adrien/ansible-role-k8s-calico
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Update from upstream
All checks were successful
continuous-integration/drone/push Build is passing
Details

Browse source
This commit is contained in:
Adrien Reslinger 2021-02-23 16:31:44 +01:00
parent 6f178af19b
commit e2bb4a7cb8
Signed by: adrien
GPG key ID: DA7B27055C66D6DE
10 changed files with 60 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

12
files/bgpconfigurations.crd.projectcalico.org-CustomResourceDefinition.yaml
View file

@ -119,6 +119,18 @@ spec:
type: string type: string
type: object type: object
type: array type: array
serviceLoadBalancerIPs:
description: ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes
Service LoadBalancer IPs. Kubernetes Service status.LoadBalancer.Ingress
IPs will only be advertised if they are within one of these blocks.
items:
description: ServiceLoadBalancerIPBlock represents a single allowed
LoadBalancer IP CIDR block.
properties:
cidr:
type: string
type: object
type: array
type: object type: object
type: object type: object
served: true served: true

6
files/bgppeers.crd.projectcalico.org-CustomResourceDefinition.yaml
View file

@ -88,6 +88,12 @@ spec:
remote AS number comes from the remote node's NodeBGPSpec.ASNumber, remote AS number comes from the remote node's NodeBGPSpec.ASNumber,
or the global default if that is not set. or the global default if that is not set.
type: string type: string
sourceAddress:
description: Specifies whether and how to configure a source address
for the peerings generated by this BGPPeer resource. Default value
"UseNodeIP" means to configure the node IP as the source address. "None"
means not to configure a source address.
type: string
type: object type: object
type: object type: object
served: true served: true

1
files/calico-kube-controllers-ClusterRole.yaml
View file

@ -38,6 +38,7 @@ rules:
- create - create
- update - update
- delete - delete
- watch
# kube-controllers manages hostendpoints. # kube-controllers manages hostendpoints.
- apiGroups: ["crd.projectcalico.org"] - apiGroups: ["crd.projectcalico.org"]
resources: resources:

2
files/calico-kube-controllers-Deployment.yaml
View file

@ -34,7 +34,7 @@ spec:
priorityClassName: system-cluster-critical priorityClassName: system-cluster-critical
containers: containers:
- name: calico-kube-controllers - name: calico-kube-controllers
image: docker.io/calico/kube-controllers:v3.17.3 image: docker.io/calico/kube-controllers:v3.18.0
env: env:
# Choose which controllers to run. # Choose which controllers to run.
- name: ENABLED_CONTROLLERS - name: ENABLED_CONTROLLERS

8
files/calico-node-DaemonSet.yaml
View file

@ -44,7 +44,7 @@ spec:
# It can be deleted if this is a fresh installation, or if you have already # It can be deleted if this is a fresh installation, or if you have already
# upgraded to use calico-ipam. # upgraded to use calico-ipam.
- name: upgrade-ipam - name: upgrade-ipam
image: docker.io/calico/cni:v3.17.3 image: docker.io/calico/cni:v3.18.0
command: ["/opt/cni/bin/calico-ipam", "-upgrade"] command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
envFrom: envFrom:
- configMapRef: - configMapRef:
@ -71,7 +71,7 @@ spec:
# This container installs the CNI binaries # This container installs the CNI binaries
# and CNI network config file on each node. # and CNI network config file on each node.
- name: install-cni - name: install-cni
image: docker.io/calico/cni:v3.17.3 image: docker.io/calico/cni:v3.18.0
command: ["/opt/cni/bin/install"] command: ["/opt/cni/bin/install"]
envFrom: envFrom:
- configMapRef: - configMapRef:
@ -112,7 +112,7 @@ spec:
# Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes # Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes
# to communicate with Felix over the Policy Sync API. # to communicate with Felix over the Policy Sync API.
- name: flexvol-driver - name: flexvol-driver
image: docker.io/calico/pod2daemon-flexvol:v3.17.3 image: docker.io/calico/pod2daemon-flexvol:v3.18.0
volumeMounts: volumeMounts:
- name: flexvol-driver-host - name: flexvol-driver-host
mountPath: /host/driver mountPath: /host/driver
@ -123,7 +123,7 @@ spec:
# container programs network policy and routes on each # container programs network policy and routes on each
# host. # host.
- name: calico-node - name: calico-node
image: docker.io/calico/node:v3.17.3 image: docker.io/calico/node:v3.18.0
envFrom: envFrom:
- configMapRef: - configMapRef:
# Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode. # Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.

12
files/felixconfigurations.crd.projectcalico.org-CustomResourceDefinition.yaml
View file

@ -133,11 +133,11 @@ spec:
traffic that goes from a workload endpoint to the host itself (after traffic that goes from a workload endpoint to the host itself (after
the traffic hits the endpoint egress policy). By default Calico the traffic hits the endpoint egress policy). By default Calico
blocks traffic from workload endpoints to the host itself with an blocks traffic from workload endpoints to the host itself with an
iptables “DROP” action. If you want to allow some or all traffic iptables "DROP" action. If you want to allow some or all traffic
from endpoint to host, set this parameter to RETURN or ACCEPT. Use from endpoint to host, set this parameter to RETURN or ACCEPT. Use
RETURN if you have your own rules in the iptables “INPUT” chain; RETURN if you have your own rules in the iptables "INPUT" chain;
Calico will insert its rules at the top of that chain, then “RETURN” Calico will insert its rules at the top of that chain, then "RETURN"
packets to the “INPUT” chain once it has completed processing workload packets to the "INPUT" chain once it has completed processing workload
endpoint egress policy. Use ACCEPT to unconditionally accept packets endpoint egress policy. Use ACCEPT to unconditionally accept packets
from workloads after processing workload endpoint egress policy. from workloads after processing workload endpoint egress policy.
[Default: Drop]' [Default: Drop]'
@ -171,7 +171,7 @@ spec:
accidentally cutting off a host with incorrect configuration. Each accidentally cutting off a host with incorrect configuration. Each
port should be specified as tcp:<port-number> or udp:<port-number>. port should be specified as tcp:<port-number> or udp:<port-number>.
For back-compatibility, if the protocol is not specified, it defaults For back-compatibility, if the protocol is not specified, it defaults
to “tcp”. To disable all inbound host ports, use the value none. to "tcp". To disable all inbound host ports, use the value none.
The default value allows ssh access and DHCP. [Default: tcp:22, The default value allows ssh access and DHCP. [Default: tcp:22,
udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]' udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667]'
items: items:
@ -194,7 +194,7 @@ spec:
to avoid accidentally cutting off a host with incorrect configuration. to avoid accidentally cutting off a host with incorrect configuration.
Each port should be specified as tcp:<port-number> or udp:<port-number>. Each port should be specified as tcp:<port-number> or udp:<port-number>.
For back-compatibility, if the protocol is not specified, it defaults For back-compatibility, if the protocol is not specified, it defaults
to “tcp”. To disable all outbound host ports, use the value none. to "tcp". To disable all outbound host ports, use the value none.
The default value opens etcd''s standard ports to ensure that Felix The default value opens etcd''s standard ports to ensure that Felix
does not get cut off from etcd as well as allowing DHCP and DNS. does not get cut off from etcd as well as allowing DHCP and DNS.
[Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667, [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667,

20
files/globalnetworkpolicies.crd.projectcalico.org-CustomResourceDefinition.yaml
View file

@ -48,7 +48,7 @@ spec:
action. Both selector-based security Policy and security Profiles action. Both selector-based security Policy and security Profiles
reference rules - separated out as a list of rules for both ingress reference rules - separated out as a list of rules for both ingress
and egress packet matching. \n Each positive match criteria has and egress packet matching. \n Each positive match criteria has
a negated version, prefixed with ”Not”. All the match criteria a negated version, prefixed with \"Not\". All the match criteria
within a rule must be satisfied for a packet to match. A single within a rule must be satisfied for a packet to match. A single
rule can contain the positive and negative version of a match rule can contain the positive and negative version of a match
and both must be satisfied for the rule to match." and both must be satisfied for the rule to match."
@ -131,9 +131,9 @@ spec:
One negates the set of matched endpoints, the other negates One negates the set of matched endpoints, the other negates
the whole match: \n \tSelector = \"!has(my_label)\" matches the whole match: \n \tSelector = \"!has(my_label)\" matches
packets that are from other Calico-controlled \tendpoints packets that are from other Calico-controlled \tendpoints
that do not have the label “my_label”. \n \tNotSelector that do not have the label \"my_label\". \n \tNotSelector
= \"has(my_label)\" matches packets that are not from = \"has(my_label)\" matches packets that are not from
Calico-controlled \tendpoints that do have the label “my_label”. Calico-controlled \tendpoints that do have the label \"my_label\".
\n The effect is that the latter will accept packets from \n The effect is that the latter will accept packets from
non-Calico sources whereas the former is limited to packets non-Calico sources whereas the former is limited to packets
from Calico-controlled endpoints." from Calico-controlled endpoints."
@ -336,9 +336,9 @@ spec:
One negates the set of matched endpoints, the other negates One negates the set of matched endpoints, the other negates
the whole match: \n \tSelector = \"!has(my_label)\" matches the whole match: \n \tSelector = \"!has(my_label)\" matches
packets that are from other Calico-controlled \tendpoints packets that are from other Calico-controlled \tendpoints
that do not have the label “my_label”. \n \tNotSelector that do not have the label \"my_label\". \n \tNotSelector
= \"has(my_label)\" matches packets that are not from = \"has(my_label)\" matches packets that are not from
Calico-controlled \tendpoints that do have the label “my_label”. Calico-controlled \tendpoints that do have the label \"my_label\".
\n The effect is that the latter will accept packets from \n The effect is that the latter will accept packets from
non-Calico sources whereas the former is limited to packets non-Calico sources whereas the former is limited to packets
from Calico-controlled endpoints." from Calico-controlled endpoints."
@ -379,7 +379,7 @@ spec:
action. Both selector-based security Policy and security Profiles action. Both selector-based security Policy and security Profiles
reference rules - separated out as a list of rules for both ingress reference rules - separated out as a list of rules for both ingress
and egress packet matching. \n Each positive match criteria has and egress packet matching. \n Each positive match criteria has
a negated version, prefixed with ”Not”. All the match criteria a negated version, prefixed with \"Not\". All the match criteria
within a rule must be satisfied for a packet to match. A single within a rule must be satisfied for a packet to match. A single
rule can contain the positive and negative version of a match rule can contain the positive and negative version of a match
and both must be satisfied for the rule to match." and both must be satisfied for the rule to match."
@ -462,9 +462,9 @@ spec:
One negates the set of matched endpoints, the other negates One negates the set of matched endpoints, the other negates
the whole match: \n \tSelector = \"!has(my_label)\" matches the whole match: \n \tSelector = \"!has(my_label)\" matches
packets that are from other Calico-controlled \tendpoints packets that are from other Calico-controlled \tendpoints
that do not have the label “my_label”. \n \tNotSelector that do not have the label \"my_label\". \n \tNotSelector
= \"has(my_label)\" matches packets that are not from = \"has(my_label)\" matches packets that are not from
Calico-controlled \tendpoints that do have the label “my_label”. Calico-controlled \tendpoints that do have the label \"my_label\".
\n The effect is that the latter will accept packets from \n The effect is that the latter will accept packets from
non-Calico sources whereas the former is limited to packets non-Calico sources whereas the former is limited to packets
from Calico-controlled endpoints." from Calico-controlled endpoints."
@ -667,9 +667,9 @@ spec:
One negates the set of matched endpoints, the other negates One negates the set of matched endpoints, the other negates
the whole match: \n \tSelector = \"!has(my_label)\" matches the whole match: \n \tSelector = \"!has(my_label)\" matches
packets that are from other Calico-controlled \tendpoints packets that are from other Calico-controlled \tendpoints
that do not have the label “my_label”. \n \tNotSelector that do not have the label \"my_label\". \n \tNotSelector
= \"has(my_label)\" matches packets that are not from = \"has(my_label)\" matches packets that are not from
Calico-controlled \tendpoints that do have the label “my_label”. Calico-controlled \tendpoints that do have the label \"my_label\".
\n The effect is that the latter will accept packets from \n The effect is that the latter will accept packets from
non-Calico sources whereas the former is limited to packets non-Calico sources whereas the former is limited to packets
from Calico-controlled endpoints." from Calico-controlled endpoints."

2
files/hostendpoints.crd.projectcalico.org-CustomResourceDefinition.yaml
View file

@ -56,7 +56,7 @@ spec:
is empty - through the specific interface that has one of the IPs is empty - through the specific interface that has one of the IPs
in ExpectedIPs. Therefore, when InterfaceName is empty, at least in ExpectedIPs. Therefore, when InterfaceName is empty, at least
one expected IP must be specified. Only external interfaces (such one expected IP must be specified. Only external interfaces (such
as “eth0”) are supported here; it isn't possible for a HostEndpoint as \"eth0\") are supported here; it isn't possible for a HostEndpoint
to protect traffic through a specific local workload interface. to protect traffic through a specific local workload interface.
\n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints; \n Note: Only some kinds of policy are implemented for \"*\" HostEndpoints;
initially just pre-DNAT policy. Please check Calico documentation initially just pre-DNAT policy. Please check Calico documentation

9
files/kubecontrollersconfigurations.crd.projectcalico.org-CustomResourceDefinition.yaml
View file

@ -106,6 +106,10 @@ spec:
description: 'LogSeverityScreen is the log severity above which logs description: 'LogSeverityScreen is the log severity above which logs
are sent to the stdout. [Default: Info]' are sent to the stdout. [Default: Info]'
type: string type: string
prometheusMetricsPort:
description: 'PrometheusMetricsPort is the TCP port that the Prometheus
metrics server should bind to. Set to 0 to disable. [Default: 9094]'
type: integer
required: required:
- controllers - controllers
type: object type: object
@ -206,6 +210,11 @@ spec:
description: 'LogSeverityScreen is the log severity above which description: 'LogSeverityScreen is the log severity above which
logs are sent to the stdout. [Default: Info]' logs are sent to the stdout. [Default: Info]'
type: string type: string
prometheusMetricsPort:
description: 'PrometheusMetricsPort is the TCP port that the Prometheus
metrics server should bind to. Set to 0 to disable. [Default:
9094]'
type: integer
required: required:
- controllers - controllers
type: object type: object

20
files/networkpolicies.crd.projectcalico.org-CustomResourceDefinition.yaml
View file

@ -37,7 +37,7 @@ spec:
action. Both selector-based security Policy and security Profiles action. Both selector-based security Policy and security Profiles
reference rules - separated out as a list of rules for both ingress reference rules - separated out as a list of rules for both ingress
and egress packet matching. \n Each positive match criteria has and egress packet matching. \n Each positive match criteria has
a negated version, prefixed with ”Not”. All the match criteria a negated version, prefixed with \"Not\". All the match criteria
within a rule must be satisfied for a packet to match. A single within a rule must be satisfied for a packet to match. A single
rule can contain the positive and negative version of a match rule can contain the positive and negative version of a match
and both must be satisfied for the rule to match." and both must be satisfied for the rule to match."
@ -120,9 +120,9 @@ spec:
One negates the set of matched endpoints, the other negates One negates the set of matched endpoints, the other negates
the whole match: \n \tSelector = \"!has(my_label)\" matches the whole match: \n \tSelector = \"!has(my_label)\" matches
packets that are from other Calico-controlled \tendpoints packets that are from other Calico-controlled \tendpoints
that do not have the label “my_label”. \n \tNotSelector that do not have the label \"my_label\". \n \tNotSelector
= \"has(my_label)\" matches packets that are not from = \"has(my_label)\" matches packets that are not from
Calico-controlled \tendpoints that do have the label “my_label”. Calico-controlled \tendpoints that do have the label \"my_label\".
\n The effect is that the latter will accept packets from \n The effect is that the latter will accept packets from
non-Calico sources whereas the former is limited to packets non-Calico sources whereas the former is limited to packets
from Calico-controlled endpoints." from Calico-controlled endpoints."
@ -325,9 +325,9 @@ spec:
One negates the set of matched endpoints, the other negates One negates the set of matched endpoints, the other negates
the whole match: \n \tSelector = \"!has(my_label)\" matches the whole match: \n \tSelector = \"!has(my_label)\" matches
packets that are from other Calico-controlled \tendpoints packets that are from other Calico-controlled \tendpoints
that do not have the label “my_label”. \n \tNotSelector that do not have the label \"my_label\". \n \tNotSelector
= \"has(my_label)\" matches packets that are not from = \"has(my_label)\" matches packets that are not from
Calico-controlled \tendpoints that do have the label “my_label”. Calico-controlled \tendpoints that do have the label \"my_label\".
\n The effect is that the latter will accept packets from \n The effect is that the latter will accept packets from
non-Calico sources whereas the former is limited to packets non-Calico sources whereas the former is limited to packets
from Calico-controlled endpoints." from Calico-controlled endpoints."
@ -368,7 +368,7 @@ spec:
action. Both selector-based security Policy and security Profiles action. Both selector-based security Policy and security Profiles
reference rules - separated out as a list of rules for both ingress reference rules - separated out as a list of rules for both ingress
and egress packet matching. \n Each positive match criteria has and egress packet matching. \n Each positive match criteria has
a negated version, prefixed with ”Not”. All the match criteria a negated version, prefixed with \"Not\". All the match criteria
within a rule must be satisfied for a packet to match. A single within a rule must be satisfied for a packet to match. A single
rule can contain the positive and negative version of a match rule can contain the positive and negative version of a match
and both must be satisfied for the rule to match." and both must be satisfied for the rule to match."
@ -451,9 +451,9 @@ spec:
One negates the set of matched endpoints, the other negates One negates the set of matched endpoints, the other negates
the whole match: \n \tSelector = \"!has(my_label)\" matches the whole match: \n \tSelector = \"!has(my_label)\" matches
packets that are from other Calico-controlled \tendpoints packets that are from other Calico-controlled \tendpoints
that do not have the label “my_label”. \n \tNotSelector that do not have the label \"my_label\". \n \tNotSelector
= \"has(my_label)\" matches packets that are not from = \"has(my_label)\" matches packets that are not from
Calico-controlled \tendpoints that do have the label “my_label”. Calico-controlled \tendpoints that do have the label \"my_label\".
\n The effect is that the latter will accept packets from \n The effect is that the latter will accept packets from
non-Calico sources whereas the former is limited to packets non-Calico sources whereas the former is limited to packets
from Calico-controlled endpoints." from Calico-controlled endpoints."
@ -656,9 +656,9 @@ spec:
One negates the set of matched endpoints, the other negates One negates the set of matched endpoints, the other negates
the whole match: \n \tSelector = \"!has(my_label)\" matches the whole match: \n \tSelector = \"!has(my_label)\" matches
packets that are from other Calico-controlled \tendpoints packets that are from other Calico-controlled \tendpoints
that do not have the label “my_label”. \n \tNotSelector that do not have the label \"my_label\". \n \tNotSelector
= \"has(my_label)\" matches packets that are not from = \"has(my_label)\" matches packets that are not from
Calico-controlled \tendpoints that do have the label “my_label”. Calico-controlled \tendpoints that do have the label \"my_label\".
\n The effect is that the latter will accept packets from \n The effect is that the latter will accept packets from
non-Calico sources whereas the former is limited to packets non-Calico sources whereas the former is limited to packets
from Calico-controlled endpoints." from Calico-controlled endpoints."