Preparation for osh-infra merger
Change-Id: I14b3c545a6494c11d7f60b37e31af5ec97ef6782
This commit is contained in:
Sergiy Markin
parent
754859ce1d
commit
4b44b4354e
26
charts/calico/Chart.yaml
Normal file
26
charts/calico/Chart.yaml
Normal file
@ -0,0 +1,26 @@
|
|||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
appVersion: v3.25.1
|
||||||
|
description: OpenStack-Helm Calico
|
||||||
|
name: calico
|
||||||
|
version: 0.1.8
|
||||||
|
home: https://github.com/projectcalico/calico
|
||||||
|
icon: https://camo.githubusercontent.com/64c8b5ed6ac97553ae367348e8a59a24e2ed5bdc/687474703a2f2f646f63732e70726f6a65637463616c69636f2e6f72672f696d616765732f66656c69782e706e67
|
||||||
|
sources:
|
||||||
|
- https://github.com/projectcalico/calico
|
||||||
|
- https://opendev.org/openstack/openstack-helm
|
||||||
|
maintainers:
|
||||||
|
- name: OpenStack-Helm Authors
|
||||||
|
...
|
||||||
18
charts/calico/requirements.yaml
Normal file
18
charts/calico/requirements.yaml
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
---
|
||||||
|
dependencies:
|
||||||
|
- name: helm-toolkit
|
||||||
|
repository: file://../deps/helm-toolkit
|
||||||
|
version: ">= 0.1.0"
|
||||||
|
...
|
||||||
102
charts/calico/templates/bin/_calico-settings.sh.tpl
Normal file
102
charts/calico/templates/bin/_calico-settings.sh.tpl
Normal file
@ -0,0 +1,102 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
set -eux
|
||||||
|
|
||||||
|
|
||||||
|
{{/* Robustness, Calico 3.x wants things as Titlecase; this causes pain */}}
|
||||||
|
{{- $_ := set .Values.conf.node "CALICO_IPV4POOL_IPIP" (title .Values.conf.node.CALICO_IPV4POOL_IPIP ) -}}
|
||||||
|
{{- $_ := set .Values.conf.node "CALICO_STARTUP_LOGLEVEL" (title .Values.conf.node.CALICO_STARTUP_LOGLEVEL ) -}}
|
||||||
|
{{- $_ := set .Values.conf.node "FELIX_LOGSEVERITYSCREEN" (title .Values.conf.node.FELIX_LOGSEVERITYSCREEN ) -}}
|
||||||
|
|
||||||
|
|
||||||
|
{{- $envAll := . }}
|
||||||
|
|
||||||
|
{{ if empty .Values.conf.node.CALICO_IPV4POOL_CIDR }}
|
||||||
|
{{ $_ := set .Values.conf.node "CALICO_IPV4POOL_CIDR" .Values.networking.podSubnet }}
|
||||||
|
{{ end }}
|
||||||
|
|
||||||
|
# An idempotent script for interacting with calicoctl to instantiate
|
||||||
|
# peers, and manipulate calico settings that we must perform
|
||||||
|
# post-deployment.
|
||||||
|
|
||||||
|
CTL=/calicoctl
|
||||||
|
|
||||||
|
# Generate configuration the way we want it to be, it doesn't matter
|
||||||
|
# if it's already set, in that case Calico will no nothing.
|
||||||
|
|
||||||
|
# BGPConfiguration: nodeToNodeMeshEnabled & asNumber
|
||||||
|
$CTL apply -f - <<EOF
|
||||||
|
apiVersion: projectcalico.org/v3
|
||||||
|
kind: BGPConfiguration
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
|
spec:
|
||||||
|
asNumber: {{ .Values.networking.bgp.asnumber }}
|
||||||
|
logSeverityScreen: {{ .Values.conf.node.FELIX_LOGSEVERITYSCREEN }}
|
||||||
|
nodeToNodeMeshEnabled: {{ .Values.networking.settings.mesh }}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# FelixConfiguration: ipipEnabled
|
||||||
|
$CTL apply -f - <<EOF
|
||||||
|
apiVersion: projectcalico.org/v3
|
||||||
|
kind: FelixConfiguration
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
|
spec:
|
||||||
|
ipipEnabled: {{ .Values.networking.settings.ippool.ipip.enabled }}
|
||||||
|
logSeverityScreen: {{ .Values.conf.node.FELIX_LOGSEVERITYSCREEN }}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# ipPool - https://docs.projectcalico.org/v3.4/reference/calicoctl/resources/ippool
|
||||||
|
$CTL apply -f - <<EOF
|
||||||
|
apiVersion: projectcalico.org/v3
|
||||||
|
kind: IPPool
|
||||||
|
metadata:
|
||||||
|
name: default-ipv4-ippool
|
||||||
|
spec:
|
||||||
|
cidr: {{ .Values.conf.node.CALICO_IPV4POOL_CIDR }}
|
||||||
|
{{- if .Values.conf.node.CALICO_IPV4POOL_BLOCKSIZE }}
|
||||||
|
blockSize: {{ .Values.conf.node.CALICO_IPV4POOL_BLOCKSIZE }}
|
||||||
|
{{- end }}
|
||||||
|
ipipMode: {{ .Values.conf.node.CALICO_IPV4POOL_IPIP }}
|
||||||
|
natOutgoing: {{ .Values.networking.settings.ippool.nat_outgoing }}
|
||||||
|
disabled: {{ .Values.networking.settings.ippool.disabled }}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
|
||||||
|
# IPv4 peers
|
||||||
|
{{ if .Values.networking.bgp.ipv4.peers }}
|
||||||
|
$CTL apply -f - <<EOF
|
||||||
|
{{ .Values.networking.bgp.ipv4.peers | toYaml }}
|
||||||
|
EOF
|
||||||
|
{{ end }}
|
||||||
|
|
||||||
|
# IPv6 peers
|
||||||
|
{{ if .Values.networking.bgp.ipv6.peers }}
|
||||||
|
$CTL apply -f - <<EOF
|
||||||
|
{{ .Values.networking.bgp.ipv6.peers | toYaml }}
|
||||||
|
EOF
|
||||||
|
{{ end }}
|
||||||
|
|
||||||
|
{{/* gotpl quirks mean it is easier to loop from 0 to 9 looking for a match in an inner loop than trying to extract and sort */}}
|
||||||
|
{{ if .Values.networking.policy }}
|
||||||
|
# Policy and Endpoint rules
|
||||||
|
{{ range $n, $data := tuple 0 1 2 3 4 5 6 7 8 9 }}
|
||||||
|
# Priority: {{ $n }} objects
|
||||||
|
{{- range $section, $data := $envAll.Values.networking.policy }}
|
||||||
|
{{- if eq (toString $data.priority) (toString $n) }}
|
||||||
|
{{/* add a safety check so we don't attempt to run calicoctl with an empty resource set */}}
|
||||||
|
{{- if gt (len $data.rules) 0 }}
|
||||||
|
# Section: {{ $section }} Priority: {{ $data.priority }} {{ $n }}
|
||||||
|
$CTL apply -f - <<EOF
|
||||||
|
{{ $data.rules | toYaml }}
|
||||||
|
EOF
|
||||||
|
{{- else }}
|
||||||
|
echo "Skipping empty rules list."
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{ end }}
|
||||||
|
|
||||||
|
exit 0
|
||||||
57
charts/calico/templates/bin/_install-calicoctl.sh.tpl
Normal file
57
charts/calico/templates/bin/_install-calicoctl.sh.tpl
Normal file
@ -0,0 +1,57 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# instantiate calicoctl in /opt/bin/cni, including a wrapper around
|
||||||
|
# the bin that points to the correct etcd endpoint and etcd
|
||||||
|
# certificate data
|
||||||
|
cp -v /calicoctl /host/opt/cni/bin/calicoctl.bin
|
||||||
|
[ -x /host/opt/cni/bin/calicoctl.bin ] || chmod +x /host/opt/cni/bin/calicoctl.bin
|
||||||
|
|
||||||
|
if [ ! -z "$ETCD_KEY" ]; then
|
||||||
|
DIR=$(dirname /host/$ETCD_KEY_FILE)
|
||||||
|
mkdir -p $DIR
|
||||||
|
cat <<EOF>/host/$ETCD_KEY_FILE
|
||||||
|
$ETCD_KEY
|
||||||
|
EOF
|
||||||
|
chmod 600 /host/$ETCD_KEY_FILE
|
||||||
|
fi;
|
||||||
|
|
||||||
|
if [ ! -z "$ETCD_CA_CERT" ]; then
|
||||||
|
DIR=$(dirname /host/$ETCD_CA_CERT_FILE)
|
||||||
|
mkdir -p $DIR
|
||||||
|
cat <<EOF>/host/$ETCD_CA_CERT_FILE
|
||||||
|
$ETCD_CA_CERT
|
||||||
|
EOF
|
||||||
|
chmod 600 /host/$ETCD_CA_CERT_FILE
|
||||||
|
fi;
|
||||||
|
|
||||||
|
if [ ! -z "$ETCD_CERT" ]; then
|
||||||
|
DIR=$(dirname /host/$ETCD_CERT_FILE)
|
||||||
|
mkdir -p $DIR
|
||||||
|
cat <<EOF>/host/$ETCD_CERT_FILE
|
||||||
|
$ETCD_CERT
|
||||||
|
EOF
|
||||||
|
chmod 600 /host/$ETCD_CERT_FILE
|
||||||
|
fi;
|
||||||
|
|
||||||
|
# This looks a bit funny. Notice that if $ETCD_ENDPOINTS and friends
|
||||||
|
# are defined in this (calico node initContainer/startup) context;
|
||||||
|
# generate a shell script to set the values on the host where thse
|
||||||
|
# variables will *not* be set
|
||||||
|
cat <<EOF>/host/opt/cni/bin/calicoctl
|
||||||
|
#!/bin/bash
|
||||||
|
#
|
||||||
|
# do *NOT* modify this file; this is autogenerated by the calico-node
|
||||||
|
# deployment startup process
|
||||||
|
|
||||||
|
export ETCD_ENDPOINTS="${ETCD_ENDPOINTS}"
|
||||||
|
|
||||||
|
[ -e "${ETCD_KEY_FILE}" ] && export ETCD_KEY_FILE="${ETCD_KEY_FILE}"
|
||||||
|
[ -e "${ETCD_CERT_FILE}" ] && export ETCD_CERT_FILE="${ETCD_CERT_FILE}"
|
||||||
|
[ -e "${ETCD_CA_CERT_FILE}" ] && export ETCD_CA_CERT_FILE="${ETCD_CA_CERT_FILE}"
|
||||||
|
|
||||||
|
exec /opt/cni/bin/calicoctl.bin \$*
|
||||||
|
EOF
|
||||||
|
|
||||||
|
chmod +x /host/opt/cni/bin/calicoctl
|
||||||
128
charts/calico/templates/bird/_bird.cfg.template.tpl
Normal file
128
charts/calico/templates/bird/_bird.cfg.template.tpl
Normal file
@ -0,0 +1,128 @@
|
|||||||
|
# Generated by confd
|
||||||
|
include "bird_aggr.cfg";
|
||||||
|
include "bird_ipam.cfg";
|
||||||
|
{{`{{$node_ip_key := printf "/host/%s/ip_addr_v4" (getenv "NODENAME")}}{{$node_ip := getv $node_ip_key}}`}}
|
||||||
|
|
||||||
|
# ensure we only listen to a specific ip and address
|
||||||
|
listen bgp address {{`{{$node_ip}}`}} port {{.Values.networking.bgp.ipv4.port.listen}};
|
||||||
|
|
||||||
|
{{`{{$router_id := getenv "CALICO_ROUTER_ID" ""}}`}}
|
||||||
|
{{`router id {{if ne "" ($router_id)}}{{$router_id}}{{else}}{{$node_ip}}{{end}};`}}
|
||||||
|
|
||||||
|
{{`{{define "LOGGING"}}`}}
|
||||||
|
{{`{{$node_logging_key := printf "/host/%s/loglevel" (getenv "NODENAME")}}{{if exists $node_logging_key}}{{$logging := getv $node_logging_key}}`}}
|
||||||
|
{{`{{if eq $logging "debug"}} debug all;{{else if ne $logging "none"}} debug { states };{{end}}`}}
|
||||||
|
{{`{{else if exists "/global/loglevel"}}{{$logging := getv "/global/loglevel"}}`}}
|
||||||
|
{{`{{if eq $logging "debug"}} debug all;{{else if ne $logging "none"}} debug { states };{{end}}`}}
|
||||||
|
{{`{{else}} debug { states };{{end}}`}}
|
||||||
|
{{`{{end}}`}}
|
||||||
|
|
||||||
|
# Configure synchronization between routing tables and kernel.
|
||||||
|
protocol kernel {
|
||||||
|
learn; # Learn all alien routes from the kernel
|
||||||
|
persist; # Don't remove routes on bird shutdown
|
||||||
|
scan time 2; # Scan kernel routing table every 2 seconds
|
||||||
|
import all;
|
||||||
|
export filter calico_ipip; # Default is export none
|
||||||
|
graceful restart; # Turn on graceful restart to reduce potential flaps in
|
||||||
|
# routes when reloading BIRD configuration. With a full
|
||||||
|
# automatic mesh, there is no way to prevent BGP from
|
||||||
|
# flapping since multiple nodes update their BGP
|
||||||
|
# configuration at the same time, GR is not guaranteed to
|
||||||
|
# work correctly in this scenario.
|
||||||
|
}
|
||||||
|
|
||||||
|
# Watch interface up/down events.
|
||||||
|
protocol device {
|
||||||
|
{{` {{template "LOGGING"}}`}}
|
||||||
|
scan time 2; # Scan interfaces every 2 seconds
|
||||||
|
}
|
||||||
|
|
||||||
|
protocol direct {
|
||||||
|
{{` {{template "LOGGING"}}`}}
|
||||||
|
interface -"cali*", "*"; # Exclude cali* but include everything else.
|
||||||
|
}
|
||||||
|
|
||||||
|
{{`{{if eq "" ($node_ip)}}# IPv4 disabled on this node.`}}
|
||||||
|
{{`{{else}}{{$node_as_key := printf "/host/%s/as_num" (getenv "NODENAME")}}`}}
|
||||||
|
# Template for all BGP clients
|
||||||
|
template bgp bgp_template {
|
||||||
|
{{` {{template "LOGGING"}}`}}
|
||||||
|
description "Connection to BGP peer";
|
||||||
|
{{` local as {{if exists $node_as_key}}{{getv $node_as_key}}{{else}}{{getv "/global/as_num"}}{{end}};`}}
|
||||||
|
multihop;
|
||||||
|
gateway recursive; # This should be the default, but just in case.
|
||||||
|
import all; # Import all routes, since we don't know what the upstream
|
||||||
|
# topology is and therefore have to trust the ToR/RR.
|
||||||
|
export filter calico_pools; # Only want to export routes for workloads.
|
||||||
|
{{` source address {{$node_ip}}; # The local address we use for the TCP connection`}}
|
||||||
|
add paths on;
|
||||||
|
graceful restart; # See comment in kernel section about graceful restart.
