amf.yaml

################################################################################
# Licensed to the OpenAirInterface (OAI) Software Alliance under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The OpenAirInterface Software Alliance licenses this file to You under
# the terms found in the LICENSE file in the root of this source tree.
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#-------------------------------------------------------------------------------
# For more information about the OpenAirInterface (OAI) Software Alliance:
#      contact@openairinterface.org
##################################################################################
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: oaiops
  name: oai-amf-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: oai-amf-operator-cluster-role
rules:
  - apiGroups: [""]
    resources: [events]
    verbs: [create]
  - apiGroups: ["security.openshift.io"]
    resources: ["securitycontextconstraints"]
    resourceNames: ["anyuid"]
    verbs: [use]
  - apiGroups: [apiextensions.k8s.io]
    resources: [customresourcedefinitions]
    verbs: [get, list, watch, create, update, patch]
  - apiGroups: ["ref.nephio.org"]
    resources: [configs,config]
    verbs: [list, watch, update, patch, get]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: [roles,rolebindings]
    verbs: [get, create, delete, patch]
  - apiGroups: ["workload.nephio.org"]
    resources: [nfdeployments,nfdeployments/status,nfconfigs,nfdeployments/finalizers]
    verbs: [get, list, watch, update, patch]
  - apiGroups: [""]
    resources: [pods,serviceaccounts,configmaps,services,services/finalizers,serviceaccounts/finalizers]
    verbs:  [get, list, watch, create, update, patch, delete]
  - apiGroups: ["apps","extensions"]
    resources: [deployments,deployments/status,deployments/finalizers]
    verbs:  [get, list, watch, create, update, patch, delete]
  - apiGroups: ["k8s.cni.cncf.io"]
    resources: [network-attachment-definitions]
    verbs: [get, list, watch, create, update, patch, delete]
  - apiGroups: [""]
    resources: [namespaces]
    verbs: [list, watch]
  - apiGroups: [admissionregistration.k8s.io/v1, admissionregistration.k8s.io/v1beta1]
    resources: [validatingwebhookconfigurations, mutatingwebhookconfigurations]
    verbs: [create, patch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: oai-amf-operator-rolebinding-cluster
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: oai-amf-operator-cluster-role
subjects:
  - kind: ServiceAccount
    name: oai-amf-operator
    namespace: oaiops
## In case you want to restrict to a namespace uncomment this role and remove the rights from cluster role
#---
# apiVersion: rbac.authorization.k8s.io/v1
# kind: Role
# metadata:
#   namespace: oaiops
#   name: oai-amf-operator-role
# rules:
#   # Framework: posting the events about the handlers progress/errors.
#   - apiGroups: [""]
#     resources: [events]
#     verbs: [create]
#   - apiGroups: ["workload.nephio.org"]
#     resources: [nfdeployments,nfdeployments/status]
#     verbs: [list, watch, update, patch]
#   - apiGroups: [""]
#     resources: [pods, serviceaccounts, configmaps, services, persistentvolumeclaims]
#     verbs:  [get, list, watch, create, update, patch, delete]
#   - apiGroups: ["apps","extensions"]
#     resources: [deployments,deployments/status]
#     verbs:  [get, list, watch, create, update, patch, delete]
# ---
# apiVersion: rbac.authorization.k8s.io/v1
# kind: RoleBinding
# metadata:
#   namespace: oaiops
#   name: oai-amf-operator-rolebinding-namespaced
# roleRef:
#   apiGroup: rbac.authorization.k8s.io
#   kind: Role
#   name: oai-amf-operator-role
# subjects:
#   - kind: ServiceAccount
#     name: oai-amf-operator
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: oai-amf-op-conf
  namespace: oaiops
data:
  amf.yaml: |
    nad: 
      parent: 'eth0'
      create: False
    # these ports are here for creating the kube-svc should be same for the nf
    nfInterfaces:
      n2: 'n2'
      sbi: 'eth0'
    ports:
      - name: 'n2'
        port: 38412
        protocol: SCTP
      - name: 'http'
        port: 80
        protocol: TCP
    compute:
      req:
        cpu: '100m'
        memory: '512Mi'
      limits:
        cpu: '100m'
        memory: '512Mi'
    logLevel: info
    image: 'docker.io/oaisoftwarealliance/oai-amf:v2.0.1'
    fqdn:
      smf: 'oai-smf'
      ausf: 'oai-ausf'
      nrf: 'oai-nrf'
      udm: 'oai-udm'
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: oai-amf-nf-conf
  namespace: oaiops
data:
  amf.yaml: |
