apiVersion: v1
kind: Namespace
metadata:
  labels:
    app: flow-aggregator
  name: flow-aggregator
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: flow-aggregator
  name: flow-aggregator
  namespace: flow-aggregator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: flow-aggregator
  name: flow-exporter-role
  namespace: flow-aggregator
rules:
- apiGroups:
  - ""
  resourceNames:
  - flow-aggregator-ca
  resources:
  - configmaps
  verbs:
  - get
- apiGroups:
  - ""
  resourceNames:
  - flow-aggregator-client-tls
  resources:
  - secrets
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: flow-aggregator
  name: flow-aggregator-role
rules:
- apiGroups:
  - ""
  resourceNames:
  - flow-aggregator-ca
  resources:
  - configmaps
  verbs:
  - get
  - update
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
- apiGroups:
  - ""
  resourceNames:
  - flow-aggregator-client-tls
  resources:
  - secrets
  verbs:
  - get
  - update
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: flow-aggregator
  name: flow-exporter-role-binding
  namespace: flow-aggregator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: flow-exporter-role
subjects:
- kind: ServiceAccount
  name: antrea-agent
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: flow-aggregator
  name: flow-aggregator-cluster-id-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: antrea-cluster-identity-reader
subjects:
- kind: ServiceAccount
  name: flow-aggregator
  namespace: flow-aggregator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: flow-aggregator
  name: flow-aggregator-cluster-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: flow-aggregator-role
subjects:
- kind: ServiceAccount
  name: flow-aggregator
  namespace: flow-aggregator
---
apiVersion: v1
data:
  flow-aggregator.conf: |
    # Provide the flow collector address as string with format <IP>:<port>[:<proto>], where proto is tcp or udp.
    # If no L4 transport proto is given, we consider tcp as default.
    #externalFlowCollectorAddr: ""

    # Provide the active flow record timeout as a duration string. This determines
    # how often the flow aggregator exports the active flow records to the flow
    # collector. Thus, for flows with a continuous stream of packets, a flow record
    # will be exported to the collector once the elapsed time since the last export
    # event in the flow aggregator is equal to the value of this timeout.
    # Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
    #activeFlowRecordTimeout: 60s

    # Provide the inactive flow record timeout as a duration string. This determines
    # how often the flow aggregator exports the inactive flow records to the flow
    # collector. A flow record is considered to be inactive if no matching record
    # has been received by the flow aggregator in the specified interval.
    # Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
    #inactiveFlowRecordTimeout: 90s

    # Provide the transport protocol for the flow aggregator collecting process, which is tls, tcp or udp.
    #aggregatorTransportProtocol: "tls"

    # Provide DNS name or IP address of flow aggregator for generating TLS certificate. It must match
    # the flowCollectorAddr parameter in the antrea-agent config.
    #flowAggregatorAddress: "flow-aggregator.flow-aggregator.svc"

    # Provide the 32-bit Observation Domain ID which will uniquely identify this instance of the flow
    # aggregator to an external flow collector. If omitted, an Observation Domain ID will be generated
    # from the persistent cluster UUID generated by Antrea. Failing that (e.g. because the cluster UUID
    # is not available), a value will be randomly generated, which may vary across restarts of the flow
    # aggregator.
    #observationDomainID:

    # Provide format for records sent to the configured flow collector.
    # Supported formats are IPFIX and JSON.
    #recordFormat: "IPFIX"

    # recordContents enables configuring some fields in the flow records, A field can
    # be either included (true) or excluded (false) by providing a bool value.
    recordContents:
      # Determine whether source and destination Pod labels will be included in the flow records.
      #podLabels: false
kind: ConfigMap
metadata:
  annotations: {}
  labels:
    app: flow-aggregator
  name: flow-aggregator-configmap-5df2dmbm8h
  namespace: flow-aggregator
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: flow-aggregator
  name: flow-aggregator
  namespace: flow-aggregator
spec:
  ports:
  - name: ipfix-udp
    port: 4739
    protocol: UDP
    targetPort: 4739
  - name: ipfix-tcp
    port: 4739
    protocol: TCP
    targetPort: 4739
  selector:
    app: flow-aggregator
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: flow-aggregator
  name: flow-aggregator
  namespace: flow-aggregator
spec:
  replicas: 1
  selector:
    matchLabels:
      app: flow-aggregator
  template:
    metadata:
      labels:
        app: flow-aggregator
    spec:
      containers:
      - args:
        - --config
        - /etc/flow-aggregator/flow-aggregator.conf
        - --logtostderr=false
        - --log_dir=/var/log/antrea/flow-aggregator
        - --alsologtostderr
        - --log_file_max_size=100
        - --log_file_max_num=4
        - --v=0
        image: projects.registry.vmware.com/antrea/flow-aggregator:latest
        imagePullPolicy: IfNotPresent
        name: flow-aggregator
        ports:
        - containerPort: 4739
        volumeMounts:
        - mountPath: /etc/flow-aggregator/flow-aggregator.conf
          name: flow-aggregator-config
          readOnly: true
          subPath: flow-aggregator.conf
        - mountPath: /var/log/antrea/flow-aggregator
          name: host-var-log-antrea-flow-aggregator
      nodeSelector:
        kubernetes.io/arch: amd64
        kubernetes.io/os: linux
      serviceAccountName: flow-aggregator
      volumes:
      - configMap:
          name: flow-aggregator-configmap-5df2dmbm8h
        name: flow-aggregator-config
      - hostPath:
          path: /var/log/antrea/flow-aggregator
          type: DirectoryOrCreate
        name: host-var-log-antrea-flow-aggregator