Merge branch 'kubernetes-sigs:master' into hetzner_flatcar
This commit is contained in:
florianow
GitHub
commit
73ff8144c2
21 changed files with 351 additions and 390 deletions
10
README.md
10
README.md
|
|
@ -135,7 +135,7 @@ Note: Upstart/SysV init based OS types are not supported.
|
|||
## Supported Components
|
||||
|
||||
- Core
|
||||
- [kubernetes](https://github.com/kubernetes/kubernetes) v1.24.4
|
||||
- [kubernetes](https://github.com/kubernetes/kubernetes) v1.24.5
|
||||
- [etcd](https://github.com/etcd-io/etcd) v3.5.4
|
||||
- [docker](https://www.docker.com/) v20.10 (see note)
|
||||
- [containerd](https://containerd.io/) v1.6.8
|
||||
|
|
@ -144,7 +144,7 @@ Note: Upstart/SysV init based OS types are not supported.
|
|||
- [cni-plugins](https://github.com/containernetworking/plugins) v1.1.1
|
||||
- [calico](https://github.com/projectcalico/calico) v3.23.3
|
||||
- [canal](https://github.com/projectcalico/canal) (given calico/flannel versions)
|
||||
- [cilium](https://github.com/cilium/cilium) v1.11.7
|
||||
- [cilium](https://github.com/cilium/cilium) v1.12.1
|
||||
- [flannel](https://github.com/flannel-io/flannel) v0.18.1
|
||||
- [kube-ovn](https://github.com/alauda/kube-ovn) v1.9.7
|
||||
- [kube-router](https://github.com/cloudnativelabs/kube-router) v1.5.1
|
||||
|
|
@ -152,12 +152,12 @@ Note: Upstart/SysV init based OS types are not supported.
|
|||
- [weave](https://github.com/weaveworks/weave) v2.8.1
|
||||
- [kube-vip](https://github.com/kube-vip/kube-vip) v0.4.2
|
||||
- Application
|
||||
- [cert-manager](https://github.com/jetstack/cert-manager) v1.9.0
|
||||
- [cert-manager](https://github.com/jetstack/cert-manager) v1.9.1
|
||||
- [coredns](https://github.com/coredns/coredns) v1.8.6
|
||||
- [ingress-nginx](https://github.com/kubernetes/ingress-nginx) v1.3.1
|
||||
- [krew](https://github.com/kubernetes-sigs/krew) v0.4.3
|
||||
- [argocd](https://argoproj.github.io/) v2.4.7
|
||||
- [helm](https://helm.sh/) v3.9.2
|
||||
- [argocd](https://argoproj.github.io/) v2.4.12
|
||||
- [helm](https://helm.sh/) v3.9.4
|
||||
- [metallb](https://metallb.universe.tf/) v0.12.1
|
||||
- [registry](https://github.com/distribution/distribution) v2.8.1
|
||||
- Storage Plugin
|
||||
|
|
|
|||
|
|
@ -56,7 +56,7 @@ cilium_operator_extra_volume_mounts:
|
|||
## Choose Cilium version
|
||||
|
||||
```yml
|
||||
cilium_version: v1.11.3
|
||||
cilium_version: v1.12.1
|
||||
```
|
||||
|
||||
## Add variable to config
|
||||
|
|
|
|||
|
|
@ -210,7 +210,7 @@ metallb_speaker_enabled: true
|
|||
# my_asn: 4200000000
|
||||
|
||||
argocd_enabled: false
|
||||
# argocd_version: v2.4.7
|
||||
# argocd_version: v2.4.12
|
||||
# argocd_namespace: argocd
|
||||
# Default password:
|
||||
# - https://argo-cd.readthedocs.io/en/stable/getting_started/#4-login-using-the-cli
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ kube_token_dir: "{{ kube_config_dir }}/tokens"
|
|||
kube_api_anonymous_auth: true
|
||||
|
||||
## Change this to use another Kubernetes version, e.g. a current beta release
|
||||
kube_version: v1.24.4
|
||||
kube_version: v1.24.5
|
||||
|
||||
# Where the binaries will be downloaded.
|
||||
# Note: ensure that you've enough disk space (about 1G)
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
---
|
||||
# cilium_version: "v1.11.7"
|
||||
# cilium_version: "v1.12.1"
|
||||
|
||||
# Log-level
|
||||
# cilium_debug: false
|
||||
|
|
@ -118,6 +118,7 @@
|
|||
# https://docs.cilium.io/en/stable/concepts/networking/masquerading/
|
||||
# By default, all packets from a pod destined to an IP address outside of the cilium_native_routing_cidr range are masqueraded
|
||||
# cilium_ip_masq_agent_enable: false
|
||||
|
||||
### A packet sent from a pod to a destination which belongs to any CIDR from the nonMasqueradeCIDRs is not going to be masqueraded
|
||||
# cilium_non_masquerade_cidrs:
|
||||
# - 10.0.0.0/8
|
||||
|
|
|
|||
|
|
@ -115,12 +115,12 @@ flannel_cni_version: "v1.1.0"
|
|||
cni_version: "v1.1.1"
|
||||
weave_version: 2.8.1
|
||||
pod_infra_version: "3.6"
|
||||
cilium_version: "v1.11.7"
|
||||
cilium_version: "v1.12.1"
|
||||
kube_ovn_version: "v1.9.7"
|
||||
kube_ovn_dpdk_version: "19.11-{{ kube_ovn_version }}"
|
||||
kube_router_version: "v1.5.1"
|
||||
multus_version: "v3.8-{{ image_arch }}"
|
||||
helm_version: "v3.9.2"
|
||||
helm_version: "v3.9.4"
|
||||
nerdctl_version: "0.22.2"
|
||||
krew_version: "v0.4.3"
|
||||
|
||||
|
|
@ -184,11 +184,13 @@ crictl_checksums:
|
|||
# Kubernetes versions above Kubespray's current target version are untested and should be used with caution.
|
||||
kubelet_checksums:
|
||||
arm:
|
||||
v1.24.5: ce55155d1aff0c72effee19c6bef534c2b7d1b23ec701d70335d181bd2d12a87
|
||||
v1.24.4: f9d387c18159a4473e7bdc290780ba1b1c92e8d8b41f558c15ee044db54636cd
|
||||
v1.24.3: fe34b1a0892cdfb015f66be8f2d3450130a5d04f9466732020e186c8da0ee799
|
||||
v1.24.2: e484fb000dcfdcf7baca79451745e29764747a27d36f3fc1dda5815b9cbc9b22
|
||||
v1.24.1: 393d130a1715205a253b2f70dbd1f00d1a52ab89b4f3684ed116a937e68116ec
|
||||
v1.24.0: fd19ff957c73e5397f9af931c82bdb95791e47dc7d3135d38720ecda211758a3
|
||||
v1.23.11: 93bbe3a130dcd7d5732e8b949f13ba8728bb37d3d4bd58408f99352cf484f9d0
|
||||
v1.23.10: d6d5aa26f16e735962cac5f2ee8ddc0d3b9d2aa14b8e968cb55fc9745f9a8b03
|
||||
v1.23.9: f22edc9838eb3d0788d951c1fc8fdb0e1bf6c43ad638a215172f25b54ca27a8a
|
||||
v1.23.8: 53c4f44ba10d9c53a4526fccb4d20146e52473788058684ca2de74ae0e1abb11
|
||||
|
|
@ -200,6 +202,7 @@ kubelet_checksums:
|
|||
v1.23.2: f9e83b3bd99b9e70cd98a5f8dc75a89d3d51548d51e4e05615cdc48d6144f908
|
||||
v1.23.1: 29868f172ef171ae990deafcdc13af7fe5b00f0a546ae81c267c4ad01231c3ce
|
||||
v1.23.0: 7417fc7cd624a85887f0a28054f58f7534143579fe85285d0b68c8984c95f2ba
|
||||
v1.22.14: b2f2bcb73bb367b7ea4834b41e01818f8aaa25c725e641008e6f320a9274851b
|
||||
v1.22.13: c2230f8ff03102502b6f9f10dcc494af6c536fd8f1f9467aa42ba684da4e9106
|
||||
v1.22.12: bb50b896769cb5e53101ef36e580095b8e546ea0dc194687e662824248b183ac
|
||||
v1.22.11: 528e01a436b1b91edaa192ecc6befff5f5a2e17f9f340e3f4908b8bed1cebbe9
|
||||
|
|
@ -215,11 +218,13 @@ kubelet_checksums:
|
|||
v1.22.1: f42bc00f274be7ce0578b359cbccc48ead03894b599f5bf4d10e44c305fbab65
|
||||
v1.22.0: 4354dc8db1d8ca336eb940dd73adcd3cf17cbdefbf11889602420f6ee9c6c4bb
|
||||
arm64:
|
||||
v1.24.5: dd5dcea80828979981654ec0732b197be252a3259a527cbc299d9575bc2de3e8
|
||||
v1.24.4: 2d9817c1e9e1edd9480aa05862ea6e9655a9512d820b1933175f5d7c8253ca61
|
||||
v1.24.3: 6c04ae25ee9b434f40e0d2466eb4ef5604dc43f306ddf1e5f165fc9d3c521e12
|
||||
v1.24.2: 40a8460e104fbf97abee9763f6e1f2143debc46cc6c9a1a18e21c1ff9960d8c0
|
||||
v1.24.1: c2189c6956afda0f6002839f9f14a9b48c89dcc0228701e84856be36a3aac6bf
|
||||
v1.24.0: 8f066c9a048dd1704bf22ccf6e994e2fa2ea1175c9768a786f6cb6608765025e
|
||||
v1.23.11: ce4f568c3193e8e0895062f783980da89adb6b54a399c797656a3ce172ddb2fc
|
||||
v1.23.10: 8ce1c79ee7c5d346719e3637e72a51dd96fc7f2e1f443aa39b05c1d9d9de32c8
|
||||
v1.23.9: c11b14ab3fa8e567c54e893c5a937f53618b26c9b62416cc8aa7760835f68350
|
||||
v1.23.8: 1b4ec707e29e8136e3516a437cb541a79c52c69b1331a7add2b47e7ac7d032e6
