update
This commit is contained in:
havelight-ee
@@ -0,0 +1,10 @@
|
||||
# This is a tech-preview manifest which installs the Calico API server. Note that this manifest is liable to change
|
||||
# or be removed in future releases without further warning.
|
||||
#
|
||||
# Namespace and namespace-scoped resources.
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
name: calico-apiserver
|
||||
name: calico-apiserver
|
||||
@@ -0,0 +1,287 @@
|
||||
# Policy to ensure the API server isn't cut off. Can be modified, but ensure
|
||||
# that the main API server is always able to reach the Calico API server.
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: allow-apiserver
|
||||
namespace: calico-apiserver
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
apiserver: "true"
|
||||
ingress:
|
||||
- ports:
|
||||
- protocol: TCP
|
||||
port: 5443
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: calico-api
|
||||
namespace: calico-apiserver
|
||||
spec:
|
||||
ports:
|
||||
- name: apiserver
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 5443
|
||||
selector:
|
||||
apiserver: "true"
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
apiserver: "true"
|
||||
k8s-app: calico-apiserver
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
apiserver: "true"
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
apiserver: "true"
|
||||
k8s-app: calico-apiserver
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- --secure-port=5443
|
||||
env:
|
||||
- name: DATASTORE_TYPE
|
||||
value: kubernetes
|
||||
image: {{ calico_apiserver_image_repo }}:{{ calico_apiserver_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /version
|
||||
port: 5443
|
||||
scheme: HTTPS
|
||||
initialDelaySeconds: 90
|
||||
periodSeconds: 10
|
||||
name: calico-apiserver
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /code/filecheck
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
securityContext:
|
||||
privileged: false
|
||||
runAsUser: 0
|
||||
volumeMounts:
|
||||
- mountPath: /code/apiserver.local.config/certificates
|
||||
name: calico-apiserver-certs
|
||||
dnsPolicy: ClusterFirst
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
restartPolicy: Always
|
||||
serviceAccount: calico-apiserver
|
||||
serviceAccountName: calico-apiserver
|
||||
tolerations:
|
||||
- effect: NoSchedule
|
||||
key: node-role.kubernetes.io/master
|
||||
volumes:
|
||||
- name: calico-apiserver-certs
|
||||
secret:
|
||||
secretName: calico-apiserver-certs
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
|
||||
---
|
||||
|
||||
# Cluster-scoped resources below here.
|
||||
apiVersion: apiregistration.k8s.io/v1
|
||||
kind: APIService
|
||||
metadata:
|
||||
name: v3.projectcalico.org
|
||||
spec:
|
||||
group: projectcalico.org
|
||||
groupPriorityMinimum: 1500
|
||||
caBundle: {{ calico_apiserver_cabundle }}
|
||||
service:
|
||||
name: calico-api
|
||||
namespace: calico-apiserver
|
||||
port: 443
|
||||
version: v3
|
||||
versionPriority: 200
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: calico-crds
|
||||
rules:
|
||||
- apiGroups:
|
||||
- extensions
|
||||
- networking.k8s.io
|
||||
- ""
|
||||
resources:
|
||||
- networkpolicies
|
||||
- nodes
|
||||
- namespaces
|
||||
- pods
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- crd.projectcalico.org
|
||||
resources:
|
||||
- globalnetworkpolicies
|
||||
- networkpolicies
|
||||
- clusterinformations
|
||||
- hostendpoints
|
||||
- globalnetworksets
|
||||
- networksets
|
||||
- bgpconfigurations
|
||||
- bgppeers
|
||||
- felixconfigurations
|
||||
- kubecontrollersconfigurations
|
||||
- ippools
|
||||
- ipreservations
|
||||
- ipamblocks
|
||||
- blockaffinities
|
||||
- caliconodestatuses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- apiGroups:
|
||||
- policy
|
||||
resourceNames:
|
||||
- calico-apiserver
|
||||
resources:
|
||||
- podsecuritypolicies
|
||||
verbs:
|
||||
- use
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: calico-extension-apiserver-auth-access
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- extension-apiserver-authentication
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- get
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterroles
|
||||
- clusterrolebindings
|
||||
- roles
|
||||
- rolebindings
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: calico-webhook-reader
|
||||
rules:
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- mutatingwebhookconfigurations
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: calico-apiserver-access-crds
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: calico-crds
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: calico-apiserver-delegate-auth
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: system:auth-delegator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: calico-apiserver-webhook-reader
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: calico-webhook-reader
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: calico-extension-apiserver-auth-access
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: calico-extension-apiserver-auth-access
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: calico-apiserver
|
||||
namespace: calico-apiserver
|
||||
@@ -0,0 +1,27 @@
|
||||
kind: ConfigMap
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: calico-config
|
||||
namespace: kube-system
|
||||
data:
|
||||
{% if calico_datastore == "etcd" %}
|
||||
etcd_endpoints: "{{ etcd_access_addresses }}"
|
||||
etcd_ca: "/calico-secrets/ca_cert.crt"
|
||||
etcd_cert: "/calico-secrets/cert.crt"
|
||||
etcd_key: "/calico-secrets/key.pem"
|
||||
{% elif calico_datastore == "kdd" and typha_enabled %}
|
||||
# To enable Typha, set this to "calico-typha" *and* set a non-zero value for Typha replicas
|
||||
# below. We recommend using Typha if you have more than 50 nodes. Above 100 nodes it is
|
||||
# essential.
|
||||
typha_service_name: "calico-typha"
|
||||
{% endif %}
|
||||
{% if calico_network_backend == 'bird' %}
|
||||
cluster_type: "kubespray,bgp"
|
||||
calico_backend: "bird"
|
||||
{% else %}
|
||||
cluster_type: "kubespray"
|
||||
calico_backend: "{{ calico_network_backend }}"
|
||||
{% endif %}
|
||||
{% if inventory_hostname in groups['k8s_cluster'] and peer_with_router|default(false) %}
|
||||
as: "{{ local_as|default(global_as_num) }}"
|
||||
{% endif -%}
|
||||
168
kubespray/roles/network_plugin/calico/templates/calico-cr.yml.j2
Normal file
168
kubespray/roles/network_plugin/calico/templates/calico-cr.yml.j2
Normal file
@@ -0,0 +1,168 @@
|
||||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: calico-node
|
||||
namespace: kube-system
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- pods
|
||||
- nodes
|
||||
- namespaces
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
# EndpointSlices are used for Service-based network policy rule
|
||||
# enforcement.
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- watch
|
||||
- list
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- endpoints
|
||||
- services
|
||||
verbs:
|
||||
- watch
|
||||
- list
|
||||
{% if calico_datastore == "kdd" %}
|
||||
# Used to discover Typhas.
|
||||
- get
|
||||
{% endif %}
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- nodes/status
|
||||
verbs:
|
||||
# Needed for clearing NodeNetworkUnavailable flag.
|
||||
- patch
|
||||
{% if calico_datastore == "etcd" %}
|
||||
- apiGroups:
|
||||
- policy
|
||||
resourceNames:
|
||||
- privileged
|
||||
resources:
|
||||
- podsecuritypolicies
|
||||
verbs:
|
||||
- use
|
||||
{% elif calico_datastore == "kdd" %}
|
||||
# Calico stores some configuration information in node annotations.
|
||||
- update
|
||||
# Watch for changes to Kubernetes NetworkPolicies.
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources:
|
||||
- networkpolicies
|
||||
verbs:
|
||||
- watch
|
||||
- list
|
||||
# Used by Calico for policy information.
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- pods
|
||||
- namespaces
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
# The CNI plugin patches pods/status.
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- pods/status
|
||||
verbs:
|
||||
- patch
|
||||
# Calico monitors various CRDs for config.
|
||||
- apiGroups: ["crd.projectcalico.org"]
|
||||
resources:
|
||||
- globalfelixconfigs
|
||||
- felixconfigurations
|
||||
- bgppeers
|
||||
- globalbgpconfigs
|
||||
- bgpconfigurations
|
||||
- ippools
|
||||
- ipreservations
|
||||
- ipamblocks
|
||||
- globalnetworkpolicies
|
||||
- globalnetworksets
|
||||
- networkpolicies
|
||||
- networksets
|
||||
- clusterinformations
|
||||
- hostendpoints
|
||||
- blockaffinities
|
||||
- caliconodestatuses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
# Calico must create and update some CRDs on startup.
|
||||
- apiGroups: ["crd.projectcalico.org"]
|
||||
resources:
|
||||
- ippools
|
||||
- felixconfigurations
|
||||
- clusterinformations
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
# Calico must update some CRDs.
|
||||
- apiGroups: [ "crd.projectcalico.org" ]
|
||||
resources:
|
||||
- caliconodestatuses
|
||||
verbs:
|
||||
- update
|
||||
# Calico stores some configuration information on the node.
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
# These permissions are only required for upgrade from v2.6, and can
|
||||
# be removed after upgrade or on fresh installations.
|
||||
- apiGroups: ["crd.projectcalico.org"]
|
||||
resources:
|
||||
- bgpconfigurations
|
||||
- bgppeers
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
# These permissions are required for Calico CNI to perform IPAM allocations.
|
||||
- apiGroups: ["crd.projectcalico.org"]
|
||||
resources:
|
||||
- blockaffinities
|
||||
- ipamblocks
|
||||
- ipamhandles
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- apiGroups: ["crd.projectcalico.org"]
|
||||
resources:
|
||||
- ipamconfigs
|
||||
verbs:
|
||||
- get
|
||||
# Block affinities must also be watchable by confd for route aggregation.
|
||||
- apiGroups: ["crd.projectcalico.org"]
|
||||
resources:
|
||||
- blockaffinities
|
||||
verbs:
|
||||
- watch
|
||||
# The Calico IPAM migration needs to get daemonsets. These permissions can be
|
||||
# removed if not upgrading from an installation using host-local IPAM.
|
||||
- apiGroups: ["apps"]
|
||||
resources:
|
||||
- daemonsets
|
||||
verbs:
|
||||
- get
|
||||
{% endif %}
|
||||
# Used for creating service account tokens to be used by the CNI plugin
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- serviceaccounts/token
|
||||
resourceNames:
|
||||
- calico-node
|
||||
verbs:
|
||||
- create
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: calico-node
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: calico-node
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: calico-node
|
||||
namespace: kube-system
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: crd.projectcalico.org/v1
|
||||
kind: IPAMConfig
|
||||
metadata:
|
||||
name: default
|
||||
spec:
|
||||
autoAllocateBlocks: {{ calico_ipam_autoallocateblocks }}
|
||||
strictAffinity: {{ calico_ipam_strictaffinity }}
|
||||
maxBlocksPerHost: {{ calico_ipam_maxblocksperhost }}
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: calico-node
|
||||
namespace: kube-system
|
||||
@@ -0,0 +1,464 @@
|
||||
---
|
||||
# This manifest installs the calico/node container, as well
|
||||
# as the Calico CNI plugins and network config on
|
||||
# each master and worker node in a Kubernetes cluster.
|
||||
kind: DaemonSet
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: calico-node
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: calico-node
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: calico-node
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: calico-node
|
||||
annotations:
|
||||
{% if calico_datastore == "etcd" %}
|
||||
kubespray.etcd-cert/serial: "{{ etcd_client_cert_serial }}"
|
||||
{% endif %}
|
||||
{% if calico_felix_prometheusmetricsenabled %}
|
||||
prometheus.io/scrape: 'true'
|
||||
prometheus.io/port: "{{ calico_felix_prometheusmetricsport }}"
|
||||
{% endif %}
|
||||
spec:
|
||||
nodeSelector:
|
||||
{{ calico_ds_nodeselector }}
|
||||
priorityClassName: system-node-critical
|
||||
hostNetwork: true
|
||||
serviceAccountName: calico-node
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
# Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
|
||||
# deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
|
||||
terminationGracePeriodSeconds: 0
|
||||
initContainers:
|
||||
{% if calico_datastore == "kdd" %}
|
||||
# This container performs upgrade from host-local IPAM to calico-ipam.
|
||||
# It can be deleted if this is a fresh installation, or if you have already
|
||||
# upgraded to use calico-ipam.
|
||||
- name: upgrade-ipam
|
||||
image: {{ calico_cni_image_repo }}:{{ calico_cni_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
command: ["/opt/cni/bin/calico-ipam", "-upgrade"]
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
# Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
|
||||
name: kubernetes-services-endpoint
|
||||
optional: true
|
||||
env:
|
||||
- name: KUBERNETES_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: CALICO_NETWORKING_BACKEND
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: calico-config
|
||||
key: calico_backend
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/cni/networks
|
||||
name: host-local-net-dir
|
||||
- mountPath: /host/opt/cni/bin
|
||||
name: cni-bin-dir
|
||||
securityContext:
|
||||
privileged: true
|
||||
{% endif %}
|
||||
# This container installs the Calico CNI binaries
|
||||
# and CNI network config file on each node.
|
||||
- name: install-cni
|
||||
image: {{ calico_cni_image_repo }}:{{ calico_cni_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
command: ["/opt/cni/bin/install"]
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
# Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
|
||||
name: kubernetes-services-endpoint
|
||||
optional: true
|
||||
env:
|
||||
# Name of the CNI config file to create.
|
||||
- name: CNI_CONF_NAME
|
||||
value: "10-calico.conflist"
|
||||
# Install CNI binaries
|
||||
- name: UPDATE_CNI_BINARIES
|
||||
value: "true"
|
||||
# The CNI network config to install on each node.
|
||||
- name: CNI_NETWORK_CONFIG_FILE
|
||||
value: "/host/etc/cni/net.d/calico.conflist.template"
|
||||
# Prevents the container from sleeping forever.
|
||||
- name: SLEEP
|
||||
value: "false"
|
||||
{% if calico_datastore == "kdd" %}
|
||||
# Set the hostname based on the k8s node name.
|
||||
- name: KUBERNETES_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
{% endif %}
|
||||
volumeMounts:
|
||||
- mountPath: /host/etc/cni/net.d
|
||||
name: cni-net-dir
|
||||
- mountPath: /host/opt/cni/bin
|
||||
name: cni-bin-dir
|
||||
securityContext:
|
||||
privileged: true
|
||||
# Adds a Flex Volume Driver that creates a per-pod Unix Domain Socket to allow Dikastes
|
||||
# to communicate with Felix over the Policy Sync API.
|
||||
- name: flexvol-driver
|
||||
image: {{ calico_flexvol_image_repo }}:{{ calico_flexvol_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
volumeMounts:
|
||||
- name: flexvol-driver-host
|
||||
mountPath: /host/driver
|
||||
securityContext:
|
||||
privileged: true
|
||||
containers:
|
||||
# Runs calico/node container on each Kubernetes node. This
|
||||
# container programs network policy and routes on each
|
||||
# host.
|
||||
- name: calico-node
|
||||
image: {{ calico_node_image_repo }}:{{ calico_node_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
# Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
|
||||
name: kubernetes-services-endpoint
|
||||
optional: true
|
||||
env:
|
||||
# The location of the Calico etcd cluster.
|
||||
{% if calico_datastore == "etcd" %}
|
||||
- name: ETCD_ENDPOINTS
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: calico-config
|
||||
key: etcd_endpoints
|
||||
# Location of the CA certificate for etcd.
|
||||
- name: ETCD_CA_CERT_FILE
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: calico-config
|
||||
key: etcd_ca
|
||||
# Location of the client key for etcd.
|
||||
- name: ETCD_KEY_FILE
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: calico-config
|
||||
key: etcd_key
|
||||
# Location of the client certificate for etcd.
|
||||
- name: ETCD_CERT_FILE
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: calico-config
|
||||
key: etcd_cert
|
||||
{% elif calico_datastore == "kdd" %}
|
||||
# Use Kubernetes API as the backing datastore.
|
||||
- name: DATASTORE_TYPE
|
||||
value: "kubernetes"
|
||||
{% if typha_enabled %}
|
||||
# Typha support: controlled by the ConfigMap.
|
||||
- name: FELIX_TYPHAK8SSERVICENAME
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: calico-config
|
||||
key: typha_service_name
|
||||
{% if typha_secure %}
|
||||
- name: FELIX_TYPHACN
|
||||
value: typha-server
|
||||
- name: FELIX_TYPHACAFILE
|
||||
value: /etc/typha-ca/ca.crt
|
||||
- name: FELIX_TYPHACERTFILE
|
||||
value: /etc/typha-client/typha-client.crt
|
||||
- name: FELIX_TYPHAKEYFILE
|
||||
value: /etc/typha-client/typha-client.key
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
# Wait for the datastore.
|
||||
- name: WAIT_FOR_DATASTORE
|
||||
value: "true"
|
||||
{% endif %}
|
||||
{% if calico_network_backend == 'vxlan' %}
|
||||
- name: FELIX_VXLANVNI
|
||||
value: "{{ calico_vxlan_vni }}"
|
||||
- name: FELIX_VXLANPORT
|
||||
value: "{{ calico_vxlan_port }}"
|
||||
{% endif %}
|
||||
# Choose the backend to use.
|
||||
- name: CALICO_NETWORKING_BACKEND
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: calico-config
|
||||
key: calico_backend
|
||||
# Cluster type to identify the deployment type
|
||||
- name: CLUSTER_TYPE
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: calico-config
|
||||
key: cluster_type
|
||||
# Set noderef for node controller.
|
||||
- name: CALICO_K8S_NODE_REF
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
# Disable file logging so `kubectl logs` works.
|
||||
- name: CALICO_DISABLE_FILE_LOGGING
|
||||
value: "true"
|
||||
# Set Felix endpoint to host default action to ACCEPT.
|
||||
- name: FELIX_DEFAULTENDPOINTTOHOSTACTION
|
||||
value: "{{ calico_endpoint_to_host_action|default('RETURN') }}"
|
||||
- name: FELIX_HEALTHHOST
|
||||
value: "{{ calico_healthhost }}"
|
||||
{% if kube_proxy_mode == 'ipvs' and kube_apiserver_node_port_range is defined %}
|
||||
- name: FELIX_KUBENODEPORTRANGES
|
||||
value: "{{ kube_apiserver_node_port_range.split('-')[0] }}:{{ kube_apiserver_node_port_range.split('-')[1] }}"
|
||||
{% endif %}
|
||||
- name: FELIX_IPTABLESBACKEND
|
||||
value: "{{ calico_iptables_backend }}"
|
||||
- name: FELIX_IPTABLESLOCKTIMEOUTSECS
|
||||
value: "{{ calico_iptables_lock_timeout_secs }}"
|
||||
# should be set in etcd before deployment
|
||||
# # Configure the IP Pool from which Pod IPs will be chosen.
|
||||
# - name: CALICO_IPV4POOL_CIDR
|
||||
# value: "{{ calico_pool_cidr | default(kube_pods_subnet) }}"
|
||||
- name: CALICO_IPV4POOL_IPIP
|
||||
value: "{{ calico_ipv4pool_ipip }}"
|
||||
- name: FELIX_IPV6SUPPORT
|
||||
value: "{{ enable_dual_stack_networks | default(false) }}"
|
||||
# Set Felix logging to "info"
|
||||
- name: FELIX_LOGSEVERITYSCREEN
|
||||
value: "{{ calico_loglevel }}"
|
||||
# Set Calico startup logging to "error"
|
||||
- name: CALICO_STARTUP_LOGLEVEL
|
||||
value: "{{ calico_node_startup_loglevel }}"
|
||||
# Enable or disable usage report
|
||||
- name: FELIX_USAGEREPORTINGENABLED
|
||||
value: "{{ calico_usage_reporting }}"
|
||||
# Set MTU for tunnel device used if ipip is enabled
|
||||
{% if calico_mtu is defined %}
|
||||
# Set MTU for tunnel device used if ipip is enabled
|
||||
- name: FELIX_IPINIPMTU
|
||||
value: "{{ calico_veth_mtu | default(calico_mtu) }}"
|
||||
# Set MTU for the VXLAN tunnel device.
|
||||
- name: FELIX_VXLANMTU
|
||||
value: "{{ calico_veth_mtu | default(calico_mtu) }}"
|
||||
# Set MTU for the Wireguard tunnel device.
|
||||
- name: FELIX_WIREGUARDMTU
|
||||
value: "{{ calico_veth_mtu | default(calico_mtu) }}"
|
||||
{% endif %}
|
||||
- name: FELIX_CHAININSERTMODE
|
||||
value: "{{ calico_felix_chaininsertmode }}"
|
||||
- name: FELIX_PROMETHEUSMETRICSENABLED
|
||||
value: "{{ calico_felix_prometheusmetricsenabled }}"
|
||||
- name: FELIX_PROMETHEUSMETRICSPORT
|
||||
value: "{{ calico_felix_prometheusmetricsport }}"
|
||||
- name: FELIX_PROMETHEUSGOMETRICSENABLED
|
||||
value: "{{ calico_felix_prometheusgometricsenabled }}"
|
||||
- name: FELIX_PROMETHEUSPROCESSMETRICSENABLED
|
||||
value: "{{ calico_felix_prometheusprocessmetricsenabled }}"
|
||||
{% if calico_ip_auto_method is defined %}
|
||||
- name: IP_AUTODETECTION_METHOD
|
||||
value: "{{ calico_ip_auto_method }}"
|
||||
{% else %}
|
||||
- name: NODEIP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: IP_AUTODETECTION_METHOD
|
||||
value: "can-reach=$(NODEIP)"
|
||||
{% endif %}
|
||||
- name: IP
|
||||
value: "autodetect"
|
||||
{% if calico_ip6_auto_method is defined and enable_dual_stack_networks %}
|
||||
- name: IP6_AUTODETECTION_METHOD
|
||||
value: "{{ calico_ip6_auto_method }}"
|
||||
{% endif %}
|
||||
{% if calico_felix_mtu_iface_pattern is defined %}
|
||||
- name: FELIX_MTUIFACEPATTERN
|
||||
value: "{{ calico_felix_mtu_iface_pattern }}"
|
||||
{% endif %}
|
||||
{% if enable_dual_stack_networks %}
|
||||
- name: IP6
|
||||
value: autodetect
|
||||
{% endif %}
|
||||
{% if calico_use_default_route_src_ipaddr|default(false) %}
|
||||
- name: FELIX_DEVICEROUTESOURCEADDRESS
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
{% endif %}
|
||||
- name: NODENAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: FELIX_HEALTHENABLED
|
||||
value: "true"
|
||||
- name: FELIX_IGNORELOOSERPF
|
||||
value: "{{ calico_node_ignorelooserpf }}"
|
||||
- name: CALICO_MANAGE_CNI
|
||||
value: "true"
|
||||
{% if calico_node_extra_envs is defined %}
|
||||
{% for key in calico_node_extra_envs %}
|
||||
- name: {{ key }}
|
||||
value: "{{ calico_node_extra_envs[key] }}"
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
securityContext:
|
||||
privileged: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: {{ calico_node_cpu_limit }}
|
||||
memory: {{ calico_node_memory_limit }}
|
||||
requests:
|
||||
cpu: {{ calico_node_cpu_requests }}
|
||||
memory: {{ calico_node_memory_requests }}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /bin/calico-node
|
||||
- -shutdown
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/calico-node
|
||||
- -felix-live
|
||||
{% if calico_network_backend == "bird" %}
|
||||
- -bird-live
|
||||
{% endif %}
|
||||
periodSeconds: 10
|
||||
initialDelaySeconds: 10
|
||||
timeoutSeconds: {{ calico_node_livenessprobe_timeout | default(10) }}
|
||||
failureThreshold: 6
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/calico-node
|
||||
{% if calico_network_backend == "bird" %}
|
||||
- -bird-ready
|
||||
{% endif %}
|
||||
- -felix-ready
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: {{ calico_node_readinessprobe_timeout | default(10) }}
|
||||
failureThreshold: 6
|
||||
volumeMounts:
|
||||
- mountPath: /lib/modules
|
||||
name: lib-modules
|
||||
readOnly: true
|
||||
- mountPath: /var/run/calico
|
||||
name: var-run-calico
|
||||
readOnly: false
|
||||
- mountPath: /var/lib/calico
|
||||
name: var-lib-calico
|
||||
readOnly: false
|
||||
{% if calico_datastore == "etcd" %}
|
||||
- mountPath: /calico-secrets
|
||||
name: etcd-certs
|
||||
readOnly: true
|
||||
{% endif %}
|
||||
- name: xtables-lock
|
||||
mountPath: /run/xtables.lock
|
||||
readOnly: false
|
||||
# For maintaining CNI plugin API credentials.
|
||||
- mountPath: /host/etc/cni/net.d
|
||||
name: cni-net-dir
|
||||
readOnly: false
|
||||
{% if typha_secure %}
|
||||
- name: typha-client
|
||||
mountPath: /etc/typha-client
|
||||
readOnly: true
|
||||
- name: typha-cacert
|
||||
subPath: ca.crt
|
||||
mountPath: /etc/typha-ca/ca.crt
|
||||
readOnly: true
|
||||
{% endif %}
|
||||
- name: policysync
|
||||
mountPath: /var/run/nodeagent
|
||||
{% if calico_bpf_enabled %}
|
||||
# For eBPF mode, we need to be able to mount the BPF filesystem at /sys/fs/bpf so we mount in the
|
||||
# parent directory.
|
||||
- name: sysfs
|
||||
mountPath: /sys/fs/
|
||||
# Bidirectional means that, if we mount the BPF filesystem at /sys/fs/bpf it will propagate to the host.
|
||||
# If the host is known to mount that filesystem already then Bidirectional can be omitted.
|
||||
mountPropagation: Bidirectional
|
||||
{% endif %}
|
||||
- name: cni-log-dir
|
||||
mountPath: /var/log/calico/cni
|
||||
readOnly: true
|
||||
volumes:
|
||||
# Used by calico/node.
|
||||
- name: lib-modules
|
||||
hostPath:
|
||||
path: /lib/modules
|
||||
- name: var-run-calico
|
||||
hostPath:
|
||||
path: /var/run/calico
|
||||
- name: var-lib-calico
|
||||
hostPath:
|
||||
path: /var/lib/calico
|
||||
# Used to install CNI.
|
||||
- name: cni-net-dir
|
||||
hostPath:
|
||||
path: /etc/cni/net.d
|
||||
- name: cni-bin-dir
|
||||
hostPath:
|
||||
path: /opt/cni/bin
|
||||
{% if calico_datastore == "etcd" %}
|
||||
# Mount in the etcd TLS secrets.
|
||||
- name: etcd-certs
|
||||
hostPath:
|
||||
path: "{{ calico_cert_dir }}"
|
||||
{% endif %}
|
||||
# Mount the global iptables lock file, used by calico/node
|
||||
- name: xtables-lock
|
||||
hostPath:
|
||||
path: /run/xtables.lock
|
||||
type: FileOrCreate
|
||||
{% if calico_datastore == "kdd" %}
|
||||
# Mount in the directory for host-local IPAM allocations. This is
|
||||
# used when upgrading from host-local to calico-ipam, and can be removed
|
||||
# if not using the upgrade-ipam init container.
|
||||
- name: host-local-net-dir
|
||||
hostPath:
|
||||
path: /var/lib/cni/networks
|
||||
{% endif %}
|
||||
{% if typha_enabled and typha_secure %}
|
||||
- name: typha-client
|
||||
secret:
|
||||
secretName: typha-client
|
||||
items:
|
||||
- key: tls.crt
|
||||
path: typha-client.crt
|
||||
- key: tls.key
|
||||
path: typha-client.key
|
||||
- name: typha-cacert
|
||||
hostPath:
|
||||
path: "/etc/kubernetes/ssl/"
|
||||
{% endif %}
|
||||
{% if calico_bpf_enabled %}
|
||||
- name: sysfs
|
||||
hostPath:
|
||||
path: /sys/fs/
|
||||
type: DirectoryOrCreate
|
||||
{% endif %}
|
||||
# Used to access CNI logs.
|
||||
- name: cni-log-dir
|
||||
hostPath:
|
||||
path: /var/log/calico/cni
|
||||
# Used to create per-pod Unix Domain Sockets
|
||||
- name: policysync
|
||||
hostPath:
|
||||
type: DirectoryOrCreate
|
||||
path: /var/run/nodeagent
|
||||
# Used to install Flex Volume Driver
|
||||
- name: flexvol-driver-host
|
||||
hostPath:
|
||||
type: DirectoryOrCreate
|
||||
path: "{{ kubelet_flexvolumes_plugins_dir | default('/usr/libexec/kubernetes/kubelet-plugins/volume/exec') }}/nodeagent~uds"
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: {{ serial | default('20%') }}
|
||||
type: RollingUpdate
|
||||
@@ -0,0 +1,190 @@
|
||||
# This manifest creates a Service, which will be backed by Calico's Typha daemon.
|
||||
# Typha sits in between Felix and the API server, reducing Calico's load on the API server.
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: calico-typha
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: calico-typha
|
||||
spec:
|
||||
ports:
|
||||
- port: 5473
|
||||
protocol: TCP
|
||||
targetPort: calico-typha
|
||||
name: calico-typha
|
||||
{% if typha_prometheusmetricsenabled %}
|
||||
- port: {{ typha_prometheusmetricsport }}
|
||||
protocol: TCP
|
||||
targetPort: http-metrics
|
||||
name: metrics
|
||||
{% endif %}
|
||||
selector:
|
||||
k8s-app: calico-typha
|
||||
|
||||
---
|
||||
|
||||
# This manifest creates a Deployment of Typha to back the above service.
|
||||
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: calico-typha
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: calico-typha
|
||||
spec:
|
||||
# Number of Typha replicas. To enable Typha, set this to a non-zero value *and* set the
|
||||
# typha_service_name variable in the calico-config ConfigMap above.
|
||||
#
|
||||
# We recommend using Typha if you have more than 50 nodes. Above 100 nodes it is essential
|
||||
# (when using the Kubernetes datastore). Use one replica for every 100-200 nodes. In
|
||||
# production, we recommend running at least 3 replicas to reduce the impact of rolling upgrade.
|
||||
replicas: {{ typha_replicas }}
|
||||
revisionHistoryLimit: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: calico-typha
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: calico-typha
|
||||
annotations:
|
||||
cluster-autoscaler.kubernetes.io/safe-to-evict: 'true'
|
||||
{% if typha_prometheusmetricsenabled %}
|
||||
prometheus.io/scrape: 'true'
|
||||
prometheus.io/port: "{{ typha_prometheusmetricsport }}"
|
||||
{% endif %}
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
hostNetwork: true
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
# Since Calico can't network a pod until Typha is up, we need to run Typha itself
|
||||
# as a host-networked pod.
|
||||
serviceAccountName: calico-node
|
||||
priorityClassName: system-cluster-critical
|
||||
# fsGroup allows using projected serviceaccount tokens as described here kubernetes/kubernetes#82573
|
||||
securityContext:
|
||||
fsGroup: 65534
|
||||
containers:
|
||||
- image: {{ calico_typha_image_repo }}:{{ calico_typha_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
name: calico-typha
|
||||
ports:
|
||||
- containerPort: 5473
|
||||
name: calico-typha
|
||||
protocol: TCP
|
||||
{% if typha_prometheusmetricsenabled %}
|
||||
- containerPort: {{ typha_prometheusmetricsport }}
|
||||
name: http-metrics
|
||||
protocol: TCP
|
||||
{% endif %}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
# Allow KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT to be overridden for eBPF mode.
|
||||
name: kubernetes-services-endpoint
|
||||
optional: true
|
||||
env:
|
||||
# Enable "info" logging by default. Can be set to "debug" to increase verbosity.
|
||||
- name: TYPHA_LOGSEVERITYSCREEN
|
||||
value: "info"
|
||||
# Disable logging to file and syslog since those don't make sense in Kubernetes.
|
||||
- name: TYPHA_LOGFILEPATH
|
||||
value: "none"
|
||||
- name: TYPHA_LOGSEVERITYSYS
|
||||
value: "none"
|
||||
# Monitor the Kubernetes API to find the number of running instances and rebalance
|
||||
# connections.
|
||||
- name: TYPHA_CONNECTIONREBALANCINGMODE
|
||||
value: "kubernetes"
|
||||
- name: TYPHA_DATASTORETYPE
|
||||
value: "kubernetes"
|
||||
- name: TYPHA_HEALTHENABLED
|
||||
value: "true"
|
||||
- name: TYPHA_MAXCONNECTIONSLOWERLIMIT
|
||||
value: "{{ typha_max_connections_lower_limit }}"
|
||||
{% if typha_secure %}
|
||||
- name: TYPHA_CAFILE
|
||||
value: /etc/ca/ca.crt
|
||||
- name: TYPHA_CLIENTCN
|
||||
value: typha-client
|
||||
- name: TYPHA_SERVERCERTFILE
|
||||
value: /etc/typha/server_certificate.pem
|
||||
- name: TYPHA_SERVERKEYFILE
|
||||
value: /etc/typha/server_key.pem
|
||||
{% endif %}
|
||||
{% if typha_prometheusmetricsenabled %}
|
||||
# Since Typha is host-networked,
|
||||
# this opens a port on the host, which may need to be secured.
|
||||
- name: TYPHA_PROMETHEUSMETRICSENABLED
|
||||
value: "true"
|
||||
- name: TYPHA_PROMETHEUSMETRICSPORT
|
||||
value: "{{ typha_prometheusmetricsport }}"
|
||||
{% endif %}
|
||||
{% if typha_secure %}
|
||||
volumeMounts:
|
||||
- mountPath: /etc/typha
|
||||
name: typha-server
|
||||
readOnly: true
|
||||
- mountPath: /etc/ca/ca.crt
|
||||
subPath: ca.crt
|
||||
name: cacert
|
||||
readOnly: true
|
||||
{% endif %}
|
||||
# Needed for version >=3.7 when the 'host-local' ipam is used
|
||||
# Should never happen given templates/cni-calico.conflist.j2
|
||||
# Configure route aggregation based on pod CIDR.
|
||||
# - name: USE_POD_CIDR
|
||||
# value: "true"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /liveness
|
||||
port: 9098
|
||||
host: localhost
|
||||
periodSeconds: 30
|
||||
initialDelaySeconds: 30
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readiness
|
||||
port: 9098
|
||||
host: localhost
|
||||
periodSeconds: 10
|
||||
{% if typha_secure %}
|
||||
volumes:
|
||||
- name: typha-server
|
||||
secret:
|
||||
secretName: typha-server
|
||||
items:
|
||||
- key: tls.crt
|
||||
path: server_certificate.pem
|
||||
- key: tls.key
|
||||
path: server_key.pem
|
||||
- name: cacert
|
||||
hostPath:
|
||||
path: "{{ kube_cert_dir }}"
|
||||
{% endif %}
|
||||
|
||||
---
|
||||
|
||||
# This manifest creates a Pod Disruption Budget for Typha to allow K8s Cluster Autoscaler to evict
|
||||
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: calico-typha
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: calico-typha
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: calico-typha
|
||||
@@ -0,0 +1,6 @@
|
||||
#!/bin/bash
|
||||
ETCD_ENDPOINTS={{ etcd_access_addresses }} \
|
||||
ETCD_CA_CERT_FILE={{ calico_cert_dir }}/ca_cert.crt \
|
||||
ETCD_CERT_FILE={{ calico_cert_dir }}/cert.crt \
|
||||
ETCD_KEY_FILE={{ calico_cert_dir }}/key.pem \
|
||||
{{ bin_dir }}/calicoctl --allow-version-mismatch "$@"
|
||||
@@ -0,0 +1,8 @@
|
||||
#!/bin/bash
|
||||
DATASTORE_TYPE=kubernetes \
|
||||
{% if inventory_hostname in groups['kube_control_plane'] %}
|
||||
KUBECONFIG=/etc/kubernetes/admin.conf \
|
||||
{% else %}
|
||||
KUBECONFIG=/etc/cni/net.d/calico-kubeconfig \
|
||||
{% endif %}
|
||||
{{ bin_dir }}/calicoctl --allow-version-mismatch "$@"
|
||||
@@ -0,0 +1,86 @@
|
||||
{
|
||||
"name": "{{ calico_cni_name }}",
|
||||
"cniVersion":"0.3.1",
|
||||
"plugins":[
|
||||
{
|
||||
{% if calico_datastore == "kdd" %}
|
||||
"datastore_type": "kubernetes",
|
||||
"nodename": "__KUBERNETES_NODE_NAME__",
|
||||
{% else %}
|
||||
{% if cloud_provider is defined %}
|
||||
"nodename": "{{ calico_kubelet_name.stdout }}",
|
||||
{% else %}
|
||||
"nodename": "{{ calico_baremetal_nodename }}",
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
"type": "calico",
|
||||
"log_level": "info",
|
||||
{% if calico_cni_log_file_path %}
|
||||
"log_file_path": "{{ calico_cni_log_file_path }}",
|
||||
{% endif %}
|
||||
{% if calico_datastore == "etcd" %}
|
||||
"etcd_endpoints": "{{ etcd_access_addresses }}",
|
||||
"etcd_cert_file": "{{ calico_cert_dir }}/cert.crt",
|
||||
"etcd_key_file": "{{ calico_cert_dir }}/key.pem",
|
||||
"etcd_ca_cert_file": "{{ calico_cert_dir }}/ca_cert.crt",
|
||||
{% endif %}
|
||||
{% if calico_ipam_host_local is defined %}
|
||||
"ipam": {
|
||||
"type": "host-local",
|
||||
"subnet": "usePodCidr"
|
||||
},
|
||||
{% else %}
|
||||
"ipam": {
|
||||
"type": "calico-ipam",
|
||||
{% if enable_dual_stack_networks %}
|
||||
"assign_ipv6": "true",
|
||||
{% if calico_cni_pool_ipv6 %}
|
||||
"ipv6_pools": ["{{ calico_pool_cidr_ipv6 | default(kube_pods_subnet_ipv6) }}"],
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% if calico_cni_pool %}
|
||||
"ipv4_pools": ["{{ calico_pool_cidr | default(kube_pods_subnet) }}"],
|
||||
{% endif %}
|
||||
"assign_ipv4": "true"
|
||||
},
|
||||
{% endif %}
|
||||
{% if calico_allow_ip_forwarding %}
|
||||
"container_settings": {
|
||||
"allow_ip_forwarding": true
|
||||
},
|
||||
{% endif %}
|
||||
{% if (calico_feature_control is defined) and (calico_feature_control|length > 0) %}
|
||||
"feature_control": {
|
||||
{% for fc in calico_feature_control -%}
|
||||
{% set fcval = calico_feature_control[fc] -%}
|
||||
"{{ fc }}": {{ (fcval | string | lower) if (fcval == true or fcval == false) else "\"" + fcval + "\"" }}{{ "," if not loop.last else "" }}
|
||||
{% endfor -%}
|
||||
{{- "" }}
|
||||
},
|
||||
{% endif %}
|
||||
{% if enable_network_policy %}
|
||||
"policy": {
|
||||
"type": "k8s"
|
||||
},
|
||||
{% endif %}
|
||||
{% if calico_mtu is defined and calico_mtu is number %}
|
||||
"mtu": {{ calico_mtu }},
|
||||
{% endif %}
|
||||
"kubernetes": {
|
||||
"kubeconfig": "__KUBECONFIG_FILEPATH__"
|
||||
}
|
||||
},
|
||||
{
|
||||
"type":"portmap",
|
||||
"capabilities": {
|
||||
"portMappings": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"type":"bandwidth",
|
||||
"capabilities": {
|
||||
"bandwidth": true
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
namespace: kube-system
|
||||
name: kubernetes-services-endpoint
|
||||
data:
|
||||
{% if calico_bpf_enabled %}
|
||||
{% if loadbalancer_apiserver is defined %}
|
||||
KUBERNETES_SERVICE_HOST: "{{ apiserver_loadbalancer_domain_name }}"
|
||||
KUBERNETES_SERVICE_PORT: "{{ loadbalancer_apiserver.port | default(kube_apiserver_port) }}"
|
||||
{%- elif use_localhost_as_kubeapi_loadbalancer|default(False)|bool %}
|
||||
KUBERNETES_SERVICE_HOST: "127.0.0.1"
|
||||
KUBERNETES_SERVICE_PORT: "{{ kube_apiserver_port }}"
|
||||
{%- else %}
|
||||
KUBERNETES_SERVICE_HOST: "{{ first_kube_control_plane_address }}"
|
||||
KUBERNETES_SERVICE_PORT: "{{ kube_apiserver_port }}"
|
||||
{%- endif %}
|
||||
{% endif %}
|
||||
@@ -0,0 +1,102 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Author: Smana smainklh@gmail.com
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -o errexit
|
||||
set -o pipefail
|
||||
usage()
|
||||
{
|
||||
cat << EOF
|
||||
Create self signed certificates
|
||||
|
||||
Usage : $(basename $0) -f <config> [-d <ssldir>]
|
||||
-h | --help : Show this message
|
||||
-f | --config : Openssl configuration file
|
||||
-d | --ssldir : Directory where the certificates will be installed
|
||||
-c | --cadir : Directory where the existing CA is located
|
||||
-s | --service : Service for the ca
|
||||
|
||||
ex :
|
||||
$(basename $0) -f openssl.conf -d /srv/ssl
|
||||
EOF
|
||||
}
|
||||
|
||||
# Options parsing
|
||||
while (($#)); do
|
||||
case "$1" in
|
||||
-h | --help) usage; exit 0;;
|
||||
-f | --config) CONFIG=${2}; shift 2;;
|
||||
-d | --ssldir) SSLDIR="${2}"; shift 2;;
|
||||
-c | --cadir) CADIR="${2}"; shift 2;;
|
||||
-s | --service) SERVICE="${2}"; shift 2;;
|
||||
*)
|
||||
usage
|
||||
echo "ERROR : Unknown option"
|
||||
exit 3
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [ -z ${CONFIG} ]; then
|
||||
echo "ERROR: the openssl configuration file is missing. option -f"
|
||||
exit 1
|
||||
fi
|
||||
if [ -z ${SSLDIR} ]; then
|
||||
SSLDIR="/etc/calico/certs"
|
||||
fi
|
||||
|
||||
tmpdir=$(mktemp -d /tmp/calico_${SERVICE}_certs.XXXXXX)
|
||||
trap 'rm -rf "${tmpdir}"' EXIT
|
||||
cd "${tmpdir}"
|
||||
|
||||
mkdir -p ${SSLDIR} ${CADIR}
|
||||
|
||||
# Root CA
|
||||
if [ -e "$CADIR/ca.key" ]; then
|
||||
# Reuse existing CA
|
||||
cp $CADIR/{ca.crt,ca.key} .
|
||||
else
|
||||
openssl genrsa -out ca.key {{certificates_key_size}} > /dev/null 2>&1
|
||||
openssl req -x509 -new -nodes -key ca.key -days {{certificates_duration}} -out ca.crt -subj "/CN=calico-${SERVICE}-ca" > /dev/null 2>&1
|
||||
fi
|
||||
|
||||
if [ $SERVICE == "typha" ]; then
|
||||
# Typha server
|
||||
openssl genrsa -out typha-server.key {{certificates_key_size}} > /dev/null 2>&1
|
||||
openssl req -new -key typha-server.key -out typha-server.csr -subj "/CN=typha-server" -config ${CONFIG} > /dev/null 2>&1
|
||||
openssl x509 -req -in typha-server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out typha-server.crt -days {{certificates_duration}} -extensions ssl_client -extfile ${CONFIG} > /dev/null 2>&1
|
||||
|
||||
# Typha client
|
||||
openssl genrsa -out typha-client.key {{certificates_key_size}} > /dev/null 2>&1
|
||||
openssl req -new -key typha-client.key -out typha-client.csr -subj "/CN=typha-client" -config ${CONFIG} > /dev/null 2>&1
|
||||
openssl x509 -req -in typha-client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out typha-client.crt -days {{certificates_duration}} -extensions ssl_client -extfile ${CONFIG} > /dev/null 2>&1
|
||||
|
||||
elif [ $SERVICE == "apiserver" ]; then
|
||||
# calico-apiserver
|
||||
openssl genrsa -out apiserver.key {{certificates_key_size}} > /dev/null 2>&1
|
||||
openssl req -new -key apiserver.key -out apiserver.csr -subj "/CN=calico-apiserver" -config ${CONFIG} > /dev/null 2>&1
|
||||
openssl x509 -req -in apiserver.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out apiserver.crt -days {{certificates_duration}} -extensions ssl_client_apiserver -extfile ${CONFIG} > /dev/null 2>&1
|
||||
else
|
||||
echo "ERROR: the openssl configuration file is missing. option -s"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Install certs
|
||||
if [ -e "$CADIR/ca.key" ]; then
|
||||
# No pass existing CA
|
||||
rm -f ca.crt ca.key
|
||||
fi
|
||||
|
||||
mv {*.crt,*.key} ${SSLDIR}/
|
||||
Reference in New Issue
Block a user