Last active
April 26, 2020 00:13
-
-
Save iceman91176/80edd9a0d517d3a448139958d59969b7 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # Source: calico/templates/calico-config.yaml | |
| # This ConfigMap is used to configure a self-hosted Calico installation. | |
| kind: ConfigMap | |
| apiVersion: v1 | |
| metadata: | |
| name: calico-config | |
| namespace: kube-system | |
| data: | |
| # Typha is disabled. | |
| typha_service_name: "none" | |
| # Configure the backend to use. | |
| calico_backend: "bird" | |
| # Configure the MTU to use | |
| veth_mtu: "1440" | |
| # The CNI network configuration to install on each node. The special | |
| # values in this config will be automatically populated. | |
| cni_network_config: |- | |
| { | |
| "name": "k8s-pod-network", | |
| "cniVersion": "0.3.1", | |
| "plugins": [ | |
| { | |
| "type": "calico", | |
| "log_level": "info", | |
| "datastore_type": "kubernetes", | |
| "nodename": "__KUBERNETES_NODE_NAME__", | |
| "mtu": __CNI_MTU__, | |
| "ipam": { | |
| "type": "calico-ipam" | |
| }, | |
| "policy": { | |
| "type": "k8s" | |
| }, | |
| "kubernetes": { | |
| "kubeconfig": "__KUBECONFIG_FILEPATH__" | |
| } | |
| }, | |
| { | |
| "type": "portmap", | |
| "snat": true, | |
| "capabilities": {"portMappings": true} | |
| } | |
| ] | |
| } | |
| --- | |
| # Source: calico/templates/kdd-crds.yaml | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: felixconfigurations.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: FelixConfiguration | |
| plural: felixconfigurations | |
| singular: felixconfiguration | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: ipamblocks.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: IPAMBlock | |
| plural: ipamblocks | |
| singular: ipamblock | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: blockaffinities.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: BlockAffinity | |
| plural: blockaffinities | |
| singular: blockaffinity | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: ipamhandles.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: IPAMHandle | |
| plural: ipamhandles | |
| singular: ipamhandle | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: ipamconfigs.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: IPAMConfig | |
| plural: ipamconfigs | |
| singular: ipamconfig | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: bgppeers.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: BGPPeer | |
| plural: bgppeers | |
| singular: bgppeer | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: bgpconfigurations.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: BGPConfiguration | |
| plural: bgpconfigurations | |
| singular: bgpconfiguration | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: ippools.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: IPPool | |
| plural: ippools | |
| singular: ippool | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: hostendpoints.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: HostEndpoint | |
| plural: hostendpoints | |
| singular: hostendpoint | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: clusterinformations.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: ClusterInformation | |
| plural: clusterinformations | |
| singular: clusterinformation | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: globalnetworkpolicies.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: GlobalNetworkPolicy | |
| plural: globalnetworkpolicies | |
| singular: globalnetworkpolicy | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: globalnetworksets.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: GlobalNetworkSet | |
| plural: globalnetworksets | |
| singular: globalnetworkset | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: networkpolicies.crd.projectcalico.org | |
| spec: | |
| scope: Namespaced | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: NetworkPolicy | |
| plural: networkpolicies | |
| singular: networkpolicy | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: networksets.crd.projectcalico.org | |
| spec: | |
| scope: Namespaced | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: NetworkSet | |
| plural: networksets | |
| singular: networkset | |
| --- | |
| # Source: calico/templates/rbac.yaml | |
| # Include a clusterrole for the kube-controllers component, | |
| # and bind it to the calico-kube-controllers serviceaccount. | |
| kind: ClusterRole | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| metadata: | |
| name: calico-kube-controllers | |
| rules: | |
| # Nodes are watched to monitor for deletions. | |
| - apiGroups: [""] | |
| resources: | |
| - nodes | |
| verbs: | |
| - watch | |
| - list | |
| - get | |
| # Pods are queried to check for existence. | |
| - apiGroups: [""] | |
| resources: | |
| - pods | |
| verbs: | |
| - get | |
| # IPAM resources are manipulated when nodes are deleted. | |
| - apiGroups: ["crd.projectcalico.org"] | |
| resources: | |
| - ippools | |
| verbs: | |
| - list | |
| - apiGroups: ["crd.projectcalico.org"] | |
| resources: | |
| - blockaffinities | |
| - ipamblocks | |
| - ipamhandles | |
| verbs: | |
| - get | |
| - list | |
| - create | |
| - update | |
| - delete | |
| # Needs access to update clusterinformations. | |
| - apiGroups: ["crd.projectcalico.org"] | |
| resources: | |
| - clusterinformations | |
| verbs: | |
| - get | |
| - create | |
| - update | |
| --- | |
| kind: ClusterRoleBinding | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| metadata: | |
| name: calico-kube-controllers | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: calico-kube-controllers | |
| subjects: | |
| - kind: ServiceAccount | |
| name: calico-kube-controllers | |
| namespace: kube-system | |
| --- | |
| # Include a clusterrole for the calico-node DaemonSet, | |
| # and bind it to the calico-node serviceaccount. | |
| kind: ClusterRole | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| metadata: | |
| name: calico-node | |
| rules: | |
| # The CNI plugin needs to get pods, nodes, and namespaces. | |
| - apiGroups: [""] | |
| resources: | |
| - pods | |
| - nodes | |
| - namespaces | |
| verbs: | |
| - get | |
| - apiGroups: [""] | |
| resources: | |
| - endpoints | |
| - services | |
| verbs: | |
| # Used to discover service IPs for advertisement. | |
| - watch | |
| - list | |
| # Used to discover Typhas. | |
| - get | |
| - apiGroups: [""] | |
| resources: | |
| - nodes/status | |
| verbs: | |
| # Needed for clearing NodeNetworkUnavailable flag. | |
| - patch | |
| # Calico stores some configuration information in node annotations. | |
| - update | |
| # Watch for changes to Kubernetes NetworkPolicies. | |
| - apiGroups: ["networking.k8s.io"] | |
| resources: | |
| - networkpolicies | |
| verbs: | |
| - watch | |
| - list | |
| # Used by Calico for policy information. | |
| - apiGroups: [""] | |
| resources: | |
| - pods | |
| - namespaces | |
| - serviceaccounts | |
| verbs: | |
| - list | |
| - watch | |
| # The CNI plugin patches pods/status. | |
| - apiGroups: [""] | |
| resources: | |
| - pods/status | |
| verbs: | |
| - patch | |
| # Calico monitors various CRDs for config. | |
| - apiGroups: ["crd.projectcalico.org"] | |
| resources: | |
| - globalfelixconfigs | |
| - felixconfigurations | |
| - bgppeers | |
| - globalbgpconfigs | |
| - bgpconfigurations | |
| - ippools | |
| - ipamblocks | |
| - globalnetworkpolicies | |
| - globalnetworksets | |
| - networkpolicies | |
| - networksets | |
| - clusterinformations | |
| - hostendpoints | |
| - blockaffinities | |
| verbs: | |
| - get | |
| - list | |
| - watch | |
| # Calico must create and update some CRDs on startup. | |
| - apiGroups: ["crd.projectcalico.org"] | |
| resources: | |
| - ippools | |
| - felixconfigurations | |
| - clusterinformations | |
| verbs: | |
| - create | |
| - update | |
| # Calico stores some configuration information on the node. | |
| - apiGroups: [""] | |
| resources: | |
| - nodes | |
| verbs: | |
| - get | |
| - list | |
| - watch | |
| # These permissions are only requried for upgrade from v2.6, and can | |
| # be removed after upgrade or on fresh installations. | |
| - apiGroups: ["crd.projectcalico.org"] | |
| resources: | |
| - bgpconfigurations | |
| - bgppeers | |
| verbs: | |
| - create | |
| - update | |
| # These permissions are required for Calico CNI to perform IPAM allocations. | |
| - apiGroups: ["crd.projectcalico.org"] | |
| resources: | |
| - blockaffinities | |
| - ipamblocks | |
| - ipamhandles | |
| verbs: | |
| - get | |
| - list | |
| - create | |
| - update | |
| - delete | |
| - apiGroups: ["crd.projectcalico.org"] | |
| resources: | |
| - ipamconfigs | |
| verbs: | |
| - get | |
| # Block affinities must also be watchable by confd for route aggregation. | |
| - apiGroups: ["crd.projectcalico.org"] | |
| resources: | |
| - blockaffinities | |
| verbs: | |
| - watch | |
| # The Calico IPAM migration needs to get daemonsets. These permissions can be | |
| # removed if not upgrading from an installation using host-local IPAM. | |
| - apiGroups: ["apps"] | |
| resources: | |
| - daemonsets | |
| verbs: | |
| - get | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: calico-node | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: calico-node | |
| subjects: | |
| - kind: ServiceAccount | |
| name: calico-node | |
| namespace: kube-system | |
| --- | |
| apiVersion: v1 | |
| data: | |
| bird_ipam.cfg.template: |- | |
| # Generated by confd | |
| # Getting IP from etcd /host/NODENAME/ip_addr_v4 fails,so take it from CALICO_ROUTER_ID | |
| {{- $node_ip := getenv "CALICO_ROUTER_ID"}} | |
| function fix_next_hop () | |
| { | |
| {{if eq "" ($node_ip) -}} | |
| # No Node-IP found in ENV CALICO_ROUTER_ID - cannot fix next-hop | |
| {{- else -}} | |
| if bgp_next_hop ~ [127.0.0.1] then { | |
| bgp_next_hop = {{ $node_ip}}; | |
| } {{- end }} | |
| #accept; | |
| } | |
| filter calico_export_to_bgp_peers { | |
| calico_aggr(); | |
| fix_next_hop(); | |
| {{- $static_key := "/staticroutes"}} | |
| {{- if ls $static_key}} | |
| # Export static routes. | |
| {{- range ls $static_key}} | |
| {{- $parts := split . "-"}} | |
| {{- $cidr := join $parts "/"}} | |
| if ( net ~ {{$cidr}} ) then { accept; } | |
| {{- end}} | |
| {{- end}} | |
| {{range ls "/v1/ipam/v4/pool"}}{{$data := json (getv (printf "/v1/ipam/v4/pool/%s" .))}} | |
| if ( net ~ {{$data.cidr}} ) then { | |
| accept; | |
| } | |
| {{- end}} | |
| reject; | |
| } | |
| {{$network_key := printf "/bgp/v1/host/%s/network_v4" (getenv "NODENAME")}} | |
| filter calico_kernel_programming { | |
| {{- $reject_key := "/rejectcidrs"}} | |
| {{- if ls $reject_key}} | |
| # Don't program static routes into kernel. | |
| {{- range ls $reject_key}} | |
| {{- $parts := split . "-"}} | |
| {{- $cidr := join $parts "/"}} | |
| if ( net ~ {{$cidr}} ) then { reject; } | |
| {{- end}} | |
| {{- end}} | |
| {{- if exists $network_key}}{{$network := getv $network_key}} | |
| {{range ls "/v1/ipam/v4/pool"}}{{$data := json (getv (printf "/v1/ipam/v4/pool/%s" .))}} | |
| if ( net ~ {{$data.cidr}} ) then { | |
| {{- if $data.vxlan_mode}} | |
| # Don't program VXLAN routes into the kernel - these are handled by Felix. | |
| reject; | |
| } | |
| {{- else if $data.ipip_mode}}{{if eq $data.ipip_mode "cross-subnet"}} | |
| if defined(bgp_next_hop) && ( bgp_next_hop ~ {{$network}} ) then | |
| krt_tunnel = ""; {{- /* Destination in ipPool, mode is cross sub-net, route from-host on subnet, do not use IPIP */}} | |
| else | |
| krt_tunnel = "{{$data.ipip}}"; {{- /* Destination in ipPool, mode is cross sub-net, route from-host off subnet, set the tunnel (if IPIP not enabled, value will be "") */}} | |
| accept; | |
| } {{- else}} | |
| krt_tunnel = "{{$data.ipip}}"; {{- /* Destination in ipPool, mode not cross sub-net, set the tunnel (if IPIP not enabled, value will be "") */}} | |
| accept; | |
| } {{- end}} {{- else}} | |
| krt_tunnel = "{{$data.ipip}}"; {{- /* Destination in ipPool, mode field is not present, set the tunnel (if IPIP not enabled, value will be "") */}} | |
| accept; | |
| } {{- end}} | |
| {{end}} | |
| {{- end}}{{/* End of 'exists $network_key' */}} | |
| accept; {{- /* Destination is not in any ipPool, accept */}} | |
| } | |
| bird.cfg.template: |- | |
| # Generated by confd | |
| include "bird_aggr.cfg"; | |
| include "bird_ipam.cfg"; | |
| {{- $node_ip_key := printf "/host/%s/ip_addr_v4" (getenv "NODENAME")}}{{$node_ip := getv $node_ip_key}} | |
| {{- $router_id := getenv "CALICO_ROUTER_ID" ""}} | |
| {{- $node_name := getenv "NODENAME"}} | |
| router id {{if eq "hash" ($router_id) -}} | |
| {{hashToIPv4 $node_name}}; | |
| {{- else -}} | |
| {{if ne "" ($router_id)}}{{$router_id}}{{else}}{{$node_ip}}{{end}}; | |
| {{- end}} | |
| {{- define "LOGGING"}} | |
| {{- $node_logging_key := printf "/host/%s/loglevel" (getenv "NODENAME")}} | |
| {{- if exists $node_logging_key}} | |
| {{- $logging := getv $node_logging_key}} | |
| {{- if eq $logging "debug"}} | |
| debug all; | |
| {{- else if ne $logging "none"}} | |
| debug { states }; | |
| {{- end}} | |
| {{- else if exists "/global/loglevel"}} | |
| {{- $logging := getv "/global/loglevel"}} | |
| {{- if eq $logging "debug"}} | |
| debug all; | |
| {{- else if ne $logging "none"}} | |
| debug { states }; | |
| {{- end}} | |
| {{- else}} | |
| debug { states }; | |
| {{- end}} | |
| {{- end}} | |
| # Configure synchronization between routing tables and kernel. | |
| protocol kernel { | |
| learn; # Learn all alien routes from the kernel | |
| persist; # Don't remove routes on bird shutdown | |
| scan time 2; # Scan kernel routing table every 2 seconds | |
| import all; | |
| export filter calico_kernel_programming; # Default is export none | |
| graceful restart; # Turn on graceful restart to reduce potential flaps in | |
| # routes when reloading BIRD configuration. With a full | |