|
||||
|
|
@ -231,6 +236,7 @@ kubelet_checksums:
|
|||
v1.23.2: 65372ad077a660dfb8a863432c8a22cd0b650122ca98ce2e11f51a536449339f
|
||||
v1.23.1: c24e4ab211507a39141d227595610383f7c5686cae3795b7d75eebbce8606f3d
|
||||
v1.23.0: a546fb7ccce69c4163e4a0b19a31f30ea039b4e4560c23fd6e3016e2b2dfd0d9
|
||||
v1.22.14: 663287b907c4aed4dfde55639da15a0d23fd0608b13afa9cf71fc3da850f3660
|
||||
v1.22.13: f8c1ec9fec6b36646ac05e1e26f0cd3e20395b500eca8ee3baeb3ca59935fdb0
|
||||
v1.22.12: 0e58133c153be32e8e61004cfdc18f8a02ef465f979c6d5bf3e998fbe3f89fca
|
||||
v1.22.11: d20398fa95ee724d63c3263af65eeb49e56c963fcace92efed2d2d0f6084c11a
|
||||
|
|
@ -246,11 +252,13 @@ kubelet_checksums:
|
|||
v1.22.1: d5ffd67d8285fb224a1c49622fd739131f7b941e3d68f233dec96e72c9ebee63
|
||||
v1.22.0: cea637a7da4f1097b16b0195005351c07032a820a3d64c3ff326b9097cfac930
|
||||
amd64:
|
||||
v1.24.5: 2448debe26e90341b038d7ccfcd55942c76ef3d9db48e42ceae5e8de3fbad631
|
||||
v1.24.4: 0f34d12aaa1b911adbf75dd63df03d0674dde921fa0571a51acd2b5b576ba0a4
|
||||
v1.24.3: da575ceb7c44fddbe7d2514c16798f39f8c10e54b5dbef3bcee5ac547637db11
|
||||
v1.24.2: 13da57d32be1debad3d8923e481f30aaa46bca7030b7e748b099d403b30e5343
|
||||
v1.24.1: fc352d5c983b0ccf47acd8816eb826d781f408d27263dd8f761dfb63e69abfde
|
||||
v1.24.0: 3d98ac8b4fb8dc99f9952226f2565951cc366c442656a889facc5b1b2ec2ba52
|
||||
v1.23.11: b0e6d413f9b4cf1007fcb9f0ea6460ed5273a50c945ae475c224036b0ab817f7
|
||||
v1.23.10: c2ba75b36000103af6fa2c3955c5b8a633b33740e234931441082e21a334b80b
|
||||
v1.23.9: a5975920be1de0768e77ef101e4e42b179406add242c0883a7dc598f2006d387
|
||||
v1.23.8: 1ba15ad4d9d99cfc3cbef922b5101492ad74e812629837ac2e5705a68cb7af1e
|
||||
|
|
@ -262,6 +270,7 @@ kubelet_checksums:
|
|||
v1.23.2: c3c4be17910935d234b776288461baf7a9c6a7414d1f1ac2ef8d3a1af4e41ab6
|
||||
v1.23.1: 7ff47abf62096a41005d18c6d482cf73f26b613854173327fa9f2b98720804d4
|
||||
v1.23.0: 4756ff345dd80704b749d87efb8eb294a143a1f4a251ec586197d26ad20ea518
|
||||
v1.22.14: 76b1512da1104b4e80e23fa2c4d1cbd87b865f7bc25a41a46932cf0a219469ac
|
||||
v1.22.13: f55a72f5546ecf463f54e9220a1c38179b94b32ba561dfd6ec1f2fbe8231d640
|
||||
v1.22.12: d54539bd0fa43b43e9ad2ac4e6644bcb3f1e98b8fc371befba7ac362d93a6b00
|
||||
v1.22.11: 50fb1ede16c15dfe0bcb9fa98148d969ae8efeb8b599ce5eb5f09ab78345c9d1
|
||||
|
|
@ -277,11 +286,13 @@ kubelet_checksums:
|
|||
v1.22.1: 2079780ad2ff993affc9b8e1a378bf5ee759bf87fdc446e6a892a0bbd7353683
|
||||
v1.22.0: fec5c596f7f815f17f5d7d955e9707df1ef02a2ca5e788b223651f83376feb7f
|
||||
ppc64le:
|
||||
v1.24.5: 56844b2594212e81d7cd4470f81da5d0f79876f044ee6d1707166fe76fdcb03a
|
||||
v1.24.4: 38475815448bd5d43e893b6a9ac9fd3ae8b0dbddf8a7ba92d3f83437b5c1b916
|
||||
v1.24.3: 0bfb73c1932c8593ef6281efc6d16bf440275fed1272466f76101ea0f0971907
|
||||
v1.24.2: 43e9354dfc46b6d3579a6c9a3e49a2f079fec8e63c3ed998143ab2f05790d132
|
||||
v1.24.1: c59319571efe34ad9bcc4edfe89f5e324d9026d1c3182d86cadc00cfc77f7a06
|
||||
v1.24.0: d41d62f6aeff9f8f9b1a1390ed2b17994952966741d6675af8410799bca38931
|
||||
v1.23.11: 64b02bc0f17b9df2b7ca8006d6cb6c1345f32fe6e748fcb6cbe9c4b406b116f6
|
||||
v1.23.10: a8f742b9b1c0b1a70719da6ea52e92d276b5ad6c59db0070aacdc474292c7e7a
|
||||
v1.23.9: 6b05833c938c1d31e7450e93aebff561dfaa43eacafde1a011e0945ec2114fec
|
||||
v1.23.8: f07b6194add802e2e5c5905a79ef744118ccb82ebcbf4e402a11bdb478de2c0f
|
||||
|
|
@ -293,6 +304,7 @@ kubelet_checksums:
|
|||
v1.23.2: 6fdee30ee13149845aac8d110ad6a1894bb35f953e1ecb562ce7c59f63329dca
|
||||
v1.23.1: 9c3dc8ba6888b610e204d4066f0460d5b24037219300bb5f5b254ea7e8d5a4d1
|
||||
v1.23.0: 25c841e08ab2655486813287aa97cadf7524277040599e95c32ed9f206308753
|
||||
v1.22.14: 7d27862fdb447d9d6a3547a1c5f3fd7dd718bc4b3cebbc13af686d169910e5e9
|
||||
v1.22.13: ac81fe025a69834f872d70d696472780e8e5713e0ca2450dcfc2cd9745b55239
|
||||
v1.22.12: 50e418ff8b8d1f4746be37d5658895dfcb892b0a3a8a2dd7320e760d4159826c
|
||||
v1.22.11: 48e6b0e8d4483e7ccce02dd658b4c92be6859bbb235c58e8902182503280a14c
|
||||
|
|
@ -309,11 +321,13 @@ kubelet_checksums:
|
|||
v1.22.0: 957dcc6ae45078ce971af183c0061d60168c15f484dcd978588cc6380236423f
|
||||
kubectl_checksums:
|
||||
arm:
|
||||
v1.24.5: 3ca0fcb90b715f0c13eafe15c9100495a8648d459f1281f3340875d1b0b7e78f
|
||||
v1.24.4: 060c0bb55aa3284c489cf8224ab10296d486b5a2e7f3e5d6440c9382698bf68a
|
||||
v1.24.3: 4ae94095580973931da53fd3b823909d85ca05055d6300f392d9dc9e5748d612
|
||||
v1.24.2: c342216e1d32c28953e13f28ced387feda675b969a196ed69eaeda137fa7486a
|
||||
v1.24.1: 42e880ff20a55e8ec49187d54e2c1367226d220a0a6a1797e7fbf97426762f4f
|
||||
v1.24.0: 410fc0b3c718f8f431fe4f7d5820bf8133b16ffb76187a53fa90929a77a38cbc
|
||||
v1.23.11: 6eaffb8f64929e888137366cf2aa7fd1df2cf851de4f96f62fe70ed4d79f0ef7
|
||||
v1.23.10: b2156478b03b90c0f72fd386ceab2e78b7cf32eab9d9b4696c28d2bb45c9d3ec
|
||||
v1.23.9: 44caabd847c147ded79aa91daa49a5e0ea68ce4a0833b0733df1c8313375ff80
|
||||
v1.23.8: c4a2be3c61f40d4b1b0f61d509b0e361e85f10b7d2a98120d180c023ede7728f
|
||||
|
|
@ -325,6 +339,7 @@ kubectl_checksums:
|
|||
v1.23.2: 6521719af33342f00ebb6cf020848e25152a63ed5f35a94440c08373b7a36173
|
||||
v1.23.1: 52001ed48e9e1c8b8623f3e6b0242111227721e5ddd08fa18046c65c406e35a5
|
||||
v1.23.0: 6152216d88fa4d32da58c67f78b63b3b99bf4d4d726ffb9fb74ea698dccc8644
|
||||
v1.22.14: f8dd8db49ec02d9095ec0ac5409f498505748cfbb6b394addaa6401be2403680
|
||||
v1.22.13: 4228743e4e51403692cf9578b35f3550a769804011126a9be18536ac591e8dd2
|
||||
v1.22.12: 9aa6e8df0dc0c77fd546762ccc78c3f2d349049855c59b0699a3192621590754
|
||||
v1.22.11: 8e0c2a168aac356b3c84e9366ae19c26fc5ecd1344e3ef92f56377ec4ccddc3b
|
||||
|
|
@ -340,11 +355,13 @@ kubectl_checksums:
|
|||
v1.22.1: 50991ec4313ee42da03d60e21b90bc15e3252c97db189d1b66aad5bbb555997b
|
||||
v1.22.0: 6d7c787416a148acffd49746837df4cebb1311c652483dc3d2c8d24ce1cc897e
|
||||
arm64:
|
||||
v1.24.5: a5e348758c0f2b22adeb1b663b4b66781bded895d8ea2a714eb1de81fb00907a
|
||||
v1.24.4: 0aa4a08ff81efe3fc1a8ef880ca2f8622e3b1f93bf622583d7b9bfe3124afe61
|
||||
v1.24.3: bdad4d3063ddb7bfa5ecf17fb8b029d5d81d7d4ea1650e4369aafa13ed97149a
|
||||
v1.24.2: 5a4c3652f08b4d095b686e1323ac246edbd8b6e5edd5a2626fb71afbcd89bc79
|
||||
v1.24.1: b817b54183e089494f8b925096e9b65af3a356d87f94b73929bf5a6028a06271
|
||||
v1.24.0: 449278789de283648e4076ade46816da249714f96e71567e035e9d17e1fff06d
|
||||
v1.23.11: 9416cc7abaf03eb83f854a45a41986bf4e1232d129d7caafc3101a01ca11b0e3
|
||||
v1.23.10: d88b7777b3227dd49f44dbd1c7b918f9ddc5d016ecc47547a717a501fcdc316b
|
||||
v1.23.9: 66659f614d06d0fe80c5eafdba7073940906de98ea5ee2a081d84fa37d8c5a21
|
||||
v1.23.8: b293fce0b3dec37d3f5b8875b8fddc64e02f0f54f54dd7742368973c52530890
|
||||
|
|
@ -356,6 +373,7 @@ kubectl_checksums:
|
|||
v1.23.2: 6e7bb8ddc5fc8fa89a4c31aba02942718b092a5107585bd09a83c95039c7510b
|
||||
v1.23.1: c0c24c7f6a974390e15148a575c84878e925f32328ff96ae173ec762678e4524
|
||||
v1.23.0: 1d77d6027fc8dfed772609ad9bd68f611b7e4ce73afa949f27084ad3a92b15fe
|
||||
v1.22.14: 942c5f0e7be658ed047d8691df3f80cf1dd00a642fb7eab5c5367cb2f8e937e6
|
||||
v1.22.13: e3e845bac0e1c30de20438433a8d75c64c237892245887a2818bd877b9601b41
|
||||
v1.22.12: 7d6507ecb8061f7d94d1bd6b982c56b1a1f929427bcc27a962fe66c61100f12a
|
||||
v1.22.11: 35da77af0581740aa8815c461ee912181fbb4cec09c2e0c9f6dbee58a48758a6
|
||||
|
|
@ -371,11 +389,13 @@ kubectl_checksums:
|
|||
v1.22.1: 5c7ef1e505c35a8dc0b708f6b6ecdad6723875bb85554e9f9c3fe591e030ae5c
|
||||
v1.22.0: 8d9cc92dcc942f5ea2b2fc93c4934875d9e0e8ddecbde24c7d4c4e092cfc7afc
|
||||
amd64:
|
||||
v1.24.5: 3037f2ec62956e7146fc86defb052d8d3b28e2daa199d7e3ff06d1e06a6286ed
|
||||
v1.24.4: 4a76c70217581ba327f0ad0a0a597c1a02c62222bb80fbfea4f2f5cb63f3e2d8
|
||||
v1.24.3: 8a45348bdaf81d46caf1706c8bf95b3f431150554f47d444ffde89e8cdd712c1
|
||||
v1.24.2: f15fb430afd79f79ef7cf94a4e402cd212f02d8ec5a5e6a7ba9c3d5a2f954542
|
||||
v1.24.1: 0ec3c2dbafc6dd27fc8ad25fa27fc527b5d7356d1830c0efbb8adcf975d9e84a
|
||||
v1.24.0: 94d686bb6772f6fb59e3a32beff908ab406b79acdfb2427abdc4ac3ce1bb98d7
|
||||
v1.23.11: cf04ad2fa1cf118a951d690af0afbbe8f5fc4f02c721c848080d466e6159111e
|
||||
v1.23.10: 3ffa658e7f1595f622577b160bdcdc7a5a90d09d234757ffbe53dd50c0cb88f7
|
||||
v1.23.9: 053561f7c68c5a037a69c52234e3cf1f91798854527692acd67091d594b616ce
|
||||
v1.23.8: 299803a347e2e50def7740c477f0dedc69fc9e18b26b2f10e9ff84a411edb894
|
||||
|
|
@ -387,6 +407,7 @@ kubectl_checksums:
|
|||
v1.23.2: 5b55b58205acbafa7f4e3fc69d9ce5a9257be63455db318e24db4ab5d651cbde
|
||||
v1.23.1: 156fd5e7ebbedf3c482fd274089ad75a448b04cf42bc53f370e4e4ea628f705e
|
||||
v1.23.0: 2d0f5ba6faa787878b642c151ccb2c3390ce4c1e6c8e2b59568b3869ba407c4f
|
||||
v1.22.14: a4408b32b9729e38c14b38a64ea6f00d67d2127f9c1314fbc2273a37a987a2d2
|
||||
v1.22.13: b96d2bc9137ec63546a29513c40c5d4f74e9f89aa11edc15e3c2f674d5fa3e02
|
||||
v1.22.12: 8e36c8fa431e454e3368c6174ce3111b7f49c28feebdae6801ab3ca45f02d352
|
||||
v1.22.11: a61c697e3c9871da7b609511248e41d9c9fb6d9e50001425876676924761586b
|
||||
|
|
@ -402,11 +423,13 @@ kubectl_checksums:
|
|||
v1.22.1: 78178a8337fc6c76780f60541fca7199f0f1a2e9c41806bded280a4a5ef665c9
|
||||
v1.22.0: 703e70d49b82271535bc66bc7bd469a58c11d47f188889bd37101c9772f14fa1
|
||||
ppc64le:
|
||||
v1.24.5: 0861df1c77336fbe569887a884d62a24fcb6486d43798a8767dba7e5865c3c98
|
||||
v1.24.4: cfd7151471dd9878d48ab8d7bc3cf945c207e130568ee778f1aed9ceb84afd44
|
||||
v1.24.3: 893a83cd636650d1ad50be0e9a2517f2f4434c35646dacd9160b66446aee404e
|
||||
v1.24.2: cacf9b4a539853158b885c39fa714710767aa6c12804fccb7de6b037228b811f
|
||||
v1.24.1: 8812543e6c34101d37ad9d7a7edb91621db0fe992b16bd9beb8e5ddb4c7792c5
|
||||
v1.24.0: 153a1ca1593ef4cb56b16922f8e229986a621d396112f0cfad6fa568ad00fa75
|
||||
v1.23.11: 52556d4e8ba19e8b0a65e4ac70203922b42b054647ec59a0177a2c4f61b903e7
|
||||
v1.23.10: fc0867d7412d7698029413a8307d8e74748d47e402c075e8d6cc79ed772fb232
|
||||
v1.23.9: 141532b62ce75860975d5913bfbf784a09b0abc83ca7d31a6b1eddf28866ce67
|
||||
v1.23.8: 599ed10fc7e8fcb5884485cecf690c7645947d1f144b66d717a3f064f11c0b8f
|
||||
|
|
@ -418,6 +441,7 @@ kubectl_checksums:
|
|||
v1.23.2: 97d50dc4ff0a6c70bbfcbd45f6959e6201c6317392b2894008017380669f6015
|
||||
v1.23.1: 514e50afdb5b8953adfffe4941e903748348830bdd82805fd4489c3334a02a4a
|
||||
v1.23.0: e96f2b16d8a10fe6531dfac9143efa4960432cf2ae8b26ffd174fa00eb28a851
|
||||
v1.22.14: 808ff251575a3fc6afff52bb97a965d9fb2d01dd6d626d6b666759a35efbe612
|
||||
v1.22.13: fd4a8473a57275579eedd64a5d13aabf801cddef9f4a81f11658c40b19f559da
|
||||
v1.22.12: 3855d0a2add2a093772cb024b3cf678ddfa840b4a764f925b0c58ff94aaf13ee
|
||||
v1.22.11: e74b2c62c524b81e22a5e66bf2abe2f036d26bb541663a4383abd6655d365288
|
||||
|
|
@ -434,11 +458,13 @@ kubectl_checksums:
|
|||
v1.22.0: 7ea30171a5db9dfbdc240674f5cde00fb75a8193ef73783950b8d10c810b6a5b
|
||||
kubeadm_checksums:
|
||||
arm:
|
||||
v1.24.5: 973f1ad7da9216fe3e0319a0c4fcb519a21a773cd39a0a445e689bea3d4a27c7
|
||||
v1.24.4: e0c1510ab2ed1cd555abad6f226454a3206aaaf20474da7dcf976ddc86a065d4
|
||||
v1.24.3: dc90c93e2305a7babafc41185a43435a9f3af2ef5d546bbd06e6553898e43d9e
|
||||
v1.24.2: d4bead61c1ba03113281ab96b21530b32e96eea24220bd2aebe1abdec739c266
|
||||
v1.24.1: 1c0b22c941badb40f4fb93e619b4a1c5e4bba7c1c7313f7c7e87d77150f35153
|
||||
v1.24.0: c463bf24981dea705f4ee6e547abd5cc3b3e499843f836aae1a04f5b80abf4c2
|
||||
v1.23.11: 4ea0f63d245d01eccc5c3f2c849e2c799392d5e37c9bc4c0ec7a06a5d3722622
|
||||
v1.23.10: e0db03e8c4c06c3c3e5e29558fa316b0b56ac9d2801751c4a36b2e3f84455b1f
|
||||
v1.23.9: fa265d592d4f85b083919baa80b232deae20acaf2a20095a9c417c4d5324e002
|
||||
v1.23.8: 24d159ac19b519453050a977d2f238873c328e3a9dd3dfe524a32f421b64dadb
|
||||
|
|
@ -450,6 +476,7 @@ kubeadm_checksums:
|
|||
v1.23.2: 63a6ca7dca76475ddef84e4ff84ef058ee2003d0e453b85a52729094025d158e
|
||||
v1.23.1: 77baac1659f7f474ba066ef8ca67a86accc4e40d117e73c6c76a2e62689d8369
|
||||
v1.23.0: b59790cdce297ac0937cc9ce0599979c40bc03601642b467707014686998dbda
|
||||
v1.22.14: d852fd8846253c23b86651469e970295a3930130d5005e533cdc66bf64bd413e
|
||||
v1.22.13: dc8cb74f5f427958eda265c8190c2f12877e71eb4f04269dd85dfa86a8044208
|
||||
v1.22.12: d2d1f19c74186e9247cea9ff9ba484a658bd4985060979babe5c28389e594d0a
|
||||
v1.22.11: b2a5a1c827fe18f4589628cdb69e73c1e65011381ec015e1daa7a31198199302
|
||||
|
|
@ -465,11 +492,13 @@ kubeadm_checksums:
|
|||
v1.22.1: cc08281c5261e860df9a0b5040b8aa2e6d202a243daf25556f5f6d3fd8f2e1e9
|
||||
v1.22.0: 6a002deb0ee191001d5c0e0435e9a995d70aa376d55075c5f61e70ce198433b8
|
||||
arm64:
|
||||
v1.24.5: a68c6dd24ef47825bb34a2ad430d76e6b4d3cbe92187363676993d0538013ac2
|
||||
v1.24.4: 18de228f6087a2e5243bffcd2cc88c40180a4fa83e4de310ad071b4620bdd8b6
|
||||
v1.24.3: ea0fb451b69d78e39548698b32fb8623fad61a1a95483fe0add63e3ffb6e31b5
|
||||
v1.24.2: bd823b934d1445a020f8df5fe544722175024af62adbf6eb27dc7250d5db0548
|
||||
v1.24.1: 04f18fe097351cd16dc91cd3bde979201916686c6f4e1b87bae69ab4479fda04
|
||||
v1.24.0: 3e0fa21b8ebce04ca919fdfea7cc756e5f645166b95d6e4b5d9912d7721f9004
|
||||
v1.23.11: 329d9aa9461baf4a7b7225e664ec1ecd61512b937e1f160f9a303bc0f0d44bbb
|
||||
v1.23.10: 42e957eebef78f6462644d9debc096616054ebd2832e95a176c07c28ebed645c
|
||||
v1.23.9: a0a007023db78e5f78d3d4cf3268b83f093201847c1c107ffb3dc695f988c113
|
||||
v1.23.8: 9b3d8863ea4ab0438881ccfbe285568529462bc77ef4512b515397a002d81b22
|
||||
|
|
@ -481,6 +510,7 @@ kubeadm_checksums:
|
|||
v1.23.2: a29fcde7f92e1abfe992e99f415d3aee0fa381478b4a3987e333438b5380ddff
|
||||
v1.23.1: eb865da197f4595dec21e6fb1fa1751ef25ac66b64fa77fd4411bbee33352a40
|
||||
v1.23.0: 989d117128dcaa923b2c7a917a03f4836c1b023fe1ee723541e0e39b068b93a6
|
||||
v1.22.14: cc03d2bdf29900244ff59614e007786f3ff4820e4d77709067298f5b2db20a9e
|
||||
v1.22.13: 2c42aadc99b46b6b5684acc7dfa630c67cb12c19b17df4cea3d2091ef5753011
|
||||
v1.22.12: d0469a3008411edb50f6562e00f1df28123cf2dc368f1538f1b41e27b0482b1c
|
||||
v1.22.11: 15e1cba65f0db4713bf45ee23dbd01dd30048d20ad97ef985d6b9197f8ae359a
|
||||
|
|
@ -496,11 +526,13 @@ kubeadm_checksums:
|
|||
v1.22.1: 85df7978b2e5bb78064ed0bcce14a39d105a1a3968bb92ee5d2f96a1fa09ed12
|
||||
v1.22.0: 9fc14b993de2c275b54445255d7770bd1d6cdb49f4cf9c227c5b035f658a2351
|
||||
amd64:
|
||||
v1.24.5: 3b9c1844ec0fc3c94015d63470b073a7b219082b6a6424c6b0da9cf97e234aeb
|
||||
v1.24.4: 9ec08e0905c0a29a68676ba9f6dd7de73bef13cfa2b846a45e1c2189572dc57c
|
||||
v1.24.3: 406d5a80712c45d21cdbcc51aab298f0a43170df9477259443d48eac116998ff
|
||||
v1.24.2: 028f73b8e7c2ae389817d34e0cb829a814ce2fac0a535a3aa0708f3133e3e712
|
||||
v1.24.1: 15e3193eecbc69330ada3f340c5a47999959bc227c735fa95e4aa79470c085d0
|
||||
v1.24.0: 5e58a29eaaf69ea80e90d9780d2a2d5f189fd74f94ec3bec9e3823d472277318
|
||||
v1.23.11: 2f10bd298a694d3133ea19192b796a106c282441e4148c114c39376042097692
|
||||
v1.23.10: 43d186c3c58e3f8858c6a22bc71b5441282ac0ccbff6f1d0c2a66ee045986b64
|
||||
v1.23.9: 947571c50ab840796fdd4ffb129154c005dfcb0fe83c6eff392d46cf187fd296
|
||||
v1.23.8: edbd60fd6a7e11c71f848b3a6e5d1b5a2bb8ebd703e5490caa8db267361a7b89
|
||||
|
|
@ -512,6 +544,7 @@ kubeadm_checksums:
|
|||
v1.23.2: 58487391ec37489bb32fe532e367995e9ecaeafdb65c2113ff3675e7a8407219
|
||||
v1.23.1: 4d5766cb90050ee84e15df5e09148072da2829492fdb324521c4fa6d74d3aa34
|
||||
v1.23.0: e21269a058d4ad421cf5818d4c7825991b8ba51cd06286932a33b21293b071b0
|
||||
v1.22.14: c8343a3e8a3056d922e466733486ccbbd8efd01a453a9e93e1cf8a164281e6b2
|
||||
v1.22.13: acbb0dd67b7656d0c70049484ba31c1981b803be0ae8f430dacad67e3e06c121
|
||||
v1.22.12: 9410dcff069993caa7dfe783d35ac2d929ec258a2c3a4f0c3f269f1091931263
|
||||
v1.22.11: da3594b4e905627fd5c158531280e40a71dadf44f1f0b6c061a1b729a898dd9b
|
||||
|
|
@ -527,11 +560,13 @@ kubeadm_checksums:
|
|||
v1.22.1: 50a5f0d186d7aefae309539e9cc7d530ef1a9b45ce690801655c2bee722d978c
|
||||
v1.22.0: 90a48b92a57ff6aef63ff409e2feda0713ca926b2cd243fe7e88a84c483456cc
|
||||
ppc64le:
|
||||
v1.24.5: f416c45ca5826ea3ff13be393911424a0fba3aa30b5557d3d32541551566142a
|
||||
v1.24.4: 00fe93a291ddca28188056e597fc812b798706ea19b2da6f8aaf688f6ea95c0e
|
||||
v1.24.3: 1cb40441d8982362c6d4ffdd9a980a4563dcc5cccc1bb1d7370f0bd7340484d2
|
||||
v1.24.2: 452922d2ec9bfa5e085a879174d1d99adb6212598f3c8ffe15b5e7c3a4e128bb
|
||||
v1.24.1: 74e84b4e6f2c328a169dab33956bc076a2c1670c638764b9163b1080dcb68137
|
||||
v1.24.0: 286de74330365bf660d480297a7aba165a956f6fbb98acd11df2f672e21d7b5c
|
||||
v1.23.11: 9930cfb4ae7663f145c1d08e06c49ab60e28a6613ac5c7b19d047f15c1e24c22
|
||||
v1.23.10: c9f484bd8806f50ce051a28776ef92e3634a1cdc0a47c9483ee77c34cde845c1
|
||||
v1.23.9: 03643613aa6afc6251270adc7681029d4fc10e8a75d553a1d8e63cf5b5a2a8fe
|
||||
v1.23.8: dcfb69f564b34942136cc4cc340b1c800e3e610292e517e68ab5e0157b9510af
|
||||
|
|
@ -543,6 +578,7 @@ kubeadm_checksums:
|
|||
v1.23.2: 2d76c4d9795e25867b9b6fe7853f94efb8c2f2b3052adab4073fddca93eedc01
|
||||
v1.23.1: 6b645c868834197bcb25104f468c601477967341aba6326bdf5d0957dcaa9edc
|
||||
v1.23.0: 895c84055bca698f50ecdf1fc01d2f368563f77384b1dd00bdacbf6d0c825cc1
|
||||
v1.22.14: 0230c40496cde3e40ed141d514869c60b0f2ad60d12a7cff9a963e6934d430b3
|
||||
v1.22.13: 066051f2efb29656a04dbb6a378b813779fedacbf3be7034286b07ad43e364c7
|
||||
v1.22.12: 70c14af98ecaa5d4ac234c827a560df9a020b346af250b6fb8ac9e50943486d3
|
||||
v1.22.11: b2a8d92de208b66e3c2bd03521e26cf84a3977c74242e4f0e6724bdebd861326
|
||||
|
|
@ -645,13 +681,13 @@ krew_archive_checksums:
|
|||
|
||||
helm_archive_checksums:
|
||||
arm:
|
||||
v3.9.2: fb9f0c1c9475c66c2b3579b908c181d519761bbfae963ffac860bc683a2253de
|
||||
v3.9.4: 18ce0f79dcd927fea5b714ca03299929dad05266192d4cde3de6b4c4d4544249
|
||||
arm64:
|
||||
v3.9.2: e4e2f9aad786042d903534e3131bc5300d245c24bbadf64fc46cca1728051dbc
|
||||
v3.9.4: d24163e466f7884c55079d1050968e80a05b633830047116cdfd8ae28d35b0c0
|
||||
amd64:
|
||||
v3.9.2: 3f5be38068a1829670440ccf00b3b6656fd90d0d9cfd4367539f3b13e4c20531
|
||||
v3.9.4: 31960ff2f76a7379d9bac526ddf889fb79241191f1dbe2a24f7864ddcb3f6560
|
||||
ppc64le:
|
||||
v3.9.2: 85ae9bc357095917cdb2d801b7eb62926f3fed6c2dcf07e1280809ad2af3daa9
|
||||
v3.9.4: c63a951415c192397fda07c2f52aa60639b280920381c48d58be6803eb0c22f9
|
||||
|
||||
cri_dockerd_archive_checksums:
|
||||
arm:
|
||||
|
|
@ -987,7 +1023,7 @@ ingress_nginx_kube_webhook_certgen_imae_repo: "{{ kube_image_repo }}/ingress-ngi
|
|||
ingress_nginx_kube_webhook_certgen_imae_tag: "v1.3.0"
|
||||
alb_ingress_image_repo: "{{ docker_image_repo }}/amazon/aws-alb-ingress-controller"
|
||||
alb_ingress_image_tag: "v1.1.9"
|
||||
cert_manager_version: "v1.9.0"
|
||||
cert_manager_version: "v1.9.1"
|
||||
cert_manager_controller_image_repo: "{{ quay_image_repo }}/jetstack/cert-manager-controller"
|
||||
cert_manager_controller_image_tag: "{{ cert_manager_version }}"
|
||||
cert_manager_cainjector_image_repo: "{{ quay_image_repo }}/jetstack/cert-manager-cainjector"
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
---
|
||||
argocd_enabled: false
|
||||
argocd_version: v2.4.7
|
||||
argocd_version: v2.4.12
|
||||
argocd_namespace: argocd
|
||||
# argocd_admin_password:
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
- name: Kubernetes Apps | Install yq
|
||||
become: yes
|
||||
get_url:
|
||||
url: "https://github.com/mikefarah/yq/releases/download/v4.25.3/yq_linux_amd64"
|
||||
url: "https://github.com/mikefarah/yq/releases/download/v4.27.5/yq_linux_{{ host_architecture }}"
|
||||
dest: "{{ bin_dir }}/yq"
|
||||
mode: '0755'
|
||||
|
||||
|
|
|
|||
|
|
@ -24,6 +24,8 @@ vsphere_csi_aggressive_node_drain: False
|
|||
vsphere_csi_aggressive_node_unreachable_timeout: 300
|
||||
vsphere_csi_aggressive_node_not_ready_timeout: 300
|
||||
|
||||
vsphere_csi_node_affinity: {}
|
||||
|
||||
# If this is true, debug information will be displayed but
|
||||
# may contain some private data, so it is recommended to set it to false
|
||||
# in the production environment.
|
||||
|
|
|
|||
|
|
@ -19,6 +19,10 @@ spec:
|
|||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
{% if vsphere_csi_node_affinity %}
|
||||
affinity:
|
||||
{{ vsphere_csi_node_affinity | to_nice_yaml | indent(width=8) }}
|
||||
{% endif %}
|
||||
serviceAccountName: vsphere-csi-node
|
||||
hostNetwork: true
|
||||
dnsPolicy: "ClusterFirstWithHostNet"
|
||||
|
|
|
|||
|
|
@ -108,7 +108,6 @@ spec:
|
|||
protocol: TCP
|
||||
{% endif %}
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ is_fedora_coreos: false
|
|||
disable_swap: true
|
||||
|
||||
## Change this to use another Kubernetes version, e.g. a current beta release
|
||||
kube_version: v1.24.4
|
||||
kube_version: v1.24.5
|
||||
|
||||
## The minimum version working
|
||||
kube_version_min_required: v1.22.0
|
||||
|
|
|
|||
3
roles/network_plugin/calico/vars/rocky-9.yml
Normal file
3
roles/network_plugin/calico/vars/rocky-9.yml
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
---
|
||||
calico_wireguard_packages:
|
||||
- wireguard-tools
|
||||
|
|
@ -1,4 +1,5 @@
|
|||
---
|
||||
cilium_min_version_required: "1.10"
|
||||
# Log-level
|
||||
cilium_debug: false
|
||||
|
||||
|
|
@ -7,7 +8,7 @@ cilium_enable_ipv4: true
|
|||
cilium_enable_ipv6: false
|
||||
|
||||
# Cilium agent health port
|
||||
cilium_agent_health_port: "{%- if cilium_version | regex_replace('v') is version('1.11.6', '>=') -%}9879{%- else -%}9876{%- endif -%}"
|
||||
cilium_agent_health_port: "{%- if cilium_version | regex_replace('v') is version('1.11.6', '>=') -%}9879 {%- else -%} 9876 {%- endif -%}"
|
||||
|
||||
# Identity allocation mode selects how identities are shared between cilium
|
||||
# nodes by setting how they are stored. The options are "crd" or "kvstore".
|
||||
|
|
@ -106,6 +107,7 @@ cilium_wireguard_userspace_fallback: false
|
|||
# https://docs.cilium.io/en/stable/concepts/networking/masquerading/
|
||||
# By default, all packets from a pod destined to an IP address outside of the cilium_native_routing_cidr range are masqueraded
|
||||
cilium_ip_masq_agent_enable: false
|
||||
|
||||
### A packet sent from a pod to a destination which belongs to any CIDR from the nonMasqueradeCIDRs is not going to be masqueraded
|
||||
cilium_non_masquerade_cidrs:
|
||||
- 10.0.0.0/8
|
||||
|
|
@ -201,7 +203,7 @@ cilium_cgroup_host_root: "/run/cilium/cgroupv2"
|
|||
|
||||
# Specifies the ratio (0.0-1.0) of total system memory to use for dynamic
|
||||
# sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
|
||||
cilium_bpf_map_dynamic_size_ratio: "{%- if cilium_version | regex_replace('v') is version('1.8', '>=') -%}0.0025{%- else -%}0.0{%- endif -%}"
|
||||
cilium_bpf_map_dynamic_size_ratio: "0.0025"
|
||||
|
||||
# -- Enables masquerading of IPv4 traffic leaving the node from endpoints.
|
||||
# Available for Cilium v1.10 and up
|
||||
|
|
@ -240,3 +242,8 @@ cilium_disable_cnp_status_updates: true
|
|||
# Configure how long to wait for the Cilium DaemonSet to be ready again
|
||||
cilium_rolling_restart_wait_retries_count: 30
|
||||
cilium_rolling_restart_wait_retries_delay_seconds: 10
|
||||
|
||||
# Cilium changed the default metrics exporter ports in 1.12
|
||||
cilium_agent_scrape_port: "{{ cilium_version | regex_replace('v') is version('1.12', '>=') | ternary('9962', '9090') }}"
|
||||
cilium_operator_scrape_port: "{{ cilium_version | regex_replace('v') is version('1.12', '>=') | ternary('9963', '6942') }}"
|
||||
cilium_hubble_scrape_port: "{{ cilium_version | regex_replace('v') is version('1.12', '>=') | ternary('9965', '9091') }}"
|
||||
|
|
|
|||
|
|
@ -48,13 +48,10 @@
|
|||
msg: "cilium_encryption_type must be either 'ipsec' or 'wireguard'"
|
||||
when: cilium_encryption_enabled
|
||||
|
||||
- name: Stop if `cilium_encryption_type` is set to "wireguard" and cilium_version is < v1.10.0
|
||||
- name: Stop if cilium_version is < v1.10.0
|
||||
assert:
|
||||
that: cilium_version | regex_replace('v') is version('1.10', '>')
|
||||
msg: "cilium_encryption_type is set to 'wireguard' but cilium_version is < v1.10.0"
|
||||
when:
|
||||
- cilium_encryption_enabled
|
||||
- cilium_encryption_type == "wireguard"
|
||||
that: cilium_version | regex_replace('v') is version(cilium_min_version_required, '>=')
|
||||
msg: "cilium_version is too low. Minimum version {{ cilium_min_version_required }}"
|
||||
|
||||
# TODO: Clean this task up when we drop backward compatibility support for `cilium_ipsec_enabled`
|
||||
- name: Set `cilium_encryption_type` to "ipsec" and if `cilium_ipsec_enabled` is true
|
||||
|
|
|
|||
|
|
@ -39,7 +39,14 @@ rules:
|
|||
- get
|
||||
- list
|
||||
- watch
|
||||
{% if cilium_version | regex_replace('v') is version('1.10', '>=') %}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
|
|
@ -47,22 +54,14 @@ rules:
|
|||
- services/status
|
||||
verbs:
|
||||
- update
|
||||
{% endif %}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
# to automatically read from k8s and import the node's pod CIDR to cilium's
|
||||
# etcd so all nodes know how to reach another pod running in in a different
|
||||
# node.
|
||||
- nodes
|
||||
# to perform the translation of a CNP that contains `ToGroup` to its endpoints
|
||||
- services
|
||||
- endpoints
|
||||
# to check apiserver connectivity
|
||||
- namespaces
|
||||
{% if cilium_version | regex_replace('v') is version('1.7', '<') %}
|
||||
- componentstatuses
|
||||
{% endif %}
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
|
|
@ -72,26 +71,22 @@ rules:
|
|||
resources:
|
||||
- ciliumnetworkpolicies
|
||||
- ciliumnetworkpolicies/status
|
||||
- ciliumnetworkpolicies/finalizers
|
||||
- ciliumclusterwidenetworkpolicies
|
||||
- ciliumclusterwidenetworkpolicies/status
|
||||
- ciliumclusterwidenetworkpolicies/finalizers
|
||||
- ciliumendpoints
|
||||
- ciliumendpoints/status
|
||||
{% if cilium_version | regex_replace('v') is version('1.6', '>=') %}
|
||||
- ciliumendpoints/finalizers
|
||||
- ciliumnodes
|
||||
- ciliumnodes/status
|
||||
- ciliumnodes/finalizers
|
||||
- ciliumidentities
|
||||
- ciliumidentities/status
|
||||
{% endif %}
|
||||
{% if cilium_version | regex_replace('v') is version('1.9', '>=') %}
|
||||
- ciliumnetworkpolicies/finalizers
|
||||
- ciliumclusterwidenetworkpolicies/finalizers
|
||||
- ciliumendpoints/finalizers
|
||||
- ciliumnodes/finalizers
|
||||
- ciliumidentities/finalizers
|
||||
- ciliumlocalredirectpolicies
|
||||
- ciliumlocalredirectpolicies/status
|
||||
- ciliumlocalredirectpolicies/finalizers
|
||||
{% endif %}
|
||||
{% if cilium_version | regex_replace('v') is version('1.11', '>=') %}
|
||||
- ciliumendpointslices
|
||||
{% endif %}
|
||||
|
|
@ -101,12 +96,7 @@ rules:
|
|||
- ciliumenvoyconfigs
|
||||
{% endif %}
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- '*'
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
|
|
@ -117,16 +107,12 @@ rules:
|
|||
- list
|
||||
- update
|
||||
- watch
|
||||
{% if cilium_version | regex_replace('v') is version('1.8', '>=') %}
|
||||
# For cilium-operator running in HA mode.
|
||||
#
|
||||
# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election
|
||||
# between mulitple running instances.
|
||||
# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less
|
||||
# common and fewer objects in the cluster watch "all Leases".
|
||||
# The support for leases was introduced in coordination.k8s.io/v1 during Kubernetes 1.14 release.
|
||||
# In Cilium we currently don't support HA mode for K8s version < 1.14. This condition make sure
|
||||
# that we only authorize access to leases resources in supported K8s versions.
|
||||
# For cilium-operator running in HA mode.
|
||||
#
|
||||
# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election
|
||||
# between multiple running instances.
|
||||
# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less
|
||||
# common and fewer objects in the cluster watch "all Leases".
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
|
|
@ -135,4 +121,26 @@ rules:
|
|||
- create
|
||||
- get
|
||||
- update
|
||||
{% if cilium_version | regex_replace('v') is version('1.12', '>=') %}
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- update
|
||||
resourceNames:
|
||||
- ciliumbgploadbalancerippools.cilium.io
|
||||
- ciliumbgppeeringpolicies.cilium.io
|
||||
- ciliumclusterwideenvoyconfigs.cilium.io
|
||||
- ciliumclusterwidenetworkpolicies.cilium.io
|
||||
- ciliumegressgatewaypolicies.cilium.io
|
||||
- ciliumegressnatpolicies.cilium.io
|
||||
- ciliumendpoints.cilium.io
|
||||
- ciliumendpointslices.cilium.io
|
||||
- ciliumenvoyconfigs.cilium.io
|
||||
- ciliumexternalworkloads.cilium.io
|
||||
- ciliumidentities.cilium.io
|
||||
- ciliumlocalredirectpolicies.cilium.io
|
||||
- ciliumnetworkpolicies.cilium.io
|
||||
- ciliumnodes.cilium.io
|
||||
{% endif %}
|
||||
|
|
|
|||
|
|
@ -2,11 +2,11 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: cilium-operator
|
||||
namespace: kube-system
|
||||
labels:
|
||||
io.cilium/app: operator
|
||||
name: cilium-operator
|
||||
name: cilium-operator
|
||||
namespace: kube-system
|
||||
spec:
|
||||
replicas: {{ cilium_operator_replicas }}
|
||||
selector:
|
||||
|
|
@ -22,29 +22,22 @@ spec:
|
|||
metadata:
|
||||
{% if cilium_enable_prometheus %}
|
||||
annotations:
|
||||
prometheus.io/port: "6942"
|
||||
prometheus.io/port: "{{ cilium_operator_scrape_port }}"
|
||||
prometheus.io/scrape: "true"
|
||||
{% endif %}
|
||||
labels:
|
||||
io.cilium/app: operator
|
||||
name: cilium-operator
|
||||
spec:
|
||||
# In HA mode, cilium-operator pods must not be scheduled on the same
|
||||
# node as they will clash with each other.
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: io.cilium/app
|
||||
operator: In
|
||||
values:
|
||||
- operator
|
||||
topologyKey: "kubernetes.io/hostname"
|
||||
containers:
|
||||
- args:
|
||||
- --debug=$(CILIUM_DEBUG)
|
||||
- name: cilium-operator
|
||||
image: "{{ cilium_operator_image_repo }}:{{ cilium_operator_image_tag }}"
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
command:
|
||||
- cilium-operator
|
||||
args:
|
||||
- --config-dir=/tmp/cilium/config-map
|
||||
- --debug=$(CILIUM_DEBUG)
|
||||
{% if cilium_operator_custom_args is string %}
|
||||
- {{ cilium_operator_custom_args }}
|
||||
{% else %}
|
||||
|
|
@ -52,14 +45,7 @@ spec:
|
|||
- {{ flag }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
command:
|
||||
- cilium-operator
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: K8S_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
|
|
@ -76,45 +62,23 @@ spec:
|
|||
key: debug
|
||||
name: cilium-config
|
||||
optional: true
|
||||
# We are already mounting the whole ConfigMap as a directory.
|
||||
# https://github.com/cilium/cilium/pull/10347
|
||||
{% if cilium_version | regex_replace('v') is version('1.8', '<') %}
|
||||
- name: CILIUM_CLUSTER_NAME
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: cluster-name
|
||||
name: cilium-config
|
||||
optional: true
|
||||
- name: CILIUM_CLUSTER_ID
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: cluster-id
|
||||
name: cilium-config
|
||||
optional: true
|
||||
- name: CILIUM_DISABLE_ENDPOINT_CRD
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: disable-endpoint-crd
|
||||
name: cilium-config
|
||||
optional: true
|
||||
{% endif %}
|
||||
- name: AWS_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
name: cilium-aws
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
optional: true
|
||||
- name: AWS_SECRET_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
name: cilium-aws
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
optional: true
|
||||
- name: AWS_DEFAULT_REGION
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: AWS_DEFAULT_REGION
|
||||
name: cilium-aws
|
||||
key: AWS_DEFAULT_REGION
|
||||
optional: true
|
||||
{% if cilium_kube_proxy_replacement == 'strict' %}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
|
|
@ -122,14 +86,16 @@ spec:
|
|||
- name: KUBERNETES_SERVICE_PORT
|
||||
value: "{{ kube_apiserver_global_endpoint | urlsplit('port') }}"
|
||||
{% endif %}
|
||||
image: "{{ cilium_operator_image_repo }}:{{ cilium_operator_image_tag }}"
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
name: cilium-operator
|
||||
{% if cilium_enable_prometheus %}
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
ports:
|
||||
- containerPort: 6942
|
||||
hostPort: 6942
|
||||
name: prometheus
|
||||
- name: prometheus
|
||||
containerPort: {{ cilium_operator_scrape_port }}
|
||||
hostPort: {{ cilium_operator_scrape_port }}
|
||||
protocol: TCP
|
||||
{% endif %}
|
||||
livenessProbe:
|
||||
|
|
@ -146,46 +112,55 @@ spec:
|
|||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
volumeMounts:
|
||||
{% if cilium_identity_allocation_mode == "kvstore" %}
|
||||
- mountPath: /var/lib/etcd-config
|
||||
name: etcd-config-path
|
||||
- name: cilium-config-path
|
||||
mountPath: /tmp/cilium/config-map
|
||||
readOnly: true
|
||||
- mountPath: "{{cilium_cert_dir}}"
|
||||
name: etcd-secrets
|
||||
{% if cilium_identity_allocation_mode == "kvstore" %}
|
||||
- name: etcd-config-path
|
||||
mountPath: /var/lib/etcd-config
|
||||
readOnly: true
|
||||
- name: etcd-secrets
|
||||
mountPath: "{{cilium_cert_dir}}"
|
||||
readOnly: true
|
||||
{% endif %}
|
||||
- mountPath: /tmp/cilium/config-map
|
||||
name: cilium-config-path
|
||||
readOnly: true
|
||||
{% for volume_mount in cilium_operator_extra_volume_mounts %}
|
||||
- {{ volume_mount | to_nice_yaml(indent=2) | indent(14) }}
|
||||
{% endfor %}
|
||||
dnsPolicy: ClusterFirst
|
||||
priorityClassName: system-node-critical
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
restartPolicy: Always
|
||||
priorityClassName: system-node-critical
|
||||
serviceAccount: cilium-operator
|
||||
serviceAccountName: cilium-operator
|
||||
hostNetwork: true
|
||||
# In HA mode, cilium-operator pods must not be scheduled on the same
|
||||
# node as they will clash with each other.
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- topologyKey: kubernetes.io/hostname
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
io.cilium/app: operator
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
volumes:
|
||||
- name: cilium-config-path
|
||||
configMap:
|
||||
name: cilium-config
|
||||
{% if cilium_identity_allocation_mode == "kvstore" %}
|
||||
# To read the etcd config stored in config maps
|
||||
- configMap:
|
||||
- name: etcd-config-path
|
||||
configMap:
|
||||
name: cilium-config
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: etcd-config
|
||||
path: etcd.config
|
||||
name: cilium-config
|
||||
name: etcd-config-path
|
||||
# To read the k8s etcd secrets in case the user might want to use TLS
|
||||
- name: etcd-secrets
|
||||
hostPath:
|
||||
path: "{{cilium_cert_dir}}"
|
||||
{% endif %}
|
||||
- configMap:
|
||||
name: cilium-config
|
||||
name: cilium-config-path
|
||||
{% for volume in cilium_operator_extra_volumes %}
|
||||
- {{ volume | to_nice_yaml(indent=2) | indent(10) }}
|
||||
{% endfor %}
|
||||
|
|
|
|||
|
|
@ -41,8 +41,8 @@ data:
|
|||
# NOTE that this will open the port on ALL nodes where Cilium pods are
|
||||
# scheduled.
|
||||
{% if cilium_enable_prometheus %}
|
||||
prometheus-serve-addr: ":9090"
|
||||
operator-prometheus-serve-addr: ":6942"
|
||||
prometheus-serve-addr: ":{{ cilium_agent_scrape_port }}"
|
||||
operator-prometheus-serve-addr: ":{{ cilium_operator_scrape_port }}"
|
||||
enable-metrics: "true"
|
||||
{% endif %}
|
||||
|
||||
|
|
@ -127,31 +127,6 @@ data:
|
|||
cluster-id: "{{ cilium_cluster_id }}"
|
||||
{% endif %}
|
||||
|
||||
# `tofqdns-enable-poller` is deprecated in 1.8, removed in 1.9
|
||||
# https://github.com/cilium/cilium/issues/8604
|
||||
{% if cilium_version | regex_replace('v') is version('1.9', '<') %}
|
||||
# DNS Polling periodically issues a DNS lookup for each `matchName` from
|
||||
# cilium-agent. The result is used to regenerate endpoint policy.
|
||||
# DNS lookups are repeated with an interval of 5 seconds, and are made for
|
||||
# A(IPv4) and AAAA(IPv6) addresses. Should a lookup fail, the most recent IP
|
||||
# data is used instead. An IP change will trigger a regeneration of the Cilium
|
||||
# policy for each endpoint and increment the per cilium-agent policy
|
||||
# repository revision.
|
||||
#
|
||||
# This option is disabled by default starting from version 1.4.x in favor
|
||||
# of a more powerful DNS proxy-based implementation, see [0] for details.
|
||||
# Enable this option if you want to use FQDN policies but do not want to use
|
||||
# the DNS proxy.
|
||||
#
|
||||
# To ease upgrade, users may opt to set this option to "true".
|
||||
# Otherwise please refer to the Upgrade Guide [1] which explains how to
|
||||
# prepare policy rules for upgrade.
|
||||
#
|
||||
# [0] http://docs.cilium.io/en/stable/policy/language/#dns-based
|
||||
# [1] http://docs.cilium.io/en/stable/install/upgrade/#changes-that-may-require-action
|
||||
tofqdns-enable-poller: "{{cilium_tofqdns_enable_poller}}"
|
||||
{% endif %}
|
||||
|
||||
# `wait-bpf-mount` is removed after v1.10.4
|
||||
# https://github.com/cilium/cilium/commit/d2217045cb3726a7f823174e086913b69b8090da
|
||||
{% if cilium_version | regex_replace('v') is version('1.10.4', '<') %}
|
||||
|
|
@ -159,14 +134,6 @@ data:
|
|||
wait-bpf-mount: "false"
|
||||
{% endif %}
|
||||
|
||||
# `enable-legacy-services` is deprecated in 1.6, removed in 1.9
|
||||
# https://github.com/cilium/cilium/pull/10255
|
||||
{% if cilium_version | regex_replace('v') is version('1.9', '<') %}
|
||||
# Enable legacy services (prior v1.5) to prevent from terminating existing
|
||||
# connections with services when upgrading Cilium from < v1.5 to v1.5.
|
||||
enable-legacy-services: "{{cilium_enable_legacy_services}}"
|
||||
{% endif %}
|
||||
|
||||
kube-proxy-replacement: "{{ cilium_kube_proxy_replacement }}"
|
||||
|
||||
# `native-routing-cidr` is deprecated in 1.10, removed in 1.12.
|
||||
|
|
@ -191,7 +158,7 @@ data:
|
|||
{% if cilium_enable_hubble %}
|
||||
enable-hubble: "true"
|
||||
{% if cilium_enable_hubble_metrics %}
|
||||
hubble-metrics-server: ":9091"
|
||||
hubble-metrics-server: ":{{ cilium_hubble_scrape_port }}"
|
||||
hubble-metrics:
|
||||
{% for hubble_metrics_cycle in cilium_hubble_metrics %}
|
||||
{{ hubble_metrics_cycle }}
|
||||
|
|
@ -228,9 +195,7 @@ data:
|
|||
{% endif %}
|
||||
|
||||
# IPAM settings
|
||||
{% if cilium_version | regex_replace('v') is version('1.9', '>=') %}
|
||||
ipam: "{{ cilium_ipam_mode }}"
|
||||
{% endif %}
|
||||
|
||||
agent-health-port: "{{ cilium_agent_health_port }}"
|
||||
|
||||
|
|
@ -240,10 +205,8 @@ data:
|
|||
|
||||
bpf-map-dynamic-size-ratio: "{{ cilium_bpf_map_dynamic_size_ratio }}"
|
||||
|
||||
{% if cilium_version | regex_replace('v') is version('1.10', '>=') %}
|
||||
enable-ipv4-masquerade: "{{ cilium_enable_ipv4_masquerade }}"
|
||||
enable-ipv6-masquerade: "{{ cilium_enable_ipv6_masquerade }}"
|
||||
{% endif %}
|
||||
|
||||
enable-bpf-masquerade: "{{ cilium_enable_bpf_masquerade }}"
|
||||
|
||||
|
|
@ -258,7 +221,6 @@ data:
|
|||
enable-bpf-clock-probe: "{{ cilium_enable_bpf_clock_probe }}"
|
||||
|
||||
disable-cnp-status-updates: "{{ cilium_disable_cnp_status_updates }}"
|
||||
|
||||
{% if cilium_ip_masq_agent_enable %}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
|
|
|||
|
|
@ -7,9 +7,6 @@ rules:
|
|||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
{% if cilium_version | regex_replace('v') is version('1.7', '<') %}
|
||||
- ingresses
|
||||
{% endif %}
|
||||
- networkpolicies
|
||||
verbs:
|
||||
- get
|
||||
|
|
@ -28,34 +25,25 @@ rules:
|
|||
resources:
|
||||
- namespaces
|
||||
- services
|
||||
- nodes
|
||||
- pods
|
||||
- endpoints
|
||||
{% if cilium_version | regex_replace('v') is version('1.7', '<') %}
|
||||
- componentstatuses
|
||||
{% endif %}
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{% if cilium_version | regex_replace('v') is version('1.7', '<') %}
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{% endif %}
|
||||
{% if cilium_version | regex_replace('v') is version('1.7', '>') %}
|
||||
{% if cilium_version | regex_replace('v') is version('1.12', '<') %}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- pods/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
{% endif %}
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
|
|
@ -66,6 +54,7 @@ rules:
|
|||
- list
|
||||
- watch
|
||||
- update
|
||||
{% endif %}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
|
|
@ -78,47 +67,45 @@ rules:
|
|||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
# Deprecated for removal in v1.10
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
|
||||
# This is used when validating policies in preflight. This will need to stay
|
||||
# until we figure out how to avoid "get" inside the preflight, and then
|
||||
# should be removed ideally.
|
||||
- get
|
||||
- apiGroups:
|
||||
- cilium.io
|
||||
resources:
|
||||
- ciliumnetworkpolicies
|
||||
- ciliumnetworkpolicies/status
|
||||
{% if cilium_version | regex_replace('v') is version('1.7', '>=') %}
|
||||
- ciliumclusterwidenetworkpolicies
|
||||
- ciliumclusterwidenetworkpolicies/status
|
||||
{% endif %}
|
||||
- ciliumendpoints
|
||||
- ciliumendpoints/status
|
||||
{% if cilium_version | regex_replace('v') is version('1.6', '>=') %}
|
||||
- ciliumnodes
|
||||
- ciliumnodes/status
|
||||
- ciliumidentities
|
||||
- ciliumidentities/status
|
||||
{% endif %}
|
||||
{% if cilium_version | regex_replace('v') is version('1.9', '>=') %}
|
||||
- ciliumnetworkpolicies/finalizers
|
||||
- ciliumclusterwidenetworkpolicies/finalizers
|
||||
- ciliumendpoints/finalizers
|
||||
- ciliumnodes/finalizers
|
||||
- ciliumidentities/finalizers
|
||||
- ciliumlocalredirectpolicies
|
||||
- ciliumlocalredirectpolicies/status
|
||||
- ciliumlocalredirectpolicies/finalizers
|
||||
{% endif %}
|
||||
{% if cilium_version | regex_replace('v') is version('1.10', '>=') %}
|
||||
- ciliumegressnatpolicies
|
||||
{% endif %}
|
||||
{% if cilium_version | regex_replace('v') is version('1.11', '>=') %}
|
||||
- ciliumendpointslices
|
||||
{% endif %}
|
||||
{% if cilium_version | regex_replace('v') is version('1.12', '>=') %}
|
||||
- ciliumbgploadbalancerippools
|
||||
- ciliumbgppeeringpolicies
|
||||
{% endif %}
|
||||
{% if cilium_version | regex_replace('v') is version('1.11.5', '<') %}
|
||||
- ciliumnetworkpolicies/finalizers
|
||||
- ciliumclusterwidenetworkpolicies/finalizers
|
||||
- ciliumendpoints/finalizers
|
||||
- ciliumnodes/finalizers
|
||||
- ciliumidentities/finalizers
|
||||
- ciliumlocalredirectpolicies/finalizers
|
||||
{% endif %}
|
||||
verbs:
|
||||
- '*'
|
||||
|
|
@ -128,6 +115,7 @@ rules:
|
|||
resources:
|
||||
- ciliumclusterwideenvoyconfigs
|
||||
- ciliumenvoyconfigs
|
||||
- ciliumegressgatewaypolicies
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
|
|
|
|||
|
|
@ -11,8 +11,3 @@ subjects:
|
|||
- kind: ServiceAccount
|
||||
name: cilium
|
||||
namespace: kube-system
|
||||
{% if cilium_version | regex_replace('v') is version('1.9', '<') %}
|
||||
- apiGroup: rbac.authorization.k8s.io
|
||||
kind: Group
|
||||
name: system:nodes
|
||||
{% endif %}
|
||||
|
|
|
|||
|
|
@ -2,37 +2,37 @@
|
|||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: cilium
|
||||
name: cilium
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: cilium
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: cilium
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
# Specifies the maximum number of Pods that can be unavailable during the update process.
|
||||
maxUnavailable: 2
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{% if cilium_enable_prometheus %}
|
||||
prometheus.io/port: "9090"
|
||||
prometheus.io/port: "{{ cilium_agent_scrape_port }}"
|
||||
prometheus.io/scrape: "true"
|
||||
{% endif %}
|
||||
scheduler.alpha.kubernetes.io/tolerations: '[{"key":"dedicated","operator":"Equal","value":"master","effect":"NoSchedule"}]'
|
||||
labels:
|
||||
k8s-app: cilium
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: k8s-app
|
||||
operator: In
|
||||
values:
|
||||
- cilium
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers:
|
||||
- args:
|
||||
- name: cilium-agent
|
||||
image: "{{cilium_image_repo}}:{{cilium_image_tag}}"
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
command:
|
||||
- cilium-agent
|
||||
args:
|
||||
- --config-dir=/tmp/cilium/config-map
|
||||
{% if cilium_mtu != "" %}
|
||||
- --mtu={{ cilium_mtu }}
|
||||
|
|
@ -44,54 +44,6 @@ spec:
|
|||
- {{ flag }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
command:
|
||||
- cilium-agent
|
||||
env:
|
||||
- name: K8S_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: spec.nodeName
|
||||
- name: CILIUM_K8S_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: CILIUM_CLUSTERMESH_CONFIG
|
||||
value: /var/lib/cilium/clustermesh/
|
||||
{% if cilium_kube_proxy_replacement == 'strict' %}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
value: "{{ kube_apiserver_global_endpoint | urlsplit('hostname') }}"
|
||||
- name: KUBERNETES_SERVICE_PORT
|
||||
value: "{{ kube_apiserver_global_endpoint | urlsplit('port') }}"
|
||||
{% endif %}
|
||||
{% for env_var in cilium_agent_extra_env_vars %}
|
||||
- {{ env_var | to_nice_yaml(indent=2) | indent(10) }}
|
||||
{% endfor %}
|
||||
image: "{{cilium_image_repo}}:{{cilium_image_tag}}"
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
resources:
|
||||
limits:
|
||||
cpu: {{ cilium_cpu_limit }}
|
||||
memory: {{ cilium_memory_limit }}
|
||||
requests:
|
||||
cpu: {{ cilium_cpu_requests }}
|
||||
memory: {{ cilium_memory_requests }}
|
||||
lifecycle:
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
- "/cni-install.sh"
|
||||
{% if cilium_version | regex_replace('v') is version('1.10', '>=') %}
|
||||
- "--cni-exclusive={{ cilium_cni_exclusive }}"
|
||||
{% endif %}
|
||||
{% if cilium_version | regex_replace('v') is version('1.12', '>=') %}
|
||||
- "--log-file={{ cilium_cni_log_file }}"
|
||||
{% endif %}
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /cni-uninstall.sh
|
||||
startupProbe:
|
||||
httpGet:
|
||||
host: '127.0.0.1'
|
||||
|
|
@ -131,80 +83,109 @@ spec:
|
|||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
timeoutSeconds: 5
|
||||
name: cilium-agent
|
||||
env:
|
||||
- name: K8S_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: spec.nodeName
|
||||
- name: CILIUM_K8S_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: CILIUM_CLUSTERMESH_CONFIG
|
||||
value: /var/lib/cilium/clustermesh/
|
||||
{% if cilium_kube_proxy_replacement == 'strict' %}
|
||||
- name: KUBERNETES_SERVICE_HOST
|
||||
value: "{{ kube_apiserver_global_endpoint | urlsplit('hostname') }}"
|
||||
- name: KUBERNETES_SERVICE_PORT
|
||||
value: "{{ kube_apiserver_global_endpoint | urlsplit('port') }}"
|
||||
{% endif %}
|
||||
{% for env_var in cilium_agent_extra_env_vars %}
|
||||
- {{ env_var | to_nice_yaml(indent=2) | indent(10) }}
|
||||
{% endfor %}
|
||||
lifecycle:
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
- "/cni-install.sh"
|
||||
- "--cni-exclusive={{ cilium_cni_exclusive | string | lower }}"
|
||||
{% if cilium_version | regex_replace('v') is version('1.12', '>=') %}
|
||||
- "--enable-debug={{ cilium_debug | string | lower }}"
|
||||
- "--log-file={{ cilium_cni_log_file }}"
|
||||
{% endif %}
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /cni-uninstall.sh
|
||||
resources:
|
||||
limits:
|
||||
cpu: {{ cilium_cpu_limit }}
|
||||
memory: {{ cilium_memory_limit }}
|
||||
requests:
|
||||
cpu: {{ cilium_cpu_requests }}
|
||||
memory: {{ cilium_memory_requests }}
|
||||
{% if cilium_enable_prometheus or cilium_enable_hubble_metrics %}
|
||||
ports:
|
||||
{% endif %}
|
||||
{% if cilium_enable_prometheus %}
|
||||
- containerPort: 9090
|
||||
hostPort: 9090
|
||||
name: prometheus
|
||||
- name: prometheus
|
||||
containerPort: {{ cilium_agent_scrape_port }}
|
||||
hostPort: {{ cilium_agent_scrape_port }}
|
||||
protocol: TCP
|
||||
{% endif %}
|
||||
{% if cilium_enable_hubble_metrics %}
|
||||
- containerPort: 9091
|
||||
hostPort: 9091
|
||||
name: hubble-metrics
|
||||
- name: hubble-metrics
|
||||
containerPort: {{ cilium_hubble_scrape_port }}
|
||||
hostPort: {{ cilium_hubble_scrape_port }}
|
||||
protocol: TCP
|
||||
{% endif %}
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
- mountPath: /sys/fs/bpf
|
||||
name: bpf-maps
|
||||
- name: bpf-maps
|
||||
mountPath: /sys/fs/bpf
|
||||
mountPropagation: Bidirectional
|
||||
- mountPath: /var/run/cilium
|
||||
name: cilium-run
|
||||
- mountPath: /host/opt/cni/bin
|
||||
name: cni-path
|
||||
- mountPath: /host/etc/cni/net.d
|
||||
name: etc-cni-netd
|
||||
# pkg/workloads was depreca, removed in 1.7
|
||||
# https://github.com/cilium/cilium/pull/9447
|
||||
{% if cilium_version | regex_replace('v') is version('1.7', '<') %}
|
||||
{% if container_manager == 'docker' %}
|
||||
- mountPath: /var/run/docker.sock
|
||||
name: docker-socket
|
||||
readOnly: true
|
||||
{% else %}
|
||||
- name: "{{ container_manager }}-socket"
|
||||
mountPath: {{ cri_socket }}
|
||||
readOnly: true
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
- name: cilium-run
|
||||
mountPath: /var/run/cilium
|
||||
- name: cni-path
|
||||
mountPath: /host/opt/cni/bin
|
||||
- name: etc-cni-netd
|
||||
mountPath: /host/etc/cni/net.d
|
||||
{% if cilium_identity_allocation_mode == "kvstore" %}
|
||||
- mountPath: /var/lib/etcd-config
|
||||
name: etcd-config-path
|
||||
- name: etcd-config-path
|
||||
mountPath: /var/lib/etcd-config
|
||||
readOnly: true
|
||||
- mountPath: "{{cilium_cert_dir}}"
|
||||
name: etcd-secrets
|
||||
- name: etcd-secrets
|
||||
mountPath: "{{cilium_cert_dir}}"
|
||||
readOnly: true
|
||||
{% endif %}
|
||||
- mountPath: /var/lib/cilium/clustermesh
|
||||
name: clustermesh-secrets
|
||||
- name: clustermesh-secrets
|
||||
mountPath: /var/lib/cilium/clustermesh
|
||||
readOnly: true
|
||||
- mountPath: /tmp/cilium/config-map
|
||||
name: cilium-config-path
|
||||
- name: cilium-config-path
|
||||
mountPath: /tmp/cilium/config-map
|
||||
readOnly: true
|
||||
{% if cilium_ip_masq_agent_enable %}
|
||||
{% if cilium_ip_masq_agent_enable %}\
|
||||
- name: ip-masq-agent
|
||||
mountPath: /etc/config
|
||||
readOnly: true
|
||||
{% endif %}
|
||||
# Needed to be able to load kernel modules
|
||||
- mountPath: /lib/modules
|
||||
name: lib-modules
|
||||
- name: lib-modules
|
||||
mountPath: /lib/modules
|
||||
readOnly: true
|
||||
- mountPath: /run/xtables.lock
|
||||
name: xtables-lock
|
||||
- name: xtables-lock
|
||||
mountPath: /run/xtables.lock
|
||||
{% if cilium_encryption_enabled and cilium_encryption_type == "ipsec" %}
|
||||
- mountPath: /etc/ipsec
|
||||
name: cilium-ipsec-secrets
|
||||
- name: cilium-ipsec-secrets
|
||||
mountPath: /etc/ipsec
|
||||
readOnly: true
|
||||
{% endif %}
|
||||
{% if cilium_hubble_install %}
|
||||
- mountPath: /var/lib/cilium/tls/hubble
|
||||
name: hubble-tls
|
||||
- name: hubble-tls
|
||||
mountPath: /var/lib/cilium/tls/hubble
|
||||
readOnly: true
|
||||
{% endif %}
|
||||
{% for volume_mount in cilium_agent_extra_volume_mounts %}
|
||||
|
|
@ -245,22 +226,50 @@ spec:
|
|||
securityContext:
|
||||
privileged: true
|
||||
{% endif %}
|
||||
- command:
|
||||
{% if cilium_version | regex_replace('v') is version('1.11.7', '>=') %}
|
||||
- name: apply-sysctl-overwrites
|
||||
image: "{{cilium_image_repo}}:{{cilium_image_tag}}"
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
env:
|
||||
- name: BIN_PATH
|
||||
value: /opt/cni/bin
|
||||
command:
|
||||
- sh
|
||||
- -ec
|
||||
# The statically linked Go program binary is invoked to avoid any
|
||||
# dependency on utilities like sh that can be missing on certain
|
||||
# distros installed on the underlying host. Copy the binary to the
|
||||
# same directory where we install cilium cni plugin so that exec permissions
|
||||
# are available.
|
||||
- |
|
||||
cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;
|
||||
nsenter --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-sysctlfix";
|
||||
rm /hostbin/cilium-sysctlfix
|
||||
volumeMounts:
|
||||
- name: hostproc
|
||||
mountPath: /hostproc
|
||||
- name: cni-path
|
||||
mountPath: /hostbin
|
||||
securityContext:
|
||||
privileged: true
|
||||
{% endif %}
|
||||
- name: clean-cilium-state
|
||||
image: "{{cilium_image_repo}}:{{cilium_image_tag}}"
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
command:
|
||||
- /init-container.sh
|
||||
env:
|
||||
- name: CILIUM_ALL_STATE
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: clean-cilium-state
|
||||
name: cilium-config
|
||||
key: clean-cilium-state
|
||||
optional: true
|
||||
# CLEAN_CILIUM_BPF_STATE is deprecated in 1.6.
|
||||
# https://github.com/cilium/cilium/pull/7478
|
||||
- name: "{{ cilium_version | regex_replace('v') is version('1.6', '<')| ternary('CLEAN_CILIUM_BPF_STATE','CILIUM_BPF_STATE') }}"
|
||||
- name: CILIUM_BPF_STATE
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
key: clean-cilium-bpf-state
|
||||
name: cilium-config
|
||||
key: clean-cilium-bpf-state
|
||||
optional: true
|
||||
# Removed in 1.11 and up.
|
||||
# https://github.com/cilium/cilium/commit/f7a3f59fd74983c600bfce9cac364b76d20849d9
|
||||
|
|
@ -278,32 +287,25 @@ spec:
|
|||
- name: KUBERNETES_SERVICE_PORT
|
||||
value: "{{ kube_apiserver_global_endpoint | urlsplit('port') }}"
|
||||
{% endif %}
|
||||
{% if cilium_version | regex_replace('v') is version('1.9', '<') %}
|
||||
image: "{{cilium_init_image_repo}}:{{cilium_init_image_tag}}"
|
||||
{% else %}
|
||||
image: "{{cilium_image_repo}}:{{cilium_image_tag}}"
|
||||
{% endif %}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
name: clean-cilium-state
|
||||
securityContext:
|
||||
privileged: true
|
||||
volumeMounts:
|
||||
- mountPath: /sys/fs/bpf
|
||||
name: bpf-maps
|
||||
- name: bpf-maps
|
||||
mountPath: /sys/fs/bpf
|
||||
{% if cilium_version | regex_replace('v') is version('1.11', '>=') %}
|
||||
# Required to mount cgroup filesystem from the host to cilium agent pod
|
||||
- name: cilium-cgroup
|
||||
mountPath: {{ cilium_cgroup_host_root }}
|
||||
mountPropagation: HostToContainer
|
||||
{% endif %}
|
||||
- mountPath: /var/run/cilium
|
||||
name: cilium-run
|
||||
- name: cilium-run
|
||||
mountPath: /var/run/cilium
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
priorityClassName: system-node-critical
|
||||
restartPolicy: Always
|
||||
priorityClassName: system-node-critical
|
||||
serviceAccount: cilium
|
||||
serviceAccountName: cilium
|
||||
terminationGracePeriodSeconds: 1
|
||||
|
|
@ -312,36 +314,26 @@ spec:
|
|||
{% if cilium_identity_allocation_mode == "kvstore" %}
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
{% endif %}
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- topologyKey: kubernetes.io/hostname
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
k8s-app: cilium
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
volumes:
|
||||
# To keep state between restarts / upgrades
|
||||
- hostPath:
|
||||
- name: cilium-run
|
||||
hostPath:
|
||||
path: /var/run/cilium
|
||||
type: DirectoryOrCreate
|
||||
name: cilium-run
|
||||
# To keep state between restarts / upgrades for bpf maps
|
||||
- hostPath:
|
||||
- name: bpf-maps
|
||||
hostPath:
|
||||
path: /sys/fs/bpf
|
||||
type: DirectoryOrCreate
|
||||
name: bpf-maps
|
||||
# pkg/workloads was deprecated in 1.6, removed in 1.7
|
||||
# https://github.com/cilium/cilium/pull/9447
|
||||
{% if cilium_version | regex_replace('v') is version('1.7', '<') %}
|
||||
{% if container_manager == 'docker' %}
|
||||
# To read docker events from the node
|
||||
- hostPath:
|
||||
path: /var/run/docker.sock
|
||||
type: Socket
|
||||
name: docker-socket
|
||||
{% else %}
|
||||
# To read crio events from the node
|
||||
- hostPath:
|
||||
path: {{ cri_socket }}
|
||||
type: Socket
|
||||
name: {{ container_manager }}-socket
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% if cilium_version | regex_replace('v') is version('1.11', '>=') %}
|
||||
# To mount cgroup2 filesystem on the host
|
||||
- name: hostproc
|
||||
|
|
@ -355,34 +347,34 @@ spec:
|
|||
type: DirectoryOrCreate
|
||||
{% endif %}
|
||||
# To install cilium cni plugin in the host
|
||||
- hostPath:
|
||||
- name: cni-path
|
||||
hostPath:
|
||||
path: /opt/cni/bin
|
||||
type: DirectoryOrCreate
|
||||
name: cni-path
|
||||
# To install cilium cni configuration in the host
|
||||
- hostPath:
|
||||
- name: etc-cni-netd
|
||||
hostPath:
|
||||
path: /etc/cni/net.d
|
||||
type: DirectoryOrCreate
|
||||
name: etc-cni-netd
|
||||
# To be able to load kernel modules
|
||||
- hostPath:
|
||||
- name: lib-modules
|
||||
hostPath:
|
||||
path: /lib/modules
|
||||
name: lib-modules
|
||||
# To access iptables concurrently with other processes (e.g. kube-proxy)
|
||||
- hostPath:
|
||||
- name: xtables-lock
|
||||
hostPath:
|
||||
path: /run/xtables.lock
|
||||
type: FileOrCreate
|
||||
name: xtables-lock
|
||||
{% if cilium_identity_allocation_mode == "kvstore" %}
|
||||
# To read the etcd config stored in config maps
|
||||
- configMap:
|
||||
- name: etcd-config-path
|
||||
configMap:
|
||||
name: cilium-config
|
||||
# note: the leading zero means this number is in octal representation: do not remove it
|
||||
defaultMode: 0400
|
||||
items:
|
||||
- key: etcd-config
|
||||
path: etcd.config
|
||||
name: cilium-config
|
||||
name: etcd-config-path
|
||||
# To read the k8s etcd secrets in case the user might want to use TLS
|
||||
- name: etcd-secrets
|
||||
hostPath:
|
||||
|
|
@ -391,21 +383,22 @@ spec:
|
|||
# To read the clustermesh configuration
|
||||
- name: clustermesh-secrets
|
||||
secret:
|
||||
secretName: cilium-clustermesh
|
||||
# note: the leading zero means this number is in octal representation: do not remove it
|
||||
defaultMode: 0400
|
||||
optional: true
|
||||
secretName: cilium-clustermesh
|
||||
# To read the configuration from the config map
|
||||
- configMap:
|
||||
- name: cilium-config-path
|
||||
configMap:
|
||||
name: cilium-config
|
||||
name: cilium-config-path
|
||||
{% if cilium_ip_masq_agent_enable %}
|
||||
- configMap:
|
||||
- name: ip-masq-agent
|
||||
configMap:
|
||||
name: ip-masq-agent
|
||||
optional: true
|
||||
items:
|
||||
- key: config
|
||||
path: ip-masq-agent
|
||||
name: ip-masq-agent
|
||||
{% endif %}
|
||||
{% if cilium_encryption_enabled and cilium_encryption_type == "ipsec" %}
|
||||
- name: cilium-ipsec-secrets
|
||||
|
|
@ -420,21 +413,12 @@ spec:
|
|||
sources:
|
||||
- secret:
|
||||
name: hubble-server-certs
|
||||
optional: true
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: client-ca.crt
|
||||
- key: tls.crt
|
||||
path: server.crt
|
||||
- key: tls.key
|
||||
path: server.key
|
||||
optional: true
|
||||
- configMap:
|
||||
name: hubble-ca-cert
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: client-ca.crt
|
||||
optional: true
|
||||
{% endif %}
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
# Specifies the maximum number of Pods that can be unavailable during the update process.
|
||||
maxUnavailable: 2
|
||||
type: RollingUpdate
|
||||
|
|
|
|||
Loading…
Reference in a new issue