---
kind: PodSecurityPolicy
metadata:
  annotations: {}
  labels:
    name: metallb-psp
  name: metallb-psp
spec:
  allowPrivilegeEscalation: false
  allowedCapabilities:
    - net_raw
  fsGroup:
    ranges:
      - max: 65535
        min: 1
    rule: MustRunAs
  hostIPC: false
  hostNetwork: true
  hostPID: false
  hostPorts:
    - max: 7472
      min: 7472
  privileged: false
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
    - ALL
  runAsGroup:
    rule: MustRunAsNonRoot
  runAsUser:
    rule: MustRunAsNonRoot
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    ranges:
      - max: 65535
        min: 1
    rule: MustRunAs
  volumes:
    - configMap
    - secret
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  annotations: {}
  labels:
    app: metallb
    name: metallb-system-speaker
  name: metallb-system:speaker
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - nodes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
    resourceNames:
      - metallb-psp
    resources:
      - podsecuritypolicies
    verbs:
      - use
---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations: {}
  labels:
    app: metallb
    name: metallb-speaker
  name: metallb-speaker
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  annotations: {}
  labels:
    app: metallb
    name: metallb-system-speaker
  name: metallb-system:speaker
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metallb-system:speaker
subjects:
  - kind: ServiceAccount
    name: metallb-speaker
    namespace: metallb-system
---
apiVersion: apps/v1beta2
kind: DaemonSet
metadata:
  annotations: {}
  labels:
    component: speaker
  name: speaker
  namespace: metallb-system
spec:
  selector:
    matchLabels:
      app: metallb
      component: speaker
  template:
    metadata:
      annotations: {}
      labels:
        app: metallb
        component: speaker
      namespace: metallb-system
    spec:
      containers:
        - args:
            - --port=7472
            - --config=config
          env:
            - name: METALLB_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
          image: metallb/speaker:v0.7.3
          imagePullPolicy: IfNotPresent
          name: speaker
          ports:
            - containerPort: 7472
              name: monitoring
          resources:
            limits:
              cpu: 100m
              memory: 100Mi
          securityContext:
            capabilities:
              add:
                - net_raw
            readOnlyRootFilesystem: true
            runAsUser: 1000
          stdin: false
          tty: false
          volumeMounts: []
      hostNetwork: true
      imagePullSecrets: []
      initContainers: []
      serviceAccountName: metallb-speaker
      terminationGracePeriodSeconds: 0
      volumes: []
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate