 
 # Set these values if your APIToken and region are already present in a k8s secret.
 # secretRef:
@@ -124,4 +124,45 @@ resources:
   #   cpu: "1000m"
 
 # This flag allows to scrape /metrics endpoint without authorization
-allowUnauthorizedMetrics: false
+# allowUnauthorizedMetrics: false
+
+# enables host network
+# enableHostNetwork: false 
+
+# specify the update strategy
+# updateStrategy:
+#   type: RollingUpdate
+#   rollingUpdate:
+#     maxUnavailable: 25%
+
+# log verbosity of the CCM
+# logVerbosity: 3
+
+# set the liveness and readiness probes
+# livenessProbe:
+#   tcpSocket:
+#     port: 10253
+#   initialDelaySeconds: 15
+#   timeoutSeconds: 15
+#   failureThreshold: 8
+
+# readinessProbe:
+#   tcpSocket:
+#     port: 10253
+#   initialDelaySeconds: 15
+#   timeoutSeconds: 15
+#   failureThreshold: 8
+
+# set extra arguments to the CCM container.
+# extraArgs:
+# - --kubeconfig=/etc/kubernetes/value
+
+# add toggle to rbac, useful when running CCM outside a cluster
+# rbac:
+#   enabled: true
+
+# template kubeconfig volume
+# k8sVolume: 
+# - name: k8s
+#   hostPath:
+#     path: /etc/kubeconfig