|
||||||
|
}
|
||||||
|
|
||||||
|
# ------------- Node-to-node mesh -------------
|
||||||
|
{{`{{- $node_cid_key := printf "/host/%s/rr_cluster_id" (getenv "NODENAME")}}`}}
|
||||||
|
{{`{{- $node_cluster_id := getv $node_cid_key}}`}}
|
||||||
|
{{`{{- if ne "" ($node_cluster_id)}}`}}
|
||||||
|
{{`# This node is configured as a route reflector with cluster ID {{$node_cluster_id}};`}}
|
||||||
|
# ignore node-to-node mesh setting.
|
||||||
|
{{`{{- else}}`}}
|
||||||
|
{{`{{if (json (getv "/global/node_mesh")).enabled}}`}}
|
||||||
|
{{`{{range $host := lsdir "/host"}}`}}
|
||||||
|
{{`{{$onode_as_key := printf "/host/%s/as_num" .}}`}}
|
||||||
|
{{`{{$onode_ip_key := printf "/host/%s/ip_addr_v4" .}}{{if exists $onode_ip_key}}{{$onode_ip := getv $onode_ip_key}}`}}
|
||||||
|
{{`{{$nums := split $onode_ip "."}}{{$id := join $nums "_"}}`}}
|
||||||
|
{{`# For peer {{$onode_ip_key}}`}}
|
||||||
|
{{`{{if eq $onode_ip ($node_ip) }}# Skipping ourselves ({{$node_ip}})`}}
|
||||||
|
{{`{{else if ne "" $onode_ip}}protocol bgp Mesh_{{$id}} from bgp_template {`}}
|
||||||
|
{{` neighbor {{$onode_ip}} as {{if exists $onode_as_key}}{{getv $onode_as_key}}{{else}}{{getv "/global/as_num"}}{{end}};`}}
|
||||||
|
neighbor port {{.Values.networking.bgp.ipv4.port.neighbor}};
|
||||||
|
{{`}{{end}}{{end}}{{end}}`}}
|
||||||
|
{{`{{else}}`}}
|
||||||
|
# Node-to-node mesh disabled
|
||||||
|
{{`{{end}}`}}
|
||||||
|
{{`{{- end}}`}}
|
||||||
|
|
||||||
|
|
||||||
|
# ------------- Global peers -------------
|
||||||
|
{{`{{if ls "/global/peer_v4"}}`}}
|
||||||
|
{{`{{range gets "/global/peer_v4/*"}}{{$data := json .Value}}`}}
|
||||||
|
{{`{{$nums := split $data.ip "."}}{{$id := join $nums "_"}}`}}
|
||||||
|
{{`# For peer {{.Key}}`}}
|
||||||
|
{{`{{- if eq $data.ip ($node_ip) }}`}}
|
||||||
|
{{`# Skipping ourselves ({{$node_ip}})`}}
|
||||||
|
{{`{{- else}}`}}
|
||||||
|
{{`protocol bgp Global_{{$id}} from bgp_template {`}}
|
||||||
|
{{` neighbor {{$data.ip}} as {{$data.as_num}};`}}
|
||||||
|
neighbor port {{.Values.networking.bgp.ipv4.port.neighbor}};
|
||||||
|
{{`{{- if and (ne "" ($node_cluster_id)) (ne $data.rr_cluster_id ($node_cluster_id))}}`}}
|
||||||
|
rr client;
|
||||||
|
{{` rr cluster id {{$node_cluster_id}};`}}
|
||||||
|
{{`{{- end}}`}}
|
||||||
|
}
|
||||||
|
{{`{{- end}}`}}
|
||||||
|
{{`{{end}}`}}
|
||||||
|
{{`{{else}}# No global peers configured.{{end}}`}}
|
||||||
|
|
||||||
|
|
||||||
|
# ------------- Node-specific peers -------------
|
||||||
|
{{`{{$node_peers_key := printf "/host/%s/peer_v4" (getenv "NODENAME")}}`}}
|
||||||
|
{{`{{if ls $node_peers_key}}`}}
|
||||||
|
{{`{{range gets (printf "%s/*" $node_peers_key)}}{{$data := json .Value}}`}}
|
||||||
|
{{`{{$nums := split $data.ip "."}}{{$id := join $nums "_"}}`}}
|
||||||
|
{{`# For peer {{.Key}}`}}
|
||||||
|
{{`{{- if eq $data.ip ($node_ip) }}`}}
|
||||||
|
{{`# Skipping ourselves ({{$node_ip}})`}}
|
||||||
|
{{`{{- else}}`}}
|
||||||
|
{{`protocol bgp Node_{{$id}} from bgp_template {`}}
|
||||||
|
{{` neighbor {{$data.ip}} as {{$data.as_num}};`}}
|
||||||
|
neighbor port {{.Values.networking.bgp.ipv4.port.neighbor}};
|
||||||
|
{{`{{- if and (ne "" ($node_cluster_id)) (ne $data.rr_cluster_id ($node_cluster_id))}}`}}
|
||||||
|
rr client;
|
||||||
|
{{` rr cluster id {{$node_cluster_id}};`}}
|
||||||
|
{{`{{- end}}`}}
|
||||||
|
}
|
||||||
|
{{`{{- end}}`}}
|
||||||
|
{{`{{end}}`}}
|
||||||
|
{{`{{else}}# No node-specific peers configured.{{end}}`}}
|
||||||
|
{{`{{end}}{{/* End of IPv4 enable check */}}`}}
|
||||||
131
charts/calico/templates/bird/_bird6.cfg.template.tpl
Normal file
131
charts/calico/templates/bird/_bird6.cfg.template.tpl
Normal file
@ -0,0 +1,131 @@
|
|||||||
|
# Generated by confd
|
||||||
|
include "bird6_aggr.cfg";
|
||||||
|
include "bird6_ipam.cfg";
|
||||||
|
{{`{{$node_ip_key := printf "/host/%s/ip_addr_v4" (getenv "NODENAME")}}{{$node_ip := getv $node_ip_key}}`}}
|
||||||
|
{{`{{$node_ip6_key := printf "/host/%s/ip_addr_v6" (getenv "NODENAME")}}{{$node_ip6 := getv $node_ip6_key}}`}}
|
||||||
|
|
||||||
|
{{`{{$router_id := getenv "CALICO_ROUTER_ID" ""}}`}}
|
||||||
|
{{`router id {{if ne "" ($router_id)}}{{$router_id}}{{else}}{{$node_ip}}{{end}}; # Use IPv4 address since router id is 4 octets, even in MP-BGP`}}
|
||||||
|
|
||||||
|
{{`{{define "LOGGING"}}`}}
|
||||||
|
{{`{{$node_logging_key := printf "/host/%s/loglevel" (getenv "NODENAME")}}{{if exists $node_logging_key}}{{$logging := getv $node_logging_key}}`}}
|
||||||
|
{{`{{if eq $logging "debug"}} debug all;{{else if ne $logging "none"}} debug { states };{{end}}`}}
|
||||||
|
{{`{{else if exists "/global/loglevel"}}{{$logging := getv "/global/loglevel"}}`}}
|
||||||
|
{{`{{if eq $logging "debug"}} debug all;{{else if ne $logging "none"}} debug { states };{{end}}`}}
|
||||||
|
{{`{{else}} debug { states };{{end}}`}}
|
||||||
|
{{`{{end}}`}}
|
||||||
|
|
||||||
|
# Configure synchronization between routing tables and kernel.
|
||||||
|
protocol kernel {
|
||||||
|
learn; # Learn all alien routes from the kernel
|
||||||
|
persist; # Don't remove routes on bird shutdown
|
||||||
|
scan time 2; # Scan kernel routing table every 2 seconds
|
||||||
|
import all;
|
||||||
|
export all; # Default is export none
|
||||||
|
graceful restart; # Turn on graceful restart to reduce potential flaps in
|
||||||
|
# routes when reloading BIRD configuration. With a full
|
||||||
|
# automatic mesh, there is no way to prevent BGP from
|
||||||
|
# flapping since multiple nodes update their BGP
|
||||||
|
# configuration at the same time, GR is not guaranteed to
|
||||||
|
# work correctly in this scenario.
|
||||||
|
}
|
||||||
|
|
||||||
|
# Watch interface up/down events.
|
||||||
|
protocol device {
|
||||||
|
{{` {{template "LOGGING"}}`}}
|
||||||
|
scan time 2; # Scan interfaces every 2 seconds
|
||||||
|
}
|
||||||
|
|
||||||
|
protocol direct {
|
||||||
|
{{` {{template "LOGGING"}}`}}
|
||||||
|
interface -"cali*", "*"; # Exclude cali* but include everything else.
|
||||||
|
}
|
||||||
|
|
||||||
|
{{`{{if eq "" ($node_ip6)}}# IPv6 disabled on this node.`}}
|
||||||
|
{{`{{else}}{{$node_as_key := printf "/host/%s/as_num" (getenv "NODENAME")}}`}}
|
||||||
|
|
||||||
|
# ensure we only listen to a specific ip and address
|
||||||
|
listen bgp address {{`{{$node_ip6}}`}} port {{.Values.networking.bgp.ipv6.port.listen}};
|
||||||
|
|
||||||
|
# Template for all BGP clients
|
||||||
|
template bgp bgp_template {
|
||||||
|
{{` {{template "LOGGING"}}`}}
|
||||||
|
description "Connection to BGP peer";
|
||||||
|
{{` local as {{if exists $node_as_key}}{{getv $node_as_key}}{{else}}{{getv "/global/as_num"}}{{end}};`}}
|
||||||
|
multihop;
|
||||||
|
gateway recursive; # This should be the default, but just in case.
|
||||||
|
import all; # Import all routes, since we don't know what the upstream
|
||||||
|
# topology is and therefore have to trust the ToR/RR.
|
||||||
|
export filter calico_pools; # Only want to export routes for workloads.
|
||||||
|
{{` source address {{$node_ip6}}; # The local address we use for the TCP connection`}}
|
||||||
|
add paths on;
|
||||||
|
graceful restart; # See comment in kernel section about graceful restart.
|
||||||
|
}
|
||||||
|
|
||||||
|
# ------------- Node-to-node mesh -------------
|
||||||
|
{{`{{- $node_cid_key := printf "/host/%s/rr_cluster_id" (getenv "NODENAME")}}`}}
|
||||||
|
{{`{{- $node_cluster_id := getv $node_cid_key}}`}}
|
||||||
|
{{`{{- if ne "" ($node_cluster_id)}}`}}
|
||||||
|
{{`# This node is configured as a route reflector with cluster ID {{$node_cluster_id}};`}}
|
||||||
|
# ignore node-to-node mesh setting.
|
||||||
|
{{`{{- else}}`}}
|
||||||
|
{{`{{if (json (getv "/global/node_mesh")).enabled}}`}}
|
||||||
|
{{`{{range $host := lsdir "/host"}}`}}
|
||||||
|
{{`{{$onode_as_key := printf "/host/%s/as_num" .}}`}}
|
||||||
|
{{`{{$onode_ip_key := printf "/host/%s/ip_addr_v6" .}}{{if exists $onode_ip_key}}{{$onode_ip := getv $onode_ip_key}}`}}
|
||||||
|
{{`{{$nums := split $onode_ip ":"}}{{$id := join $nums "_"}}`}}
|
||||||
|
{{`# For peer {{$onode_ip_key}}`}}
|
||||||
|
{{`{{if eq $onode_ip ($node_ip6) }}# Skipping ourselves ({{$node_ip6}})`}}
|
||||||
|
{{`{{else if eq "" $onode_ip}}# No IPv6 address configured for this node`}}
|
||||||
|
{{`{{else}}protocol bgp Mesh_{{$id}} from bgp_template {`}}
|
||||||
|
{{` neighbor {{$onode_ip}} as {{if exists $onode_as_key}}{{getv $onode_as_key}}{{else}}{{getv "/global/as_num"}}{{end}};`}}
|
||||||
|
neighbor port {{.Values.networking.bgp.ipv6.port.neighbor}};
|
||||||
|
{{`}{{end}}{{end}}{{end}}`}}
|
||||||
|
{{`{{else}}`}}
|
||||||
|
# Node-to-node mesh disabled
|
||||||
|
{{`{{end}}`}}
|
||||||
|
{{`{{- end}}`}}
|
||||||
|
|
||||||
|
|
||||||
|
# ------------- Global peers -------------
|
||||||
|
{{`{{if ls "/global/peer_v6"}}`}}
|
||||||
|
{{`{{range gets "/global/peer_v6/*"}}{{$data := json .Value}}`}}
|
||||||
|
{{`{{$nums := split $data.ip ":"}}{{$id := join $nums "_"}}`}}
|
||||||
|
{{`# For peer {{.Key}}`}}
|
||||||
|
{{`{{- if eq $data.ip ($node_ip6) }}`}}
|
||||||
|
{{`# Skipping ourselves ({{$node_ip6}})`}}
|
||||||
|
{{`{{- else}}`}}
|
||||||
|
{{`protocol bgp Global_{{$id}} from bgp_template {`}}
|
||||||
|
{{` neighbor {{$data.ip}} as {{$data.as_num}};`}}
|
||||||
|
neighbor port {{.Values.networking.bgp.ipv6.port.neighbor}};
|
||||||
|
{{`{{- if and (ne "" ($node_cluster_id)) (ne $data.rr_cluster_id ($node_cluster_id))}}`}}
|
||||||
|
rr client;
|
||||||
|
{{` rr cluster id {{$node_cluster_id}};`}}
|
||||||
|
{{`{{- end}}`}}
|
||||||
|
}
|
||||||
|
{{`{{- end}}`}}
|
||||||
|
{{`{{end}}`}}
|
||||||
|
{{`{{else}}# No global peers configured.{{end}}`}}
|
||||||
|
|
||||||
|
|
||||||
|
# ------------- Node-specific peers -------------
|
||||||
|
{{`{{$node_peers_key := printf "/host/%s/peer_v6" (getenv "NODENAME")}}`}}
|
||||||
|
{{`{{if ls $node_peers_key}}`}}
|
||||||
|
{{`{{range gets (printf "%s/*" $node_peers_key)}}{{$data := json .Value}}`}}
|
||||||
|
{{`{{$nums := split $data.ip ":"}}{{$id := join $nums "_"}}`}}
|
||||||
|
{{`# For peer {{.Key}}`}}
|
||||||
|
{{`{{- if eq $data.ip ($node_ip6) }}`}}
|
||||||
|
{{`# Skipping ourselves ({{$node_ip6}})`}}
|
||||||
|
{{`{{- else}}`}}
|
||||||
|
{{`protocol bgp Node_{{$id}} from bgp_template {`}}
|
||||||
|
{{` neighbor {{$data.ip}} as {{$data.as_num}};`}}
|
||||||
|
neighbor port {{.Values.networking.bgp.ipv6.port.neighbor}};
|
||||||
|
{{`{{- if and (ne "" ($node_cluster_id)) (ne $data.rr_cluster_id ($node_cluster_id))}}`}}
|
||||||
|
rr client;
|
||||||
|
{{` rr cluster id {{$node_cluster_id}};`}}
|
||||||
|
{{`{{- end}}`}}
|
||||||
|
}
|
||||||
|
{{`{{- end}}`}}
|
||||||
|
{{`{{end}}`}}
|
||||||
|
{{`{{else}}# No node-specific peers configured.{{end}}`}}
|
||||||
|
{{`{{end}}`}}
|
||||||
36
charts/calico/templates/bird/_bird6_ipam.cfg.template.tpl
Normal file
36
charts/calico/templates/bird/_bird6_ipam.cfg.template.tpl
Normal file
@ -0,0 +1,36 @@
|
|||||||
|
# Generated by confd
|
||||||
|
|
||||||
|
function osh_filters ()
|
||||||
|
{
|
||||||
|
# support any addresses matching our secondary announcements
|
||||||
|
{{- range .Values.networking.bgp.ipv6.additional_cidrs }}
|
||||||
|
if ( net ~ {{ . }} ) then { accept; }
|
||||||
|
{{- end }}
|
||||||
|
}
|
||||||
|
|
||||||
|
function apply_communities ()
|
||||||
|
{
|
||||||
|
# Set community value based on dictionary of cidrs
|
||||||
|
{{- $asnum := .Values.networking.bgp.asnumber }}
|
||||||
|
{{- range .Values.networking.bgp.ipv6.community_cidr_ref }}
|
||||||
|
{{- $community := .community }}
|
||||||
|
{{- $cidr := .cidr }}
|
||||||
|
{{- with .prefix }}
|
||||||
|
if ( net ~ {{ $cidr }} ) then { bgp_community.add(({{ . }}, {{ $community }})); }
|
||||||
|
{{- else }}
|
||||||
|
if ( net ~ {{ $cidr }} ) then { bgp_community.add(({{ $asnum }}, {{ $community }})); }
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
}
|
||||||
|
|
||||||
|
filter calico_pools {
|
||||||
|
apply_communities();
|
||||||
|
calico_aggr();
|
||||||
|
osh_filters();
|
||||||
|
{{`{{range ls "/pool"}}{{$data := json (getv (printf "/pool/%s" .))}}`}}
|
||||||
|
{{` if ( net ~ {{$data.cidr}} ) then {`}}
|
||||||
|
accept;
|
||||||
|
}
|
||||||
|
{{`{{end}}`}}
|
||||||
|
reject;
|
||||||
|
}
|
||||||
60
charts/calico/templates/bird/_bird_ipam.cfg.template.tpl
Normal file
60
charts/calico/templates/bird/_bird_ipam.cfg.template.tpl
Normal file
@ -0,0 +1,60 @@
|
|||||||
|
# Generated by confd
|
||||||
|
|
||||||
|
function osh_filters ()
|
||||||
|
{
|
||||||
|
# support any addresses matching our secondary announcements
|
||||||
|
{{- range .Values.networking.bgp.ipv4.additional_cidrs }}
|
||||||
|
if ( net ~ {{ . }} ) then { accept; }
|
||||||
|
{{- end }}
|
||||||
|
}
|
||||||
|
|
||||||
|
function apply_communities ()
|
||||||
|
{
|
||||||
|
# Set community value based on dictionary of cidrs
|
||||||
|
{{- $asnum := .Values.networking.bgp.asnumber }}
|
||||||
|
{{- range .Values.networking.bgp.ipv4.community_cidr_ref }}
|
||||||
|
{{- $community := .community }}
|
||||||
|
{{- $cidr := .cidr }}
|
||||||
|
{{- with .prefix }}
|
||||||
|
if ( net ~ {{ $cidr }} ) then { bgp_community.add(({{ . }}, {{ $community }})); }
|
||||||
|
{{- else }}
|
||||||
|
if ( net ~ {{ $cidr }} ) then { bgp_community.add(({{ $asnum }}, {{ $community }})); }
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
}
|
||||||
|
|
||||||
|
filter calico_pools {
|
||||||
|
apply_communities();
|
||||||
|
calico_aggr();
|
||||||
|
osh_filters();
|
||||||
|
{{`{{range ls "/v1/ipam/v4/pool"}}{{$data := json (getv (printf "/v1/ipam/v4/pool/%s" .))}}`}}
|
||||||
|
{{` if ( net ~ {{$data.cidr}} ) then {`}}
|
||||||
|
accept;
|
||||||
|
}
|
||||||
|
{{`{{end}}`}}
|
||||||
|
reject;
|
||||||
|
}
|
||||||
|
|
||||||
|
{{`{{$network_key := printf "/bgp/v1/host/%s/network_v4" (getenv "NODENAME")}}{{if exists $network_key}}{{$network := getv $network_key}}`}}
|
||||||
|
filter calico_ipip {
|
||||||
|
{{`{{range ls "/v1/ipam/v4/pool"}}{{$data := json (getv (printf "/v1/ipam/v4/pool/%s" .))}}`}}
|
||||||
|
{{` if ( net ~ {{$data.cidr}} ) then {`}}
|
||||||
|
{{`{{if $data.ipip_mode}}{{if eq $data.ipip_mode "cross-subnet"}}`}}
|
||||||
|
{{` if defined(bgp_next_hop) && ( bgp_next_hop ~ {{$network}} ) then`}}
|
||||||
|
{{` krt_tunnel = ""; {{/* Destination in ipPool, mode is cross sub-net, route from-host on subnet, do not use IPIP */}}`}}
|
||||||
|
else
|
||||||
|
{{` krt_tunnel = "{{$data.ipip}}"; {{/* Destination in ipPool, mode is cross sub-net, route from-host off subnet, set the tunnel (if IPIP not enabled, value will be "") */}}`}}
|
||||||
|
accept;
|
||||||
|
{{` } {{else}}`}}
|
||||||
|
{{` krt_tunnel = "{{$data.ipip}}"; {{/* Destination in ipPool, mode not cross sub-net, set the tunnel (if IPIP not enabled, value will be "") */}}`}}
|
||||||
|
accept;
|
||||||
|
{{` } {{end}} {{else}}`}}
|
||||||
|
{{` krt_tunnel = "{{$data.ipip}}"; {{/* Destination in ipPool, mode field is not present, set the tunnel (if IPIP not enabled, value will be "") */}}`}}
|
||||||
|
accept;
|
||||||
|
{{` } {{end}}`}}
|
||||||
|
{{`{{end}}`}}
|
||||||
|
{{` accept; {{/* Destination is not in any ipPool, accept */}}`}}
|
||||||
|
}
|
||||||
|
{{`{{else}}`}}
|
||||||
|
filter calico_ipip { accept; }
|
||||||
|
{{`{{end}}{{/* End of 'exists $network_key' */}}`}}
|
||||||
29
charts/calico/templates/configmap-bin.yaml
Normal file
29
charts/calico/templates/configmap-bin.yaml
Normal file
@ -0,0 +1,29 @@
|
|||||||
|
{{/*
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.manifests.configmap_bin }}
|
||||||
|
{{- $envAll := . }}
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: calico-bin
|
||||||
|
data:
|
||||||
|
image-repo-sync.sh: |
|
||||||
|
{{- include "helm-toolkit.scripts.image_repo_sync" . | indent 4 }}
|
||||||
|
install-calicoctl.sh: |
|
||||||
|
{{ tuple "bin/_install-calicoctl.sh.tpl" . | include "helm-toolkit.utils.template" | indent 4 }}
|
||||||
|
calico-settings.sh: |
|
||||||
|
{{ tuple "bin/_calico-settings.sh.tpl" . | include "helm-toolkit.utils.template" | indent 4 }}
|
||||||
|
{{- end }}
|
||||||
34
charts/calico/templates/configmap-bird.yaml
Normal file
34
charts/calico/templates/configmap-bird.yaml
Normal file
@ -0,0 +1,34 @@
|
|||||||
|
{{/*
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.manifests.configmap_bird }}
|
||||||
|
{{- $envAll := . }}
|
||||||
|
|
||||||
|
---
|
||||||
|
kind: ConfigMap
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: calico-bird
|
||||||
|
data:
|
||||||
|
# we overlay templates found natively in the calico-node container
|
||||||
|
# so that we may override bgp configuration
|
||||||
|
bird.cfg.template: |
|
||||||
|
{{ tuple "bird/_bird.cfg.template.tpl" . | include "helm-toolkit.utils.template" | indent 4 }}
|
||||||
|
bird_ipam.cfg.template: |
|
||||||
|
{{ tuple "bird/_bird_ipam.cfg.template.tpl" . | include "helm-toolkit.utils.template" | indent 4 }}
|
||||||
|
bird6.cfg.template: |
|
||||||
|
{{ tuple "bird/_bird6.cfg.template.tpl" . | include "helm-toolkit.utils.template" | indent 4 }}
|
||||||
|
bird6_ipam.cfg.template: |
|
||||||
|
{{ tuple "bird/_bird6_ipam.cfg.template.tpl" . | include "helm-toolkit.utils.template" | indent 4 }}
|
||||||
|
{{- end }}
|
||||||
32
charts/calico/templates/configmap-etc.yaml
Normal file
32
charts/calico/templates/configmap-etc.yaml
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
{{/*
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.manifests.configmap_etc }}
|
||||||
|
{{- $envAll := . }}
|
||||||
|
---
|
||||||
|
kind: ConfigMap
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: calico-etc
|
||||||
|
data:
|
||||||
|
# The location of your etcd cluster. This uses the Service clusterIP
|
||||||
|
# defined below.
|
||||||
|
etcd_endpoints: {{ tuple "etcd" "internal" "client" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" }}
|
||||||
|
|
||||||
|
# The CNI network configuration to install on each node, generated
|
||||||
|
# from (Values.)conf.cni_network_config
|
||||||
|
cni_network_config: |-
|
||||||
|
{{ toJson $envAll.Values.conf.cni_network_config | indent 4 }}
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
133
charts/calico/templates/daemonset-calico-etcd.yaml
Normal file
133
charts/calico/templates/daemonset-calico-etcd.yaml
Normal file
@ -0,0 +1,133 @@
|
|||||||
|
{{/*
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.manifests.daemonset_calico_etcd }}
|
||||||
|
{{- $envAll := . }}
|
||||||
|
|
||||||
|
{{- $serviceAccountName := "calico-etcd" }}
|
||||||
|
{{ tuple $envAll "calico-etcd" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
|
||||||
|
|
||||||
|
---
|
||||||
|
# This manifest installs the Calico etcd on the kubeadm master. This uses a DaemonSet
|
||||||
|
# to force it to run on the master even when the master isn't schedulable, and uses
|
||||||
|
# nodeSelector to ensure it only runs on the master.
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: DaemonSet
|
||||||
|
metadata:
|
||||||
|
name: calico-etcd
|
||||||
|
annotations:
|
||||||
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
|
||||||
|
labels:
|
||||||
|
k8s-app: calico-etcd
|
||||||
|
{{ tuple $envAll "calico" "etcd" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
k8s-app: calico-etcd
|
||||||
|
{{ tuple $envAll "calico" "etcd" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
k8s-app: calico-etcd
|
||||||
|
{{ tuple $envAll "calico" "etcd" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
||||||
|
annotations:
|
||||||
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
|
||||||
|
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
|
spec:
|
||||||
|
{{ dict "envAll" $envAll "application" "etcd" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
|
||||||
|
serviceAccountName: {{ $serviceAccountName }}
|
||||||
|
priorityClassName: system-cluster-critical
|
||||||
|
tolerations:
|
||||||
|
# This taint is set by all kubelets running `--cloud-provider=external`
|
||||||
|
# so we should tolerate it to schedule the Calico pods
|
||||||
|
- key: node.cloudprovider.kubernetes.io/uninitialized
|
||||||
|
value: "true"
|
||||||
|
effect: NoSchedule
|
||||||
|
# Allow this pod to run on the master/control-plane.
|
||||||
|
- key: node-role.kubernetes.io/master
|
||||||
|
effect: NoSchedule
|
||||||
|
- key: node-role.kubernetes.io/control-plane
|
||||||
|
effect: NoSchedule
|
||||||
|
# Allow this pod to be rescheduled while the node is in "critical add-ons only" mode.
|
||||||
|
# This, along with the annotation above marks this pod as a critical add-on.
|
||||||
|
- key: CriticalAddonsOnly
|
||||||
|
operator: Exists
|
||||||
|
# Only run this pod on the master.
|
||||||
|
nodeSelector:
|
||||||
|
node-role.kubernetes.io/master: ""
|
||||||
|
hostNetwork: true
|
||||||
|
initContainers:
|
||||||
|
{{ tuple $envAll "etcd" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
|
||||||
|
containers:
|
||||||
|
- name: calico-etcd
|
||||||
|
{{ tuple $envAll "calico_etcd" | include "helm-toolkit.snippets.image" | indent 10 }}
|
||||||
|
{{ tuple $envAll $envAll.Values.pod.resources.calico_etcd | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
||||||
|
{{ dict "envAll" $envAll "application" "etcd" "container" "calico_etcd" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
|
||||||
|
env:
|
||||||
|
- name: CALICO_ETCD_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.podIP
|
||||||
|
command:
|
||||||
|
- /usr/local/bin/etcd
|
||||||
|
args:
|
||||||
|
- --name=calico
|
||||||
|
- --data-dir=/var/etcd/calico-data
|
||||||
|
{{ if eq .Values.endpoints.etcd.scheme.default "https" }}
|
||||||
|
- --client-cert-auth=True
|
||||||
|
- --peer-client-cert-auth=True
|
||||||
|
- --trusted-ca-file=/etc/calico-certs/ca.crt
|
||||||
|
- --cert-file=/etc/calico-certs/server.crt
|
||||||
|
- --key-file=/etc/calico-certs/server.key
|
||||||
|
- --peer-trusted-ca-file=/etc/calico-certs/ca.crt
|
||||||
|
- --peer-cert-file=/etc/calico-certs/server.crt
|
||||||
|
- --peer-key-file=/etc/calico-certs/server.key
|
||||||
|
{{ end }}
|
||||||
|
- --advertise-client-urls={{ tuple "etcd" "internal" "client" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" }}
|
||||||
|
- --listen-client-urls={{ tuple "etcd" "internal" "client" . | include "helm-toolkit.endpoints.keystone_endpoint_scheme_lookup" }}://0.0.0.0:{{ tuple "etcd" "internal" "client" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
|
||||||
|
- --listen-peer-urls={{ tuple "etcd" "internal" "peer" . | include "helm-toolkit.endpoints.keystone_endpoint_scheme_lookup" }}://0.0.0.0:{{ tuple "etcd" "internal" "peer" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
|
||||||
|
- --auto-compaction-retention=1
|
||||||
|
volumeMounts:
|
||||||
|
- name: pod-tmp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: var-etcd
|
||||||
|
mountPath: /var/etcd
|
||||||
|
{{ if .Values.conf.etcd.credentials.ca }}
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: /etc/calico-certs/ca.crt
|
||||||
|
subPath: etcd.ca
|
||||||
|
readOnly: true
|
||||||
|
{{ end }}
|
||||||
|
{{ if .Values.conf.etcd.credentials.certificate }}
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: /etc/calico-certs/server.crt
|
||||||
|
subPath: etcd.crt
|
||||||
|
readOnly: true
|
||||||
|
{{ end }}
|
||||||
|
{{ if .Values.conf.etcd.credentials.key }}
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: /etc/calico-certs/server.key
|
||||||
|
subPath: etcd.key
|
||||||
|
readOnly: true
|
||||||
|
{{ end }}
|
||||||
|
volumes:
|
||||||
|
- name: pod-tmp
|
||||||
|
emptyDir: {}
|
||||||
|
- name: var-etcd
|
||||||
|
hostPath:
|
||||||
|
path: /var/etcd
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
secret:
|
||||||
|
secretName: calico-etcd-secrets
|
||||||
|
{{- end }}
|
||||||
414
charts/calico/templates/daemonset-calico-node.yaml
Normal file
414
charts/calico/templates/daemonset-calico-node.yaml
Normal file
@ -0,0 +1,414 @@
|
|||||||
|
{{/*
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.manifests.daemonset_calico_node }}
|
||||||
|
{{- $envAll := . }}
|
||||||
|
|
||||||
|
|
||||||
|
{{/* Robustness, Calico 3.x wants things as Titlecase; this causes pain */}}
|
||||||
|
{{- $_ := set .Values.conf.node "CALICO_IPV4POOL_IPIP" (title .Values.conf.node.CALICO_IPV4POOL_IPIP ) -}}
|
||||||
|
{{- $_ := set .Values.conf.node "CALICO_STARTUP_LOGLEVEL" (title .Values.conf.node.CALICO_STARTUP_LOGLEVEL ) -}}
|
||||||
|
{{- $_ := set .Values.conf.node "FELIX_LOGSEVERITYSCREEN" (title .Values.conf.node.FELIX_LOGSEVERITYSCREEN ) -}}
|
||||||
|
|
||||||
|
|
||||||
|
{{/* If using tunnels, and FELIX_IPINIPMTU is not set, make it 20 less than the physical to account for IPIP overhead */}}
|
||||||
|
{{- if empty .Values.conf.node.FELIX_IPINIPMTU -}}
|
||||||
|
{{- if ne .Values.conf.node.CALICO_IPV4POOL_IPIP "Never" -}}
|
||||||
|
{{- $_ := set .Values.conf.node "FELIX_IPINIPMTU" (sub .Values.networking.mtu 20) -}}
|
||||||
|
# Setting tunnel MTU to {{ .Values.conf.node.FELIX_IPINIPMTU }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
|
||||||
|
{{/* CNI_MTU is >= than the IPIP mtu, usually the physical MTU of the system */}}
|
||||||
|
{{- if empty .Values.conf.node.CNI_MTU -}}
|
||||||
|
{{- $_ := set .Values.conf.node "CNI_MTU" .Values.networking.mtu -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
|
||||||
|
{{- if empty .Values.conf.node.CALICO_IPV4POOL_CIDR -}}
|
||||||
|
{{- $_ := set .Values.conf.node "CALICO_IPV4POOL_CIDR" .Values.networking.podSubnet -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
{{- $serviceAccountName := "calico-node" }}
|
||||||
|
{{ tuple $envAll "calico_node" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: calico-node
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: calico-node
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ $serviceAccountName }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
---
|
||||||
|
kind: ClusterRole
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ $serviceAccountName }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
- nodes
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups: ["batch"]
|
||||||
|
resources: ["jobs"]
|
||||||
|
verbs: ["get"]
|
||||||
|
---
|
||||||
|
# This manifest installs the calico/node container, as well
|
||||||
|
# as the Calico CNI plugins and network config on
|
||||||
|
# each master and worker node in a Kubernetes cluster.
|
||||||
|
kind: DaemonSet
|
||||||
|
apiVersion: apps/v1
|
||||||
|
metadata:
|
||||||
|
name: calico-node
|
||||||
|
annotations:
|
||||||
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
|
||||||
|
labels:
|
||||||
|
k8s-app: calico-node
|
||||||
|
{{ tuple $envAll "calico" "node" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
k8s-app: calico-node
|
||||||
|
{{ tuple $envAll "calico" "node" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }}
|
||||||
|
updateStrategy:
|
||||||
|
type: RollingUpdate
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: 1
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
k8s-app: calico-node
|
||||||
|
{{ tuple $envAll "calico" "node" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
||||||
|
annotations:
|
||||||
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
|
||||||
|
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
|
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
|
configmap-bird-hash: {{ tuple "configmap-bird.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
|
{{ dict "envAll" $envAll "podName" "calico-node" "containerNames" (list "calico-node") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
|
||||||
|
{{- if .Values.monitoring.prometheus.enabled }}
|
||||||
|
{{- $prometheus_annotations := $envAll.Values.monitoring.prometheus.calico_node }}
|
||||||
|
{{ tuple $prometheus_annotations | include "helm-toolkit.snippets.prometheus_pod_annotations" | indent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
{{ dict "envAll" $envAll "application" "calico_node" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
|
||||||
|
nodeSelector:
|
||||||
|
beta.kubernetes.io/os: linux
|
||||||
|
hostNetwork: true
|
||||||
|
priorityClassName: system-cluster-critical
|
||||||
|
tolerations:
|
||||||
|
# Make sure calico-node gets scheduled on all nodes.
|
||||||
|
- effect: NoSchedule
|
||||||
|
operator: Exists
|
||||||
|
- key: node.kubernetes.io/not-ready
|
||||||
|
effect: NoSchedule
|
||||||
|
operator: Exists
|
||||||
|
# Mark the pod as a critical add-on for rescheduling.
|
||||||
|
- key: CriticalAddonsOnly
|
||||||
|
operator: Exists
|
||||||
|
- effect: NoExecute
|
||||||
|
operator: Exists
|
||||||
|
serviceAccountName: {{ $serviceAccountName }}
|
||||||
|
# Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
|
||||||
|
# deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
|
||||||
|
terminationGracePeriodSeconds: 0
|
||||||
|
|
||||||
|
initContainers:
|
||||||
|
{{ tuple $envAll "calico_node" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
|
||||||
|
{{ if .Values.manifests.daemonset_calico_node_calicoctl }}
|
||||||
|
- name: install-calicoctl
|
||||||
|
{{ tuple $envAll "calico_ctl" | include "helm-toolkit.snippets.image" | indent 10 }}
|
||||||
|
{{ tuple $envAll $envAll.Values.pod.resources.calico_ctl | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
||||||
|
{{ dict "envAll" $envAll "application" "calico_node" "container" "calico_ctl" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
|
||||||
|
command:
|
||||||
|
- /tmp/install-calicoctl.sh
|
||||||
|
env:
|
||||||
|
- name: ETCD_ENDPOINTS
|
||||||
|
valueFrom:
|
||||||
|
configMapKeyRef:
|
||||||
|
name: calico-etc
|
||||||
|
key: etcd_endpoints
|
||||||
|
{{ if .Values.endpoints.etcd.auth.client.tls.ca }}
|
||||||
|
- name: ETCD_CA_CERT_FILE
|
||||||
|
value: {{ .Values.endpoints.etcd.auth.client.path.ca }}
|
||||||
|
- name: ETCD_CA_CERT
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: calico-etcd-secrets
|
||||||
|
key: tls.ca
|
||||||
|
{{ end }}
|
||||||
|
{{ if .Values.endpoints.etcd.auth.client.tls.key }}
|
||||||
|
- name: ETCD_KEY_FILE
|
||||||
|
value: {{ .Values.endpoints.etcd.auth.client.path.key }}
|
||||||
|
- name: ETCD_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: calico-etcd-secrets
|
||||||
|
key: tls.key
|
||||||
|
{{ end }}
|
||||||
|
{{ if .Values.endpoints.etcd.auth.client.tls.crt }}
|
||||||
|
- name: ETCD_CERT_FILE
|
||||||
|
value: {{ .Values.endpoints.etcd.auth.client.path.crt }}
|
||||||
|
- name: ETCD_CERT
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: calico-etcd-secrets
|
||||||
|
key: tls.crt
|
||||||
|
{{ end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: pod-tmp
|
||||||
|
mountPath: /tmp
|
||||||
|
- mountPath: /host/etc/calico
|
||||||
|
name: calico-cert-dir
|
||||||
|
- mountPath: /host/opt/cni/bin
|
||||||
|
name: cni-bin-dir
|
||||||
|
- mountPath: /tmp/install-calicoctl.sh
|
||||||
|
name: calico-bin
|
||||||
|
subPath: install-calicoctl.sh
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.ca }}
|
||||||
|
subPath: tls.ca
|
||||||
|
readOnly: true
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.crt }}
|
||||||
|
subPath: tls.crt
|
||||||
|
readOnly: true
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.key }}
|
||||||
|
subPath: tls.key
|
||||||
|
readOnly: true
|
||||||
|
{{ end }}
|
||||||
|
# This container installs the Calico CNI binaries
|
||||||
|
# and CNI network config file on each node.
|
||||||
|
- name: install-cni
|
||||||
|
{{ tuple $envAll "calico_cni" | include "helm-toolkit.snippets.image" | indent 10 }}
|
||||||
|
{{ dict "envAll" $envAll "application" "calico_node" "container" "install_cni" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
|
||||||
|
command: ["/install-cni.sh"]
|
||||||
|
env:
|
||||||
|
# Prevents the container from sleeping forever.
|
||||||
|
- name: SLEEP
|
||||||
|
value: "false"
|
||||||
|
# Name of the CNI config file to create.
|
||||||
|
#
|
||||||
|
# NOTE: Calico v3 needs to end in .conflist; Calico v2 is
|
||||||
|
# different!
|
||||||
|
- name: CNI_CONF_NAME
|
||||||
|
value: "10-calico.conflist"
|
||||||
|
# The location of the Calico etcd cluster.
|
||||||
|
- name: ETCD_ENDPOINTS
|
||||||
|
valueFrom:
|
||||||
|
configMapKeyRef:
|
||||||
|
name: calico-etc
|
||||||
|
key: etcd_endpoints
|
||||||
|
# The CNI network config to install on each node.
|
||||||
|
- name: CNI_NETWORK_CONFIG
|
||||||
|
valueFrom:
|
||||||
|
configMapKeyRef:
|
||||||
|
name: calico-etc
|
||||||
|
key: cni_network_config
|
||||||
|
|
||||||
|
|
||||||
|
volumeMounts:
|
||||||
|
- name: pod-tmp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: cni-bin-dir
|
||||||
|
mountPath: /host/opt/cni/bin
|
||||||
|
- name: cni-net-dir
|
||||||
|
mountPath: /host/etc/cni/net.d
|
||||||
|
{{ if .Values.conf.etcd.credentials.ca }}
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: /calico-secrets/etcd-ca
|
||||||
|
subPath: etcd.ca
|
||||||
|
readOnly: true
|
||||||
|
{{ end }}
|
||||||
|
{{ if .Values.conf.etcd.credentials.certificate }}
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: /calico-secrets/etcd-cert
|
||||||
|
subPath: etcd.crt
|
||||||
|
readOnly: true
|
||||||
|
{{ end }}
|
||||||
|
{{ if .Values.conf.etcd.credentials.key }}
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: /calico-secrets/etcd-key
|
||||||
|
subPath: etcd.key
|
||||||
|
readOnly: true
|
||||||
|
{{ end }}
|
||||||
|
volumes:
|
||||||
|
- name: pod-tmp
|
||||||
|
emptyDir: {}
|
||||||
|
# Used by calico/node.
|
||||||
|
- name: lib-modules
|
||||||
|
hostPath:
|
||||||
|
path: /lib/modules
|
||||||
|
- name: var-run-calico
|
||||||
|
hostPath:
|
||||||
|
path: /var/run/calico
|
||||||
|
- name: var-lib-calico
|
||||||
|
hostPath:
|
||||||
|
path: /var/lib/calico
|
||||||
|
- name: xtables-lock
|
||||||
|
hostPath:
|
||||||
|
path: /run/xtables.lock
|
||||||
|
type: FileOrCreate
|
||||||
|
# Used to install CNI.
|
||||||
|
- name: cni-bin-dir
|
||||||
|
hostPath:
|
||||||
|
path: /opt/cni/bin
|
||||||
|
- name: cni-net-dir
|
||||||
|
hostPath:
|
||||||
|
path: /etc/cni/net.d
|
||||||
|
- name: calico-cert-dir
|
||||||
|
hostPath:
|
||||||
|
path: /etc/calico
|
||||||
|
- name: calico-etc
|
||||||
|
configMap:
|
||||||
|
name: calico-etc
|
||||||
|
defaultMode: 0444
|
||||||
|
- name: calico-bird
|
||||||
|
configMap:
|
||||||
|
name: calico-bird
|
||||||
|
defaultMode: 0444
|
||||||
|
- name: calico-bin
|
||||||
|
configMap:
|
||||||
|
name: calico-bin
|
||||||
|
defaultMode: 0555
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
secret:
|
||||||
|
secretName: calico-etcd-secrets
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
containers:
|
||||||
|
# Runs calico/node container on each Kubernetes node. This
|
||||||
|
# container programs network policy and routes on each
|
||||||
|
# host.
|
||||||
|
- name: calico-node
|
||||||
|
{{ tuple $envAll "calico_node" | include "helm-toolkit.snippets.image" | indent 10 }}
|
||||||
|
{{ tuple $envAll $envAll.Values.pod.resources.calico_node | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
||||||
|
{{ dict "envAll" $envAll "application" "calico_node" "container" "calico_node" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
|
||||||
|
env:
|
||||||
|
# Values expanded explicitly from conf.node (some of which
|
||||||
|
# might be derived from elsewhere, see values.yaml for an
|
||||||
|
# explanation of this)
|
||||||
|
#
|
||||||
|
{{ include "helm-toolkit.utils.to_k8s_env_vars" .Values.conf.node | indent 12 }}
|
||||||
|
|
||||||
|
# Values explicit in the chart not expected to be found in
|
||||||
|
# conf.node
|
||||||
|
#
|
||||||
|
|
||||||
|
# The location of the Calico etcd cluster.
|
||||||
|
- name: ETCD_ENDPOINTS
|
||||||
|
valueFrom:
|
||||||
|
configMapKeyRef:
|
||||||
|
name: calico-etc
|
||||||
|
key: etcd_endpoints
|
||||||
|
|
||||||
|
# etcd certs
|
||||||
|
{{ if .Values.endpoints.etcd.auth.client.tls.ca }}
|
||||||
|
- name: ETCD_CA_CERT_FILE
|
||||||
|
value: {{ .Values.endpoints.etcd.auth.client.path.ca }}
|
||||||
|
{{ end }}
|
||||||
|
{{ if .Values.endpoints.etcd.auth.client.tls.key }}
|
||||||
|
- name: ETCD_KEY_FILE
|
||||||
|
value: {{ .Values.endpoints.etcd.auth.client.path.key }}
|
||||||
|
{{ end }}
|
||||||
|
{{ if .Values.endpoints.etcd.auth.client.tls.crt }}
|
||||||
|
- name: ETCD_CERT_FILE
|
||||||
|
value: {{ .Values.endpoints.etcd.auth.client.path.crt }}
|
||||||
|
{{ end }}
|
||||||
|
|
||||||
|
# Set noderef for node controller.
|
||||||
|
- name: CALICO_K8S_NODE_REF
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: spec.nodeName
|
||||||
|
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /liveness
|
||||||
|
port: 9099
|
||||||
|
host: localhost
|
||||||
|
periodSeconds: 10
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
failureThreshold: 6
|
||||||
|
|
||||||
|
# Only for Calico v3
|
||||||
|
readinessProbe:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bin/calico-node
|
||||||
|
- -bird-ready
|
||||||
|
- -felix-ready
|
||||||
|
periodSeconds: 10
|
||||||
|
volumeMounts:
|
||||||
|
- name: pod-tmp
|
||||||
|
mountPath: /tmp
|
||||||
|
- mountPath: /lib/modules
|
||||||
|
name: lib-modules
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /run/xtables.lock
|
||||||
|
name: xtables-lock
|
||||||
|
readOnly: false
|
||||||
|
- mountPath: /var/run/calico
|
||||||
|
name: var-run-calico
|
||||||
|
readOnly: false
|
||||||
|
|
||||||
|
# bird template replacements
|
||||||
|
# bird cfg
|
||||||
|
- mountPath: /etc/calico/confd/templates/bird.cfg.template
|
||||||
|
name: calico-bird
|
||||||
|
subPath: bird.cfg.template
|
||||||
|
# bird ipam
|
||||||
|
- mountPath: /etc/calico/confd/templates/bird_ipam.cfg.template
|
||||||
|
name: calico-bird
|
||||||
|
subPath: bird_ipam.cfg.template
|
||||||
|
# bird6 cfg
|
||||||
|
- mountPath: /etc/calico/confd/templates/bird6.cfg.template
|
||||||
|
name: calico-bird
|
||||||
|
subPath: bird6.cfg.template
|
||||||
|
# bird6 ipam
|
||||||
|
- mountPath: /etc/calico/confd/templates/bird6_ipam.cfg.template
|
||||||
|
name: calico-bird
|
||||||
|
subPath: bird6_ipam.cfg.template
|
||||||
|
# etcd secrets
|
||||||
|
- mountPath: /var/lib/calico
|
||||||
|
name: var-lib-calico
|
||||||
|
readOnly: false
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.ca }}
|
||||||
|
subPath: tls.ca
|
||||||
|
readOnly: true
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.crt }}
|
||||||
|
subPath: tls.crt
|
||||||
|
readOnly: true
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.key }}
|
||||||
|
subPath: tls.key
|
||||||
|
readOnly: true
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
181
charts/calico/templates/deployment-calico-kube-controllers.yaml
Normal file
181
charts/calico/templates/deployment-calico-kube-controllers.yaml
Normal file
@ -0,0 +1,181 @@
|
|||||||
|
{{/*
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.manifests.deployment_calico_kube_controllers }}
|
||||||
|
{{- $envAll := . }}
|
||||||
|
|
||||||
|
{{- $serviceAccountName := "calico-kube-controllers" }}
|
||||||
|
{{ tuple $envAll "calico_kube_controllers" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
|
||||||
|
---
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ $serviceAccountName }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ $serviceAccountName }}
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ $serviceAccountName }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
---
|
||||||
|
kind: ClusterRole
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ $serviceAccountName }}
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
- extensions
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
- namespaces
|
||||||
|
- networkpolicies
|
||||||
|
- nodes
|
||||||
|
- serviceaccounts
|
||||||
|
verbs:
|
||||||
|
- watch
|
||||||
|
- list
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- networkpolicies
|
||||||
|
verbs:
|
||||||
|
- watch
|
||||||
|
- list
|
||||||
|
---
|
||||||
|
|
||||||
|
# This manifest deploys the Calico Kubernetes controllers.
|
||||||
|
# See https://github.com/projectcalico/kube-controllers
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: calico-kube-controllers
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
k8s-app: calico-kube-controllers
|
||||||
|
{{ tuple $envAll "calico" "kube-controllers" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
||||||
|
annotations:
|
||||||
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
|
||||||
|
spec:
|
||||||
|
priorityClassName: system-cluster-critical
|
||||||
|
# The controllers can only have a single active instance.
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
k8s-app: calico-kube-controllers
|
||||||
|
{{ tuple $envAll "calico" "kube-controllers" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }}
|
||||||
|
{{ tuple $envAll | include "helm-toolkit.snippets.kubernetes_upgrades_deployment" | indent 2 }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
name: calico-kube-controllers
|
||||||
|
labels:
|
||||||
|
k8s-app: calico-kube-controllers
|
||||||
|
{{ tuple $envAll "calico" "kube-controllers" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
||||||
|
annotations:
|
||||||
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
|
||||||
|
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
|
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
|
spec:
|
||||||
|
{{ dict "envAll" $envAll "application" "kube_controllers" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
|
||||||
|
nodeSelector:
|
||||||
|
beta.kubernetes.io/os: linux
|
||||||
|
# The controllers must run in the host network namespace so that
|
||||||
|
# it isn't governed by policy that would prevent it from working.
|
||||||
|
hostNetwork: true
|
||||||
|
tolerations:
|
||||||
|
# Mark the pod as a critical add-on for rescheduling.
|
||||||
|
- key: node.cloudprovider.kubernetes.io/uninitialized
|
||||||
|
value: "true"
|
||||||
|
effect: NoSchedule
|
||||||
|
|
||||||
|
- key: CriticalAddonsOnly
|
||||||
|
operator: Exists
|
||||||
|
- key: node-role.kubernetes.io/master
|
||||||
|
effect: NoSchedule
|
||||||
|
- key: node-role.kubernetes.io/control-plane
|
||||||
|
effect: NoSchedule
|
||||||
|
- key: node.kubernetes.io/not-ready
|
||||||
|
operator: Exists
|
||||||
|
effect: NoSchedule
|
||||||
|
serviceAccountName: {{ $serviceAccountName }}
|
||||||
|
initContainers:
|
||||||
|
{{ tuple $envAll "calico_kube_controllers" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
|
||||||
|
containers:
|
||||||
|
- name: calico-kube-controllers
|
||||||
|
{{ tuple $envAll "calico_kube_controllers" | include "helm-toolkit.snippets.image" | indent 10 }}
|
||||||
|
{{ tuple $envAll $envAll.Values.pod.resources.calico_kube_controllers | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
||||||
|
{{ dict "envAll" $envAll "application" "kube_controllers" "container" "kube_controller" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
|
||||||
|
env:
|
||||||
|
# The location of the Calico etcd cluster.
|
||||||
|
- name: ETCD_ENDPOINTS
|
||||||
|
valueFrom:
|
||||||
|
configMapKeyRef:
|
||||||
|
name: calico-etc
|
||||||
|
key: etcd_endpoints
|
||||||
|
|
||||||
|
# conf.controllers expanded values
|
||||||
|
{{ include "helm-toolkit.utils.to_k8s_env_vars" .Values.conf.controllers | indent 12 }}
|
||||||
|
|
||||||
|
{{ if .Values.endpoints.etcd.auth.client.tls.ca }}
|
||||||
|
# etcd tls files
|
||||||
|
- name: ETCD_CA_CERT_FILE
|
||||||
|
value: {{ .Values.endpoints.etcd.auth.client.path.ca }}
|
||||||
|
{{ end }}
|
||||||
|
{{ if .Values.endpoints.etcd.auth.client.tls.key }}
|
||||||
|
- name: ETCD_KEY_FILE
|
||||||
|
value: {{ .Values.endpoints.etcd.auth.client.path.key }}
|
||||||
|
{{ end }}
|
||||||
|
{{ if .Values.endpoints.etcd.auth.client.tls.crt }}
|
||||||
|
- name: ETCD_CERT_FILE
|
||||||
|
value: {{ .Values.endpoints.etcd.auth.client.path.crt }}
|
||||||
|
{{ end }}
|
||||||
|
|
||||||
|
# etcd tls mounts
|
||||||
|
volumeMounts:
|
||||||
|
- name: pod-tmp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.ca }}
|
||||||
|
subPath: tls.ca
|
||||||
|
readOnly: true
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.crt }}
|
||||||
|
subPath: tls.crt
|
||||||
|
readOnly: true
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.key }}
|
||||||
|
subPath: tls.key
|
||||||
|
readOnly: true
|
||||||
|
|
||||||
|
# Calico v3 only
|
||||||
|
readinessProbe:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /usr/bin/check-status
|
||||||
|
- -r
|
||||||
|
livenessProbe:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /usr/bin/check-status
|
||||||
|
- -r
|
||||||
|
volumes:
|
||||||
|
- name: pod-tmp
|
||||||
|
emptyDir: {}
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
secret:
|
||||||
|
secretName: calico-etcd-secrets
|
||||||
|
defaultMode: 0400
|
||||||
|
{{- end }}
|
||||||
2
charts/calico/templates/etc/_bird-tar-deposit.base64.txt
Normal file
2
charts/calico/templates/etc/_bird-tar-deposit.base64.txt
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
H4sIAJLrq1sCA+3IOwqFMABE0SwlS4jGxPVYvFIQP4W7N1ja+0A4p7nD/OZlP8O7UlOH4W7z7L27
|
||||||
|
nEs/1lL62v4x5S7EFP7g2PZpjTEAAAAAAAAAAADAh1zOUd8NACgAAA==
|
||||||
109
charts/calico/templates/job-calico-settings.yaml
Normal file
109
charts/calico/templates/job-calico-settings.yaml
Normal file
@ -0,0 +1,109 @@
|
|||||||
|
{{/*
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.manifests.job_calico_settings }}
|
||||||
|
{{- $envAll := . }}
|
||||||
|
|
||||||
|
{{- $serviceAccountName := "calico-settings" }}
|
||||||
|
{{ tuple $envAll "calico_settings" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: calico-settings
|
||||||
|
labels:
|
||||||
|
{{ tuple $envAll "calico" "calico_settings" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
||||||
|
annotations:
|
||||||
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
|
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
|
||||||
|
labels:
|
||||||
|
{{ tuple $envAll "calico" "calico_settings" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
||||||
|
spec:
|
||||||
|
{{ dict "envAll" $envAll "application" "calico_settings" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
|
||||||
|
hostNetwork: true
|
||||||
|
priorityClassName: system-cluster-critical
|
||||||
|
tolerations:
|
||||||
|
- key: node-role.kubernetes.io/control-plane
|
||||||
|
effect: NoSchedule
|
||||||
|
- key: node.kubernetes.io/not-ready
|
||||||
|
operator: Exists
|
||||||
|
effect: NoSchedule
|
||||||
|
# Allow this pod to be rescheduled while the node is in "critical add-ons only" mode.
|
||||||
|
# This, along with the annotation above marks this pod as a critical add-on.
|
||||||
|
- key: CriticalAddonsOnly
|
||||||
|
operator: Exists
|
||||||
|
serviceAccountName: {{ $serviceAccountName }}
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
initContainers:
|
||||||
|
{{ tuple $envAll "calico_settings" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
|
||||||
|
containers:
|
||||||
|
- name: calico-settings
|
||||||
|
{{ tuple $envAll "calico_settings" | include "helm-toolkit.snippets.image" | indent 10 }}
|
||||||
|
{{ tuple $envAll $envAll.Values.pod.resources.calico_settings | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
||||||
|
{{ dict "envAll" $envAll "application" "calico_settings" "container" "calico_settings" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
|
||||||
|
env:
|
||||||
|
- name: ETCD_ENDPOINTS
|
||||||
|
valueFrom:
|
||||||
|
configMapKeyRef:
|
||||||
|
name: calico-etc
|
||||||
|
key: etcd_endpoints
|
||||||
|
{{ if .Values.endpoints.etcd.auth.client.tls.ca }}
|
||||||
|
- name: ETCD_CA_CERT_FILE
|
||||||
|
value: {{ .Values.endpoints.etcd.auth.client.path.ca }}
|
||||||
|
{{ end }}
|
||||||
|
{{ if .Values.endpoints.etcd.auth.client.tls.key }}
|
||||||
|
- name: ETCD_KEY_FILE
|
||||||
|
value: {{ .Values.endpoints.etcd.auth.client.path.key }}
|
||||||
|
{{ end }}
|
||||||
|
{{ if .Values.endpoints.etcd.auth.client.tls.crt }}
|
||||||
|
- name: ETCD_CERT_FILE
|
||||||
|
value: {{ .Values.endpoints.etcd.auth.client.path.crt }}
|
||||||
|
{{ end }}
|
||||||
|
command:
|
||||||
|
- /tmp/calico-settings.sh
|
||||||
|
volumeMounts:
|
||||||
|
- name: pod-tmp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: calico-bin
|
||||||
|
mountPath: /tmp/calico-settings.sh
|
||||||
|
subPath: calico-settings.sh
|
||||||
|
readOnly: true
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.ca }}
|
||||||
|
subPath: tls.ca
|
||||||
|
readOnly: true
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.crt }}
|
||||||
|
subPath: tls.crt
|
||||||
|
readOnly: true
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
mountPath: {{ .Values.endpoints.etcd.auth.client.path.key }}
|
||||||
|
subPath: tls.key
|
||||||
|
readOnly: true
|
||||||
|
volumes:
|
||||||
|
- name: pod-tmp
|
||||||
|
emptyDir: {}
|
||||||
|
- name: calico-bin
|
||||||
|
configMap:
|
||||||
|
name: calico-bin
|
||||||
|
defaultMode: 0555
|
||||||
|
- name: calico-etcd-secrets
|
||||||
|
secret:
|
||||||
|
secretName: calico-etcd-secrets
|
||||||
|
{{- end }}
|
||||||
19
charts/calico/templates/job-image-repo-sync.yaml
Normal file
19
charts/calico/templates/job-image-repo-sync.yaml
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
{{/*
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and .Values.manifests.job_image_repo_sync .Values.images.local_registry.active }}
|
||||||
|
|
||||||
|
{{- $imageRepoSyncJob := dict "envAll" . "serviceName" "calico" -}}
|
||||||
|
{{ $imageRepoSyncJob | include "helm-toolkit.manifests.job_image_repo_sync" }}
|
||||||
|
{{- end }}
|
||||||
31
charts/calico/templates/secret-etcd-certificates.yaml
Normal file
31
charts/calico/templates/secret-etcd-certificates.yaml
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
{{/*
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.manifests.secret_certificates }}
|
||||||
|
{{- $envAll := . }}
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
type: kubernetes.io/tls
|
||||||
|
metadata:
|
||||||
|
name: calico-etcd-secrets
|
||||||
|
data:
|
||||||
|
tls.ca: {{ .Values.endpoints.etcd.auth.client.tls.ca | default "" | b64enc }}
|
||||||
|
tls.key: {{ .Values.endpoints.etcd.auth.client.tls.key | default "" | b64enc }}
|
||||||
|
tls.crt: {{ .Values.endpoints.etcd.auth.client.tls.crt | default "" | b64enc }}
|
||||||
|
etcd.ca: {{ .Values.conf.etcd.credentials.ca | default "" | b64enc }}
|
||||||
|
etcd.crt: {{ .Values.conf.etcd.credentials.certificate | default "" | b64enc }}
|
||||||
|
etcd.key: {{ .Values.conf.etcd.credentials.key | default "" | b64enc }}
|
||||||
|
{{- end }}
|
||||||
17
charts/calico/templates/secret-registry.yaml
Normal file
17
charts/calico/templates/secret-registry.yaml
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
{{/*
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if and .Values.manifests.secret_registry .Values.endpoints.oci_image_registry.auth.enabled }}
|
||||||
|
{{ include "helm-toolkit.manifests.secret_registry" ( dict "envAll" . "registryUser" .Chart.Name ) }}
|
||||||
|
{{- end }}
|
||||||
37
charts/calico/templates/service-calico-etcd.yaml
Normal file
37
charts/calico/templates/service-calico-etcd.yaml
Normal file
@ -0,0 +1,37 @@
|
|||||||
|
{{/*
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{- if .Values.manifests.service_calico_etcd }}
|
||||||
|
{{- $envAll := . }}
|
||||||
|
---
|
||||||
|
# This manifest installs the Service which gets traffic to the Calico
|
||||||
|
# etcd.
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
k8s-app: calico-etcd
|
||||||
|
{{ tuple $envAll "calico" "etcd" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
||||||
|
name: {{ tuple "etcd" "internal" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" }}
|
||||||
|
spec:
|
||||||
|
# Select the calico-etcd pod running on the master.
|
||||||
|
selector:
|
||||||
|
k8s-app: calico-etcd
|
||||||
|
{{ tuple $envAll "calico" "etcd" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
||||||
|
# This ClusterIP needs to be known in advance, since we cannot rely
|
||||||
|
# on DNS to get access to etcd.
|
||||||
|
clusterIP: {{ tuple "etcd" "internal" . | include "helm-toolkit.endpoints.endpoint_host_lookup" }}
|
||||||
|
ports:
|
||||||
|
- port: {{ tuple "etcd" "internal" "client" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
|
||||||
|
{{- end }}
|
||||||
595
charts/calico/values.yaml
Normal file
595
charts/calico/values.yaml
Normal file
@ -0,0 +1,595 @@
|
|||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
---
|
||||||
|
images:
|
||||||
|
tags:
|
||||||
|
# These are minimum versions, older images will very likely not
|
||||||
|
# work
|
||||||
|
calico_etcd: quay.io/coreos/etcd:v3.5.9
|
||||||
|
calico_node: quay.io/calico/node:v3.25.1
|
||||||
|
calico_cni: quay.io/calico/cni:v3.25.1
|
||||||
|
calico_ctl: calico/ctl:v3.25.1
|
||||||
|
calico_settings: calico/ctl:v3.25.1
|
||||||
|
# NOTE: plural key, singular value
|
||||||
|
calico_kube_controllers: quay.io/calico/kube-controllers:v3.25.1
|
||||||
|
dep_check: quay.io/airshipit/kubernetes-entrypoint:v1.0.0
|
||||||
|
image_repo_sync: docker.io/library/docker:24.0.1
|
||||||
|
pull_policy: IfNotPresent
|
||||||
|
local_registry:
|
||||||
|
active: false
|
||||||
|
exclude:
|
||||||
|
- dep_check
|
||||||
|
- image_repo_sync
|
||||||
|
- calico_etcd
|
||||||
|
- calico_node
|
||||||
|
- calico_cni
|
||||||
|
- calico_kube_controllers
|
||||||
|
|
||||||
|
pod:
|
||||||
|
security_context:
|
||||||
|
etcd:
|
||||||
|
pod:
|
||||||
|
runAsUser: 0
|
||||||
|
container:
|
||||||
|
calico_etcd:
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
calico_node:
|
||||||
|
pod:
|
||||||
|
runAsUser: 0
|
||||||
|
container:
|
||||||
|
calico_ctl:
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
install_cni:
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
calico_node:
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
capabilities:
|
||||||
|
add:
|
||||||
|
- 'NET_ADMIN'
|
||||||
|
- 'SYS_ADMIN'
|
||||||
|
kube_controllers:
|
||||||
|
pod:
|
||||||
|
runAsUser: 0
|
||||||
|
container:
|
||||||
|
kube_controller:
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
calico_settings:
|
||||||
|
pod:
|
||||||
|
runAsUser: 0
|
||||||
|
container:
|
||||||
|
calico_settings:
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
resources:
|
||||||
|
enabled: false
|
||||||
|
jobs:
|
||||||
|
image_repo_sync:
|
||||||
|
requests:
|
||||||
|
memory: "128Mi"
|
||||||
|
cpu: "100m"
|
||||||
|
limits:
|
||||||
|
memory: "1024Mi"
|
||||||
|
cpu: "2000m"
|
||||||
|
calico_settings:
|
||||||
|
requests:
|
||||||
|
memory: "128Mi"
|
||||||
|
cpu: "100m"
|
||||||
|
limits:
|
||||||
|
memory: "1024Mi"
|
||||||
|
cpu: "2000m"
|
||||||
|
calico_kube_controllers:
|
||||||
|
requests:
|
||||||
|
memory: "128Mi"
|
||||||
|
cpu: "100m"
|
||||||
|
limits:
|
||||||
|
memory: "1024Mi"
|
||||||
|
cpu: "2000m"
|
||||||
|
calico_node:
|
||||||
|
requests:
|
||||||
|
memory: "128Mi"
|
||||||
|
cpu: "250m"
|
||||||
|
limits:
|
||||||
|
memory: "1024Mi"
|
||||||
|
cpu: "2000m"
|
||||||
|
calico_cni:
|
||||||
|
requests:
|
||||||
|
memory: "128Mi"
|
||||||
|
cpu: "100m"
|
||||||
|
limits:
|
||||||
|
memory: "1024Mi"
|
||||||
|
cpu: "2000m"
|
||||||
|
calico_ctl:
|
||||||
|
requests:
|
||||||
|
memory: "128Mi"
|
||||||
|
cpu: "100m"
|
||||||
|
limits:
|
||||||
|
memory: "1024Mi"
|
||||||
|
cpu: "2000m"
|
||||||
|
calico_etcd:
|
||||||
|
requests:
|
||||||
|
memory: "128Mi"
|
||||||
|
cpu: "100m"
|
||||||
|
limits:
|
||||||
|
memory: "1024Mi"
|
||||||
|
cpu: "2000m"
|
||||||
|
lifecycle:
|
||||||
|
upgrades:
|
||||||
|
deployments:
|
||||||
|
revision_history: 3
|
||||||
|
pod_replacement_strategy: RollingUpdate
|
||||||
|
rolling_update:
|
||||||
|
max_unavailable: 1
|
||||||
|
max_surge: 3
|
||||||
|
disruption_budget:
|
||||||
|
controllers:
|
||||||
|
min_available: 0
|
||||||
|
mandatory_access_control:
|
||||||
|
type: apparmor
|
||||||
|
calico-node:
|
||||||
|
calico-node: runtime/default
|
||||||
|
|
||||||
|
dependencies:
|
||||||
|
dynamic:
|
||||||
|
common:
|
||||||
|
local_image_registry:
|
||||||
|
jobs:
|
||||||
|
- calico-image-repo-sync
|
||||||
|
services:
|
||||||
|
- endpoint: node
|
||||||
|
service: local_image_registry
|
||||||
|
static:
|
||||||
|
calico_kube_controllers:
|
||||||
|
services:
|
||||||
|
- endpoint: internal
|
||||||
|
service: calico-etcd
|
||||||
|
calico_node:
|
||||||
|
services:
|
||||||
|
- endpoint: internal
|
||||||
|
service: calico-etcd
|
||||||
|
calico_settings:
|
||||||
|
services:
|
||||||
|
- endpoint: internal
|
||||||
|
service: calico-etcd
|
||||||
|
calico_etcd:
|
||||||
|
services: null
|
||||||
|
image_repo_sync:
|
||||||
|
services:
|
||||||
|
- endpoint: internal
|
||||||
|
service: local_image_registry
|
||||||
|
|
||||||
|
secrets:
|
||||||
|
oci_image_registry:
|
||||||
|
calico: calico-oci-image-registry
|
||||||
|
|
||||||
|
endpoints:
|
||||||
|
cluster_domain_suffix: cluster.local
|
||||||
|
local_image_registry:
|
||||||
|
name: docker-registry
|
||||||
|
namespace: docker-registry
|
||||||
|
hosts:
|
||||||
|
default: localhost
|
||||||
|
internal: docker-registry
|
||||||
|
node: localhost
|
||||||
|
host_fqdn_override:
|
||||||
|
default: null
|
||||||
|
port:
|
||||||
|
registry:
|
||||||
|
node: 5000
|
||||||
|
oci_image_registry:
|
||||||
|
name: oci-image-registry
|
||||||
|
namespace: oci-image-registry
|
||||||
|
auth:
|
||||||
|
enabled: false
|
||||||
|
calico:
|
||||||
|
username: calico
|
||||||
|
password: password
|
||||||
|
hosts:
|
||||||
|
default: localhost
|
||||||
|
host_fqdn_override:
|
||||||
|
default: null
|
||||||
|
port:
|
||||||
|
registry:
|
||||||
|
default: null
|
||||||
|
etcd:
|
||||||
|
auth:
|
||||||
|
client:
|
||||||
|
tls:
|
||||||
|
crt: null
|
||||||
|
ca: null
|
||||||
|
key: null
|
||||||
|
path:
|
||||||
|
# these must be within /etc/calico
|
||||||
|
crt: /etc/calico/pki/crt
|
||||||
|
ca: /etc/calico/pki/ca
|
||||||
|
key: /etc/calico/pki/key
|
||||||
|
scheme:
|
||||||
|
default: http
|
||||||
|
path:
|
||||||
|
default: ' ' # space required to provide a truly empty path
|
||||||
|
hosts:
|
||||||
|
default: 10.96.232.136
|
||||||
|
host_fqdn_override:
|
||||||
|
default: null
|
||||||
|
service:
|
||||||
|
name: null
|
||||||
|
port:
|
||||||
|
client:
|
||||||
|
default: 6666
|
||||||
|
peer:
|
||||||
|
default: 6667
|
||||||
|
|
||||||
|
monitoring:
|
||||||
|
prometheus:
|
||||||
|
enabled: true
|
||||||
|
calico_node:
|
||||||
|
scrape: true
|
||||||
|
port: 9091
|
||||||
|
|
||||||
|
networking:
|
||||||
|
podSubnet: 192.168.0.0/16
|
||||||
|
# Physical MTU, if ipip is enabled, the chart will adjust things downward
|
||||||
|
mtu: 1500
|
||||||
|
|
||||||
|
settings:
|
||||||
|
mesh: "on"
|
||||||
|
# technically this could be a list, today we only support a single
|
||||||
|
# podSubnet, the one above. The settings below will be applied to
|
||||||
|
# that ipPool
|
||||||
|
ippool:
|
||||||
|
ipip:
|
||||||
|
enabled: true
|
||||||
|
nat_outgoing: true
|
||||||
|
disabled: false
|
||||||
|
|
||||||
|
bgp:
|
||||||
|
# our asnumber for bgp peering
|
||||||
|
asnumber: 64512
|
||||||
|
ipv4:
|
||||||
|
# https://docs.projectcalico.org/v3.4/reference/calicoctl/resources/bgppeer
|
||||||
|
#
|
||||||
|
# this is a list of peer objects that will be passed directly to
|
||||||
|
# calicoctl - for global peers, the scope should be global and
|
||||||
|
# the node attribute removed
|
||||||
|
#
|
||||||
|
# apiVersion: projectcalico.org/v3
|
||||||
|
# kind: BGPPeer
|
||||||
|
# metadata:
|
||||||
|
# name: some.name
|
||||||
|
# spec:
|
||||||
|
# node: rack1-host1
|
||||||
|
# peerIP: 10.1.10.39
|
||||||
|
# asNumber: 64512
|
||||||
|
peers: []
|
||||||
|
# this is a list of additional IPv4 cidrs that if we discover
|
||||||
|
# IPs within them on a host, we will announce the address in
|
||||||
|
# addition to traditional pod workloads
|
||||||
|
additional_cidrs: []
|
||||||
|
# community_cidr_ref contains embedded objects that describe a
|
||||||
|
# BGP community that is to be associated with the supplied CIDR.
|
||||||
|
# The top-level key names are not important.
|
||||||
|
#
|
||||||
|
# The resulting BGP community will take the form of
|
||||||
|
# <prefix>:<community>
|
||||||
|
# If no prefix is specified then the asnumber is used
|
||||||
|
community_cidr_ref:
|
||||||
|
# cidr_community_description:
|
||||||
|
# cidr: 192.168.0.0/16
|
||||||
|
# community: 54321
|
||||||
|
# prefix: 55555
|
||||||
|
# alpha:
|
||||||
|
# cidr: 10.0.0.0/16
|
||||||
|
# community: 54322
|
||||||
|
port:
|
||||||
|
neighbor: 179
|
||||||
|
listen: 179
|
||||||
|
ipv6:
|
||||||
|
# https://docs.projectcalico.org/v3.4/reference/calicoctl/resources/bgppeer
|
||||||
|
#
|
||||||
|
# this is a list of peer objects that will be passed directly to
|
||||||
|
# calicoctl - for global peers, the scope should be global and
|
||||||
|
# the node attribute removed
|
||||||
|
#
|
||||||
|
# apiVersion: projectcalico.org/v3
|
||||||
|
# kind: BGPPeer
|
||||||
|
# metadata:
|
||||||
|
# name: some.name
|
||||||
|
# spec:
|
||||||
|
# node: rack1-host1
|
||||||
|
# peerIP: 2600:1:2:3::abcd
|
||||||
|
# asNumber: 64512
|
||||||
|
peers: []
|
||||||
|
# this is a list of additional IPv6 cidrs that if we discover
|
||||||
|
# IPs within them on a host, we will announce them in addition
|
||||||
|
# to traditional pod workloads
|
||||||
|
additional_cidrs: []
|
||||||
|
# community_cidr_ref contains embedded objects that describe a
|
||||||
|
# BGP community that is to be associated with the supplied CIDR.
|
||||||
|
# The top-level key names are not important.
|
||||||
|
#
|
||||||
|
# The resulting BGP community will take the form of
|
||||||
|
# <prefix>:<community>
|
||||||
|
# If no prefix is specified then the asnumber is used
|
||||||
|
community_cidr_ref:
|
||||||
|
# cidr_community_description:
|
||||||
|
# cidr: 2600:1:2:3::abcd/28
|
||||||
|
# community: 54321
|
||||||
|
# prefix: 55555
|
||||||
|
# alpha:
|
||||||
|
# cidr: 1400:a:2:3::abcd/26
|
||||||
|
# community: 54322
|
||||||
|
port:
|
||||||
|
neighbor: 179
|
||||||
|
listen: 179
|
||||||
|
|
||||||
|
# Policy contains embedded Calico policy and/or endpoint objects.
|
||||||
|
# Because lists are cumbersome to deal with this is stuctured as a
|
||||||
|
# dictionary (therefore not ordered). The top-level key names are
|
||||||
|
# not important, priority contains a value between 0 and 9 inclusive
|
||||||
|
# and rules contains any objects (typically used as rules).
|
||||||
|
# Priority 0 objects are emitted before priority 9. It is
|
||||||
|
# recommended any rules such as HostEndpoint be given a higher
|
||||||
|
# priority so that they are applied after more generic objects.
|
||||||
|
# Priority values outside of integers 0 through 9 are not valid and
|
||||||
|
# should not be used.
|
||||||
|
policy:
|
||||||
|
# alpha:
|
||||||
|
# priority: 0
|
||||||
|
# rules:
|
||||||
|
# - apiVersion: projectcalico.org/v3
|
||||||
|
# kind: GlobalNetworkPolicy
|
||||||
|
# metadata:
|
||||||
|
# name: allow-tcp-6379
|
||||||
|
# spec:
|
||||||
|
# order: 0
|
||||||
|
# selector: role == 'database'
|
||||||
|
# types:
|
||||||
|
# - Ingress
|
||||||
|
# - Egress
|
||||||
|
# ingress:
|
||||||
|
# - action: Allow
|
||||||
|
# protocol: TCP
|
||||||
|
# source:
|
||||||
|
# selector: role == 'frontend'
|
||||||
|
# destination:
|
||||||
|
# ports:
|
||||||
|
# - 6379
|
||||||
|
# egress:
|
||||||
|
# - action: Allow
|
||||||
|
# - apiVersion: projectcalico.org/v3
|
||||||
|
# kind: GlobalNetworkPolicy
|
||||||
|
# metadata:
|
||||||
|
# name: allow-tcp-3306
|
||||||
|
# spec:
|
||||||
|
# order: 1
|
||||||
|
# selector: role == 'database'
|
||||||
|
# types:
|
||||||
|
# - Ingress
|
||||||
|
# - Egress
|
||||||
|
# ingress:
|
||||||
|
# - action: Allow
|
||||||
|
# protocol: TCP
|
||||||
|
# source:
|
||||||
|
# selector: role == 'frontend'
|
||||||
|
# destination:
|
||||||
|
# ports:
|
||||||
|
# - 3306
|
||||||
|
# egress:
|
||||||
|
# - action: Allow
|
||||||
|
|
||||||
|
# beta:
|
||||||
|
# priority: 1
|
||||||
|
# rules:
|
||||||
|
# - apiVersion: projectcalico.org/v3
|
||||||
|
# kind: NetworkPolicy
|
||||||
|
# metadata:
|
||||||
|
# name: allow-tcp-6379
|
||||||
|
# namespace: production
|
||||||
|
# spec:
|
||||||
|
# selector: role == 'database'
|
||||||
|
# types:
|
||||||
|
# - Ingress
|
||||||
|
# - Egress
|
||||||
|
# ingress:
|
||||||
|
# - action: Allow
|
||||||
|
# protocol: TCP
|
||||||
|
# source:
|
||||||
|
# selector: role == 'frontend'
|
||||||
|
# destination:
|
||||||
|
# ports:
|
||||||
|
# - 6379
|
||||||
|
# egress:
|
||||||
|
# - action: Allow
|
||||||
|
# - apiVersion: projectcalico.org/v3
|
||||||
|
# kind: NetworkPolicy
|
||||||
|
# metadata:
|
||||||
|
# name: allow-tcp-8081
|
||||||
|
# namespace: production
|
||||||
|
# spec:
|
||||||
|
# selector: role == 'webthing'
|
||||||
|
# types:
|
||||||
|
# - Ingress
|
||||||
|
# - Egress
|
||||||
|
# ingress:
|
||||||
|
# - action: Allow
|
||||||
|
# protocol: TCP
|
||||||
|
# source:
|
||||||
|
# selector: role == 'frontend'
|
||||||
|
# destination:
|
||||||
|
# ports:
|
||||||
|
# - 8081
|
||||||
|
# egress:
|
||||||
|
# - action: Allow
|
||||||
|
|
||||||
|
# zulu:
|
||||||
|
# priority: 9
|
||||||
|
# rules:
|
||||||
|
# - apiVersion: projectcalico.org/v3
|
||||||
|
# kind: HostEndpoint
|
||||||
|
# metadata:
|
||||||
|
# name: first.thing
|
||||||
|
# labels:
|
||||||
|
# type: production
|
||||||
|
# spec:
|
||||||
|
# interfaceName: eth0
|
||||||
|
# node: mysecrethost
|
||||||
|
# expectedIPs:
|
||||||
|
# - 192.168.0.1
|
||||||
|
# - 192.168.0.2
|
||||||
|
# profiles:
|
||||||
|
# - profile1
|
||||||
|
# - profile2
|
||||||
|
# ports:
|
||||||
|
# - name: some-port
|
||||||
|
# port: 1234
|
||||||
|
# protocol: TCP
|
||||||
|
# - name: another-port
|
||||||
|
# port: 5432
|
||||||
|
# protocol: UDP
|
||||||
|
# - apiVersion: projectcalico.org/v3
|
||||||
|
# kind: HostEndpoint
|
||||||
|
# metadata:
|
||||||
|
# name: second.thing
|
||||||
|
# labels:
|
||||||
|
# type: production
|
||||||
|
# spec:
|
||||||
|
# interfaceName: eth1
|
||||||
|
# node: myothersecrethost
|
||||||
|
# expectedIPs:
|
||||||
|
# - 192.168.1.1
|
||||||
|
# - 192.168.1.2
|
||||||
|
# profiles:
|
||||||
|
# - profile1
|
||||||
|
# - profile2
|
||||||
|
# ports:
|
||||||
|
# - name: some-port
|
||||||
|
# port: 1234
|
||||||
|
# protocol: TCP
|
||||||
|
# - name: another-port
|
||||||
|
# port: 5432
|
||||||
|
# protocol: UDP
|
||||||
|
|
||||||
|
conf:
|
||||||
|
etcd:
|
||||||
|
credentials:
|
||||||
|
ca: null
|
||||||
|
key: null
|
||||||
|
certificate: null
|
||||||
|
# NOTE; syntax has subtly changed since Calico v2. For Armada *all*
|
||||||
|
# of this needes to be specified. We're using yaml here which we
|
||||||
|
# can't robustly convert to json (which the node pod requires) so it
|
||||||
|
# might be we revisit that and embedded a json string that gets
|
||||||
|
# edits
|
||||||
|
cni_network_config:
|
||||||
|
# https://docs.projectcalico.org/v3.4/reference/cni-plugin/configuration
|
||||||
|
#
|
||||||
|
# other than the etcd_* keys you likely want to leave this as-is
|
||||||
|
name: k8s-pod-network
|
||||||
|
cniVersion: 0.3.0
|
||||||
|
plugins:
|
||||||
|
- type: calico
|
||||||
|
log_level: info
|
||||||
|
etcd_endpoints: __ETCD_ENDPOINTS__
|
||||||
|
etcd_key_file: __ETCD_KEY_FILE__
|
||||||
|
etcd_cert_file: __ETCD_CERT_FILE__
|
||||||
|
etcd_ca_cert_file: __ETCD_CA_CERT_FILE__
|
||||||
|
ipam:
|
||||||
|
type: calico-ipam
|
||||||
|
policy:
|
||||||
|
type: k8s
|
||||||
|
kubernetes:
|
||||||
|
kubeconfig: __KUBECONFIG_FILEPATH__
|
||||||
|
- type: portmap
|
||||||
|
snat: true
|
||||||
|
capabilities:
|
||||||
|
portMappings: true
|
||||||
|
controllers:
|
||||||
|
# The location of the Kubernetes API. Use the default Kubernetes
|
||||||
|
# service for API access.
|
||||||
|
K8S_API: "https://kubernetes.default:443"
|
||||||
|
# Choose which controllers to run, see
|
||||||
|
# https://docs.projectcalico.org//v3.4/reference/kube-controllers/configuration
|
||||||
|
# for an explanation of each
|
||||||
|
ENABLED_CONTROLLERS: "policy,namespace,serviceaccount,workloadendpoint,node"
|
||||||
|
# Since we're running in the host namespace and might not have KubeDNS
|
||||||
|
# access, configure the container's /etc/hosts to resolve
|
||||||
|
# kubernetes.default to the correct service clusterIP.
|
||||||
|
CONFIGURE_ETC_HOSTS: true
|
||||||
|
|
||||||
|
node:
|
||||||
|
# for specific details see
|
||||||
|
# https://docs.projectcalico.org/v3.4/reference/node/configuration
|
||||||
|
name: k8s-pod-network
|
||||||
|
# Cluster type to identify the deployment type
|
||||||
|
# NOTE: v2 had a list ... v3 a comma separated string
|
||||||
|
CLUSTER_TYPE: "k8s,bgp"
|
||||||
|
# Describes which BGP networking backend to use gobgp, bird, none.
|
||||||
|
# Default is bird. NOTE(alanmeadows) today this chart only
|
||||||
|
# supports applying the bgp customizations to bird templates - in
|
||||||
|
# the future we may support gobgp as well
|
||||||
|
CALICO_NETWORKING_BACKEND: bird
|
||||||
|
# Location of the CA certificate for etcd.
|
||||||
|
ETCD_CA_CERT_FILE: ""
|
||||||
|
# Location of the client key for etcd.
|
||||||
|
ETCD_KEY_FILE: ""
|
||||||
|
# Location of the client certificate for etcd.
|
||||||
|
ETCD_CERT_FILE: ""
|
||||||
|
# Disable file logging so `kubectl logs` works.
|
||||||
|
CALICO_DISABLE_FILE_LOGGING: true
|
||||||
|
# Set Felix endpoint to host default action to ACCEPT.
|
||||||
|
# early/startup log level for calico-node on startup.
|
||||||
|
CALICO_STARTUP_LOGLEVEL: "Info"
|
||||||
|
FELIX_DEFAULTENDPOINTTOHOSTACTION: "ACCEPT"
|
||||||
|
# Configure the IP Pool from which Pod IPs will be chosen; it's
|
||||||
|
# recommended you leave this as null and the value from
|
||||||
|
# networking.podSubnet will be used
|
||||||
|
CALICO_IPV4POOL_CIDR: null
|
||||||
|
# See https://docs.projectcalico.org/v3.4/reference/calicoctl/resources/ippool
|
||||||
|
CALICO_IPV4POOL_BLOCKSIZE: 26
|
||||||
|
# Change this to 'Never' in environments with direct L2
|
||||||
|
# communication (such that tunnels are not needed for pods on
|
||||||
|
# different hosts to communicate with each otehr).
|
||||||
|
CALICO_IPV4POOL_IPIP: "Always"
|
||||||
|
# Disable IPv6 on Kubernetes.
|
||||||
|
FELIX_IPV6SUPPORT: false
|
||||||
|
# Set MTU for tunnel device used if ipip is enabled, it's
|
||||||
|
# recommended you leave this as null and an appropriate value will
|
||||||
|
# be set based on tunneling mode and the networking.mtu value
|
||||||
|
FELIX_IPINIPMTU: null
|
||||||
|
# Set Felix logging; also (ab)used for bgp configuration
|
||||||
|
FELIX_LOGSEVERITYSCREEN: "Info"
|
||||||
|
FELIX_HEALTHENABLED: true
|
||||||
|
# Set Felix experimental Prometheus metrics server
|
||||||
|
FELIX_PROMETHEUSMETRICSENABLED: true
|
||||||
|
FELIX_PROMETHEUSMETRICSPORT: "9091"
|
||||||
|
# Auto-detect the BGP IP address.
|
||||||
|
IP: ""
|
||||||
|
# Detection of source interface for routing
|
||||||
|
# options include
|
||||||
|
# can-reach=DESTINATION
|
||||||
|
# interface=INTERFACE-REGEX
|
||||||
|
IP_AUTODETECTION_METHOD: first-found
|
||||||
|
IPV6_AUTODETECTION_METHOD: first-found
|
||||||
|
|
||||||
|
manifests:
|
||||||
|
configmap_bin: true
|
||||||
|
configmap_etc: true
|
||||||
|
configmap_bird: true
|
||||||
|
daemonset_calico_etcd: true
|
||||||
|
daemonset_calico_node: true
|
||||||
|
daemonset_calico_node_calicoctl: true
|
||||||
|
deployment_calico_kube_controllers: true
|
||||||
|
job_image_repo_sync: true
|
||||||
|
job_calico_settings: true
|
||||||
|
service_calico_etcd: true
|
||||||
|
secret_certificates: true
|
||||||
|
secret_registry: true
|
||||||
|
...
|
||||||
@ -22,7 +22,7 @@ Sample Document to run containers in Docker runtime
|
|||||||
images:
|
images:
|
||||||
haproxy: haproxy:2.4
|
haproxy: haproxy:2.4
|
||||||
helm:
|
helm:
|
||||||
helm: lachlanevenson/k8s-helm:v3.15.4
|
helm: lachlanevenson/k8s-helm:v3.16.4
|
||||||
monitoring_image: busybox:1.28.3
|
monitoring_image: busybox:1.28.3
|
||||||
packages:
|
packages:
|
||||||
repositories:
|
repositories:
|
||||||
@ -121,7 +121,7 @@ Sample Document to run containers in Containerd runtime
|
|||||||
images:
|
images:
|
||||||
haproxy: haproxy:2.4
|
haproxy: haproxy:2.4
|
||||||
helm:
|
helm:
|
||||||
helm: lachlanevenson/k8s-helm:v3.15.4
|
helm: lachlanevenson/k8s-helm:v3.16.4
|
||||||
monitoring_image: busybox:1.28.3
|
monitoring_image: busybox:1.28.3
|
||||||
packages:
|
packages:
|
||||||
additional:
|
additional:
|
||||||
|
|||||||
@ -85,7 +85,7 @@ data:
|
|||||||
monitoring_image: &busybox busybox:1.28.3
|
monitoring_image: &busybox busybox:1.28.3
|
||||||
haproxy: haproxy:2.4
|
haproxy: haproxy:2.4
|
||||||
helm:
|
helm:
|
||||||
helm: lachlanevenson/k8s-helm:v3.15.4
|
helm: lachlanevenson/k8s-helm:v3.16.4
|
||||||
packages:
|
packages:
|
||||||
common:
|
common:
|
||||||
repositories:
|
repositories:
|
||||||
|
|||||||
@ -109,9 +109,9 @@ data:
|
|||||||
values: {}
|
values: {}
|
||||||
source:
|
source:
|
||||||
type: git
|
type: git
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: https://opendev.org/openstack/openstack-helm.git
|
||||||
subpath: helm-toolkit
|
subpath: helm-toolkit
|
||||||
reference: fa8916f5bcc8cbf064a387569e2630b7bbf0b49b
|
reference: 6b985e51be5e52011b88b408fe3265175ce8f47f
|
||||||
dependencies: []
|
dependencies: []
|
||||||
---
|
---
|
||||||
schema: armada/Chart/v1
|
schema: armada/Chart/v1
|
||||||
@ -133,9 +133,9 @@ data:
|
|||||||
values: {}
|
values: {}
|
||||||
source:
|
source:
|
||||||
type: git
|
type: git
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: https://opendev.org/openstack/openstack-helm.git
|
||||||
subpath: helm-toolkit
|
subpath: helm-toolkit
|
||||||
reference: fa8916f5bcc8cbf064a387569e2630b7bbf0b49b
|
reference: 6b985e51be5e52011b88b408fe3265175ce8f47f
|
||||||
dependencies: []
|
dependencies: []
|
||||||
---
|
---
|
||||||
schema: armada/Chart/v1
|
schema: armada/Chart/v1
|
||||||
@ -533,8 +533,8 @@ data:
|
|||||||
service_calico_etcd: false
|
service_calico_etcd: false
|
||||||
source:
|
source:
|
||||||
type: git
|
type: git
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: https://opendev.org/openstack/openstack-helm.git
|
||||||
reference: fa8916f5bcc8cbf064a387569e2630b7bbf0b49b
|
reference: master
|
||||||
subpath: calico
|
subpath: calico
|
||||||
dependencies:
|
dependencies:
|
||||||
- infra-helm-toolkit
|
- infra-helm-toolkit
|
||||||
|
|||||||
@ -85,7 +85,7 @@ data:
|
|||||||
monitoring_image: busybox:1.28.3
|
monitoring_image: busybox:1.28.3
|
||||||
haproxy: haproxy:2.4
|
haproxy: haproxy:2.4
|
||||||
helm:
|
helm:
|
||||||
helm: lachlanevenson/k8s-helm:v3.15.4
|
helm: lachlanevenson/k8s-helm:v3.16.4
|
||||||
packages:
|
packages:
|
||||||
common:
|
common:
|
||||||
repositories:
|
repositories:
|
||||||
|
|||||||
@ -150,9 +150,9 @@ data:
|
|||||||
values: {}
|
values: {}
|
||||||
source:
|
source:
|
||||||
type: git
|
type: git
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: https://opendev.org/openstack/openstack-helm.git
|
||||||
subpath: helm-toolkit
|
subpath: helm-toolkit
|
||||||
reference: fa8916f5bcc8cbf064a387569e2630b7bbf0b49b
|
reference: 6b985e51be5e52011b88b408fe3265175ce8f47f
|
||||||
dependencies: []
|
dependencies: []
|
||||||
---
|
---
|
||||||
schema: armada/Chart/v1
|
schema: armada/Chart/v1
|
||||||
@ -175,9 +175,9 @@ data:
|
|||||||
values: {}
|
values: {}
|
||||||
source:
|
source:
|
||||||
type: git
|
type: git
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: https://opendev.org/openstack/openstack-helm.git
|
||||||
subpath: helm-toolkit
|
subpath: helm-toolkit
|
||||||
reference: fa8916f5bcc8cbf064a387569e2630b7bbf0b49b
|
reference: 6b985e51be5e52011b88b408fe3265175ce8f47f
|
||||||
dependencies: []
|
dependencies: []
|
||||||
---
|
---
|
||||||
schema: armada/Chart/v1
|
schema: armada/Chart/v1
|
||||||
@ -552,9 +552,8 @@ data:
|
|||||||
job_image_repo_sync: false
|
job_image_repo_sync: false
|
||||||
service_calico_etcd: false
|
service_calico_etcd: false
|
||||||
source:
|
source:
|
||||||
type: git
|
type: local
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: /etc/genesis/armada/assets/charts
|
||||||
reference: master
|
|
||||||
subpath: calico
|
subpath: calico
|
||||||
dependencies:
|
dependencies:
|
||||||
- infra-helm-toolkit
|
- infra-helm-toolkit
|
||||||
|
|||||||
@ -85,7 +85,7 @@ data:
|
|||||||
monitoring_image: &busybox busybox:1.28.3
|
monitoring_image: &busybox busybox:1.28.3
|
||||||
haproxy: haproxy:2.4
|
haproxy: haproxy:2.4
|
||||||
helm:
|
helm:
|
||||||
helm: lachlanevenson/k8s-helm:v3.15.4
|
helm: lachlanevenson/k8s-helm:v3.16.4
|
||||||
packages:
|
packages:
|
||||||
common:
|
common:
|
||||||
additional:
|
additional:
|
||||||
|
|||||||
@ -109,9 +109,9 @@ data:
|
|||||||
values: {}
|
values: {}
|
||||||
source:
|
source:
|
||||||
type: git
|
type: git
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: https://opendev.org/openstack/openstack-helm.git
|
||||||
subpath: helm-toolkit
|
subpath: helm-toolkit
|
||||||
reference: fa8916f5bcc8cbf064a387569e2630b7bbf0b49b
|
reference: 6b985e51be5e52011b88b408fe3265175ce8f47f
|
||||||
dependencies: []
|
dependencies: []
|
||||||
---
|
---
|
||||||
schema: armada/Chart/v1
|
schema: armada/Chart/v1
|
||||||
@ -133,9 +133,9 @@ data:
|
|||||||
values: {}
|
values: {}
|
||||||
source:
|
source:
|
||||||
type: git
|
type: git
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: https://opendev.org/openstack/openstack-helm.git
|
||||||
subpath: helm-toolkit
|
subpath: helm-toolkit
|
||||||
reference: fa8916f5bcc8cbf064a387569e2630b7bbf0b49b
|
reference: 6b985e51be5e52011b88b408fe3265175ce8f47f
|
||||||
dependencies: []
|
dependencies: []
|
||||||
---
|
---
|
||||||
schema: armada/Chart/v1
|
schema: armada/Chart/v1
|
||||||
@ -426,9 +426,8 @@ data:
|
|||||||
job_image_repo_sync: false
|
job_image_repo_sync: false
|
||||||
service_calico_etcd: false
|
service_calico_etcd: false
|
||||||
source:
|
source:
|
||||||
type: git
|
type: local
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: /etc/genesis/armada/assets/charts
|
||||||
reference: fa8916f5bcc8cbf064a387569e2630b7bbf0b49b
|
|
||||||
subpath: calico
|
subpath: calico
|
||||||
dependencies:
|
dependencies:
|
||||||
- infra-helm-toolkit
|
- infra-helm-toolkit
|
||||||
|
|||||||
@ -85,7 +85,7 @@ data:
|
|||||||
monitoring_image: &busybox busybox:1.28.3
|
monitoring_image: &busybox busybox:1.28.3
|
||||||
haproxy: haproxy:2.4
|
haproxy: haproxy:2.4
|
||||||
helm:
|
helm:
|
||||||
helm: lachlanevenson/k8s-helm:v3.15.4
|
helm: lachlanevenson/k8s-helm:v3.16.4
|
||||||
packages:
|
packages:
|
||||||
common:
|
common:
|
||||||
repositories:
|
repositories:
|
||||||
|
|||||||
@ -109,9 +109,9 @@ data:
|
|||||||
values: {}
|
values: {}
|
||||||
source:
|
source:
|
||||||
type: git
|
type: git
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: https://opendev.org/openstack/openstack-helm.git
|
||||||
subpath: helm-toolkit
|
subpath: helm-toolkit
|
||||||
reference: fa8916f5bcc8cbf064a387569e2630b7bbf0b49b
|
reference: 6b985e51be5e52011b88b408fe3265175ce8f47f
|
||||||
dependencies: []
|
dependencies: []
|
||||||
---
|
---
|
||||||
schema: armada/Chart/v1
|
schema: armada/Chart/v1
|
||||||
@ -133,9 +133,9 @@ data:
|
|||||||
values: {}
|
values: {}
|
||||||
source:
|
source:
|
||||||
type: git
|
type: git
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: https://opendev.org/openstack/openstack-helm.git
|
||||||
subpath: helm-toolkit
|
subpath: helm-toolkit
|
||||||
reference: fa8916f5bcc8cbf064a387569e2630b7bbf0b49b
|
reference: 6b985e51be5e52011b88b408fe3265175ce8f47f
|
||||||
dependencies: []
|
dependencies: []
|
||||||
---
|
---
|
||||||
schema: armada/Chart/v1
|
schema: armada/Chart/v1
|
||||||
@ -432,9 +432,8 @@ data:
|
|||||||
job_image_repo_sync: false
|
job_image_repo_sync: false
|
||||||
service_calico_etcd: false
|
service_calico_etcd: false
|
||||||
source:
|
source:
|
||||||
type: git
|
type: local
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: /etc/genesis/armada/assets/charts
|
||||||
reference: fa8916f5bcc8cbf064a387569e2630b7bbf0b49b
|
|
||||||
subpath: calico
|
subpath: calico
|
||||||
dependencies:
|
dependencies:
|
||||||
- infra-helm-toolkit
|
- infra-helm-toolkit
|
||||||
|
|||||||
@ -153,7 +153,7 @@ VALID_DOCS = [
|
|||||||
'images': {
|
'images': {
|
||||||
'haproxy': 'haproxy:2.4',
|
'haproxy': 'haproxy:2.4',
|
||||||
'helm': {
|
'helm': {
|
||||||
'helm': 'lachlanevenson/k8s-helm:v3.15.4'
|
'helm': 'lachlanevenson/k8s-helm:v3.16.4'
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
'packages': {
|
'packages': {
|
||||||
|
|||||||
@ -38,7 +38,7 @@ data:
|
|||||||
monitoring_image: &busybox busybox:1.28.3
|
monitoring_image: &busybox busybox:1.28.3
|
||||||
haproxy: haproxy:2.4
|
haproxy: haproxy:2.4
|
||||||
helm:
|
helm:
|
||||||
helm: lachlanevenson/k8s-helm:v3.15.4
|
helm: lachlanevenson/k8s-helm:v3.16.4
|
||||||
packages:
|
packages:
|
||||||
common:
|
common:
|
||||||
repositories:
|
repositories:
|
||||||
|
|||||||
@ -110,9 +110,9 @@ data:
|
|||||||
values: {}
|
values: {}
|
||||||
source:
|
source:
|
||||||
type: git
|
type: git
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: https://opendev.org/openstack/openstack-helm.git
|
||||||
subpath: helm-toolkit
|
subpath: helm-toolkit
|
||||||
reference: master
|
reference: 6b985e51be5e52011b88b408fe3265175ce8f47f
|
||||||
dependencies: []
|
dependencies: []
|
||||||
---
|
---
|
||||||
schema: armada/Chart/v1
|
schema: armada/Chart/v1
|
||||||
@ -135,9 +135,9 @@ data:
|
|||||||
values: {}
|
values: {}
|
||||||
source:
|
source:
|
||||||
type: git
|
type: git
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: https://opendev.org/openstack/openstack-helm.git
|
||||||
subpath: helm-toolkit
|
subpath: helm-toolkit
|
||||||
reference: master
|
reference: 6b985e51be5e52011b88b408fe3265175ce8f47f
|
||||||
dependencies: []
|
dependencies: []
|
||||||
---
|
---
|
||||||
schema: armada/Chart/v1
|
schema: armada/Chart/v1
|
||||||
@ -438,9 +438,8 @@ data:
|
|||||||
job_image_repo_sync: false
|
job_image_repo_sync: false
|
||||||
service_calico_etcd: false
|
service_calico_etcd: false
|
||||||
source:
|
source:
|
||||||
type: git
|
type: local
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: /etc/genesis/armada/assets/charts
|
||||||
reference: master
|
|
||||||
subpath: calico
|
subpath: calico
|
||||||
dependencies:
|
dependencies:
|
||||||
- infra-helm-toolkit
|
- infra-helm-toolkit
|
||||||
|
|||||||
@ -105,9 +105,9 @@ data:
|
|||||||
values: {}
|
values: {}
|
||||||
source:
|
source:
|
||||||
type: git
|
type: git
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: https://opendev.org/openstack/openstack-helm.git
|
||||||
subpath: helm-toolkit
|
subpath: helm-toolkit
|
||||||
reference: fa8916f5bcc8cbf064a387569e2630b7bbf0b49b
|
reference: 6b985e51be5e52011b88b408fe3265175ce8f47f
|
||||||
dependencies: []
|
dependencies: []
|
||||||
---
|
---
|
||||||
schema: armada/Chart/v1
|
schema: armada/Chart/v1
|
||||||
@ -478,9 +478,8 @@ data:
|
|||||||
job_image_repo_sync: false
|
job_image_repo_sync: false
|
||||||
service_calico_etcd: false
|
service_calico_etcd: false
|
||||||
source:
|
source:
|
||||||
type: git
|
type: local
|
||||||
location: https://opendev.org/openstack/openstack-helm-infra.git
|
location: /etc/genesis/armada/assets/charts
|
||||||
reference: master
|
|
||||||
subpath: calico
|
subpath: calico
|
||||||
dependencies:
|
dependencies:
|
||||||
- helm-toolkit
|
- helm-toolkit
|
||||||
|
|||||||
@ -9,7 +9,7 @@ IMAGE_DEP_CHECK=quay.io/airshipit/kubernetes-entrypoint:latest-ubuntu_focal
|
|||||||
IMAGE_ETCD=quay.io/coreos/etcd:v3.5.12
|
IMAGE_ETCD=quay.io/coreos/etcd:v3.5.12
|
||||||
IMAGE_ETCDCTL=quay.io/airshipit/porthole-etcdctl-utility:latest-ubuntu_focal
|
IMAGE_ETCDCTL=quay.io/airshipit/porthole-etcdctl-utility:latest-ubuntu_focal
|
||||||
IMAGE_HAPROXY=haproxy:2.4
|
IMAGE_HAPROXY=haproxy:2.4
|
||||||
IMAGE_HELM=lachlanevenson/k8s-helm:v3.15.4
|
IMAGE_HELM=lachlanevenson/k8s-helm:v3.16.4
|
||||||
IMAGE_APISERVER=registry.k8s.io/kube-apiserver-amd64:v1.32.1
|
IMAGE_APISERVER=registry.k8s.io/kube-apiserver-amd64:v1.32.1
|
||||||
IMAGE_CONTROLLER_MANAGER=registry.k8s.io/kube-controller-manager-amd64:v1.32.1
|
IMAGE_CONTROLLER_MANAGER=registry.k8s.io/kube-controller-manager-amd64:v1.32.1
|
||||||
IMAGE_SCHEDULER=registry.k8s.io/kube-scheduler-amd64:v1.32.1
|
IMAGE_SCHEDULER=registry.k8s.io/kube-scheduler-amd64:v1.32.1
|
||||||
|
|||||||
@ -17,7 +17,7 @@
|
|||||||
set -x
|
set -x
|
||||||
|
|
||||||
HELM=$1
|
HELM=$1
|
||||||
HELM_ARTIFACT_URL=${HELM_ARTIFACT_URL:-"https://get.helm.sh/helm-v3.15.4-linux-amd64.tar.gz"}
|
HELM_ARTIFACT_URL=${HELM_ARTIFACT_URL:-"https://get.helm.sh/helm-v3.16.4-linux-amd64.tar.gz"}
|
||||||
|
|
||||||
|
|
||||||
function install_helm_binary {
|
function install_helm_binary {
|
||||||
|
|||||||
@ -16,8 +16,8 @@
|
|||||||
|
|
||||||
set -eux
|
set -eux
|
||||||
|
|
||||||
HTK_REPO=${HTK_REPO:-"https://opendev.org/openstack/openstack-helm-infra.git"}
|
HTK_REPO=${HTK_REPO:-"https://opendev.org/openstack/openstack-helm.git"}
|
||||||
HTK_STABLE_COMMIT=${HTK_COMMIT:-"d0c93b5648704b9d9999412d932f8329c80362c0"}
|
HTK_STABLE_COMMIT=${HTK_COMMIT:-"master"}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -6,7 +6,7 @@ registry.k8s.io/kube-apiserver-amd64,v1.32.1,apiserver
|
|||||||
registry.k8s.io/kube-controller-manager-amd64,v1.32.1,controller-manager
|
registry.k8s.io/kube-controller-manager-amd64,v1.32.1,controller-manager
|
||||||
registry.k8s.io/kube-scheduler-amd64,v1.32.1,scheduler
|
registry.k8s.io/kube-scheduler-amd64,v1.32.1,scheduler
|
||||||
registry.k8s.io/kube-proxy-amd64,v1.32.1,proxy
|
registry.k8s.io/kube-proxy-amd64,v1.32.1,proxy
|
||||||
lachlanevenson/k8s-helm,v3.15.4,helm
|
lachlanevenson/k8s-helm,v3.16.4,helm
|
||||||
quay.io/airshipit/armada,master,armada
|
quay.io/airshipit/armada,master,armada
|
||||||
quay.io/airshipit/armada-operator,latest,armada-operator
|
quay.io/airshipit/armada-operator,latest,armada-operator
|
||||||
quay.io/calico/cni,v3.4.0,calico-cni
|
quay.io/calico/cni,v3.4.0,calico-cni
|
||||||
|
|||||||
@ -47,7 +47,7 @@
|
|||||||
run:
|
run:
|
||||||
- tools/zuul/playbooks/deploy-promenade-containerd.yaml
|
- tools/zuul/playbooks/deploy-promenade-containerd.yaml
|
||||||
required-projects:
|
required-projects:
|
||||||
- openstack/openstack-helm-infra
|
- openstack/openstack-helm
|
||||||
timeout: 9600
|
timeout: 9600
|
||||||
nodeset: airship-promenade-single-node-jammy
|
nodeset: airship-promenade-single-node-jammy
|
||||||
vars:
|
vars:
|
||||||
@ -61,7 +61,7 @@
|
|||||||
timeout: 900
|
timeout: 900
|
||||||
nodeset: airship-promenade-single-node-jammy
|
nodeset: airship-promenade-single-node-jammy
|
||||||
vars:
|
vars:
|
||||||
HTK_COMMIT: 962333df313e04a01923ca8394d2a44f2afbb714
|
HTK_COMMIT: 6b985e51be5e52011b88b408fe3265175ce8f47f
|
||||||
|
|
||||||
- job:
|
- job:
|
||||||
name: airship-promenade-chart-build-gate-latest-htk
|
name: airship-promenade-chart-build-gate-latest-htk
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user