install-anp.yaml

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kube-network-policies
rules:
  - apiGroups:
      - ""
    resources:
      - pods
      - namespaces
      - nodes
    verbs:
      - list
      - watch
  - apiGroups:
     - "networking.k8s.io"
    resources:
      - networkpolicies
    verbs:
      - list
      - watch
  - apiGroups:
     - "policy.networking.k8s.io"
    resources:
      - adminnetworkpolicies
      - baselineadminnetworkpolicies
    verbs:
      - list
      - watch
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kube-network-policies
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kube-network-policies
subjects:
- kind: ServiceAccount
  name: kube-network-policies
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kube-network-policies
  namespace: kube-system
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-network-policies
  namespace: kube-system
  labels:
    tier: node
    app: kube-network-policies
    k8s-app: kube-network-policies
spec:
  selector:
    matchLabels:
      app: kube-network-policies
  template:
    metadata:
      labels:
        tier: node
        app: kube-network-policies
        k8s-app: kube-network-policies
    spec:
      hostNetwork: true
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccountName: kube-network-policies
      containers:
      - name: kube-network-policies
        image: registry.k8s.io/networking/kube-network-policies:v0.6.0
        command: ["/bin/netpol"]
        args: ["-v=2", "-admin-network-policy=true", "-baseline-admin-network-policy=true","--hostname-override=$(MY_NODE_NAME)","--nfqueue-id=99"]
        volumeMounts:
        - name: lib-modules
          mountPath: /lib/modules
          readOnly: true
        resources:
          requests:
            cpu: "100m"
            memory: "50Mi"
        securityContext:
          privileged: true
          capabilities:
            add: ["NET_ADMIN"]
        env:
        - name: MY_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
      volumes:
      - name: lib-modules
        hostPath:
          path: /lib/modules
---