Update to version v3.23.0
All checks were successful
continuous-integration/drone/push Build is passing
All checks were successful
continuous-integration/drone/push Build is passing
This commit is contained in:
parent
4bd2267e77
commit
a1b71d54ec
GPG key ID:
DA7B27055C66D6DE
13 changed files with 247 additions and 38 deletions
|
|
@ -77,6 +77,11 @@ spec:
|
|||
description: 'BPFEnabled, if enabled Felix will use the BPF dataplane.
|
||||
[Default: false]'
|
||||
type: boolean
|
||||
bpfEnforceRPF:
|
||||
description: 'BPFEnforceRPF enforce strict RPF on all interfaces with
|
||||
BPF programs regardless of what is the per-interfaces or global
|
||||
setting. Possible values are Disabled or Strict. [Default: Strict]'
|
||||
type: string
|
||||
bpfExtToServiceConnmark:
|
||||
description: 'BPFExtToServiceConnmark in BPF mode, control a 32bit
|
||||
mark that is set on connections from an external client to a local
|
||||
|
|
@ -116,6 +121,51 @@ spec:
|
|||
logs are emitted to the BPF trace pipe, accessible with the command
|
||||
`tc exec bpf debug`. [Default: Off].'
|
||||
type: string
|
||||
bpfMapSizeConntrack:
|
||||
description: 'BPFMapSizeConntrack sets the size for the conntrack
|
||||
map. This map must be large enough to hold an entry for each active
|
||||
connection. Warning: changing the size of the conntrack map can
|
||||
cause disruption.'
|
||||
type: integer
|
||||
bpfMapSizeIPSets:
|
||||
description: BPFMapSizeIPSets sets the size for ipsets map. The IP
|
||||
sets map must be large enough to hold an entry for each endpoint
|
||||
matched by every selector in the source/destination matches in network
|
||||
policy. Selectors such as "all()" can result in large numbers of
|
||||
entries (one entry per endpoint in that case).
|
||||
type: integer
|
||||
bpfMapSizeNATAffinity:
|
||||
type: integer
|
||||
bpfMapSizeNATBackend:
|
||||
description: BPFMapSizeNATBackend sets the size for nat back end map.
|
||||
This is the total number of endpoints. This is mostly more than
|
||||
the size of the number of services.
|
||||
type: integer
|
||||
bpfMapSizeNATFrontend:
|
||||
description: BPFMapSizeNATFrontend sets the size for nat front end
|
||||
map. FrontendMap should be large enough to hold an entry for each
|
||||
nodeport, external IP and each port in each service.
|
||||
type: integer
|
||||
bpfMapSizeRoute:
|
||||
description: BPFMapSizeRoute sets the size for the routes map. The
|
||||
routes map should be large enough to hold one entry per workload
|
||||
and a handful of entries per host (enough to cover its own IPs and
|
||||
tunnel IPs).
|
||||
type: integer
|
||||
bpfPSNATPorts:
|
||||
anyOf:
|
||||
- type: integer
|
||||
- type: string
|
||||
description: 'BPFPSNATPorts sets the range from which we randomly
|
||||
pick a port if there is a source port collision. This should be
|
||||
within the ephemeral range as defined by RFC 6056 (1024–65535) and
|
||||
preferably outside the ephemeral ranges used by common operating
|
||||
systems. Linux uses 32768–60999, while others mostly use the IANA
|
||||
defined range 49152–65535. It is not necessarily a problem if this
|
||||
range overlaps with the operating systems. Both ends of the range
|
||||
are inclusive. [Default: 20000:29999]'
|
||||
pattern: ^.*
|
||||
x-kubernetes-int-or-string: true
|
||||
chainInsertMode:
|
||||
description: 'ChainInsertMode controls whether Felix hooks the kernel''s
|
||||
top-level iptables chains by inserting a rule at the top of the
|
||||
|
|
@ -126,6 +176,15 @@ spec:
|
|||
Calico policy will be bypassed. [Default: insert]'
|
||||
type: string
|
||||
dataplaneDriver:
|
||||
description: DataplaneDriver filename of the external dataplane driver
|
||||
to use. Only used if UseInternalDataplaneDriver is set to false.
|
||||
type: string
|
||||
dataplaneWatchdogTimeout:
|
||||
description: 'DataplaneWatchdogTimeout is the readiness/liveness timeout
|
||||
used for Felix''s (internal) dataplane driver. Increase this value
|
||||
if you experience spurious non-ready or non-live events when Felix
|
||||
is under heavy load. Decrease the value to get felix to report non-live
|
||||
or non-ready more quickly. [Default: 90s]'
|
||||
type: string
|
||||
debugDisableLogDropping:
|
||||
type: boolean
|
||||
|
|
@ -154,9 +213,14 @@ spec:
|
|||
routes, by default this will be RTPROT_BOOT when left blank.
|
||||
type: integer
|
||||
deviceRouteSourceAddress:
|
||||
description: This is the source address to use on programmed device
|
||||
routes. By default the source address is left blank, leaving the
|
||||
kernel to choose the source address used.
|
||||
description: This is the IPv4 source address to use on programmed
|
||||
device routes. By default the source address is left blank, leaving
|
||||
the kernel to choose the source address used.
|
||||
type: string
|
||||
deviceRouteSourceAddressIPv6:
|
||||
description: This is the IPv6 source address to use on programmed
|
||||
device routes. By default the source address is left blank, leaving
|
||||
the kernel to choose the source address used.
|
||||
type: string
|
||||
disableConntrackInvalidCheck:
|
||||
type: boolean
|
||||
|
|
@ -230,6 +294,14 @@ spec:
|
|||
"true" or "false" will force the feature, empty or omitted values
|
||||
are auto-detected.
|
||||
type: string
|
||||
floatingIPs:
|
||||
default: Disabled
|
||||
description: FloatingIPs configures whether or not Felix will program
|
||||
floating IP addresses.
|
||||
enum:
|
||||
- Enabled
|
||||
- Disabled
|
||||
type: string
|
||||
genericXDPEnabled:
|
||||
description: 'GenericXDPEnabled enables Generic XDP so network cards
|
||||
that don''t support XDP offload or driver modes can use XDP. This
|
||||
|
|
@ -267,6 +339,9 @@ spec:
|
|||
disabled by setting the interval to 0.
|
||||
type: string
|
||||
ipipEnabled:
|
||||
description: 'IPIPEnabled overrides whether Felix should configure
|
||||
an IPIP interface on the host. Optional as Felix determines this
|
||||
based on the existing IP pools. [Default: nil (unset)]'
|
||||
type: boolean
|
||||
ipipMTU:
|
||||
description: 'IPIPMTU is the MTU to set on the tunnel device. See
|
||||
|
|
@ -333,6 +408,8 @@ spec:
|
|||
usage. [Default: 10s]'
|
||||
type: string
|
||||
ipv6Support:
|
||||
description: IPv6Support controls whether Felix enables support for
|
||||
IPv6 (if supported by the in-use dataplane).
|
||||
type: boolean
|
||||
kubeNodePortRanges:
|
||||
description: 'KubeNodePortRanges holds list of port ranges used for
|
||||
|
|
@ -346,6 +423,12 @@ spec:
|
|||
pattern: ^.*
|
||||
x-kubernetes-int-or-string: true
|
||||
type: array
|
||||
logDebugFilenameRegex:
|
||||
description: LogDebugFilenameRegex controls which source code files
|
||||
have their Debug log output included in the logs. Only logs from
|
||||
files with names that match the given regular expression are included. The
|
||||
filter only applies to Debug level logs.
|
||||
type: string
|
||||
logFilePath:
|
||||
description: 'LogFilePath is the full path to the Felix log. Set to
|
||||
none to disable file logging. [Default: /var/log/calico/felix.log]'
|
||||
|
|
@ -475,9 +558,9 @@ spec:
|
|||
routes. - CalicoIPAM: the default - use IPAM data to construct routes.'
