20c7e31ea3
* Add calico 3.7.3 support * add calico_datastore variable to policy controller role * add missing clusterrole rules for calico policy controller * disable calico kube controller when kdd mode is used for versions < 3.6
130 lines
4.2 KiB
Django/Jinja
130 lines
4.2 KiB
Django/Jinja
# This manifest creates a Service, which will be backed by Calico's Typha daemon.
|
|
# Typha sits in between Felix and the API server, reducing Calico's load on the API server.
|
|
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: calico-typha
|
|
namespace: kube-system
|
|
labels:
|
|
k8s-app: calico-typha
|
|
spec:
|
|
ports:
|
|
- port: 5473
|
|
protocol: TCP
|
|
targetPort: calico-typha
|
|
name: calico-typha
|
|
selector:
|
|
k8s-app: calico-typha
|
|
|
|
---
|
|
|
|
# This manifest creates a Deployment of Typha to back the above service.
|
|
|
|
apiVersion: apps/v1beta1
|
|
kind: Deployment
|
|
metadata:
|
|
name: calico-typha
|
|
namespace: kube-system
|
|
labels:
|
|
k8s-app: calico-typha
|
|
spec:
|
|
# Number of Typha replicas. To enable Typha, set this to a non-zero value *and* set the
|
|
# typha_service_name variable in the calico-config ConfigMap above.
|
|
#
|
|
# We recommend using Typha if you have more than 50 nodes. Above 100 nodes it is essential
|
|
# (when using the Kubernetes datastore). Use one replica for every 100-200 nodes. In
|
|
# production, we recommend running at least 3 replicas to reduce the impact of rolling upgrade.
|
|
replicas: {{ typha_replicas }}
|
|
revisionHistoryLimit: 2
|
|
template:
|
|
metadata:
|
|
labels:
|
|
k8s-app: calico-typha
|
|
annotations:
|
|
# This, along with the CriticalAddonsOnly toleration below, marks the pod as a critical
|
|
# add-on, ensuring it gets priority scheduling and that its resources are reserved
|
|
# if it ever gets evicted.
|
|
scheduler.alpha.kubernetes.io/critical-pod: ''
|
|
cluster-autoscaler.kubernetes.io/safe-to-evict: 'true'
|
|
spec:
|
|
nodeSelector:
|
|
beta.kubernetes.io/os: linux
|
|
hostNetwork: true
|
|
dnsPolicy: ClusterFirstWithHostNet
|
|
tolerations:
|
|
# Mark the pod as a critical add-on for rescheduling.
|
|
- key: CriticalAddonsOnly
|
|
operator: Exists
|
|
# Since Calico can't network a pod until Typha is up, we need to run Typha itself
|
|
# as a host-networked pod.
|
|
serviceAccountName: calico-node
|
|
containers:
|
|
# - image: calico/typha:v3.4.4
|
|
- image: {{ calico_typha_image_repo }}:{{ calico_typha_image_tag }}
|
|
name: calico-typha
|
|
ports:
|
|
- containerPort: 5473
|
|
name: calico-typha
|
|
protocol: TCP
|
|
env:
|
|
# Enable "info" logging by default. Can be set to "debug" to increase verbosity.
|
|
- name: TYPHA_LOGSEVERITYSCREEN
|
|
value: "info"
|
|
# Disable logging to file and syslog since those don't make sense in Kubernetes.
|
|
- name: TYPHA_LOGFILEPATH
|
|
value: "none"
|
|
- name: TYPHA_LOGSEVERITYSYS
|
|
value: "none"
|
|
# Monitor the Kubernetes API to find the number of running instances and rebalance
|
|
# connections.
|
|
- name: TYPHA_CONNECTIONREBALANCINGMODE
|
|
value: "kubernetes"
|
|
- name: TYPHA_DATASTORETYPE
|
|
value: "kubernetes"
|
|
- name: TYPHA_HEALTHENABLED
|
|
value: "true"
|
|
# Uncomment these lines to enable prometheus metrics. Since Typha is host-networked,
|
|
# this opens a port on the host, which may need to be secured.
|
|
#- name: TYPHA_PROMETHEUSMETRICSENABLED
|
|
# value: "true"
|
|
#- name: TYPHA_PROMETHEUSMETRICSPORT
|
|
# value: "9093"
|
|
|
|
# Needed for version >=3.7 when the 'host-local' ipam is used
|
|
# Should never happen given templates/cni-calico.conflist.j2
|
|
# Configure route aggregation based on pod CIDR.
|
|
# - name: USE_POD_CIDR
|
|
# value: "true"
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- calico-typha
|
|
- check
|
|
- liveness
|
|
periodSeconds: 30
|
|
initialDelaySeconds: 30
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- calico-typha
|
|
- check
|
|
- readiness
|
|
periodSeconds: 10
|
|
|
|
---
|
|
|
|
# This manifest creates a Pod Disruption Budget for Typha to allow K8s Cluster Autoscaler to evict
|
|
|
|
apiVersion: policy/v1beta1
|
|
kind: PodDisruptionBudget
|
|
metadata:
|
|
name: calico-typha
|
|
namespace: kube-system
|
|
labels:
|
|
k8s-app: calico-typha
|
|
spec:
|
|
maxUnavailable: 1
|
|
selector:
|
|
matchLabels:
|
|
k8s-app: calico-typha
|