    # Log level for all the NFs
    log_level:
      amf: {{ conf['logLevel'] }}
    # If you enable registration, the other NFs will use the NRF discovery mechanism
    register_nf:
      amf: yes
    http_version: 2
    ## general single_nssai configuration
    ## Defines YAML anchors, which are reused in the config file
    snssais:
      {%- for i in conf['PLMN']['plmnInfo']%}
      {%- for s in i['nssai']%}
      - &slice_{{ i['nssai'].index(s) }}
        sst: {{ s['sst'] }}
        sd: {{ s['sd'] if 'sd' in s.keys() else 'FFFFFF' }}
      {%- endfor %}
      {%- endfor %}
    ############## SBI Interfaces
    nfs:
      amf:
        host: {{ conf['fqdn']['amf'] }}  #will be replaced by service name
        sbi:
          port: 80
          api_version: v1
          interface_name: {{ conf['nfInterfaces']['sbi'] }}
        n2:
          interface_name: {{ conf['nfInterfaces']['n2'] }}
          port: 38412
      smf:
        host: {{ conf['fqdn']['smf'] }}
        sbi:
          port: 80
          api_version: v1
      udm:
        host: {{ conf['fqdn']['udm'] }}
        sbi:
          port: 80
          api_version: v1
      ausf:
        host: {{ conf['fqdn']['ausf'] }}
        sbi:
          port: 80
          api_version: v1
      nrf:
        host: {{ conf['fqdn']['nrf'] }}
        sbi:
          port: 80
          api_version: v1
    ############## NF-specific configuration
    amf:
      amf_name: {{ conf['amfName'] }}
      # This really depends on if we want to keep the "mini" version or not
      support_features_options:
        enable_simple_scenario: no # "no" by default with the normal deployment scenarios with AMF/SMF/UPF/AUSF/UDM/UDR/NRF.
                                   # set it to "yes" to use with the minimalist deployment scenario (including only AMF/SMF/UPF) by using the internal AUSF/UDM implemented inside AMF.
                                   # There's no NRF in this scenario, SMF info is taken from "nfs" section.
        enable_nssf: no
        enable_smf_selection: yes
      relative_capacity: 30
      statistics_timer_interval: 20  # in seconds
      emergency_support: false
      served_guami_list:
      {%- for i in conf['ServedGUAMI']%}
        - mcc: {{ i['plmnID']['mcc'] }}
          mnc: {{ i['plmnID']['mnc'] }}
          amf_region_id: {{ i['amfID']['amfRegionID'] }}
          amf_set_id: {{ i['amfID']['amfSetID'] }}
          amf_pointer: {{ i['amfID']['amfPointer'] }}
      {%- endfor %}
      plmn_support_list:
      {%- for i in conf['PLMN']['plmnInfo']%}
        - mcc: {{ i['plmnID']['mcc'] }}
          mnc: {{ i['plmnID']['mnc'] }}
          tac: {{ i['tac'] }}
          nssai:
            {%- for x in i['nssai'] %}
            - *slice_{{ i['nssai'].index(x) }}
            {%- endfor %}
      {%- endfor %}
      supported_integrity_algorithms:
        - "NIA1"
        - "NIA2"
      supported_encryption_algorithms:
        - "NEA0"
        - "NEA1"
        - "NEA2"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: oai-amf-controller
  namespace: oaiops
  labels:
    app.kubernetes.io/name: oai-amf
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: oai-amf
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: oai-amf
    spec:
      securityContext:
        runAsGroup: 0
        runAsUser: 0
      containers:
      - name: amf-controller
        image: "docker.io/arorasagar/oai-amf-controller:v2.0.1"
        imagePullPolicy: Always
        env:
          - name: 'NF_TYPE'
            value: 'amf'
          - name: 'DEPLOYMENT_FETCH_INTERVAL'
            value: '1'
          - name: 'DEPLOYMENT_FETCH_ITERATIONS'
            value: '100'
          - name: 'NF_CONF_PATH'
            value: '/tmp/nf/amf.yaml'
          - name: 'OP_CONF_PATH'
            value: '/tmp/op/amf.yaml'
          - name: 'TESTING'
            value: 'no'
          - name: 'KUBERNETES_BASE_URL'
            value: 'https://kubernetes.default.svc'
        volumeMounts:
          - mountPath: /tmp/op
            name: opconf
          - mountPath: /tmp/nf
            name: nfconf
        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "100m"
        # livenessProbe:
        #   httpGet:
        #     path: /healthz
        #     port: 8080
        #   initialDelaySeconds: 2
        #   periodSeconds: 5
      volumes:
      - configMap:
          name: oai-amf-op-conf
        name: opconf
      - configMap:
          name: oai-amf-nf-conf
        name: nfconf
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      serviceAccountName: oai-amf-operator
      terminationGracePeriodSeconds: 5