Add cilium_ipam_mode variable (#7418)

Starting with Cilium v1.9 the default ipam mode has changed to "Cluster
Scope". See:

https://docs.cilium.io/en/v1.9/concepts/networking/ipam/

With this ipam mode Cilium handles assigning subnets to nodes to use
for pod ip addresses. The default Kubespray deploy uses the Kube
Controller Manager for this (the --allocate-node-cidrs
kube-controller-manager flag is set). This makes the proper ipam mode
for kubespray using cilium v1.9+ "kubernetes".

Tested with Cilium 1.9.5.

This PR also mounts the cilium-config ConfigMap for this variable
to be read properly.

In the future we can probably remove the kvstore and kvstore-opt
Cilium Operator args since they can be in the ConfigMap. I will tackle
that after this merges.
This commit is contained in:
Frank Ritchie 2021-04-01 10:33:22 -04:00 committed by GitHub
parent cce9d3125d
commit f05d6b3711
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 18 additions and 2 deletions

View file

@ -54,3 +54,7 @@ cilium_native_routing_cidr: ""
# IPsec based transparent encryption between nodes # IPsec based transparent encryption between nodes
cilium_ipsec_enabled: false cilium_ipsec_enabled: false
# IP address management mode for v1.9+.
# https://docs.cilium.io/en/v1.9/concepts/networking/ipam/
cilium_ipam_mode: kubernetes

View file

@ -162,3 +162,8 @@ data:
ipsec-key-file: /etc/ipsec/keys ipsec-key-file: /etc/ipsec/keys
encrypt-node: "false" encrypt-node: "false"
{% endif %} {% endif %}
# IPAM settings
{% if cilium_version | regex_replace('v') is version('1.9', '>=') %}
ipam: "{{ cilium_ipam_mode }}"
{% endif %}

View file

@ -44,6 +44,7 @@ spec:
containers: containers:
- args: - args:
- --debug=$(CILIUM_DEBUG) - --debug=$(CILIUM_DEBUG)
- --config-dir=/tmp/cilium/config-map
- --kvstore=etcd - --kvstore=etcd
- --kvstore-opt=etcd.config=/var/lib/etcd-config/etcd.config - --kvstore-opt=etcd.config=/var/lib/etcd-config/etcd.config
command: command:
@ -142,6 +143,9 @@ spec:
- mountPath: "{{cilium_cert_dir}}" - mountPath: "{{cilium_cert_dir}}"
name: etcd-secrets name: etcd-secrets
readOnly: true readOnly: true
- mountPath: /tmp/cilium/config-map
name: cilium-config-path
readOnly: true
dnsPolicy: ClusterFirst dnsPolicy: ClusterFirst
priorityClassName: system-node-critical priorityClassName: system-node-critical
restartPolicy: Always restartPolicy: Always
@ -163,3 +167,6 @@ spec:
- name: etcd-secrets - name: etcd-secrets
hostPath: hostPath:
path: "{{cilium_cert_dir}}" path: "{{cilium_cert_dir}}"
- configMap:
name: cilium-config
name: cilium-config-path