|
||||
type: string
|
||||
routeTableRange:
|
||||
description: Calico programs additional Linux route tables for various
|
||||
purposes. RouteTableRange specifies the indices of the route tables
|
||||
that Calico should use.
|
||||
description: Deprecated in favor of RouteTableRanges. Calico programs
|
||||
additional Linux route tables for various purposes. RouteTableRange
|
||||
specifies the indices of the route tables that Calico should use.
|
||||
properties:
|
||||
max:
|
||||
type: integer
|
||||
|
|
@ -487,6 +570,21 @@ spec:
|
|||
- max
|
||||
- min
|
||||
type: object
|
||||
routeTableRanges:
|
||||
description: Calico programs additional Linux route tables for various
|
||||
purposes. RouteTableRanges specifies a set of table index ranges
|
||||
that Calico should use. Deprecates`RouteTableRange`, overrides `RouteTableRange`.
|
||||
items:
|
||||
properties:
|
||||
max:
|
||||
type: integer
|
||||
min:
|
||||
type: integer
|
||||
required:
|
||||
- max
|
||||
- min
|
||||
type: object
|
||||
type: array
|
||||
serviceLoopPrevention:
|
||||
description: 'When service IP advertisement is enabled, prevent routing
|
||||
loops to service IPs that are not in use, by dropping or rejecting
|
||||
|
|
@ -514,12 +612,22 @@ spec:
|
|||
Felix makes reports. [Default: 86400s]'
|
||||
type: string
|
||||
useInternalDataplaneDriver:
|
||||
description: UseInternalDataplaneDriver, if true, Felix will use its
|
||||
internal dataplane programming logic. If false, it will launch
|
||||
an external dataplane driver and communicate with it over protobuf.
|
||||
type: boolean
|
||||
vxlanEnabled:
|
||||
description: 'VXLANEnabled overrides whether Felix should create the
|
||||
VXLAN tunnel device for VXLAN networking. Optional as Felix determines
|
||||
this based on the existing IP pools. [Default: nil (unset)]'
|
||||
type: boolean
|
||||
vxlanMTU:
|
||||
description: 'VXLANMTU is the MTU to set on the tunnel device. See
|
||||
Configuring MTU [Default: 1440]'
|
||||
description: 'VXLANMTU is the MTU to set on the IPv4 VXLAN tunnel
|
||||
device. See Configuring MTU [Default: 1410]'
|
||||
type: integer
|
||||
vxlanMTUV6:
|
||||
description: 'VXLANMTUV6 is the MTU to set on the IPv6 VXLAN tunnel
|
||||
device. See Configuring MTU [Default: 1390]'
|
||||
type: integer
|
||||
vxlanPort:
|
||||
type: integer
|
||||
|
|
@ -537,6 +645,10 @@ spec:
|
|||
description: 'WireguardInterfaceName specifies the name to use for
|
||||
the Wireguard interface. [Default: wg.calico]'
|
||||
type: string
|
||||
wireguardKeepAlive:
|
||||
description: 'WireguardKeepAlive controls Wireguard PersistentKeepalive
|
||||
option. Set 0 to disable. [Default: 0]'
|
||||
type: string
|
||||
wireguardListeningPort:
|
||||
description: 'WireguardListeningPort controls the listening port used
|
||||
by Wireguard. [Default: 51820]'
|
||||
|
|
@ -549,6 +661,12 @@ spec:
|
|||
description: 'WireguardRoutingRulePriority controls the priority value
|
||||
to use for the Wireguard routing rule. [Default: 99]'
|
||||
type: integer
|
||||
workloadSourceSpoofing:
|
||||
description: WorkloadSourceSpoofing controls whether pods can use
|
||||
the allowedSourcePrefixes annotation to send traffic with a source
|
||||
IP address that is not theirs. This is disabled by default. When
|
||||
set to "Any", pods can request any prefix.
|
||||
type: string
|
||||
xdpEnabled:
|
||||
description: 'XDPEnabled enables XDP acceleration for suitable untracked
|
||||
incoming deny rules. [Default: true]'
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue