3a39904011
By default Calico CNI does not create any network access policies or profiles if 'policy' is enabled in CNI config. And without any policies/profiles network access to/from PODs is blocked. K8s related policies are created by calico-policy-controller in such case. So we need to start it as soon as possible, before any real workloads. This patch also fixes kube-api port in calico-policy-controller yaml template. Closes #1132
26 lines
724 B
Django/Jinja
26 lines
724 B
Django/Jinja
{
|
|
"name": "calico-k8s-network",
|
|
{% if not legacy_calicoctl %}
|
|
"hostname": "{{ ansible_hostname }}",
|
|
{% endif %}
|
|
"type": "calico",
|
|
"etcd_endpoints": "{{ etcd_access_endpoint }}",
|
|
"etcd_cert_file": "{{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem",
|
|
"etcd_key_file": "{{ etcd_cert_dir }}/node-{{ inventory_hostname }}-key.pem",
|
|
"etcd_ca_cert_file": "{{ etcd_cert_dir }}/ca.pem",
|
|
"log_level": "info",
|
|
"ipam": {
|
|
"type": "calico-ipam"
|
|
},
|
|
{% if enable_network_policy %}
|
|
"policy": {
|
|
"type": "k8s"
|
|
},
|
|
{% endif %}
|
|
{% if calico_mtu is defined and calico_mtu is number %}
|
|
"mtu": {{ calico_mtu }},
|
|
{% endif %}
|
|
"kubernetes": {
|
|
"kubeconfig": "{{ kube_config_dir }}/node-kubeconfig.yaml"
|
|
}
|
|
}
|