| # automatic mesh, there is no way to prevent BGP from | |
| # flapping since multiple nodes update their BGP | |
| # configuration at the same time, GR is not guaranteed to | |
| # work correctly in this scenario. | |
| } | |
| # Watch interface up/down events. | |
| protocol device { | |
| {{- template "LOGGING"}} | |
| scan time 2; # Scan interfaces every 2 seconds | |
| } | |
| protocol direct { | |
| {{- template "LOGGING"}} | |
| interface -"cali*", "*"; # Exclude cali* but include everything else. | |
| } | |
| {{if eq "" ($node_ip)}}# IPv4 disabled on this node. | |
| {{else}}{{$node_as_key := printf "/host/%s/as_num" (getenv "NODENAME")}} | |
| # Template for all BGP clients | |
| template bgp bgp_template { | |
| {{- $as_key := or (and (exists $node_as_key) $node_as_key) "/global/as_num"}} | |
| {{- $node_as_num := getv $as_key}} | |
| {{- template "LOGGING"}} | |
| description "Connection to BGP peer"; | |
| local as {{$node_as_num}}; | |
| multihop; | |
| gateway recursive; # This should be the default, but just in case. | |
| import all; # Import all routes, since we don't know what the upstream | |
| # topology is and therefore have to trust the ToR/RR. | |
| export filter calico_export_to_bgp_peers; # Only want to export routes for workloads. | |
| source address {{$node_ip}}; # The local address we use for the TCP connection | |
| add paths on; | |
| graceful restart; # See comment in kernel section about graceful restart. | |
| connect delay time 2; | |
| connect retry time 5; | |
| error wait time 5,30; | |
| } | |
| # ------------- Node-to-node mesh ------------- | |
| {{- $node_cid_key := printf "/host/%s/rr_cluster_id" (getenv "NODENAME")}} | |
| {{- $node_cluster_id := getv $node_cid_key}} | |
| {{- if ne "" ($node_cluster_id)}} | |
| # This node is configured as a route reflector with cluster ID {{$node_cluster_id}}; | |
| # ignore node-to-node mesh setting. | |
| {{- else}} | |
| {{if (json (getv "/global/node_mesh")).enabled}} | |
| {{range $host := lsdir "/host"}} | |
| {{$onode_as_key := printf "/host/%s/as_num" .}} | |
| {{$onode_ip_key := printf "/host/%s/ip_addr_v4" .}}{{if exists $onode_ip_key}}{{$onode_ip := getv $onode_ip_key}} | |
| {{$nums := split $onode_ip "."}}{{$id := join $nums "_"}} | |
| # For peer {{$onode_ip_key}} | |
| {{if eq $onode_ip ($node_ip) }}# Skipping ourselves ({{$node_ip}}) | |
| {{else if ne "" $onode_ip}}protocol bgp Mesh_{{$id}} from bgp_template { | |
| neighbor {{$onode_ip}} as {{if exists $onode_as_key}}{{getv $onode_as_key}}{{else}}{{getv "/global/as_num"}}{{end}}; | |
| {{- /* | |
| Make the peering unidirectional. This avoids a race where | |
| - peer A opens a connection and begins a graceful restart | |
| - before the restart completes, peer B opens its connection | |
| - peer A sees the new connection and aborts the graceful restart, causing a route flap. | |
| */ -}} | |
| {{if gt $onode_ip $node_ip}} | |
| passive on; # Mesh is unidirectional, peer will connect to us. | |
| {{- end}} | |
| }{{end}}{{end}}{{end}} | |
| {{else}} | |
| # Node-to-node mesh disabled | |
| {{end}} | |
| {{- end}} | |
| # ------------- Global peers ------------- | |
| {{if ls "/global/peer_v4"}} | |
| {{range gets "/global/peer_v4/*"}}{{$data := json .Value}} | |
| {{$nums := split $data.ip "."}}{{$id := join $nums "_"}} | |
| # For peer {{.Key}} | |
| {{- if eq $data.ip ($node_ip) }} | |
| # Skipping ourselves ({{$node_ip}}) | |
| {{- else}} | |
| protocol bgp Global_{{$id}} from bgp_template { | |
| {{if eq $data.ip ("127.0.0.1")}}passive on; # Don't talk to yourself{{end}} | |
| neighbor {{$data.ip}} as {{$data.as_num}}; | |
| {{- if and (eq $data.as_num $node_as_num) (ne "" ($node_cluster_id)) (ne $data.rr_cluster_id ($node_cluster_id))}} | |
| rr client; | |
| rr cluster id {{$node_cluster_id}}; | |
| {{- end}} | |
| } | |
| {{- end}} | |
| {{end}} | |
| {{else}}# No global peers configured.{{end}} | |
| # ------------- Node-specific peers ------------- | |
| {{$node_peers_key := printf "/host/%s/peer_v4" (getenv "NODENAME")}} | |
| {{if ls $node_peers_key}} | |
| {{range gets (printf "%s/*" $node_peers_key)}}{{$data := json .Value}} | |
| {{$nums := split $data.ip "."}}{{$id := join $nums "_"}} | |
| # For peer {{.Key}} | |
| {{- if eq $data.ip ($node_ip) }} | |
| # Skipping ourselves ({{$node_ip}}) | |
| {{- else}} | |
| protocol bgp Node_{{$id}} from bgp_template { | |
| {{if eq $data.ip ("127.0.0.1")}}passive on; # Don't talk to yourself{{end}} | |
| neighbor {{$data.ip}} as {{$data.as_num}}; | |
| {{- if and (eq $data.as_num $node_as_num) (ne "" ($node_cluster_id)) (ne $data.rr_cluster_id ($node_cluster_id))}} | |
| rr client; | |
| rr cluster id {{$node_cluster_id}}; | |
| {{- end}} | |
| } | |
| {{- end}} | |
| {{end}} | |
| {{else}}# No node-specific peers configured.{{end}} | |
| {{end}}{{/* End of IPv4 enable check */}} | |
| kind: ConfigMap | |
| metadata: | |
| annotations: | |
| creationTimestamp: ~ | |
| name: calico-metallb-config | |
| namespace: kube-system | |
| --- | |
| # Source: calico/templates/calico-node.yaml | |
| # This manifest installs the calico-node container, as well | |
| # as the CNI plugins and network config on | |
| # each master and worker node in a Kubernetes cluster. | |
| apiVersion: extensions/v1beta1 | |
| kind: DaemonSet | |
| metadata: | |
| labels: | |
| k8s-app: calico-node | |
| name: calico-node | |
| namespace: kube-system | |
| spec: | |
| revisionHistoryLimit: 10 | |
| selector: | |
| matchLabels: | |
| k8s-app: calico-node | |
| template: | |
| metadata: | |
| annotations: | |
| scheduler.alpha.kubernetes.io/critical-pod: "" | |
| creationTimestamp: null | |
| labels: | |
| k8s-app: calico-node | |
| spec: | |
| containers: | |
| - env: | |
| - name: DATASTORE_TYPE | |
| value: kubernetes | |
| - name: WAIT_FOR_DATASTORE | |
| value: "true" | |
| - name: NO_DEFAULT_POOLS | |
| value: "true" | |
| - name: NODENAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: spec.nodeName | |
| - name: CALICO_ROUTER_ID | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: status.podIP | |
| - name: CALICO_NETWORKING_BACKEND | |
| valueFrom: | |
| configMapKeyRef: | |
| key: calico_backend | |
| name: calico-config | |
| - name: CLUSTER_TYPE | |
| value: k8s,bgp | |
| - name: IP | |
| value: autodetect | |
| - name: CALICO_IPV4POOL_IPIP | |
| value: Never | |
| - name: FELIX_IPINIPMTU | |
| valueFrom: | |
| configMapKeyRef: | |
| key: veth_mtu | |
| name: calico-config | |
| - name: CALICO_IPV4POOL_CIDR | |
| value: 10.113.0.0/16 | |
| - name: CALICO_DISABLE_FILE_LOGGING | |
| value: "true" | |
| - name: FELIX_DEFAULTENDPOINTTOHOSTACTION | |
| value: ACCEPT | |
| - name: FELIX_IPV6SUPPORT | |
| value: "false" | |
| - name: FELIX_LOGSEVERITYSCREEN | |
| value: info | |
| - name: FELIX_HEALTHENABLED | |
| value: "true" | |
| image: calico/node:v3.11.2 | |
| imagePullPolicy: IfNotPresent | |
| livenessProbe: | |
| exec: | |
| command: | |
| - /bin/calico-node | |
| - -felix-live | |
| - -bird-live | |
| failureThreshold: 6 | |
| initialDelaySeconds: 10 | |
| periodSeconds: 10 | |
| successThreshold: 1 | |
| timeoutSeconds: 1 | |
| name: calico-node | |
| readinessProbe: | |
| exec: | |
| command: | |
| - /bin/calico-node | |
| - -felix-ready | |
| - -bird-ready | |
| failureThreshold: 3 | |
| periodSeconds: 10 | |
| successThreshold: 1 | |
| timeoutSeconds: 1 | |
| resources: | |
| requests: | |
| cpu: 250m | |
| securityContext: | |
| privileged: true | |
| terminationMessagePath: /dev/termination-log | |
| terminationMessagePolicy: File | |
| volumeMounts: | |
| - mountPath: /lib/modules | |
| name: lib-modules | |
| readOnly: true | |
| - mountPath: /run/xtables.lock | |
| name: xtables-lock | |
| - mountPath: /var/run/calico | |
| name: var-run-calico | |
| - mountPath: /var/lib/calico | |
| name: var-lib-calico | |
| - mountPath: /var/run/nodeagent | |
| name: policysync | |
| - mountPath: /etc/calico/confd/templates/bird.cfg.template | |
| name: bird-template | |
| subPath: bird.cfg.template | |
| - mountPath: /etc/calico/confd/templates/bird_ipam.cfg.template | |
| name: bird-template | |
| subPath: bird_ipam.cfg.template | |
| dnsPolicy: ClusterFirst | |
| hostNetwork: true | |
| initContainers: | |
| - command: | |
| - /opt/cni/bin/calico-ipam | |
| - -upgrade | |
| env: | |
| - name: KUBERNETES_NODE_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: spec.nodeName | |
| - name: CALICO_NETWORKING_BACKEND | |
| valueFrom: | |
| configMapKeyRef: | |
| key: calico_backend | |
| name: calico-config | |
| image: calico/cni:v3.11.2 | |
| imagePullPolicy: IfNotPresent | |
| name: upgrade-ipam | |
| resources: {} | |
| securityContext: | |
| privileged: true | |
| terminationMessagePath: /dev/termination-log | |
| terminationMessagePolicy: File | |
| volumeMounts: | |
| - mountPath: /var/lib/cni/networks | |
| name: host-local-net-dir | |
| - mountPath: /host/opt/cni/bin | |
| name: cni-bin-dir | |
| - command: | |
| - /install-cni.sh | |
| env: | |
| - name: CNI_CONF_NAME | |
| value: 10-calico.conflist | |
| - name: CNI_NETWORK_CONFIG | |
| valueFrom: | |
| configMapKeyRef: | |
| key: cni_network_config | |
| name: calico-config | |
| - name: KUBERNETES_NODE_NAME | |
| valueFrom: | |
| fieldRef: | |
| apiVersion: v1 | |
| fieldPath: spec.nodeName | |
| - name: CNI_MTU | |
| valueFrom: | |
| configMapKeyRef: | |
| key: veth_mtu | |
| name: calico-config | |
| - name: SLEEP | |
| value: "false" | |
| image: calico/cni:v3.11.2 | |
| imagePullPolicy: IfNotPresent | |
| name: install-cni | |
| resources: {} | |
| securityContext: | |
| privileged: true | |
| terminationMessagePath: /dev/termination-log | |
| terminationMessagePolicy: File | |
| volumeMounts: | |
| - mountPath: /host/opt/cni/bin | |
| name: cni-bin-dir | |
| - mountPath: /host/etc/cni/net.d | |
| name: cni-net-dir | |
| - image: calico/pod2daemon-flexvol:v3.11.2 | |
| imagePullPolicy: IfNotPresent | |
| name: flexvol-driver | |
| resources: {} | |
| securityContext: | |
| privileged: true | |
| terminationMessagePath: /dev/termination-log | |
| terminationMessagePolicy: File | |
| volumeMounts: | |
| - mountPath: /host/driver | |
| name: flexvol-driver-host | |
| nodeSelector: | |
| beta.kubernetes.io/os: linux | |
| priorityClassName: system-node-critical | |
| restartPolicy: Always | |
| schedulerName: default-scheduler | |
| securityContext: {} | |
| serviceAccount: calico-node | |
| serviceAccountName: calico-node | |
| terminationGracePeriodSeconds: 0 | |
| tolerations: | |
| - effect: NoSchedule | |
| operator: Exists | |
| - key: CriticalAddonsOnly | |
| operator: Exists | |
| - effect: NoExecute | |
| operator: Exists | |
| volumes: | |
| - hostPath: | |
| path: /lib/modules | |
| type: "" | |
| name: lib-modules | |
| - hostPath: | |
| path: /var/run/calico | |
| type: "" | |
| name: var-run-calico | |
| - hostPath: | |
| path: /var/lib/calico | |
| type: "" | |
| name: var-lib-calico | |
| - hostPath: | |
| path: /run/xtables.lock | |
| type: FileOrCreate | |
| name: xtables-lock | |
| - hostPath: | |
| path: /opt/cni/bin | |
| type: "" | |
| name: cni-bin-dir | |
| - hostPath: | |
| path: /etc/cni/net.d | |
| type: "" | |
| name: cni-net-dir | |
| - hostPath: | |
| path: /var/lib/cni/networks | |
| type: "" | |
| name: host-local-net-dir | |
| - hostPath: | |
| path: /var/run/nodeagent | |
| type: DirectoryOrCreate | |
| name: policysync | |
| - hostPath: | |
| path: /usr/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds | |
| type: DirectoryOrCreate | |
| name: flexvol-driver-host | |
| - configMap: | |
| defaultMode: 420 | |
| name: calico-metallb-config | |
| name: bird-template | |
| templateGeneration: 4 | |
| updateStrategy: | |
| rollingUpdate: | |
| maxUnavailable: 1 | |
| type: RollingUpdate | |
| --- | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: calico-node | |
| namespace: kube-system | |
| --- | |
| # Source: calico/templates/calico-kube-controllers.yaml | |
| # See https://github.com/projectcalico/kube-controllers | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: calico-kube-controllers | |
| namespace: kube-system | |
| labels: | |
| k8s-app: calico-kube-controllers | |
| spec: | |
| # The controllers can only have a single active instance. | |
| replicas: 1 | |
| selector: | |
| matchLabels: | |
| k8s-app: calico-kube-controllers | |
| strategy: | |
| type: Recreate | |
| template: | |
| metadata: | |
| name: calico-kube-controllers | |
| namespace: kube-system | |
| labels: | |
| k8s-app: calico-kube-controllers | |
| annotations: | |
| scheduler.alpha.kubernetes.io/critical-pod: '' | |
| spec: | |
| affinity: | |
| nodeAffinity: | |
| requiredDuringSchedulingIgnoredDuringExecution: | |
| nodeSelectorTerms: | |
| - matchExpressions: | |
| - key: node-role.projectcalico.org/calico-kube-controllers | |
| operator: Exists | |
| nodeSelector: | |
| beta.kubernetes.io/os: linux | |
| tolerations: | |
| # Mark the pod as a critical add-on for rescheduling. | |
| - key: CriticalAddonsOnly | |
| operator: Exists | |
| - key: node-role.kubernetes.io/master | |
| effect: NoSchedule | |
| serviceAccountName: calico-kube-controllers | |
| priorityClassName: system-cluster-critical | |
| containers: | |
| - name: calico-kube-controllers | |
| image: calico/kube-controllers:v3.11.2 | |
| env: | |
| # Choose which controllers to run. | |
| - name: ENABLED_CONTROLLERS | |
| value: node | |
| - name: DATASTORE_TYPE | |
| value: kubernetes | |
| readinessProbe: | |
| exec: | |
| command: | |
| - /usr/bin/check-status | |
| - -r | |
| --- | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: calico-kube-controllers | |
| namespace: kube-system | |
| --- | |
| # Source: calico/templates/calico-etcd-secrets.yaml | |
| --- | |
| # Source: calico/templates/calico-typha.yaml | |
| --- | |
| # Source: calico/templates/configure-canal.yaml |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment